0
Teams
0
GitHub Links
Link Types:GitHubInternal (roadmap.vac.dev)ExternalTask ID

IFT-TS 2026/10/12

top highlights

  • NIM team released Nim langserver 1.16.0 with many fixes and improvements.
  • QA team added Status desktop NFT transfer, onchain friends and payment-request tests.

team highlights

  • BI: Upgrading the Status Engagement Bot SDK and bot code.
  • BI: Adding the missing Element data to the Logos communication funnel dashboard.
  • BI: Updating Logos Circle CRM from Movement Team feedback.
  • BI: Adding Keycard crypto payment data to the dashboard.
  • DST: Found unstable delivery and latency in Status one-to-one and group benchmarks.
  • DST: Confirmed that a lower publish rate explains the nim-libp2p 2.3.0 bandwidth gap.
  • DST: Repeated full Logos Delivery tests at the configured publish rate.
  • DST: Fixed benchmark publish rates when the Kubernetes API is slow.
  • DST: Built and tested an experiment for automatic P2P regression runs.
  • INFRA: Completed the Rocketpool oDAO smartnode migration from AWS to OVH on NixOS.
  • INFRA: Deployed additional Lido CMv2 validator keys and the CSM 0x02 Hoodi testnet operator.
  • INFRA: Rolled out Nimbus upgrades and monitoring for the Sepolia Glamsterdam fork.
  • INFRA: Improved website health checks to detect errors that still return HTTP 200.
  • INFRA: Deployed an Attic Nix cache and tested Nimbus repository uploads.
  • INFRA: Completed the Vault upgrade to 1.21.4 on all cluster hosts.
  • NIM: Added the PubGrub solver option and split Nimble dependency resolution into separate modules.
  • NIM: Merged the Nim langserver version bump to 1.16.0 and its new transport.
  • P2P: Added early muxer negotiation and optimistic protocol selection to nim-libp2p.
  • P2P: Integrated shared RLN proofs into native Logos Delivery routing.
  • P2P: Proposed outbound byte budgets by priority for gossipsub.
  • P2P: Simplified consistent error handling in nim-libp2p.
  • P2P: Fixed QUIC connections closing when no streams are open.
  • P2P: Fixed duplicate DNS responses and improved nim-libp2p certificate renewal.
  • QA: Merged nightly Logos Delivery testing and issue reporting into Status CI.
  • QA: Expanded Basecamp tests for unloading and reloading UI plugins.
  • QA: Added LEZ sequencer registration tests.
  • QA: Reported Logos Delivery message-size and store-sync failures with reproduction tests.
  • QA: Added Status desktop NFT transfer, onchain friends and payment-request tests.
  • QA: Got the Status mobile end-to-end gate running on iOS; remaining failures involve app accessibility.
  • SEC: Closed the macOS CI incident after reinstall verification, firewall hardening and a clean indicator sweep.
  • SEC: Triaged 16 audit findings and continued vulnerability backlog reviews.
  • SEC: Updated treasury incident runbooks after the first live secure-multisig-signer signing.
  • SEC: Reported an unauthenticated Logos Blockchain node wallet API.
  • SEC: Closed two addressed LEZ findings and reported another finding.
  • TKE: Continued the Logos token buyback-and-make model and reviewed its documents.
  • TKE: Researched liquidity workgroup management and comparable blockchain programs.
  • TKE: Created the token unit precision specification PR and addressed feedback.
  • TKE: Worked on LEZ sequencer economics simulations.
  • TKE: Continued liquid staking prioritization and modelled liquid staking attack vectors in Logos.
  • WEB: Improved Basecamp downloads with platform detection and Windows installation guidance.
  • WEB: Added searchable Logos articles and moved article and podcast listings under media.
  • WEB: Patched security advisories affecting the Logos and Status websites.
  • WEB: Merged AI review and documentation tools into a shared monorepo.
  • WEB: Added font size and color controls to the email editor.
  • WEB: Fixed the Status website release banner to accept titles with or without a version prefix

ift-ts:bi:

ift-ts:dst:

ift-ts:infra:

  • develp
    • Fixed the Develp.co website layout and merged the website revamp.
    • Added missing attestation alerts for mainnet fleets.
    • Fixed the missing ClickHouse plugin for some Grafana dashboards.
    • Fixed storage issues on GitHub runners.
  • lido
    • Deployed additional Lido CMv2 validator keys to master hosts.
    • Investigated a Web3Signer key reload failure caused by a bug.
    • Deployed the Lido CSM 0x02 Hoodi testnet operator and keys.
  • rocket
    • Completed migration of the oDAO smartnode from AWS to an OVH NixOS setup.
    • Created new dashboards, alerting, CI pipelines and tests.
  • nimbus
    • Rolled out upgrades and monitoring for the Sepolia Glamsterdam fork.
    • Improved source checkout for the nimbus-build-system dependency.
    • Fixed Nimbus builds on macOS broken by debug symbols.
    • Re-bootstrapped and deployed Nimbus nodes on a Mac M2 host.
    • Adjusted retries for ERA file generation on the fleet.
    • Enabled dumping invalid blocks from beacon nodes.
    • Completed ERE file generation for all fleets.
    • Deployed a Light Client on a Sepolia host for nimbus-eth1 sync.
    • Investigated Nimbus REST API test failures on Jenkins CI.
  • logos
    • Rolled out multiple Logos modules to logos.test and logos.dev.
    • Debugged a DHT issue and node logs being flooded with errors.
    • Fixed the fleet dashboard to show module versions correctly.
    • Continued organization validation for DigiCert Windows signing.
    • Prepared the LEZ 0.3.1 release deployment.
  • status
    • Resolved Android workspace cache collisions.
    • Lowered log verbosity for RPC tests in Jenkins CI.
    • Debugged go-sqlcipher issues in ARM builds.
  • sites
    • Debugged a status.app website crash caused by a Next.js configuration issue.
    • Improved site health checks to catch errors that still return HTTP 200.
    • Fixed CSP issues preventing podcast resources from loading.
    • Researched Apple IPA size limit warnings.
  • other notes
    • Decommissioned the misc.lez-legacy host.
  • ci
    • Worked on requiring signed commits across both GitHub Enterprises.
    • Rolled out Determinate Systems Nix to Jenkins and GitHub workers.
    • Upgraded Jenkins Master and removed deprecated Blue Ocean plugins.
    • Updated CI pipelines to use Graph Pipeline View for builds.
    • Deployed an Attic Nix cache at cache.nix.free.technology.
    • Tested Attic Nix cache uploads in Nimbus repositories.
  • hq
    • Completed the Vault upgrade to 1.21.4 on all cluster hosts.
    • Re-issued the status.im certificate for internal services.
    • Fixed Wazuh agent certificate deployment issues.
    • Started splitting Consul access by fleet using policies.
    • Continued Ubuntu upgrades across all fleets.
  • bi
    • Fixed Airbyte Twitter extraction and Airflow DAG notifications.
    • Added an OAuth proxy for Airbyte in Kubernetes to improve security.
    • Rotated all Airbyte tokens as a precaution against a potential breach.
    • Continued Engagement Bot features and Status SDK improvements.

ift-ts:nim:

ift-ts:p2p:

ift-ts:qa:

ift-ts:sec:

  • ift:2026q4-ir-vulma:security-incidents
    • macOS CI IR (macm2-01.ih-eu-mda1.ci.release, declared 2026-09-04) closed — reinstall/re-attestation confirmed with jakubgs, firewall hardening verified fleet-wide (92e9129, bca5921), IOC sweep clean
    • HackenProof Status-476 / Status-479 — dev verdict in, remediation and bounty call agreed
  • ift:2026q4-ir-vulma:vulnerability-management
  • ift:2026q4-tr-continuity-plan:define-and-test-IR-runbooks
    • Runbook TBC definitions with Jason — done
    • W0001/W0002 runbook updates from first live secure-multisig-signer signing — done
  • ift:2026q4-tr-wallet-security:audit-treasury-multisig
  • ift:2026q4-tr-continuty-plan:investment-team-recalibration
    • Backup-signatory selection with Jason and the investment team — done
  • ift:2026q4-cicd-security-review:code-review-activities
    • Post-merge reviews done: WalletConnect pairing stack (status-go #7811, status-app #22367), keycard-defect characterization (status-go #7804, #7758–#7761), post-incident CI changes (status-app #22414, #22349; status-go #7815), browser downloads stack #21849–#21853
    • Cleared carried PRs — reviewed; all seven still open upstream per 2026-09-21 crawl, no longer tracked weekly
  • ift:2026q4-threat-intelligence:supply-chain-attack-research
    • Continued npm / OAuth / CI-tool supply-chain watch; macOS-miner IOCs fed into fleet detection
  • other notes
  • ift:2026q4-internal-audit:logos-blockchain-security-review
    • Reviewed the latest tag v0.3.1 release
    • Following the recent post on X about bunker mode
    • 1 x finding #193 Issue #193: node 0 wallet API unauthenticated
    • Reported at Discord thread
  • ift:2026q4-internal-audit:logos-execution-zone-security-review
  • ift:2026q4-internal-audit:logos-lez-programs-security-review
  • ift:2026q4-internal-audit:logos-messaging-security-review
    • logos-chat 0.3.0 and Accounts 0.3.0 are released

ift-ts:tke:

  • vac:tke:ift:logos-token:value-accrual
    • continued the buyback-and-make model
    • review docs
  • vac:tke:ift:ecodev:liquidity
    • researched project management approaches for liquidity work group
    • researched about similar programs in other blockchains
  • vac:tke:ift:logos-token:token-unit-precision
    • addressed feedback
    • created the PR for the spec
  • vac:tke:ift:ecodev:node-program-validators
    • briefly discussed current state with EcoDev team on Discord
  • vac:tke:blockchain:pow:new-rewards
    • addressed feedback
  • vac:tke:blockchain:pow:tokenomics
    • met with Blockchain team to discuss the current state
  • vac:tke:lez:sequencer-econ
    • Worked on sequencer economics simulations.
  • vac:tke:blockchain:penumbra-analysis
    • Continued the liquid staking prioritization analysis.
    • Continued economic modelling of liquid staking tokens in Logos, including attack vectors
  • vac:tke:blockchain
    • catch up with Marcin on the private UTXO
  • other notes
    • OOO: 1 CC days.

ift-ts:web: