mirror of
https://github.com/luxfi/node.git
synced 2026-10-30 15:24:05 +00:00
zeekay
7cf87b230b
The module already called itself github.com/luxfi/node while containing no node in Go: cmd/luxd was twenty-one lines that printed the size of a few types, and the Go column of the matrix measured a VM plugin. A repo that fetches the thing it claims to be has not replaced it, so the Go sources move in — 1515 files, the daemon and everything under it — and the build reaches outside this module for nothing. Rust and C++ sit beside it unchanged and are still measured against it by the differential. That is the point of one repo: the reference implementation and the two ports are the same checkout, so parity is a thing you can run rather than a thing you assert. Verified: builds, and the closure carries no lux-private — checked at build time rather than believed. The daemon starts twelve chains on a local network (P X C Q Z A B G K M F, plus D through its plugin) and reports healthy.
42 lines
5.5 KiB
Go
42 lines
5.5 KiB
Go
// Code generated by zipdoc; DO NOT EDIT.
|
|
|
|
package security
|
|
|
|
import (
|
|
"encoding/json"
|
|
|
|
"github.com/zap-proto/zip"
|
|
)
|
|
|
|
func init() {
|
|
zip.Describe("GET /block", zip.Doc{
|
|
Description: "BlockSecurity is the security envelope in force at a block: which profile\napplies, whether its finality signature is Pulsar-M, and which proof backend\nis allowed. A chain that accepts several backends states only the first here;\nthe exact backend a block used is in that block's own certificate.",
|
|
Fields: map[string]string{
|
|
"BlockSecurityArgs.blockNumber": "BlockNumber is the explorer-visible block height. The profile is pinned at\ngenesis so today's answer is the same at every height; the argument is\ncarried so per-block detail can be added without a new namespace.",
|
|
"BlockSecurityArgs.chain": "Chain is the chain alias (\"P\", \"X\", \"C\") the block belongs to. Reserved\nfor the same reason.",
|
|
"BlockSecurityReply.post_quantum_end_to_end": "PostQuantumEndToEnd mirrors ProfileReply.PostQuantumEndToEnd.\nDuplicated onto the block-level reply so a single block\nfetch carries the full E2E posture.",
|
|
"BlockSecurityReply.proof_backend_id": "ProofBackendID is the wire byte of the chain's canonical\nproof backend (first AllowedProofBackends entry). Pre-rendered\nhere for explorer convenience.",
|
|
"BlockSecurityReply.proof_backend_name": "ProofBackendName is the canonical SCREAMING_SNAKE_CASE name of\nthe chain's proof backend.",
|
|
"BlockSecurityReply.pulsar_m_signature_valid": "PulsarMSignatureValid is true iff the chain's finality scheme\nis a Pulsar-M variant. Blocks accepted under this profile have\nalready passed the finality-signature gate at the consensus\nlayer; this field is the explorer-facing summary.",
|
|
"BlockSecurityReply.security_profile_id": "SecurityProfileID is the wire byte of the chain's active\nprofile at the time the block was accepted. Constant for a\nchain that has not undergone a profile migration.",
|
|
"BlockSecurityReply.security_profile_name": "SecurityProfileName mirrors ProfileReply.ProfileName.",
|
|
},
|
|
Example: json.RawMessage(`{"blockNumber":"1","chain":"P"}`),
|
|
Response: json.RawMessage(`{"security_profile_id":2,"security_profile_name":"STRICT_PQ","pulsarm_signature_valid":true,"proof_backend_id":1,"proof_backend_name":"PLONKY3","post_quantum_end_to_end":true}`),
|
|
})
|
|
zip.Describe("GET /profile", zip.Doc{
|
|
Description: "SecurityProfile is the chain-wide profile this node enforces: the scheme on\nevery axis, and every primitive it forbids. The shape is fixed for a given\n(profile_id, profile_hash) pair, so a caller can cache by hash and refetch\nonly when the hash changes.",
|
|
Fields: map[string]string{
|
|
"ProfileReply.forbid_ecdsa_wallets": "Forbid* axes — one boolean per refused-primitive class. Audit\ntooling reads these to verify a deployment refuses what it\nclaims to refuse. Strict-PQ profiles set every entry true.",
|
|
"ProfileReply.hash_suite": "Scheme axes — each rendered as the SCREAMING_SNAKE canonical\nname of the scheme byte. None / Invalid / unknown bytes are\nrendered as the generic \"UNKNOWN_0x<hex>\" form so a forked\nbinary that pins an unknown byte cannot silently masquerade as\na canonical scheme.",
|
|
"ProfileReply.lux_canonical": "LuxCanonical reports whether the profile is one of the three\naudit-signed-off-on Lux canonical profiles (StrictPQ, FIPS,\nPermissive). Downstream forks that pin a different ProfileID\nMUST receive false here so audit attestations refuse them.",
|
|
"ProfileReply.nist_friendly": "NISTFriendly reports whether the chain pins a NIST-aligned\ncanonical Lux profile (StrictPQ or FIPS). A profile whose\nHashSuiteID is SHA3_NIST but whose Forbid* bits are disabled\n(the classical-compat fork case) is NOT NIST-friendly: NIST\nalignment is a full-posture predicate, not a hash-suite axis.",
|
|
"ProfileReply.post_quantum_end_to_end": "PostQuantumEndToEnd reports whether every E2E axis (wallet, tx,\ncontract-auth, KEM, recovery) is satisfied by a NIST-PQ\nprimitive AND every classical primitive is explicitly\nforbidden. Single boolean for dashboard wiring.",
|
|
"ProfileReply.profile_hash": "ProfileHash is the 48-byte SHA3-384 commitment to the profile\nencoded as a 0x-prefixed lowercase hex string (96 hex chars).\nDistinct profiles produce distinct hashes; identical profiles\nproduce identical hashes regardless of allow-list ordering.",
|
|
"ProfileReply.profile_id": "ProfileID is the wire byte of the active profile (see\nconsensus/config.ProfileID). Stable across upgrades.",
|
|
"ProfileReply.profile_name": "ProfileName is the canonical SCREAMING_SNAKE_CASE name (e.g.\n\"STRICT_PQ\"). Audit tooling matches on this name.",
|
|
},
|
|
Response: json.RawMessage(`{"profile_id":2,"profile_name":"STRICT_PQ","profile_hash":"0x00","post_quantum_end_to_end":true,"nist_friendly":true,"lux_canonical":true,"hash_suite":"SHA3_NIST","wallet_scheme":"ML_DSA_65","tx_scheme":"ML_DSA_65","contract_auth":"ML_DSA_65","validator_scheme":"ML_DSA_65","finality_scheme":"PULSAR_M","high_value_scheme":"SLH_DSA","proof_policy":"PQ_ONLY","key_exchange":"ML_KEM_768","high_value_kem":"ML_KEM_1024","recovery_scheme":"SLH_DSA","forbid_ecdsa_wallets":true,"forbid_ecdsa_contract_auth":true,"forbid_bls_contract_auth":true,"forbid_classical_kem":true,"require_typed_tx_auth":true,"forbid_pairings":true,"forbid_kzg":true,"forbid_trusted_setup":true,"forbid_classical_snarks":true,"forbid_dev_proofs":true,"forbid_fallbacks":true}`),
|
|
})
|
|
}
|