universe/k8s

Zoo Network: L2 on Lux + Brand Services

Zoo is a brand L2 on Lux primary network (shares validators via primary-network staking; see ~/work/zoo/universe/chain.yaml). The Zoo L2 EVM lives on api.lux.network/v1/chain/zoo/rpc (chainId 200200 mainnet, 200201 testnet, 200202 devnet). The manifests in this directory describe Zoo's brand services — bridge, explorer, gateway, marketing sites — that run alongside the L2 in a do-sfo3-zoo-k8s cluster. Validators themselves run on Lux clusters.

The legacy "kitchen-sink 15-chain ZooNetwork CR" in base/network.yaml and the chain-native crypto layers in base/beluga.yaml describe an unrealized sovereign-Zoo-cluster architecture. They are kept as design artifacts; the operator does not currently reconcile them in production (zoo-operator deployments sit at 0/1, ZooNetwork CRs unreconciled).

Cluster: do-sfo3-zoo-k8s (DOKS SFO3)

Namespace	Purpose	Key Pods
zoo-system	Operator, RBAC	zoo-operator
zoo-devnet	Devnet validators + services	zoo-chain (1 GPU validator), explorer, bridge
zoo-testnet	Testnet validators + services	zoo-chain (3 GPU validators), explorer, bridge
zoo-mainnet	Mainnet validators + services	zoo-chain (5 GPU validators), explorer, bridge (2)

Chain Map (15 chains)

Every validator runs all VMs -- one binary, one node, every chain:

#	Chain	VM	Letter	Chain ID	Purpose	GPU
1	zoo-evm	LuxEVM	E	200200	Smart contracts, DeFi, tokens	cevm (2.3 Gops/s)
2	zoo-dex	DexVM	D	—	Native orderbook + AMM	—
3	zoo-fhe	FHEVM	F	200203	Encrypted computation (TFHE)	TFHE bootstrap/keyswitch
4	zoo-identity	IdentityVM	I	—	DIDs, verifiable credentials, ZK proofs	—
5	zoo-keys	KeyVM	K	—	Distributed KMS (AES-GCM + ML-KEM envelope)	NTT acceleration
6	zoo-threshold	ThresholdVM	T	—	TFHE threshold reveal, CKKS ML inference	GPU FHE ops
7	zoo-mpc	MpcVM	M	—	MPC signing (CGGMP21 protocol)	—
8	zoo-bridge-chain	BridgeVM	B	—	Cross-chain lock-and-mint with MPC attestation	—
9	zoo-zk	ZKVM	Z	—	Confidential transfers, Groth16 proofs	—
10	zoo-quantum	QuantumVM	Q	—	Post-quantum Corona consensus	—
11	zoo-ai	AIVM	A	—	On-chain AI/ML inference (ONNX, GGUF)	GPU inference
12	zoo-graph	GraphVM	G	—	GraphQL data layer	—
13	zoo-oracle	OracleVM	O	—	Oracle / off-chain data feeds	—
14	zoo-relay	RelayVM	R	—	Cross-chain relay (Lux warp messages)	—
15	beluga	EVM L3	—	420420	AI app-chain with AI+FHE+PQ+ZK precompiles	All

3-Tier Crypto Layering

All cryptographic operations use a tiered architecture, no external KMS or MPC services:

Tier 1: Default Envelope (K-Chain / luxfi/kms)
  AES-256-GCM data encryption + ML-KEM-768 key encapsulation
  Every secret at rest uses this envelope. NTT-accelerated on GPU.

Tier 2: Threshold Reveal (T-Chain / TFHE)
  TFHE homomorphic encryption gates threshold key reveal.
  K-Chain stores shares encrypted under ML-KEM; T-Chain decrypts
  only when threshold (2-of-3) validators attest.

Tier 3: Confidential Compute (T-Chain / CKKS)
  CKKS scheme for encrypted arithmetic on ML model inputs/outputs.
  Beluga L3 sends encrypted inference requests; T-Chain evaluates
  under encryption; results decrypted only for the requester via
  threshold reveal (Tier 2).

How luxfi/kms and luxfi/mpc map to chains

Library	Chain	Role
luxfi/kms	K-Chain (zoo-keys)	Key generation, ML-KEM encapsulation, share storage
luxfi/mpc	M-Chain (zoo-mpc)	CGGMP21 keygen + signing sessions, presigning
luxfi/kms	T-Chain (zoo-threshold)	TFHE threshold gate, CKKS encrypted compute

M-Chain stores keygen shares on K-Chain (ML-KEM encrypted). Signing requests are authenticated via I-Chain DIDs. Bridge attestations use M-Chain MPC signatures.

Web5 Capabilities

Capability	Chain(s)	Standard
Decentralized Identifiers (DIDs)	I-Chain	did:lux:zoo:*
Verifiable Credentials	I-Chain	W3C VC Data Model 2.0
ZK Credential Proofs	I-Chain + Z-Chain	Groth16 selective disclosure
Threshold Signing	M-Chain + T-Chain	CGGMP21, 2-of-3 default
Confidential Compute (FHE)	T-Chain + Beluga	TFHE (gates), CKKS (arithmetic)
Post-Quantum Crypto	K-Chain + Q-Chain	ML-KEM-768, ML-DSA-65, SLH-DSA-128s
Cross-Chain Bridge	B-Chain + M-Chain	Lock-and-mint, MPC-attested
On-Chain AI Inference	A-Chain + Beluga	ONNX, GGUF model formats
Decentralized Oracles	O-Chain	Validator-attested data feeds
Graph Queries	G-Chain	GraphQL over chain state

GPU Acceleration

Every validator requests 1x NVIDIA GPU:

Subsystem	Accelerator	Speedup
EVM execution	cevm (C++ GPU EVM)	2.3 Gops/sec
FHE operations	TFHE bootstrap/keyswitch	40x vs CPU
CKKS arithmetic	GPU polynomial eval	20x vs CPU
Consensus	BLS12-381 batch verify	10x vs CPU
PQ crypto	ML-DSA/ML-KEM/SLH-DSA NTT	8x vs CPU

Backend auto-detection: metal (Apple Silicon), cuda (NVIDIA), dawn (cross-platform).

BLG (Beluga) Token

Property	Value
Name	BELUGA
Symbol	BLG
Decimals	18
Chain ID	420420
Role	Gas token on Beluga L3
Fee model	EIP-1559 (base fee burned)
Bridge	BLG <-> ZOO via B-Chain (lock-and-mint)
Attestation	M-Chain MPC threshold signing

Networks

Environment	Network ID	Chain ID	Lux RPC
devnet	3	200202	api.lux-dev.network
testnet	2	200201	api.lux-test.network
mainnet	1	200200	api.lux.network

API Endpoints

All chains exposed via ZooGateway at api.zoo.ngo:

Path	Chain	Description
/v1/rpc	zoo-evm	EVM JSON-RPC
/v1/ws	zoo-evm	EVM WebSocket
/v1/dex	zoo-dex	DEX orderbook + AMM
/v1/fhe	zoo-fhe	FHE computation
/v1/identity	zoo-identity	DID / credential RPCs
/v1/keys	zoo-keys	Key management RPCs
/v1/threshold	zoo-threshold	Threshold signing RPCs
/v1/mpc	zoo-mpc	MPC signing RPCs
/v1/bridge	zoo-bridge	Cross-chain transfers
/v1/zk	zoo-zk	Zero-knowledge proofs
/v1/quantum	zoo-quantum	Quantum consensus RPCs
/v1/ai	zoo-ai	AI/ML inference RPCs
/v1/graph	zoo-graph	GraphQL data layer
/v1/oracle	zoo-oracle	Oracle data feeds
/v1/relay	zoo-relay	Cross-chain relay
/v1/beluga	beluga	Beluga L3 EVM JSON-RPC
/v1/explorer	zoo-explorer	Lux explorer (Go binary)

Deploy

./deploy.sh all        # All environments
./deploy.sh system     # Operator only
./deploy.sh devnet     # Devnet
./deploy.sh testnet    # Testnet
./deploy.sh mainnet    # Mainnet

Services

Service	Kind	Replicas (dev/test/main)	Image
zoo-operator	Deployment	1 (system only)	ghcr.io/zooai/operator
zoo-chain	ZooNetwork CR	1/3/5 (GPU)	ghcr.io/zooai/zoo-node
zoo-bridge	Deployment	1/1/1	ghcr.io/zooai/zoo-bridge (SQLite + Litestream)
zoo-explorer	Deployment	1/1/2	ghcr.io/luxfi/explorer
s3	StatefulSet	1/1/1	ghcr.io/hanzoai/s3 — Litestream backend
kv	StatefulSet	1/1/1	ghcr.io/hanzoai/kv:9 — ephemeral cache
zoo-ingress	Deployment	1/1/2	ghcr.io/hanzoai/ingress
zoo-gateway	ZooGateway CR	1/1/1	ghcr.io/hanzoai/gateway

No separate IAM, KMS, or MPC deployments. Validators do everything.

Structure

k8s/
  base/
    namespace.yaml
    operator.yaml        # zoo-operator + RBAC
    network.yaml         # ZooNetwork CR (15 VMs, GPU-accelerated)
    beluga.yaml          # Beluga L3 AI app-chain
    blg-token.yaml       # BLG token CRD (gas on Beluga, bridgeable to Zoo EVM)
    s3.yaml              # MinIO (hanzoai/s3) — backs Litestream replicas
    replicate.yaml       # Litestream config for SQLite WAL → S3
    kv.yaml              # Valkey (hanzoai/kv:9) — ephemeral cache only
    bridge.yaml          # Cross-chain bridge (uses M-Chain signing)
    explorer.yaml        # Lux explorer (Go binary)
    gateway.yaml         # ZooGateway (routes to all 15 chain RPCs + Beluga)
    ingress.yaml         # Ingress + routes
    kustomization.yaml
  crds/                  # CRDs (ZooNetwork, ZooChain, ZooToken, ZooGateway, ZooExplorer)
  zoo-system/            # Operator only
  zoo-devnet/            # Devnet overlay (network-id=3, chain-id=200202)
  zoo-testnet/           # Testnet overlay (network-id=2, chain-id=200201)
  zoo-mainnet/           # Mainnet overlay (network-id=1, chain-id=200200)

Prerequisites

Secrets provisioned via KMSSecret CRs synced from kms.hanzo.ai:

• s3-credentials — MinIO ACCESS_KEY / SECRET_KEY (Litestream auth)
• zoo-kv-credentials — Valkey password (password key)
• zoo-genesis — genesis.json for any locally-bootstrapped chains
• zoo-staking-keys — validator staking TLS certs (if local validators)
• cloudflare-api-credentials — ACME DNS challenge
• ghcr-secret — container registry pull credentials

GPU nodes: DOKS GPU node pool with NVIDIA A100/H100 or equivalent.

CRDs must be applied first: kubectl --context do-sfo3-zoo-k8s apply -f k8s/crds/

Migration from External Services

Before	After
id.zoo.network (Hanzo IAM)	api.zoo.ngo/v1/identity (I-Chain)
kms.zoo.network (Hanzo KMS)	api.zoo.ngo/v1/keys (K-Chain)
mpc-node StatefulSet (3 pods)	api.zoo.ngo/v1/mpc (M-Chain) + validators
OAuth2/OIDC tokens	DID-based credentials (did:lux:zoo:*)
HTTP secret fetch	On-chain key shares (ML-KEM encrypted)
CGGMP21 sidecar	Chain-native MPC signing (M-Chain)
CPU-only consensus	GPU BLS12-381 batch verify
CPU FHE	GPU TFHE bootstrap/keyswitch (40x)
Standard EVM	cevm GPU EVM (2.3 Gops/sec)