luxfi/esign

Permissive (Apache 2.0) eSign crypto core for the Lux ecosystem.

luxfi/esign is the cryptographic foundation that any service in the Lux ecosystem — Hanzo eSign (hanzoai/esign), Hanzo Dataroom (hanzoai/dataroom), Liquidity, Pars, Osage, Zoo — can compose royalty-free. It owns:

Envelope state machine — typed Draft → Sent → Viewed → Signing → Completed lifecycle, hash-chained audit trail, tamper-evident.
PAdES PDF signing — ETSI EN 319 142 long-term-validation profile, embedded via pdfcpu (Apache 2.0).
Signature methods: Ed25519, ML-DSA-65 (post-quantum), FROST threshold (Schnorr), CGGMP21 MPC ECDSA, ECDSA-P256, RSA-PSS.
Verifier — including X.509 chain validation for Adobe / Foxit interop on standard PAdES envelopes.
Audit chain — append-only, SHA-256 hash-chained, tamper-detectable.

luxfi/esign is crypto only. It exposes no UI, no email, no workflow, no multi-tenant tables. Those concerns live in services that consume luxfi/esign — most prominently hanzoai/esign, the Hanzo-hosted DocuSign-equivalent SaaS at esign.hanzo.ai.

Why Apache 2.0?

The eSign primitive sits at the bottom of every signing flow in Lux's stack — from Reg D subscription agreements to threshold-signed trade confirmations to investor onboarding. A permissive license makes it impossible for any descendant to be infected by a copyleft clause; it composes cleanly into proprietary services, AGPL services (via ZAP RPC across a process boundary), and other OSS projects.

It also follows the precedent set by other Tier-2 Lux primitives: luxfi/lattice, luxfi/pulsar, luxfi/magnetar, luxfi/lens — Apache 2.0 lets us provide an explicit patent grant to users while keeping rugpull risk at zero.

How services compose it

luxfi/esign  (Apache 2.0)             — crypto + envelope state, no UI
       ↑ ZAP RPC                       — port 9650 by default
hanzoai/esign  (AGPL, Hanzo-hosted)    — full DocuSign-equivalent UX
       ↑ HTTPS / ZAP                   — esign.hanzo.ai
white-label tenants                    — Liquidity, Pars, Zoo, Osage, …

Hanzo eSign is the hosted product. Any tenant in the ecosystem can call its API; for in-process flows that don't need a hosted UI, the tenant can call luxfi/esign directly with no SaaS hop.

Wire format — native ZAP

luxfi/esign exposes its signing API over ZAP — the same length-prefixed binary protocol used by Lux KMS, MPC, and the ZAP-native KMS-MPC bus. ZAP carries:

Opcodes for OpEnvelopeCreate, OpEnvelopeSign, OpEnvelopeVerify, OpAuditAppend, OpAuditVerifyChain.
ML-KEM-768 hybrid handshake when reaching across pod boundaries.
Per-call latency under 1 ms in-cluster.

HTTP/REST is a thin shim over the same handlers — not the canonical transport.

Layout

luxfi/esign/
├── pkg/
│   ├── envelope/      — state machine, audit chain
│   ├── pdf/           — PAdES embed via pdfcpu
│   ├── sign/          — algorithm dispatch
│   ├── verify/        — sig + chain validation
│   ├── audit/         — append-only event log
│   └── api/           — ZAP + HTTP handlers
├── cmd/
│   └── esignd/        — standalone binary
└── spec/              — PAdES profile conformance

Status

Day 1 scaffold — envelope state machine + tests landed. Next: Ed25519 single-signer path with PDF embed, ML-DSA-65 PQ path, FROST multi-party path, ZAP RPC server.

License

Apache License, Version 2.0. See LICENSE.

3.8 KiB Raw Permalink Blame History