Stale checksum for luxfi/[email protected] caused CI build failures.
Removed old entry, re-downloaded with correct hash.
Added .gcloudignore to exclude go.work, e2e/, and binaries from cloud builds.
Backend:
- Reorg detection in tx tracker (re-verify block hash, detect receipt disappearance)
- Post-finalization safety margin (6 extra blocks before stopping tracking)
- Server-side HSM co-signing (HSMProvider interface, server calls HSM directly)
- Background intent expiry reaper (5-min sweep for stuck intents)
- Domain-separated intent hashing (lux-mpc-intent:v1 prefix)
- Backup rate limiting (max 3 active per wallet)
- Default backup changed to 2-of-3 (iCloud + HSM + offline) for fault tolerance
- All status transitions now use RecordTransition with proper actors
Frontend:
- Intents list page with status filter
- Intent detail page with lifecycle progress bar, sign/co-sign actions
- Settlements list page with status filter
- Settlement detail page with lifecycle, HSM signatures, transfer agency
- Enhanced transaction detail with on-chain confirmation, revert reason, status history
- Wallet backup UI with Shamir shard visualization
- Updated StatusBadge with all new status colors
- Nav updated with Intents + Settlements links
- Co-sign UI updated for server-side HSM flow (key_id only, no client signature)
- Replace redirect-to-dashboard with proper landing page showing
branding, feature cards, chain chips, and sign-in button
- Add /docs hub page with section cards, API reference, and examples
- Update middleware to allow / and /docs as public paths
Add HTML landing page at / route for mpc.lux.network showing:
- CGGMP21 and FROST protocol info
- Supported chains (BTC, ETH, LUX, SOL, XRPL, TON, etc.)
- Links to health, bridge dashboard, and API docs
Also update go.work to Go 1.26.1.
- Changed login redirect from /login to /oauth/authorize (standard OAuth2
authorization endpoint)
- IAM app renamed from app-lux-mpc to lux-mpc so implicit flow resolves
correctly (Casdoor uses client_id as app name lookup)
- Updated E2E tests to match new OAuth flow
- DualModeListener sniffs first byte: 0x16 → TLS, else plaintext
- Client falls back to plaintext TCP if TLS dial fails
- Enables rolling upgrades without breaking peer connectivity
- All nodes now running PQ TLS 1.3 (X25519MLKEM768) in production
- Add PQ TLS using Go 1.26 built-in X25519MLKEM768 hybrid key exchange
- Self-signed certs from Ed25519 identity keys (no separate PKI needed)
- Server: ListenTLS with ML-KEM-768 preferred curve
- Client: DialTLS with InsecureSkipVerify (auth via ZAP identity)
- Fallback to plaintext TCP when identity keys not configured
- Test confirms X25519MLKEM768 negotiation on every handshake
- Also supports SecP256r1MLKEM768 and SecP384r1MLKEM1024 fallbacks
- Add WebAuthn/FIDO2 registration and verification endpoints
POST /webauthn/register/begin, /register/complete, /verify
- Biometric approval: Face ID/Touch ID/YubiKey approve transactions
- Challenge bound to transaction ID (SHA256) preventing replay
- Enforce ApproverRoles from policy engine during transaction approval
- Add WebAuthnCredential DB model (pending_registration, active, revoked)
- Policy decisions now carry ApproverRoles for role-gated approvals
- /health returns connected_peers as int (count) not string array
- /keygen derives eth_address from 32-byte keys (was >= 33, now >= 32)
- Skip initiator verification when no explicit key configured (consensus mode)
- ConsensusIdentityStore now uses node's own key as initiator key when
no explicit event_initiator_pubkey is configured (consensus mode)
- /keygen HTTP endpoint signs GenerateKeyMessage with node's Ed25519 key
- ConsensusMPCBackend.TriggerKeygen/TriggerSign sign messages before publish
- apiOnlyMPCBackend forwards to /keygen and /health (internal API paths)
instead of /api/v1/keygen and /api/v1/status (dashboard API paths)
- mpc-api deployment points to port 9800 (internal API, no auth required)
instead of port 8081 (dashboard API, auth required)
- /health response uses snake_case keys matching ClusterStatus JSON tags
- Login redirect uses /login instead of /oauth/authorize (matches actual
Casdoor login page URL that renders the form)
- E2E tests updated to use correct field placeholders (Email, Password)
and button text (Sign In) matching the Lux ID login component
- Exempt /healthz from rate limiting to prevent K8s probe failures
- Callback page now checks both hash fragment and query string for
access_token (Casdoor returns it in query string, not hash)
- Login redirect uses /oauth/authorize instead of /login/oauth/authorize
- Add hanzo.id to default OIDC issuers in MPC API
- Update E2E tests to match corrected authorize URL
- Separate mpc-api into its own Deployment with --cluster-url proxy to mpc-node-0
- Switch OAuth from authorization code flow to implicit flow (response_type=token)
- Add Playwright E2E tests for Lux ID login flow and OIDC discovery
- Update CI to apply api-deployment.yaml and wait for mpc-api rollout
- Add OIDC token exchange endpoint (POST /api/v1/auth/oidc) that
validates Lux ID access tokens and issues local MPC API JWTs
- Update dashboard auth callback to do 2-step exchange: get Lux ID
token, then exchange for MPC API JWT via OIDC endpoint
- Fix IngressRoute to use path-based routing (/api/v1 → API, / → dashboard)
- Fix deploy.yml to target lux-k8s cluster (not hanzo-k8s)
- Fix wallet creation page to use api client instead of raw fetch
- Add /api and /healthz to dashboard middleware public paths
The API runs on node-0 of the MPC StatefulSet (--api-db, --api-listen flags).
The standalone mpc-api deployment was broken (missing --node-id in consensus
mode) and unnecessary. Removed from deploy workflow.
Added imagePullPolicy: Always to ensure :latest tag pulls fresh images.
- Replace Inter with Geist Sans/Mono in docs site
- Add geist package to docs dependencies
- Round all buttons to rounded-lg in dashboard and login pages
Split into per-arch image templates (amd64/arm64) with docker_manifests
to combine them — this is the correct goreleaser v2 pattern.
Single --platform=linux/amd64,linux/arm64 fails with docker exporter
not supporting manifest lists in buildx docker driver.
mpcd and lux-mpc-cli use terminal password prompts via golang.org/x/term which requires
syscall.Stdin as int — incompatible with Windows syscall.Handle (uintptr). Both are
server/ops tools targeting Linux/macOS; Windows support is out of scope.
e2e now references github.com/luxfi/mpc v1.0.5 (semantic tag).
Local resolution handled by go.work workspace, not replace directive.
Only remaining replace is agl/ed25519 → luxfi/edwards25519 (broken upstream).
- Bump e2e module to go 1.26.0
- Add go.work workspace file (replaces need for local replaces)
- Remove dgraph-io/badger from e2e direct deps (unused directly)
- Tidy both modules
- Document agl/ed25519 redirect requirement (broken upstream)
- goimports -w on all pkg/api, pkg/db, cmd/mpcd files
- TestError_PanicsOnOddKeyValues → TestError_OddKeyValuesLogsWarning
(logger was intentionally changed to warn+sentinel instead of panic)
- int(threshold) → threshold (threshold is already int from c.Int())
zeekay