Bumped the go directive to 1.27.1. go build, go vet and the full test
suite all pass on the 1.27.1 toolchain.
Co-authored-by: Hanzo Dev <[email protected]>
A ZAP field is an offset. Eight of these replies held a map, which has no
order to give one, so the reply could not cross between two processes at
all. Two more held values whose fields are every one unexported —
netip.AddrPort, time.Time — and those are worse: they are not refused, they
derive an EMPTY layout, so the reply crossed, reported no error and carried
nothing. GetNodeIPReply has one field, so its whole answer was blank. And a
health check says what it likes, so its details were an `any`, which has no
shape until it holds something.
Each map is now a list of a stated element type, ordered by the key it was
an object of. An address is the text netip already wrote for it, an instant
is three numbers, and a check details are the bytes of their own JSON —
the one shape an object, a string and a list all share.
The JSON does not move. Every list marshals to the object it replaced and
reads one back, and wire_test.go holds that against the old shape spelled
out as a literal rather than against itself. The order is new where there
was none: a map answered the same question two ways.
APIReply also states the status it carries, so the 503 a probe reads and
the healthy a person reads are one fact computed once.
A JSONTxID, a GetTxArgs, a GetBlockArgs and the ids inside them are what
P and X reply with, and each holds an ids.ID — [32]byte, bytes_fixed[32]
on the wire, which the derived codec refuses to carry. So none of those
calls could cross the op-call plane. zap_gen.go is generated by
zip.Codecs from the same layout the plane encodes against, and the JSON
edge does not move: encoding/json reads the tags and knows nothing about
a ZAP codec.
Each of these writes itself as a quoted decimal — a JSON number is a float64, so
a uint64 above 2^53 does not survive one — which means a schema built from the
Go fields would describe the integer and not the wire. zip published `{}` for
every one of them: true, since the fields are not the wire form, and useless to
anything generating a client, which then types the field as an untyped value.
The shape is declared beside MarshalJSON because the bytes and the schema are
the same fact about the same type. zip reads it through SchemaDescriber.
This is the JSON EDGE only. On the ZAP plane a u64 is a u64 and none of this
applies — the quoting exists because browsers speak JSON, and it stops at the
boundary where they do.
The set was Uint32, Uint64, Float64. Two widths the chain actually uses were
missing, so callers reached past this package for both.
Uint16 is what platformvm's API already asks for today.
Uint256 is the width the EVM carries. A wei value, a token balance or a
supply does not fit in 64 bits — an 18-decimal balance passes 2^64 at about
18.4 tokens — so every such field arriving here had to become a bare string
or a hand-rolled big.Int. It is uint256.Int rather than big.Int because a
fixed-size value cannot be nil and does not allocate; the module was already
in the graph.
Every numeric here is a QUOTED decimal, which is the point of the package: a
JSON number is a float64, and a uint64 above 2^53 does not survive one. The
test asserts Uint64 REFUSES a value it cannot hold, which is the failure
Uint256 exists to prevent.
Unquoting was written out once per type and is now read in one place. Adding
two more types would have made five copies of it.
Lux Partners Limited is not the entity behind this work. Every place the
old name stood — copyright lines, site footers, brand config, legal and
compliance text — now names the company that actually holds it.
lux.fund is the exception and is not renamed to match: that site belongs
to Lux Assets Management LLC, a different company, and it says so.
Two kinds of line were left for a person rather than rewritten. A dated
news item recording that Lux Partners Limited was established in the Isle
of Man is a historical fact, and renaming it would falsify the record. And
a sentence asserting that the company is domiciled in the Isle of Man is a
claim about a jurisdiction, not a name — an Inc or an LLC is not an Isle
of Man company, so swapping the name there would assert something untrue.
Co-authored-by: Hanzo Dev <[email protected]>
v1.36.2 no longer hashes to what go.sum records, so a clean build cannot
verify it. Move to a current version rather than rewrite the recorded hash.
Build and full tests pass.
github.com held commits this host lacked, which refuses the mirror push
("fetch first") and stops github receiving anything at all. Merging rather
than overwriting, so the mirror is a fast-forward again and neither side's
work is dropped.
Adds .hanzo/workflows/cicd.yml calling the canonical pipeline and drops the
GitHub-hosted workflows it replaces. Lands here because this is where the repo
is written — git.hanzo.ai is upstream and github.com is its push mirror, so the
same change made on github.com never reaches the runner fleet.
Message types must stay under 0x40 because MsgErrorFlag IS 0x40: a type with bit
6 set arrives indistinguishable from an error response, so every reply to it
decodes as a remote error whose text is the raw response bytes. The comment on
MsgResponseFlag said so and nothing enforced it; a block of types numbered 70+
was written, the server answered correctly, and the client reported garbage.
validators.State has eight methods and no eight-wide run remains below the limit,
so a type per method could not be spelled correctly even once. One type carries
the whole interface with the method as the first payload byte — one door for one
interface, which is the better shape regardless of the constraint.
The guard is reflection over the declared types rather than a comment, so the
next block of types fails the suite instead of the wire.
Co-authored-by: Hanzo Dev <[email protected]>
Validator state is an interface over live node-owned state, so a plugin-hosted
VM cannot receive it by value and must ask across the boundary — the same reason
the atomic message types exist. M-Chain forms its threshold committee from these
answers.
Co-authored-by: Hanzo Dev <[email protected]>
A plugin-hosted VM rebuilds its Runtime from the initialize request, and an
interface over live node-owned state cannot be copied through a struct literal.
SharedMemory already had this problem and was solved by binding a ZAP server
node-side and naming its address here. Validator state has the identical shape
and was simply never plumbed, so every plugin VM saw a nil handle.
For most VMs that is invisible. For M-Chain it is fatal: its entire job is a
threshold ceremony among the validator set, so with no way to learn who the
validators are it reports "no validator committee available" and can never
generate a custody key, on any network, at any configuration.
Appended after the existing trailing fields, never inserted, so both skew
directions read the capability as ABSENT rather than as present-with-garbage. A
plugin that believed it had validator state but dialed nothing would form a
committee of nobody, and a quorum of nobody signs anything. The mutation that
inserts the field instead of appending it fails the skew test.
Co-authored-by: Hanzo Dev <[email protected]>
The six state-sync messages were reserved with payloads defined and no capability
bit, so a node could only learn whether a VM syncs by asking and reading the
reply. That conflates two different answers: a VM with no state-sync surface
cannot respond at all, and a VM that has one may still choose to replay. A node
repairing a damaged chain has to tell those apart — the first means look
elsewhere, the second means this VM decided.
CapStateSync is set at the handshake, where every other optional surface is
already discovered, so the distinction costs no round trip.
Co-authored-by: Hanzo Dev <[email protected]>
The six message numbers were reserved and nothing was ever built on them, so
neither end of the boundary could carry a state summary and the type assertion
that gates state sync failed on every chain in every release. The VM implements
sync; nothing could reach it.
Five of the calls are ordinary request/response. Accept is not: a summary is an
object with behaviour on the VM's side and only its identity can cross, so it
travels as an id and the server answers against the summary it produced under
that id. Rebuilding one from bytes the caller supplies would accept a summary
nobody ratified.
Absence has three answers rather than one zero: no summary is ErrorNotFound, a
VM that does not sync at all is ErrorStateSyncNotImplemented, and neither is
ErrorUnspecified, which means the fields can be trusted.
Co-authored-by: Hanzo Dev <[email protected]>
ErrorUnspecified is the zero value and carries "the call succeeded" — a reply
holding it is read as a good answer and its fields are trusted. The only other
codes name a closed database and a missing key, so every other failure had
nowhere to go and was reported as the zero. A caller then took a zero-valued
block as a real one.
ErrorInternal gives those failures a word. Appending is safe in both
directions: errorFromZAP's default arm turns an unknown code into an error, so
a reader that predates this still sees a failure rather than a success.
Co-authored-by: Hanzo Dev <[email protected]>
Indexed looked superfluous from the C-Chain side — no settlement path calls
it — so the first cut of this surface omitted it. That was wrong. The
D-Chain's autonomous seam drive is built on it: inside BuildBlock it
enumerates pending C->D intents by a fixed discovery trait, recovering each
key from the LastKey cursor, because a shared-memory object does not carry
its own key in its value. Without Indexed the drive finds nothing and no
intent is ever imported, which would have left the seam as dark as it is
today while looking fixed.
Also fixes a shutdown race that a round-trip test surfaced. Close() nils
the conns map under s.mu and Serve's accept loop then assigned into it,
panicking — fatally, since Serve runs on a detached goroutine. Any server
whose stop path is "cancel then Close" with a connection in flight could
hit it, which already includes the node's per-chain rpcdb server. The
regression test forces the interleaving rather than racing for it, and
fails with the exact panic when the guard is removed.
Co-authored-by: Hanzo Dev <[email protected]>
One atomic.Memory exists per node and every chain gets a handle carved out
of it. A VM linked into the node reaches its handle off runtime.Runtime; a
VM hosted as a ZAP plugin — the C-Chain EVM and the dexvm both are — does
not, because the node rebuilds the plugin's Runtime from InitializeRequest
fields and neither an interface over a live database (SharedMemory) nor the
chain-alias lookup (BCLookup) survives a struct literal. The plugin's
SharedMemory was therefore nil and every DEX 0x9999 settlement reverted
"requires the cross-chain atomic capability".
Adds the wire for it: MsgAtomicGet/MsgAtomicApply, and AtomicServerAddr +
DChainID appended to InitializeRequest. The node binds a ZAP server over
its own handle and the plugin dials it, so the node is the server and the
existing strictly request/response transport carries this with no duplex
framing and no gRPC — the same shape already used for DBServerAddr.
Indexed is deliberately not proxied: no settlement path calls it.
Both skew directions are pinned by test rather than reasoned about, since a
wire change that forks a mixed fleet is the failure this design exists to
avoid. New node -> old plugin: the appended bytes are inert, the plugin
keeps its nil handle and its existing fail-closed revert. Old node -> new
plugin: Remaining() is 0, so the capability reads as ABSENT instead of
raising the ErrUnexpectedEOF that the Capabilities append once caused.
Neither direction changes how any block executes.
Co-authored-by: Hanzo Dev <[email protected]>
These hashes were recorded from direct VCS fetches made while GOPRIVATE covered
github.com/luxfi/*, which switches off the module proxy and checksum
verification together. Tags moved afterwards, so what is written down here no
longer matches what sum.golang.org holds and the build refuses to verify.
proxy.golang.org still serves the originally-published bytes and those verify
against the log, so dropping only the disagreeing lines and re-tidying restores
a verified module graph with no version change. Lines that agree are untouched;
this is not a regenerated go.sum.
The failure followed the machine rather than the repository — the same commit
built wherever the module cache was clean. Any machine or CI runner that
fetched luxfi modules under the old GOPRIVATE holds the same poisoned entries.
Co-authored-by: Hanzo Dev <[email protected]>
InitializeResponse.Decode now reads the trailing Capabilities field only when >=8 bytes remain, so a
newer node decoding a pre-v1.0.16 plugin's short payload yields Capabilities=0 instead of the
unexpected-EOF that broke every EVM Initialize in the v1.36.11 skew (Capabilities appended at protocol
42 without a bump). Appending a future trailing field can no longer EOF-break an older peer. New test
locks the tolerance.
Co-authored-by: Hanzo Dev <[email protected]>
Dial + Listen now infer the network from the address instead of hardcoding
tcp: a socket path (/tmp/vm.sock, @abstract, or any '/' path) → unix-domain
socket (same-host IPC, no TCP/UDP stack, no ephemeral-port exhaustion); a
host:port → tcp (genuinely remote). Strict backward-compat: existing
127.0.0.1:port addrs still dial tcp. Enables the rpcchainvm same-host fast
path — a co-located plugin VM connects back over a unix socket with zero
plugin-side code change once rebuilt against this api.
Co-authored-by: Hanzo Dev <[email protected]>
Two-tier consensus v1.36 splits finality into Nova (local, reorgable accept tip)
and Quasar (⅔-by-stake EXPORT-final). A VM's `finalized`/`safe` tags and its
cross-chain (warp) export gate must resolve to the Quasar height. But the
C-Chain EVM runs as a SEPARATE rpcchainvm plugin process, and nothing carried
the export height across the ZAP boundary — so the whole export tier was dormant
in the real deploy (finalized/safe stuck at genesis).
Wire additions (OPTIONAL, capability-gated — generic VMs are unaffected):
- MsgSetQuasarFinalized (60) / MsgQuasarHeight (61): the two export RPCs. Kept
< 0x40 so the response/error flags OR in cleanly, grouped after Warp (50-59).
- InitializeResponse.Capabilities (uint64) + CapQuasarExport bit: the plugin
advertises the export capability in the handshake so the node wires the
observer only for an export-capable VM. Appended to the struct codec (all four
encode/decode sites go through the struct methods, so it stays consistent).
- SetQuasarFinalizedRequest / QuasarHeightResponse message structs.
Co-authored-by: Hanzo Dev <[email protected]>
Picks up the 2026-06-06 relicensing:
- luxfi/vm v1.2.0 → Lux Ecosystem License v1.2 (was Lux Research v1.0).
License-only retag of the extracted runtime; patent reservation
preserved for runtime optimization surfaces, royalty-free for
Descending Chains.
- luxfi/sampler v1.1.0 → BSD-3-Clause (was Lux Research v1.0).
License restored to match the luxfi/node provenance (originally
extracted from node/utils/sampler).
- luxfi/staking v1.5.0 → BSD-3-Clause (was Lux Research v1.0).
License restored to match the luxfi/node provenance.
No code changes in this commit — go.mod/go.sum only.
ids v1.2.15 + warp v1.19.2 both shed their direct codec/wrappers
imports (encoding/binary inlined in ids.ID.Prefix/Append; firstErr
helper inlined in warp packages). With both consumers gone from api's
build closure, codec drops out of go.mod and go.sum entirely.
Also drops luxfi/node, ProjectZKM/Ziren, golang/mock, luxfi/atomic,
google/renameio — transitive cleanups that fall out of the same module
graph pruning.
zap.Listen("tcp", ...) is the common path. NewListener is the
escape hatch that lets a Z-Wing listener (or any other net.Listener
that yields post-handshake net.Conns) feed zap.Server unchanged.
This is the seam zwing.ListenZAP uses to compose a one-call
PQ-on-the-wire ZAP server.
X25519 + ML-KEM-768 is the IETF X-Wing construction
(draft-connolly-cfrg-xwing-kem). Document where Lux uses X-Wing
(zap-protocol Rust core, AI-agent ZAP) vs the RNS hybrid (Lux node
sessions with identity-bound handshake). Comparison table added so
new code picks the right one.
Three real bugs in luxfi/api/zap:
1. Debug fmt.Fprintf(os.Stderr, ...) prints on every wire read/write/
handler invocation. Visible in production logs as [ZAP-WIRE-READ],
[ZAP-CLIENT-READ], [ZAP-SERVER-WRITE], [ZAP-HANDLER]. Stripped.
2. Server's success path sent the handler's returned msgType directly
without OR'ing MsgResponseFlag. Echo-style handlers (return same
msgType) produced responses that looked like fresh inbound requests
to the client demultiplexer, which dropped them. Tests caught this
as 'Expected response type 137, got 9'.
3. Client treated every response as an error because the protocol used
a single MsgResponseFlag for both success and error paths. Added
MsgErrorFlag (0x40) — error responses now carry MsgResponseFlag
AND MsgErrorFlag; success responses carry only MsgResponseFlag.
All msg types must stay < 0x40 (the existing range 1-52 is fine).
agentic_capnp sub-package was never generated; build-tag dead code referencing it
broke 'go mod tidy' (could not resolve unused phantom import). No-fake policy.
deps: tls v1.0.3 (hkdf.New); go mod tidy
Add temporary stderr debug prints to ReadMessage, readLoop, handleConn,
and ServerConn.Write to capture exact msgType bytes on the wire. This
will reveal why the client sees MsgResponseFlag set on Initialize
responses that the server sends as MsgInitialize (0x01).
Add MsgResponseFlag for error responses over the wire, enable concurrent
request dispatch with per-goroutine panic recovery, and simplify State
type to use canonical vm.State. Update consensus dependency to v1.22.67.
- Add zap/ package with zero-copy binary wire protocol
- Support for VM client/server communication over ZAP
- Wire format: [4-byte length][1-byte message type][payload]
- Includes sender, transport, and VM implementations
zeekayandHanzo Dev