zeekayandHanzo Dev
ad553ad37a
Moved the go directive to 1.27.1 and verified the module with go build, go vet and the full test suite, all clean. Co-authored-by: Hanzo Dev <[email protected]>
luxfi/esign
Permissive (Apache 2.0) eSign crypto core for the Lux ecosystem.
luxfi/esign is the cryptographic foundation that any service in the
Lux ecosystem — Hanzo eSign (hanzoai/esign), Hanzo Dataroom
(hanzoai/dataroom), Liquidity, Pars, Osage, Zoo — can compose
royalty-free. It owns:
- Envelope state machine — typed Draft → Sent → Viewed → Signing → Completed lifecycle, hash-chained audit trail, tamper-evident.
- PAdES PDF signing — ETSI EN 319 142 long-term-validation profile, embedded via pdfcpu (Apache 2.0).
- Signature methods: Ed25519, ML-DSA-65 (post-quantum), FROST threshold (Schnorr), CGGMP21 MPC ECDSA, ECDSA-P256, RSA-PSS.
- Verifier — including X.509 chain validation for Adobe / Foxit interop on standard PAdES envelopes.
- Audit chain — append-only, SHA-256 hash-chained, tamper-detectable.
luxfi/esign is crypto only. It exposes no UI, no email, no
workflow, no multi-tenant tables. Those concerns live in services
that consume luxfi/esign — most prominently
hanzoai/esign, the Hanzo-hosted
DocuSign-equivalent SaaS at esign.hanzo.ai.
Why Apache 2.0?
The eSign primitive sits at the bottom of every signing flow in Lux's stack — from Reg D subscription agreements to threshold-signed trade confirmations to investor onboarding. A permissive license makes it impossible for any descendant to be infected by a copyleft clause; it composes cleanly into proprietary services, AGPL services (via ZAP RPC across a process boundary), and other OSS projects.
It also follows the precedent set by other Tier-2 Lux primitives:
luxfi/lattice, luxfi/pulsar, luxfi/magnetar, luxfi/lens —
Apache 2.0 lets us provide an explicit patent grant to users while
keeping rugpull risk at zero.
How services compose it
luxfi/esign (Apache 2.0) — crypto + envelope state, no UI
↑ ZAP RPC — port 9650 by default
hanzoai/esign (AGPL, Hanzo-hosted) — full DocuSign-equivalent UX
↑ HTTPS / ZAP — esign.hanzo.ai
white-label tenants — Liquidity, Pars, Zoo, Osage, …
Hanzo eSign is the hosted product. Any tenant in the ecosystem can
call its API; for in-process flows that don't need a hosted UI, the
tenant can call luxfi/esign directly with no SaaS hop.
Wire format — native ZAP
luxfi/esign exposes its signing API over ZAP
— the same length-prefixed binary protocol used by Lux KMS, MPC, and
the ZAP-native KMS-MPC bus. ZAP carries:
- Opcodes for
OpEnvelopeCreate,OpEnvelopeSign,OpEnvelopeVerify,OpAuditAppend,OpAuditVerifyChain. - ML-KEM-768 hybrid handshake when reaching across pod boundaries.
- Per-call latency under 1 ms in-cluster.
HTTP/REST is a thin shim over the same handlers — not the canonical transport.
Layout
luxfi/esign/
├── pkg/
│ ├── envelope/ — state machine, audit chain
│ ├── pdf/ — PAdES embed via pdfcpu
│ ├── sign/ — algorithm dispatch
│ ├── verify/ — sig + chain validation
│ ├── audit/ — append-only event log
│ └── api/ — ZAP + HTTP handlers
├── cmd/
│ └── esignd/ — standalone binary
└── spec/ — PAdES profile conformance
Status
Day 1 scaffold — envelope state machine + tests landed. Next: Ed25519 single-signer path with PDF embed, ML-DSA-65 PQ path, FROST multi-party path, ZAP RPC server.
License
Apache License, Version 2.0. See LICENSE.
Copyright 2026 Lux Industries Inc. and the luxfi/esign authors.