Bump e2e submodule's luxfi/threshold pin (v1.5.5 → v1.9.9) to drop the only
remaining corona puller in this workspace. Removes the residual
'github.com/luxfi/corona v0.2.0/go.mod' hash line from go.work.sum.
Align go.work go directive to 1.26.4 to match both workspace siblings
(../threshold and ./e2e). No source code in this repo imported corona;
this was workspace-graph hygiene only. R-LWE threshold primitive is now
referenced exclusively via luxfi/corona upstream.
mpcd is the production threshold daemon. With this commit it embeds
the JSON-RPC dispatcher from luxfi/threshold/pkg/thresholdd on a new
--threshold-listen flag (default 127.0.0.1:7300, MPC_THRESHOLD_LISTEN
env var). The dispatcher exposes every supported scheme:
cggmp21 (secp256k1 ECDSA, CGGMP21 fork)
frost (secp256k1 Schnorr, RFC 9591)
bls (BLS12-381 Shamir/Lagrange)
sr25519 (Ristretto255, via mpc node's own session — separate path)
pulsar (M-LWE / FIPS 204 ML-DSA-65 threshold, via luxfi/corona/threshold)
corona (R-LWE / Corona, via luxfi/corona/threshold)
doerner (reserved; upstream protocol non-functional, returns explicit error)
Wire format matches teleport/mpc/src/signers/rpc.ts byte-for-byte:
POST / {"jsonrpc":"2.0","id":N,"method":"<scheme>.<op>","params":{...}}
Methods per scheme: keygen / sign / verify. Public-key handles are
returned by keygen and bound on sign/verify.
Decomplecting note: the dispatcher carries zero policy. Profile
gating, auth, audit, and rate-limiting live on mpcd's existing API
surface (and on the cluster ingress in front of it). The threshold
listener is loopback by default; production exposure happens via the
KMS-facing ZAP server or the gateway.
There is no separate thresholdd daemon to deploy. The luxfi/threshold
repo's cmd/thresholdd remains as a developer / CI binary that imports
the same package — one wire, one implementation, two startup paths.
Tests: TestEmbeddedDispatcher_BLSRoundTrip (full keygen → sign →
verify → forgery rejection) and TestEmbeddedDispatcher_UnknownScheme
(-32601 method-not-found contract) both pass. README updated with the
new protocol table; full surface documented in
luxfi/threshold/LLM.md "thresholdd — unified JSON-RPC dispatcher".
Cancel was documented as "cancels a pending session belonging to the
caller's org" but the contract did not name HOW the implementation
enforces that. A loose implementation could:
- read session, transition state, then check org_id (TOCTOU window)
- distinguish "not yours" from "not found" in the error message
(enumeration oracle leaks the existence of cross-org sessions)
- skip the org predicate when a concurrent legitimate caller also
has the row open (race condition lets the wrong-org call win)
Tightened doc names the three required behaviors:
- orgID derived from ctx Claims, not caller-supplied
- SELECT-FOR-UPDATE + WHERE org_id = ctx.OrgID; mismatch returns
ErrSessionNotFound (same opaque response as unknown id)
- row-level CAS with the org predicate in WHERE, so two callers
cannot race the state transition
- idempotency on already-cancelled scoped to the SAME org
go.work bumped to 1.26.3 to satisfy the per-module go directive.
Add HTML landing page at / route for mpc.lux.network showing:
- CGGMP21 and FROST protocol info
- Supported chains (BTC, ETH, LUX, SOL, XRPL, TON, etc.)
- Links to health, bridge dashboard, and API docs
Also update go.work to Go 1.26.1.
- Bump e2e module to go 1.26.0
- Add go.work workspace file (replaces need for local replaces)
- Remove dgraph-io/badger from e2e direct deps (unused directly)
- Tidy both modules
- Document agl/ed25519 redirect requirement (broken upstream)
zeekay