IFT-TS Roadmaps and Reports

2026-11-02 IFT-TS weekly

16 min read

0
Teams
0
GitHub Links
Link Types:GitHubInternal (roadmap.vac.dev)ExternalTask ID

IFT-TS 2026/11/02

top highlights

  • NIM team released Nimble 0.26.2.
  • P2P team advanced nim-lsquic to 0.11.3.
  • WEB team completed the Basecamp landing-page renewal.

team highlights

  • DST: Found a Status rate-limiter timing mismatch that rejects valid light-node messages and delays delivery.
  • DST: Extended Messaging API experiments to Store and Edge nodes.
  • DST: Added a network partition-and-recovery scenario to regression testing.
  • NIM: Released Nimble 0.26.2.
  • NIM: Fixed nimlangserver project resolution and nimsuggest lifecycle handling.
  • NIM: Built the second nim-lint prototype with a GitHub Action.
  • P2P: Advanced nim-lsquic to 0.11.3.
  • P2P: Added GossipSub topic-stream interoperability tests.
  • P2P: Advanced Waggle interoperability and recovery tests in open PRs.
  • P2P: Added the Kademlia record-store interface; storage implementations remain in open PRs.
  • P2P: Fixed Kademlia automatic mode restarting from current network reachability.
  • P2P: Fixed binary payload delivery in the Logos libp2p module by using base64.
  • QA: Completed the Logos Execution Zone specification audit run, reporting seven high-severity findings.
  • QA: Added status-go thread permission, reaction and participant tests.
  • QA: Added Status desktop QR-code scanning tests.
  • QA: Found 13 Keycard scenarios missing end-to-end coverage.
  • QA: Built an Android end-to-end test gate triggered by PR comments.
  • SEC: Confirmed fixes for six Logos Blockchain issues and reported nine new findings, including two high-severity issues.
  • SEC: Reported seven new LEZ security findings, including one critical issue.
  • SEC: Trialled Greptile code review on 23 PRs across 15 repositories.
  • SEC: Reviewed Keycard master-key export fixes.
  • WEB: Completed the Basecamp landing-page renewal.
  • WEB: Advanced Developer Programmes and Lambda Prize pages in an open PR.
  • WEB: Promoted 18 approved Waku articles to production.
  • WEB: Added the Museum of Civil Liberties exhibit submission form.
  • WEB: Fixed the Status mobile news feed to serve article markup.
  • WEB: Added a local Logos website Playwright suite; it remains uncommitted and under testing.

ift-ts:dst:

ift-ts:nim:

ift-ts:p2p:

ift-ts:qa:

ift-ts:sec:

  • ift:2026q4-tr-wallet-security:treasury-multisig-review
    • Paused a pending treasury Safe owner change to verify an unfamiliar address. Finance confirmed the address belonged to Jordan and the emailed summary contained a typo; cleared the change to proceed.
  • ift:2026q4-ir-vulma:security-incidents
    • Keystone leak follow-up for team hardware-wallet holders, treasury signers first
    • forum.logos.co spam wave (2026-10-27): forum isn’t ours to maintain; agreed with jakubgs on IP and email-domain blocks as the response
  • ift:2026q4-ssdlc:pr-security-reviews
    • Greptile AI code reviewer installed on the logos-co org (14-day trial, announced 2026-10-27). First week: comments on 23 PRs across 15 repos (10 merged, 12 open), most in nim-libp2p-mix, plus logos-basecamp, logos-module-builder, logos-liblogos, logos-delivery-module, logos-logoscore-cli
    • Reviewed: QR scanner (#22846, #22871), client-side message rendering (#22834), community roster privacy (#7932, #7938), threads in backups (#7886), puzzle-auth bearer (#7952), wallet_getTransfers (#7951), nim-sds pin (#7877)
  • ift:2026q4-ssdlc:keycard-vulnerability-reviews
  • ift:2026q4-security-automation:threat-intel-alerting-and-news-sharing
    • Tracked and shared: poisoned Claude Code extension in the Cursor marketplace (up to ~5,000 developers), Binance probing a potential $5.8B theft, Polymarket breach claims, Linux kernel TCP flaw rated CVSS 9.8 (The Hacker News)
  • ift:2026q4-iam-operations:access-revalidation-and-cleanup
  • ift:2026q4-internal-audit:logos-blockchain-security-review
    • Reviewed open issues: Confirmed 6 issues were fixed. Closed.
    • Started a plan for offensive testing (red teaming)
    • Reported 3+6 findings (2 high, 7 medium): #275 - #283
  • ift:2026q4-internal-audit:logos-execution-zone-security-review
    • Reviewed PR #464 in lez-program.
    • Confirmed the findings from that review were fixed.
    • Closed #264
    • Reviewed open issues: Confirmed 11 issues were fixed. Closed.
    • Reported 7 new security findings:
  • other notes
    • Reviewed security scanning tools: Claude-security (Anthropic), Devin (Cognition), and zkao (zksecurity).

ift-ts:web:

Graph View