Regenerated CLI/SDK/MCP/node references with quoted YAML frontmatter so
colons in synopses (e.g. LP-103 links) no longer break the build. Full
`pnpm build` passes: 757+ static pages prerendered, all surfaces
generated from code.
Co-authored-by: Hanzo Dev <[email protected]>
229 package pages under nodes/reference, mirroring the import tree with
nested nav, generated by luxfi/node tools/docgen from source comments.
All of the node, from godoc, on docs.lux.network.
Co-authored-by: Hanzo Dev <[email protected]>
New mcp section generated by luxfi/mcp tools/docgen from the tool
registry (governance read tools with input schemas). Added under
Developer Tools beside cli and sdk — all three surfaces now generated
from code and aligned on the shared docs framework.
Co-authored-by: Hanzo Dev <[email protected]>
40 package pages under sdk/go/packages, generated by luxfi/sdk
tools/docgen straight from source comments; the curated Go SDK landing
and guides (transactions, rpc) stay on top. SDK half of docs.lux.network,
generated from code.
Co-authored-by: Hanzo Dev <[email protected]>
Replace the hand-kept, drifted command pages with 36 suites generated by
luxfi/cli tools/docgen straight from the cobra tree (adds node join, the
new suites, current flags; drops the removed wallet page). This is the
CLI section of docs.lux.network, generated from code.
Co-authored-by: Hanzo Dev <[email protected]>
Adds .hanzo/workflows/cicd.yml calling the canonical pipeline and drops the
GitHub-hosted workflows it replaces. Lands here because this is where the repo
is written — git.hanzo.ai is upstream and github.com is its push mirror, so the
same change made on github.com never reaches the runner fleet.
@hanzo/docs 17 replaces the Tailwind/Base-UI stack: layout and text are
gui primitives coloured by @hanzo/design, prose is the framework's one
stylesheet, search stays static, llms-full.txt stays, and the header
gains Ask AI grounded in the lux store. The hand-copied palette, the
postcss pipeline and the second generated content dir are gone.
Co-authored-by: Hanzo Dev <[email protected]>
The spa server sends `<file>.br`/`<file>.gz` when they exist and never
compresses on the fly; the export shipped only identity bytes, so the 30MB
search index went over the wire at 30MB. Every text asset now has both
variants beside it. The base image is the version it was built against,
not whatever `latest` means on the day of a rebuild.
Co-authored-by: Hanzo Dev <[email protected]>
Search: the export now writes its index as a static file (/api/search) and the
dialog searches it in the browser — this site has no server to ask. ⌘K did
nothing before; the provider mounted no search at all.
/llms-full.txt is the whole site as one document, for a model's context window,
built from the same processed markdown each page compiled from.
Co-authored-by: Hanzo Dev <[email protected]>
Every page shipped without its layout: the sidebar ran full width, icon names
printed as text beside their pages ("LayersStaking"), and the home page's card
titles were near-white on white. Tailwind was told where to find the UI's
classes by @hanzo/docs' copy of preset.css, whose @source paths are relative to
a package that holds no components. The stylesheet is imported from the package
that does. Frontmatter icons resolve through the loader, by their lucide name.
The home page uses the theme's tokens instead of a dark palette written in hex,
sits inside the home layout so it has a header, and its mark is the mark.
Every internal link that pointed at nothing now points at its page: the SDK,
wallet and netrunner pages linked under a /docs prefix the site does not have;
Cloud linked its own children at the root. Chains are chains — the page, the
CLI command, the guide and the section carry that name — and the P-Chain API
reference lists the methods the node answers (platform.getNets, getNet, netID),
not ones it never had.
The image is built on the forge, tagged by semver, pinned in universe. The
GitHub lane named a runner pool that no longer exists and every push since July
queued for a day and was cancelled.
Co-authored-by: Hanzo Dev <[email protected]>
The .network host was retired 2026-07-27 and no longer resolves at all (a
request to it now returns nothing, not an error), so every reference to it named
an address that cannot answer. The brand host is .cloud, matching kms.zoo.cloud
and the rest of the white-label convention.
Left alone deliberately, because rewriting them would invert what they say:
the LLM.md line that RECORDS the retirement, the e2e spec that ASSERTS
kms.lux.network must not resolve, and the recorded applies + cluster backups,
which are faithful accounts of what was applied and are not config.
Co-authored-by: Hanzo Dev <[email protected]>
81 pages still published /ext/ URLs, a /{network}/ path segment, or a
chain-alias route under api.lux.network. All three 404 today; measured:
api.lux.network/v1/bc/C/rpc 200 0x17871
api.lux.network/ext/bc/C/rpc 404
api.lux.network/mainnet/v1/bc/C/rpc 404
api.lux.network/v1/bc/zoo/rpc 404 (Zoo is api.zoo.network)
api.zoo.network/v1/bc/Zoo/rpc 404 (no alias even on its own host)
api.lux.network/v1/bogus-control 404 (control: 404 means no route)
api-reference/index.mdx is deliberately excluded from the mechanical
transform: it states the rule, so it must keep naming /ext/ and the dead
hostnames as prose.
Co-authored-by: Hanzo Dev <[email protected]>
Hand-built identity URLs are the same class of bug as a published /ext/ RPC
URL, but they fail silently instead of 404ing. Measured on lux.id today:
/v1/iam/oauth/authorize 400 text/plain "unknown client_id" <- real IdP
/oauth/authorize 200 text/html SPA shell <- silent break
/login/oauth/authorize 200 text/html SPA shell <- silent break
/v1/iam/.well-known/jwks 200 application/json real keys
/.well-known/jwks 200 text/html SPA shell <- silent break
/.well-known/openid-configuration is correct at the root (RFC 8414 fixes it
there) and already advertises the /v1/iam/... values, so discovery and the
docs disagreed. Point the docs at what discovery says, and record that an
identity endpoint is verified by content-type and body, never by status.
Co-authored-by: Hanzo Dev <[email protected]>
/ext/ is gone from api.lux.network, api.zoo.network and api.hanzo.network
(all 404 today), so every published /ext/ URL was already broken. Convert
to the one canonical path and fix the URL forms that were dead for other
reasons at the same time:
/mainnet|/testnet|/devnet path prefix -> the per-network host (404 today)
api.testnet.lux.network, testnet-api.lux.network -> api.lux-test.network
/ext/C/rpc (missing bc/) -> /v1/bc/C/rpc
chain aliases + blockchain IDs under api.lux.network -> the L1s own host
Third-party RPC hosts (Avalanche, Flare, blastapi) are left untouched.
Co-authored-by: Hanzo Dev <[email protected]>
The encryption section I just wrote said every secret gets a per-secret DEK
sealed under the REK. That is true of the ZAP plane and NOT of the HTTP plane,
and the difference is observable.
pkg/zapserver/server.go seals and unseals for real: store.Seal(s.masterKey, ...)
on put (:536), store.Open(s.masterKey, sec) on get (:509).
cmd/kms/main.go does neither. putSecretHandler assigns Ciphertext:
[]byte(req.Value) and the GET handler returns string(sec.Ciphertext). The field
is named Ciphertext but on this path it holds the value as given. What protects
it is whole-keyspace encryption at rest (KMS_ENCRYPTION_KEY_B64 via the storage
engine) plus org-scoped JWT and TLS — no per-secret key, no AAD address binding.
So mixing transports against one store misbehaves in both directions: write over
ZAP and read over HTTP and you get the sealed bytes back instead of the value;
write over HTTP and read over ZAP and the unseal fails for want of a wrapped DEK.
The page now says this plainly and tells readers to pick one transport per
secret, rather than implying an envelope that half the API does not apply.
Co-authored-by: Hanzo Dev <[email protected]>
All three KMS pages described Infisical: /api/v3/secrets, /api/v3/transit,
/api/v3/pki, /api/v1/secrets with secretValue bodies, plus workspaces you had to
create first. luxfi/kms serves none of it. These pages are where several broken
clients came from — a reader followed them, got 200 text/html back from the
embedded console SPA that answered every unmatched path, and concluded the call
had worked. luxfi/kms 1.12.8 removed that catch-all, so those paths now 404 in
JSON, and the docs are the last place still teaching them.
Replaced with the real surface, verified against cmd/kms/main.go and live:
POST /v1/kms/auth/login {clientId, clientSecret}
GET /v1/kms/orgs/{org}/secrets?path=&env= -> {"names": []}
GET /v1/kms/orgs/{org}/secrets/{path}/{name}?env= -> {"secret":{"value"}}
POST /v1/kms/orgs/{org}/secrets {path,name,env,value}
DELETE /v1/kms/orgs/{org}/secrets/{path}/{name}?env=
Also documented because each one has cost someone time: env is a field and not a
hostname; the URL splits at its LAST slash so segments must be escaped
individually; create and update are one upsert; responses are never HTML.
secrets.mdx additionally promised versioning, automatic rotation with providers,
point-in-time recovery, and folder/tag objects. pkg/store/secrets.go has exactly
Put/Get/List/Delete and the Secret struct has no version field, so the page now
says plainly that those four do not exist rather than leaving readers to
discover it. The KMSSecret CRD example went too — there is no such CRD in the
tree.
Co-authored-by: Hanzo Dev <[email protected]>
Add compliance/aml.mdx documenting the Lux AML engine (github.com/luxfi/aml,
amld) — real-time transaction monitoring: rules DSL, weight-of-evidence
scoring, sanctions screening, cases, /v1/aml API, admin UI, deployment.
Wire into compliance nav.
Replace the external-Jube ML-scorer references in regulated/{index,
compliance-integration,ats}.mdx with the native luxfi/aml engine (AML_ENGINE_URL,
POST /v1/aml/transactions). Clean-room boundary: zero jube in the docs.
Co-authored-by: Hanzo Dev <[email protected]>
The page framed the ConsensusCert as "finality" (the certificate-as-decider
model). Per LP-305 (merged), Nova/Nebula sampling DECIDES (VM.Accept at
β-confidence = local finality, leaderless, no certificate needed); the
ConsensusCert is a POST-ACCEPT attestation that authorizes EXPORT (bridges,
0x9999 DEX receipt) and never gates chain progress. Corrected the intro and
the §Finality opening; cite LP-305/LP-306 as normative. Certificate mechanics
(legs/policy/KeyEra) unchanged — they were already accurate.
Co-authored-by: Hanzo Dev <[email protected]>
The flagship node reference listed Serialization as 'Protocol Buffers' only and
luxfi/codec as 'Binary codec and serialization' — both stale post codec-kill.
Every tx/block/VM-transport message is now native ZAP (struct = wire, no
reflection); luxfi/codec remains only as the leaf byte-packer + Warp codec.
Co-authored-by: Hanzo Dev <[email protected]>
Repo moved lux-apps/lux-docs -> lux-docs/network. Build on the org-level
lux-docs-build ARC pool (github.com/lux-docs); image now ghcr.io/lux-docs/network
to match the repo path. Same-org GITHUB_TOKEN push, no cross-org PAT.
No REST API exists to flip GHCR container-package visibility, and the
package defaults to private on first publish. The cluster pulls it via the
existing lux-ns ghcr-secret imagePullSecret (verified). Comment-only fix;
[skip ci] since the functional workflow change already built in fd127a9.
Image path now matches the repo (lux-apps/lux-docs), so the build pushes
same-org with the workflow's GITHUB_TOKEN (packages: write) instead of the
cross-org GHCR_LUXFI_TOKEN PAT. Package will be made public to mirror the
old luxfi/lux-docs pull model. runs-on: lux-apps-build unchanged.
lux-apps GITHUB_TOKEN cannot write the luxfi-owned package (cross-org
'installation does not exist'). Authenticate the GHCR login with a luxfi
write:packages token (user hanzo-dev), KMS-sourced from
kms-build/ghcr-luxfi-push and set as the GHCR_LUXFI_TOKEN repo secret.
The docs repo now lives under the lux-apps org; the luxfi-bound
lux-build runner scale set no longer serves it (ARC routes by org, not
by labels). Point runs-on at the new lux-apps-build pool
(gha-runner-scale-set on arc-gha-rs-controller, lux-k8s/arc-system,
githubConfigUrl github.com/lux-apps) and refresh the stale comment.
The confidential-compute page was written mid-synthesis and documented cc as
3 Kinds (2 live + TDX stub). Verified against cc main v0.2.0 (0e55918): all six
Kinds are real verifiers — AMD SEV-SNP, Intel TDX (real DCAP v4), Intel SGX
(pure-Go DCAP), NVIDIA nvtrust (SPDM+RIM), ARM CCA (RATS CBOR/COSE), AWS Nitro
(COSE_Sign1). Dispatch is one registry (init() self-registration, no switch).
Updated vendor matrix, report fields, topology tree, custody card. next build green (460 pages).
Bring the user-facing docs in line with the released, semver-tagged
post-quantum consensus + confidential-compute architecture, cross-checked
against the actual code/tags.
Consensus finality (consensus v1.26.0):
- Quasar finality is the typed compact-certificate envelope (ConsensusCert),
not the old "triple consensus" model. Four evidence kinds (Beam BLS / Pulsar
M-LWE / Corona R-LWE / P3Q rollup), orthogonal LegKind x EvidenceMode axes,
KeyEra (one group key per era, value-not-place), and the four operator
postures (BLS_FAST / HYBRID_PQ_CHECKPOINT / STRICT_QUASAR / RECOVERY_MODE).
- Fix the flat error that Pulsar is Ring-LWE: Pulsar is Module-LWE (FIPS-204
ML-DSA, luxfi/pulsar); Corona is Ring-LWE (Ringtail, luxfi/corona).
- O(1) compaction (one group sig regardless of committee size).
- Correct PQ precompile slots (0x012202/03/04/05) and stale go.mod pins
(crypto v1.19.26, pulsar v1.1.5, corona v0.7.9).
New page confidential-compute.mdx (+ nav): the luxfi/cc attestation verifier
(one Verifier, orthogonal Kinds). Honest vendor matrix: AMD SEV-SNP and NVIDIA
nvtrust are production; Intel TDX is a tracked stub. Custody (TEE) vs
confidential-AI (NVIDIA GPU) use cases.
Decomplect (architecture.mdx, wallet/security.mdx): dealerless PQ-threshold core
+ optional luxfi/mpc (CGGMP21/FROST) and luxfi/tee custody extensions; the core
depends on neither.
HSM (hsm/index.mdx, reference/lux-hsm.mdx): document all 16 registered backends
(cloud KMS, PKCS#11/KMIP/YubiHSM/Nitrokey, hardware-wallet secure elements,
air-gap, ML-DSA PQ, TR-31), the FIPS subset, and the cgo-gated backends.
Bridge multi-vendor MPC (mpc/bridge.mdx): layered external-custodian cosigning
(Utila/Fireblocks) as an optional institutional feature over native MPC; secrets
via KMS; permissionless bridge runs on native MPC alone.
New go-live.mdx: the canonical developer/agent go-live spec (chains/VMs,
slot map, two-tier finality, VM/engine boundary, GPU byte-identity gate,
value conservation). Replace the retired 0x0600 PQ block (and the bogus
0x0604 QUASAR precompile) with the real 0x012200 block (ML-KEM..HQC +
STARK-FRI) in pq-crypto/index/api/lux-evm. Align the C-nibble chain-slot
table to the genesis registry (D-Chain at C=3, no phantom M-Chain,
Zoo/Hanzo/SPC = sovereign-L1 EVM). Add VM/engine-boundary + go-live-status
notes to dexvm/zkvm/aivm/bridgevm. P3Q = rollup-commit verifier (0x012205);
STARK-FRI = STARK (0x012220) — never conflated.
Two unescaped <tenant> placeholders in regulated/ats.mdx and regulated/bd.mdx
were parsed as JSX and broke the MDX/static-export build. With the build
failing, the shipped image carried only the home hub, so every deep topic
(/architecture, /consensus, /sdk/quickstart, ...) fell through the SPA index
fallback and rendered the hub instead of its own page. Escaping the
placeholders restores the export: generateStaticParams now emits all 458
topic pages (architecture.html, consensus.html, sdk/quickstart.html, ...),
each distinct, which the hanzoai/spa server resolves directly (verified with
the real spa binary locally — /architecture -> 'Architecture | Lux Docs', no
longer the hub).
CI: rebuild on the luxfi self-hosted ARC pool (runs-on: lux-build) and push
ghcr.io/luxfi/lux-docs:latest — the exact image the live deployment pulls.
GitHub-hosted runners are billing-blocked for luxfi. Removed the old
ubuntu-latest deploy.yml (billing-blocked) and the cross-org workflow-sanity
call that luxfi/docs cannot resolve (startup_failure).
Replaces non-canonical scale-set / org-prefixed labels with the
existing labels every arcd host registers with. Matches evo for
amd64 and spark for arm64. No new labels added.
Validators validate networks, chains live on networks. Under LP-018
sovereign-L1, AddValidatorTx is the universal add-validator tx.
AddChainValidatorTx is legacy + retained for one release cycle.
- chains/pchain.mdx: new 'Networks, Chains, and Validators' concept
section laying out network has validators / chains live on networks
/ L1 vs L2 / AddValidatorTx universal; Purpose paragraph reworded;
fee-schedule rows retitled 'Add network validator' / 'Add network
delegator'.
- cloud/subnets.mdx: 'Adding Validators' rewritten to call out
validators validate networks; CLI example switched to
'lux network addValidator'.
- warp/{index,messages,integration}.mdx: 'source chain validator set'
→ 'source network validator set'; RegisterL1Validator description
clarifies 'adds a validator to an L1 network'.
- reference/lux-netrunner.mdx: RemoveChainValidator marked legacy.
Per CTO directive: kill any alias, any shim. R-LWE threshold sig is
named Corona across all live code. Forward-only.
Sweep covers Go + TS + Sol + k8s YAML + JSON + LP markdown + skills
+ docs. Skipped: papers/audits/legal/licenses/blog/HISTORY (immutable
historical record).
Was using canonical workflow defaults (hanzoai-scoped labels) which
do not dispatch for luxfi org. Switched to round-robin pool labels:
runner-amd64: luxfi-amd64 (evo)
runner-arm64: luxfi-arm64 (spark + dbc, round-robin)
runner-deploy: lux-deploy-linux-amd64 (DO ARC pool)
Two corrections:
1. lux-fhevm.mdx claimed the coprocessor was Rust-based with the Zama tfhe
crate. The actual lux/fhe-coprocessor is pure Go (luxfi/fhe + luxfi/lattice)
with C++ / GPU (Metal+CUDA) / FPGA acceleration paths. No Rust toolchain;
no Zama crate. Quick-reference table updated to match reality.
2. lux-fhe-coprocessor.mdx had the negative "NEVER use Zama tfhe-rs" framing
in the hard requirements + a Related Skills entry pointing at a
"Rust-based FHEVM coprocessor (alternative architecture using Zama tfhe
crate)" that doesn't exist. Reframed positively: Lux-native FHE; the
FHEVM specification points at the same Go primary + C++/GPU/FPGA accel
stack.
lux-upgrade.mdx rewritten as "header-schema compatibility" tool; the
Apricot/Banff/Cortina/Durango/Etna/Fortuna/Granite fork-history table is
deleted because Lux activates every feature at genesis (LP-3641). The
Config-struct field names are retained — they are the on-wire header
schema and cannot be renamed without breaking historical replay.
lux-precompile.mdx, lux-evm.mdx, lux-lps.mdx, cchain.mdx: drop "Durango+",
"Etna activated", "ACP-181" framing. EVM hardfork gates (Shanghai/Cancun)
stay — they gate opcode behavior.
Side fix: 5 reference MDX files (corona/magnetar/proto/pulsar/quasar) had
<https://github.com/luxfi/X> raw-autolink syntax that Turbopack's MDX
parser was rejecting (Unexpected `/` before local name), failing the
docs build entirely. Switched to [text](url) form. Docs site now builds
(453 paths prerendered).
zeekayandHanzo Dev