node: v1.30.59 — DEX_REF v1.5.18 -> v1.5.19

The published v1.30.57/58 images shipped a clob_* D-Chain plugin: the remote
v1.5.18 dex tag (=origin/main, 6c12256) is the OLD clob_* surface, while the
dex_* rename lived only on refactor/decomplect-synthetic-guards. dex v1.5.19
tags that dex_* tree (048d6f6 -> d1a2873). Bumping the ref also busts the
cached 'git clone --branch ${DEX_REF}' plugin-build layer, so the rebuilt
/data/plugins/mDVT5EWM... serves /ext/bc/D/dex/dex_* (not clob_*).

.ci-status-check.md

@@ -0,0 +1 @@
+# CI Status Check - 2025-09-23 23:30:58

.ci-trigger

@@ -0,0 +1 @@
+# Triggering CI - Version 1.13.5 Ready

.envrc

@@ -0,0 +1,23 @@
+if [ -n "${LUXD_DIRENV_USE_FLAKE}" ]; then
+   if ! command -v nix > /dev/null; then
+     echo "To enable entering a dev shell via this .envrc: ./scripts/run_task.sh install-nix"
+   else
+     use flake
+   fi
+fi
+
+# Repo-local commands like ginkgo and tmpnetctl
+PATH_add bin
+
+# Configure the explicit built path of luxd for tmpnet usage
+export LUXD_PATH="${LUXD_PATH:-$PWD/bin/luxd}"
+
+# Configure the local plugin directory for both luxd and tmpnet usage
+mkdir -p $PWD/build/plugins                                       # luxd will FATAL if the directory does not exist
+export LUXD_PLUGIN_DIR="${LUXD_PLUGIN_DIR:-$PWD/build/plugins}" # Use an existing value if set
+
+# Default to tmpnetctl targeting the last deployed tmpnet network
+export TMPNET_NETWORK_DIR="${TMPNET_NETWORK_DIR:-${HOME}/.tmpnet/networks/latest}"
+
+# Allow individuals to add their own customisation
+source_env_if_exists .envrc.local

.github/CLOUD_IMAGE_SETUP.md

@@ -0,0 +1,393 @@
+# Multi-Cloud Image Build Setup
+
+This document explains how to set up the CI/CD pipeline for building Lux Network node images on AWS, GCP, and Azure.
+
+## Overview
+
+The workflows automatically build machine images when:
+- A new version tag is pushed (`v*`)
+- A GitHub release is published
+- Manually triggered via workflow dispatch
+
+## Required GitHub Secrets
+
+### AWS Secrets
+
+| Secret | Description | How to Obtain |
+|--------|-------------|---------------|
+| `AWS_AMI_ROLE_ARN` | IAM role ARN for OIDC authentication | See AWS Setup below |
+
+### GCP Secrets
+
+| Secret | Description | How to Obtain |
+|--------|-------------|---------------|
+| `GCP_PROJECT_ID` | Google Cloud project ID | GCP Console |
+| `GCP_WORKLOAD_IDENTITY_PROVIDER` | Workload Identity Federation provider | See GCP Setup below |
+| `GCP_SERVICE_ACCOUNT` | Service account email | See GCP Setup below |
+
+### Azure Secrets
+
+| Secret | Description | How to Obtain |
+|--------|-------------|---------------|
+| `AZURE_CLIENT_ID` | Azure AD application ID | See Azure Setup below |
+| `AZURE_CLIENT_SECRET` | Azure AD application secret | See Azure Setup below |
+| `AZURE_TENANT_ID` | Azure AD tenant ID | Azure Portal |
+| `AZURE_SUBSCRIPTION_ID` | Azure subscription ID | Azure Portal |
+| `AZURE_RESOURCE_GROUP` | Resource group for images | Create in Azure |
+
+---
+
+## AWS Setup
+
+### 1. Create OIDC Identity Provider
+
+```bash
+# Create the OIDC provider for GitHub Actions
+aws iam create-open-id-connect-provider \
+  --url https://token.actions.githubusercontent.com \
+  --client-id-list sts.amazonaws.com \
+  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
+```
+
+### 2. Create IAM Role
+
+```bash
+# Create trust policy file
+cat > trust-policy.json << 'EOF'
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Federated": "arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
+      },
+      "Action": "sts:AssumeRoleWithWebIdentity",
+      "Condition": {
+        "StringEquals": {
+          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+        },
+        "StringLike": {
+          "token.actions.githubusercontent.com:sub": "repo:luxfi/node:*"
+        }
+      }
+    }
+  ]
+}
+EOF
+
+# Create the role
+aws iam create-role \
+  --role-name GitHubActionsLuxAMI \
+  --assume-role-policy-document file://trust-policy.json
+```
+
+### 3. Attach Permissions
+
+```bash
+# Create policy for Packer AMI building
+cat > packer-policy.json << 'EOF'
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AttachVolume",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CopyImage",
+        "ec2:CreateImage",
+        "ec2:CreateKeypair",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSnapshot",
+        "ec2:CreateTags",
+        "ec2:CreateVolume",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteSnapshot",
+        "ec2:DeleteVolume",
+        "ec2:DeregisterImage",
+        "ec2:DescribeImageAttribute",
+        "ec2:DescribeImages",
+        "ec2:DescribeInstances",
+        "ec2:DescribeInstanceStatus",
+        "ec2:DescribeRegions",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSnapshots",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVolumes",
+        "ec2:DetachVolume",
+        "ec2:GetPasswordData",
+        "ec2:ModifyImageAttribute",
+        "ec2:ModifyInstanceAttribute",
+        "ec2:ModifySnapshotAttribute",
+        "ec2:RegisterImage",
+        "ec2:RunInstances",
+        "ec2:StopInstances",
+        "ec2:TerminateInstances"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+
+aws iam put-role-policy \
+  --role-name GitHubActionsLuxAMI \
+  --policy-name PackerAMIBuilder \
+  --policy-document file://packer-policy.json
+```
+
+### 4. Add Secret to GitHub
+
+```bash
+# Get the role ARN
+aws iam get-role --role-name GitHubActionsLuxAMI --query 'Role.Arn' --output text
+
+# Add to GitHub secrets:
+# AWS_AMI_ROLE_ARN = arn:aws:iam::YOUR_ACCOUNT_ID:role/GitHubActionsLuxAMI
+```
+
+---
+
+## GCP Setup
+
+### 1. Create Service Account
+
+```bash
+PROJECT_ID="your-gcp-project"
+
+# Create service account
+gcloud iam service-accounts create github-packer \
+  --project=$PROJECT_ID \
+  --display-name="GitHub Actions Packer"
+
+# Grant permissions
+gcloud projects add-iam-policy-binding $PROJECT_ID \
+  --member="serviceAccount:github-packer@$PROJECT_ID.iam.gserviceaccount.com" \
+  --role="roles/compute.instanceAdmin.v1"
+
+gcloud projects add-iam-policy-binding $PROJECT_ID \
+  --member="serviceAccount:github-packer@$PROJECT_ID.iam.gserviceaccount.com" \
+  --role="roles/compute.imageAdmin"
+
+gcloud projects add-iam-policy-binding $PROJECT_ID \
+  --member="serviceAccount:github-packer@$PROJECT_ID.iam.gserviceaccount.com" \
+  --role="roles/iam.serviceAccountUser"
+```
+
+### 2. Setup Workload Identity Federation
+
+```bash
+# Create workload identity pool
+gcloud iam workload-identity-pools create github-pool \
+  --project=$PROJECT_ID \
+  --location="global" \
+  --display-name="GitHub Actions Pool"
+
+# Create provider
+gcloud iam workload-identity-pools providers create-oidc github-provider \
+  --project=$PROJECT_ID \
+  --location="global" \
+  --workload-identity-pool="github-pool" \
+  --display-name="GitHub Provider" \
+  --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository" \
+  --issuer-uri="https://token.actions.githubusercontent.com"
+
+# Allow GitHub to impersonate service account
+gcloud iam service-accounts add-iam-policy-binding \
+  github-packer@$PROJECT_ID.iam.gserviceaccount.com \
+  --project=$PROJECT_ID \
+  --role="roles/iam.workloadIdentityUser" \
+  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/attribute.repository/luxfi/node"
+```
+
+### 3. Get Provider URL
+
+```bash
+# Get the provider resource name
+gcloud iam workload-identity-pools providers describe github-provider \
+  --project=$PROJECT_ID \
+  --location="global" \
+  --workload-identity-pool="github-pool" \
+  --format="value(name)"
+
+# Output format: projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/providers/github-provider
+```
+
+### 4. Add Secrets to GitHub
+
+```
+GCP_PROJECT_ID = your-gcp-project
+GCP_WORKLOAD_IDENTITY_PROVIDER = projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/providers/github-provider
+GCP_SERVICE_ACCOUNT = github-packer@your-gcp-project.iam.gserviceaccount.com
+```
+
+---
+
+## Azure Setup
+
+### 1. Create Resource Group
+
+```bash
+az group create --name luxfi-images --location eastus
+```
+
+### 2. Create App Registration
+
+```bash
+# Create app registration
+az ad app create --display-name "GitHub Actions Lux Packer"
+
+# Get the app ID
+APP_ID=$(az ad app list --display-name "GitHub Actions Lux Packer" --query "[0].appId" -o tsv)
+
+# Create service principal
+az ad sp create --id $APP_ID
+
+# Create client secret
+az ad app credential reset --id $APP_ID --display-name "github-actions"
+```
+
+### 3. Assign Permissions
+
+```bash
+SUBSCRIPTION_ID=$(az account show --query id -o tsv)
+RESOURCE_GROUP="luxfi-images"
+
+# Grant Contributor on resource group
+az role assignment create \
+  --assignee $APP_ID \
+  --role "Contributor" \
+  --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP"
+
+# Grant permissions to create VMs (for Packer)
+az role assignment create \
+  --assignee $APP_ID \
+  --role "Virtual Machine Contributor" \
+  --scope "/subscriptions/$SUBSCRIPTION_ID"
+```
+
+### 4. Create Shared Image Gallery (Optional)
+
+```bash
+# Create gallery for image distribution
+az sig create \
+  --resource-group $RESOURCE_GROUP \
+  --gallery-name luxdGallery
+
+# Create image definition
+az sig image-definition create \
+  --resource-group $RESOURCE_GROUP \
+  --gallery-name luxdGallery \
+  --gallery-image-definition luxd \
+  --publisher luxfi \
+  --offer luxd \
+  --sku node \
+  --os-type Linux \
+  --os-state Generalized \
+  --hyper-v-generation V2
+```
+
+### 5. Add Secrets to GitHub
+
+```
+AZURE_CLIENT_ID = <App ID from step 2>
+AZURE_CLIENT_SECRET = <Secret from step 2>
+AZURE_TENANT_ID = <Your Azure AD tenant ID>
+AZURE_SUBSCRIPTION_ID = <Your subscription ID>
+AZURE_RESOURCE_GROUP = luxfi-images
+```
+
+---
+
+## Testing
+
+### Manual Workflow Trigger
+
+```bash
+# Trigger AWS build
+gh workflow run build-aws-ami.yml -f tag=v1.21.15
+
+# Trigger GCP build
+gh workflow run build-gcp-image.yml -f tag=v1.21.15
+
+# Trigger Azure build
+gh workflow run build-azure-image.yml -f tag=v1.21.15
+
+# Trigger all clouds
+gh workflow run build-all-cloud-images.yml -f tag=v1.21.15
+```
+
+### Verify Images
+
+```bash
+# AWS
+aws ec2 describe-images --owners self --filters "Name=name,Values=luxd-*"
+
+# GCP
+gcloud compute images list --filter="family:luxd"
+
+# Azure
+az image list --resource-group luxfi-images
+```
+
+---
+
+## Launching Nodes
+
+### AWS
+
+```bash
+aws ec2 run-instances \
+  --image-id ami-XXXXXXXXX \
+  --instance-type c5.xlarge \
+  --key-name your-key \
+  --security-group-ids sg-XXXXXXXX \
+  --subnet-id subnet-XXXXXXXX \
+  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=luxd-node}]'
+```
+
+### GCP
+
+```bash
+gcloud compute instances create luxd-node \
+  --image-family=luxd \
+  --image-project=your-project \
+  --machine-type=n2-standard-4 \
+  --boot-disk-size=500GB \
+  --zone=us-central1-a
+```
+
+### Azure
+
+```bash
+az vm create \
+  --resource-group luxfi \
+  --name luxd-node \
+  --image luxfi-images/luxd-ubuntu-22-04-v1-21-15 \
+  --size Standard_D4s_v3 \
+  --admin-username ubuntu \
+  --generate-ssh-keys \
+  --os-disk-size-gb 500
+```
+
+---
+
+## Recommended Instance Sizes
+
+| Cloud | Minimum | Recommended | Archive Node |
+|-------|---------|-------------|--------------|
+| AWS | c5.large | c5.xlarge | c5.2xlarge |
+| GCP | n2-standard-2 | n2-standard-4 | n2-standard-8 |
+| Azure | Standard_D2s_v3 | Standard_D4s_v3 | Standard_D8s_v3 |
+
+## Ports to Open
+
+| Port | Protocol | Purpose |
+|------|----------|---------|
+| 9630 | TCP | HTTP RPC |
+| 9631 | TCP | Staking |
+| 9632 | TCP | HTTP API |
+| 22 | TCP | SSH (optional) |

.github/CODEOWNERS

@@ -1,16 +1,20 @@
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-syntax
 
-* @zeekay
-/app/ @zeekay
-/codec/ @zeekay
-/indexer/ @zeekay
-/message/ @zeekay
-/network/ @zeekay
-/proto/ @zeekay
-/consensus/ @zeekay
-/vms/xvm/ @zeekay
-/vms/platformvm/ @zeekay
-/vms/proposervm/ @zeekay
-/vms/rpcchainvm/ @zeekay
-/vms/registry/ @zeekay
-/tests/ @zeekay
+# Code owners are the final gate for PR approval to their named section of code.
+# If a single PR modifies multiple files with different code owner groups, at
+# least one code owner of the touched file should approve the PR prior to
+# merging.
+
+* @hanzo-dev
+*.md @hanzo-dev
+/.dockerignore @hanzo-dev
+/.envrc @hanzo-dev
+/.github/ @hanzo-dev
+/.github/CODEOWNERS @hanzo-dev
+/.gitignore @hanzo-dev @hanzo-dev
+/.golangci.yml @hanzo-dev @hanzo-dev
+/Dockerfile @hanzo-dev
+/Taskfile.yml @hanzo-dev
+/flake.lock @hanzo-dev
+/flake.nix @hanzo-dev
+/tests/ @hanzo-dev

.github/ISSUE_TEMPLATE/bug_report.md

@@ -20,7 +20,7 @@ A clear and concise description of what you expected to happen.
 If applicable, add screenshots to help explain your problem.
 
 **Logs**
-If applicable, please include the relevant logs that indicate a problem and/or the log directory of your node. By default, this can be found at `~/.node/logs/`.
+If applicable, please include the relevant logs that indicate a problem and/or the log directory of your node. By default, this can be found at `~/.luxd/logs/`.
 
 **Metrics**
 If applicable, please include any metrics gathered from your node to assist us in diagnosing the problem.
@@ -31,4 +31,4 @@ Which OS you used to reveal the bug.
 **Additional context**
 Add any other context about the problem here.
 
-**To best protect the Lux community security bugs should be reported in accordance to our [Security Policy](/SECURITY.md)**
+**To best protect the Lux community security bugs should be reported in accordance to our [Security Policy](../security/policy)**

.github/actionlint.yml

@@ -2,3 +2,4 @@ self-hosted-runner:
   labels:
     - custom-arm64-focal
     - custom-arm64-jammy
+    - hanzo-build-linux-amd64

.github/actions/c-chain-reexecution-benchmark/action.yml

@@ -0,0 +1,116 @@
+name: 'C-Chain Re-Execution Benchmark'
+description: 'Run C-Chain re-execution benchmark'
+
+inputs:
+  runner_name:
+    description: 'The name of the runner to use and include in the Golang Benchmark name.'
+    required: true
+  config:
+    description: 'The config to pass to the VM for the benchmark. See BenchmarkReexecuteRange for details.'
+    default: ''
+  start-block:
+    description: 'The start block for the benchmark.'
+    default: '101'
+  end-block:
+    description: 'The end block for the benchmark.'
+    default: '250000'
+  block-dir-src:
+    description: 'The source block directory. Supports S3 directory/zip and local directories.'
+    default: 's3://luxd-bootstrap-testing/cchain-mainnet-blocks-1m-ldb/**'
+  current-state-dir-src:
+    description: 'The current state directory. Supports S3 directory/zip and local directories.'
+    default: 's3://luxd-bootstrap-testing/cchain-current-state-hashdb-full-100/**'
+  aws-role:
+    description: 'AWS role to assume for S3 access.'
+    required: true
+  aws-region:
+    description: 'AWS region to use for S3 access.'
+    required: true
+  aws-role-duration-seconds:
+    description: 'The duration of the AWS role to assume for S3 access.'
+    required: true
+    default: '43200' # 12 hours
+  prometheus-push-url:
+    description: 'The push URL of the prometheus instance.'
+    required: true
+    default: ''
+  prometheus-username:
+    description: 'The username for the Prometheus instance.'
+    required: true
+    default: ''
+  prometheus-password:
+    description: 'The password for the Prometheus instance.'
+    required: true
+    default: ''
+  workspace:
+    description: 'Working directory to use for the benchmark.'
+    required: true
+    default: ${{ github.workspace }}
+  github-token:
+    description: 'GitHub token provided to GitHub Action Benchmark.'
+    required: true
+  push-github-action-benchmark:
+    description: 'Whether to push the benchmark result to GitHub.'
+    required: true
+    default: false
+  push-post-state:
+    description: 'S3 destination to copy the current-state directory after completing re-execution. If empty, this will be skipped.'
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-go-for-project
+    - name: Set task env
+      shell: bash
+      run: |
+        {
+          echo "EXECUTION_DATA_DIR=${{ inputs.workspace }}/reexecution-data"
+          echo "BENCHMARK_OUTPUT_FILE=output.txt"
+          echo "START_BLOCK=${{ inputs.start-block }}"
+          echo "END_BLOCK=${{ inputs.end-block }}"
+          echo "BLOCK_DIR_SRC=${{ inputs.block-dir-src }}"
+          echo "CURRENT_STATE_DIR_SRC=${{ inputs.current-state-dir-src }}"
+        } >> $GITHUB_ENV
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ inputs.aws-role }}
+        aws-region: ${{ inputs.aws-region }}
+        role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
+    - name: Run C-Chain Re-Execution
+      uses: ./.github/actions/run-monitored-tmpnet-cmd
+      with:
+        run: |
+          ./scripts/run_task.sh reexecute-cchain-range-with-copied-data \
+            CONFIG=${{ inputs.config }} \
+            EXECUTION_DATA_DIR=${{ env.EXECUTION_DATA_DIR }} \
+            BLOCK_DIR_SRC=${{ env.BLOCK_DIR_SRC }} \
+            CURRENT_STATE_DIR_SRC=${{ env.CURRENT_STATE_DIR_SRC }} \
+            START_BLOCK=${{ env.START_BLOCK }} \
+            END_BLOCK=${{ env.END_BLOCK }} \
+            LABELS=${{ env.LABELS }} \
+            BENCHMARK_OUTPUT_FILE=${{ env.BENCHMARK_OUTPUT_FILE }} \
+            RUNNER_NAME=${{ inputs.runner_name }} \
+            METRICS_ENABLED=true
+        prometheus_push_url: ${{ inputs.prometheus-push-url }}
+        prometheus_username: ${{ inputs.prometheus-username }}
+        prometheus_password: ${{ inputs.prometheus-password }}
+        grafana_dashboard_id: 'Gl1I20mnk/c-chain'
+        runtime: "" # Set runtime input to empty string to disable log collection
+
+    - name: Compare Benchmark Results
+      uses: benchmark-action/github-action-benchmark@v1
+      with:
+        tool: 'go'
+        output-file-path: ${{ env.BENCHMARK_OUTPUT_FILE }}
+        summary-always: true
+        github-token: ${{ inputs.github-token }}
+        auto-push: ${{ inputs.push-github-action-benchmark }}
+
+    - uses: ./.github/actions/install-nix
+      if: ${{ inputs.push-post-state != '' }}
+    - name: Push Post-State to S3 (if not exists)
+      if: ${{ inputs.push-post-state != '' }}
+      shell: nix develop --command bash -x {0}
+      run: ./scripts/run_task.sh export-dir-to-s3 LOCAL_SRC=${{ env.EXECUTION_DATA_DIR }}/current-state/ S3_DST=${{ inputs.push-post-state }}

.github/actions/install-nix/action.yml

@@ -0,0 +1,17 @@
+name: 'Install nix'
+description: 'Install nix and populate the store for the repo flake'
+
+inputs:
+  github_token:
+    description: "github token to authenticate with to avoid being rate-limited"
+    default: ${{ github.token }}
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - uses: cachix/install-nix-action@02a151ada4993995686f9ed4f1be7cfbb229e56f #v31
+      with:
+        github_access_token: ${{ inputs.github_token }}
+    - run: nix develop --command echo "dependencies installed"
+      shell: bash

.github/actions/run-monitored-tmpnet-cmd/nix-develop.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ -f "flake.nix" ]]; then
+  echo "Starting nix shell for local flake"
+  FLAKE=
+else
+  echo "No local flake found, will attempt to use luxd flake"
+
+  # Get module details from go.mod
+  MODULE_DETAILS="$(go list -m "github.com/luxfi/node" 2>/dev/null)"
+
+  # Extract the version part
+  NODE_VERSION="$(echo "${MODULE_DETAILS}" | awk '{print $2}')"
+
+  if [[ -z "${NODE_VERSION}" ]]; then
+    echo "Failed to get luxd version from go.mod"
+    exit 1
+  fi
+
+  # Check if the version matches the pattern where the last part is the module hash
+  # v*YYYYMMDDHHMMSS-abcdef123456
+  #
+  # If not, the value is assumed to represent a tag
+  if [[ "${NODE_VERSION}" =~ ^v.*[0-9]{14}-[0-9a-f]{12}$ ]]; then
+    # Use the module hash as the version
+    NODE_VERSION="$(echo "${NODE_VERSION}" | cut -d'-' -f3)"
+  fi
+
+  FLAKE="github:luxfi/node?ref=${NODE_VERSION}"
+  echo "Starting nix shell for ${FLAKE}"
+fi
+
+nix develop "${FLAKE}" "${@}"

.github/actions/run-monitored-tmpnet-cmd/output-metrics-url.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Timestamps are in seconds
+from_timestamp="$(date '+%s')"
+monitoring_period=900 # 15 minutes
+to_timestamp="$((from_timestamp + monitoring_period))"
+
+# Grafana expects microseconds, so pad timestamps with 3 zeros
+metrics_url="${GRAFANA_URL}&var-filter=gh_job_id%7C%3D%7C${GH_JOB_ID}&from=${from_timestamp}000&to=${to_timestamp}000"
+
+# Optionally ensure that the link displays metrics only for the shared
+# network rather than mixing it with the results for private networks.
+if [[ -n "${FILTER_BY_OWNER:-}" ]]; then
+  metrics_url="${metrics_url}&var-filter=network_owner%7C%3D%7C${FILTER_BY_OWNER}"
+fi
+
+echo "${metrics_url}"

.github/actions/set-go-version-in-env/action.yml

@@ -14,3 +14,9 @@ runs:
       # the run statement runs into platform-specific path handling issues.
       run: .github/actions/set-go-version-in-env/go_version_env.sh >> $GITHUB_ENV
       shell: bash
+    - name: Set GOPRIVATE for luxfi packages
+      # Some luxfi packages have large zip files that exceed Go proxy limits
+      run: |
+        echo "GOPRIVATE=github.com/luxfi/*" >> $GITHUB_ENV
+        echo "GONOSUMDB=github.com/luxfi/*" >> $GITHUB_ENV
+      shell: bash

.github/actions/set-go-version-in-env/go_version_env.sh

@@ -9,6 +9,6 @@ set -euo pipefail
 # when go is already installed.
 
 # 3 directories above this script
-LUX_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../../.. && pwd )
+NODE_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../../.. && pwd )
 
-echo GO_VERSION="~$(sed -n -e 's/^go //p' "${LUX_PATH}"/go.mod)"
+echo GO_VERSION="~$(sed -n -e 's/^go //p' "${NODE_PATH}"/go.mod)"

.github/actions/setup-go-for-project/action.yml

@@ -13,11 +13,27 @@
 name: 'Install Go toolchain with project defaults'
 description: 'Install a go toolchain with project defaults'
 
+inputs:
+  github-token:
+    description: 'GitHub token for private repo access'
+    required: false
+    default: ''
+
 runs:
   using: composite
   steps:
     - name: Set the project Go version in the environment
       uses: ./.github/actions/set-go-version-in-env
+    - name: Set GOPRIVATE and GONOSUMDB for luxfi packages
+      shell: bash
+      run: |
+        echo "GOPRIVATE=github.com/luxfi/*" >> $GITHUB_ENV
+        echo "GONOSUMDB=github.com/luxfi/*" >> $GITHUB_ENV
+    - name: Configure git for private repo access
+      if: inputs.github-token != ''
+      shell: bash
+      run: |
+        git config --global url."https://x-access-token:${{ inputs.github-token }}@github.com/".insteadOf "https://github.com/"
     - name: Set up Go
       uses: actions/setup-go@v5
       with:

.github/labels.yml

@@ -0,0 +1,105 @@
+# Lifecycle labels
+- name: "DO NOT MERGE"
+  color: "ba1b48"
+  description: "This PR must not be merged in its current state"
+- name: "lifecycle/frozen"
+  color: "2476B2"
+- name: "lifecycle/stale"
+  color: "ededed"
+
+# General category labels
+- name: "bug"
+  color: "d73a4a"
+  description: "Something isn't working"
+- name: "documentation"
+  color: "0075ca"
+  description: "Improvements or additions to documentation or examples"
+- name: "enhancement"
+  color: "a2eeef"
+  description: "New feature or request"
+- name: "needs information"
+  color: "d876e3"
+  description: "Further information is needed"
+- name: "needs investigation"
+  color: "147F45"
+  description: "It is currently unclear if there is an issue"
+- name: "good first issue"
+  color: "7057ff"
+  description: "Good for newcomers"
+- name: "help wanted"
+  color: "008672"
+  description: "Looking for someone to address this"
+- name: "ci"
+  color: "e99695"
+  description: "This focuses on changes to the CI process"
+- name: "cleanup"
+  color: "BFD4F2"
+  description: "Code quality improvement"
+- name: "dependencies"
+  color: "0366d6"
+  description: "This primarily focuses on changing a dependency"
+- name: "testing"
+  color: "220233"
+  description: "This primarily focuses on testing"
+- name: "monitoring"
+  color: "97450A"
+  description: "This primarily focuses on logs, metrics, and/or tracing"
+- name: "incident response"
+  color: "BE3D15"
+- name: "github_actions"
+  color: "000000"
+  description: "Pull requests that update GitHub Actions code"
+- name: "go"
+  color: "16e2e2"
+  description: "Pull requests that update Go code"
+- name: "needs Go upgrade"
+  color: "16e2e2"
+  description: "This requires a minor upgrade of Go to be supported"
+
+# Luxd specific labels
+- name: "antithesis"
+  color: "1d76db"
+  description: "Related to an issue reported by Antithesis"
+- name: "bubble votes"
+  color: "3C9CDD"
+- name: "consensus"
+  color: "4444ff"
+  description: "This involves consensus"
+- name: "continuous staking"
+  color: "f9d0c4"
+- name: "gossiping upgrade"
+  color: "c2e0c6"
+- name: "merkledb"
+  color: "0e8a16"
+- name: "networking"
+  color: "88E841"
+  description: "This involves networking"
+- name: "sdk"
+  color: "72ED25"
+  description: "This involves SDK tooling or frameworks"
+- name: "storage"
+  color: "3F2A70"
+  description: "This involves storage primitives"
+- name: "Uptime Tracking"
+  color: "d4c5f9"
+- name: "vm"
+  color: "d1f7a0"
+  description: "This involves virtual machines"
+- name: "warp"
+  color: "4FC611"
+- name: "Warp Signature API"
+  color: "68A7EA"
+
+# LP labels
+- name: "lp103"
+  color: "AB2C58"
+- name: "lp113"
+  color: "3359BA"
+- name: "lp118"
+  color: "DFC715"
+- name: "lp125"
+  color: "bfdadc"
+- name: "lp20"
+  color: "DB7D37"
+- name: "lp77"
+  color: "45CDF2"

.github/packer/luxd-multicloud.pkr.hcl

@@ -0,0 +1,300 @@
+packer {
+  required_plugins {
+    amazon = {
+      source  = "github.com/hashicorp/amazon"
+      version = "~> 1"
+    }
+    googlecompute = {
+      source  = "github.com/hashicorp/googlecompute"
+      version = "~> 1"
+    }
+    azure = {
+      source  = "github.com/hashicorp/azure"
+      version = "~> 2"
+    }
+    ansible = {
+      source  = "github.com/hashicorp/ansible"
+      version = "~> 1"
+    }
+  }
+}
+
+# ============================================================================
+# Variables
+# ============================================================================
+
+variable "tag" {
+  type        = string
+  description = "Git tag/version to build"
+  default     = env("TAG")
+}
+
+variable "cloud" {
+  type        = string
+  description = "Target cloud: aws, gcp, azure, or all"
+  default     = env("CLOUD")
+}
+
+variable "skip_create_image" {
+  type    = bool
+  default = false
+}
+
+# AWS Variables
+variable "aws_region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "aws_instance_type" {
+  type    = string
+  default = "c5.large"
+}
+
+# GCP Variables
+variable "gcp_project_id" {
+  type    = string
+  default = env("GCP_PROJECT_ID")
+}
+
+variable "gcp_zone" {
+  type    = string
+  default = "us-central1-a"
+}
+
+variable "gcp_machine_type" {
+  type    = string
+  default = "n2-standard-2"
+}
+
+# Azure Variables
+variable "azure_subscription_id" {
+  type    = string
+  default = env("AZURE_SUBSCRIPTION_ID")
+}
+
+variable "azure_resource_group" {
+  type    = string
+  default = env("AZURE_RESOURCE_GROUP")
+}
+
+variable "azure_location" {
+  type    = string
+  default = "eastus"
+}
+
+variable "azure_vm_size" {
+  type    = string
+  default = "Standard_D2s_v3"
+}
+
+# ============================================================================
+# Locals
+# ============================================================================
+
+locals {
+  timestamp  = regex_replace(timestamp(), "[- TZ:]", "")
+  clean_name = regex_replace(var.tag, "[^a-zA-Z0-9-]", "-")
+  image_name = "luxd-ubuntu-22-04-${local.clean_name}-${local.timestamp}"
+
+  # Build targets based on cloud variable
+  build_aws   = var.cloud == "aws" || var.cloud == "all"
+  build_gcp   = var.cloud == "gcp" || var.cloud == "all"
+  build_azure = var.cloud == "azure" || var.cloud == "all"
+}
+
+# ============================================================================
+# Data Sources
+# ============================================================================
+
+# AWS - Find latest Ubuntu 22.04 AMI
+data "amazon-ami" "ubuntu" {
+  filters = {
+    architecture        = "x86_64"
+    name                = "ubuntu/images/*ubuntu-jammy-22.04-*-server-*"
+    root-device-type    = "ebs"
+    virtualization-type = "hvm"
+  }
+  most_recent = true
+  owners      = ["099720109477"]  # Canonical
+  region      = var.aws_region
+}
+
+# ============================================================================
+# Sources
+# ============================================================================
+
+# AWS EC2 AMI
+source "amazon-ebs" "luxd" {
+  ami_name        = local.image_name
+  ami_description = "Lux Network Node ${var.tag} - Ubuntu 22.04"
+  ami_groups      = ["all"]  # Make public
+  instance_type   = var.aws_instance_type
+  region          = var.aws_region
+  source_ami      = data.amazon-ami.ubuntu.id
+  ssh_username    = "ubuntu"
+  skip_create_ami = var.skip_create_image
+
+  ami_regions = [
+    "us-east-1",
+    "us-west-2",
+    "eu-west-1",
+    "eu-central-1",
+    "ap-southeast-1",
+    "ap-northeast-1"
+  ]
+
+  tags = {
+    Name        = local.image_name
+    Version     = var.tag
+    OS          = "Ubuntu 22.04"
+    Application = "luxd"
+    ManagedBy   = "Packer"
+  }
+
+  run_tags = {
+    Name = "packer-builder-luxd"
+  }
+}
+
+# GCP Compute Image
+source "googlecompute" "luxd" {
+  project_id          = var.gcp_project_id
+  zone                = var.gcp_zone
+  machine_type        = var.gcp_machine_type
+  source_image_family = "ubuntu-2204-lts"
+  ssh_username        = "ubuntu"
+  image_name          = local.image_name
+  image_description   = "Lux Network Node ${var.tag} - Ubuntu 22.04"
+  image_family        = "luxd"
+  skip_create_image   = var.skip_create_image
+
+  image_labels = {
+    version     = replace(lower(var.tag), ".", "-")
+    os          = "ubuntu-22-04"
+    application = "luxd"
+    managed-by  = "packer"
+  }
+
+  labels = {
+    name = "packer-builder-luxd"
+  }
+}
+
+# Azure Managed Image
+source "azure-arm" "luxd" {
+  subscription_id                   = var.azure_subscription_id
+  managed_image_resource_group_name = var.azure_resource_group
+  managed_image_name                = local.image_name
+
+  os_type         = "Linux"
+  image_publisher = "Canonical"
+  image_offer     = "0001-com-ubuntu-server-jammy"
+  image_sku       = "22_04-lts-gen2"
+  location        = var.azure_location
+  vm_size         = var.azure_vm_size
+
+  ssh_username = "ubuntu"
+
+  skip_create_image = var.skip_create_image
+
+  azure_tags = {
+    Name        = local.image_name
+    Version     = var.tag
+    OS          = "Ubuntu 22.04"
+    Application = "luxd"
+    ManagedBy   = "Packer"
+  }
+}
+
+# ============================================================================
+# Build
+# ============================================================================
+
+build {
+  name = "luxd"
+
+  # Conditionally include sources based on target cloud
+  dynamic "source" {
+    for_each = local.build_aws ? ["amazon-ebs.luxd"] : []
+    labels   = ["amazon-ebs.luxd"]
+    content {}
+  }
+
+  dynamic "source" {
+    for_each = local.build_gcp ? ["googlecompute.luxd"] : []
+    labels   = ["googlecompute.luxd"]
+    content {}
+  }
+
+  dynamic "source" {
+    for_each = local.build_azure ? ["azure-arm.luxd"] : []
+    labels   = ["azure-arm.luxd"]
+    content {}
+  }
+
+  # Wait for cloud-init to complete
+  provisioner "shell" {
+    inline = [
+      "echo 'Waiting for cloud-init to complete...'",
+      "while [ ! -f /var/lib/cloud/instance/boot-finished ]; do sleep 1; done",
+      "echo 'Cloud-init complete!'",
+      "echo 'Waiting for apt locks...'",
+      "while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do sleep 1; done",
+      "while fuser /var/lib/apt/lists/lock >/dev/null 2>&1; do sleep 1; done",
+      "echo 'APT ready!'"
+    ]
+  }
+
+  # Install base dependencies
+  provisioner "shell" {
+    inline = [
+      "sudo apt-get update",
+      "sudo apt-get install -y software-properties-common curl wget git jq",
+      "sudo add-apt-repository -y ppa:longsleep/golang-backports",
+      "sudo apt-get update",
+      "sudo apt-get install -y golang-go"
+    ]
+  }
+
+  # Use Ansible for main provisioning
+  provisioner "ansible" {
+    playbook_file   = ".github/packer/create_public_ami.yml"
+    roles_path      = ".github/packer/roles/"
+    use_proxy       = false
+    extra_arguments = [
+      "-e", "component=public-ami",
+      "-e", "build=packer",
+      "-e", "os_release=jammy",
+      "-e", "tag=${var.tag}"
+    ]
+  }
+
+  # Cleanup
+  provisioner "shell" {
+    execute_command = "sudo bash -x {{ .Path }}"
+    inline = [
+      "apt-get clean",
+      "rm -rf /var/lib/apt/lists/*",
+      "rm -rf /tmp/*",
+      "rm -rf /var/tmp/*",
+      "truncate -s 0 /var/log/*.log",
+      "history -c"
+    ]
+  }
+
+  # Azure specific: Deprovision
+  provisioner "shell" {
+    only = ["azure-arm.luxd"]
+    execute_command = "chmod +x {{ .Path }}; {{ .Vars }} sudo -E sh '{{ .Path }}'"
+    inline = [
+      "/usr/sbin/waagent -force -deprovision+user && export HISTSIZE=0 && sync"
+    ]
+    inline_shebang = "/bin/sh -x"
+  }
+
+  post-processor "manifest" {
+    output     = "packer-manifest.json"
+    strip_path = true
+  }
+}

.github/packer/roles/public-ami/tasks/main.yml

@@ -1,16 +1,16 @@
 - name: Setup gpg key
   apt_key:
-    url: https://downloads.lux.network/luxd.gpg.key
+    url: https://downloads.lux.network/node.gpg.key
     state: present
 
-- name: Setup luxd repo
+- name: Setup node repo
   apt_repository:
     repo: deb https://downloads.lux.network/apt jammy main
     state: present
 
 - name: Setup golang repo
   apt_repository:
-    repo: ppa:longsleep/golang-backports 
+    repo: ppa:longsleep/golang-backports
     state: present
 
 - name: Install go
@@ -28,55 +28,55 @@
 
 - name: Setup systemd
   template:
-    src: templates/luxd.service.j2
-    dest: /etc/systemd/system/luxd.service
+    src: templates/node.service.j2
+    dest: /etc/systemd/system/node.service
     mode: 0755
 
-- name: Create lux user
+- name: Create Lux user
   user:
     name: "{{ lux_user }}"
     shell: /bin/bash
     uid: "{{ lux_uid }}"
     group: "{{ lux_group }}"
 
-- name: Create lux config dir
+- name: Create Lux config dir
   file:
-    path: /etc/luxd
+    path: /etc/node
     owner: "{{ lux_user }}"
     group: "{{ lux_group }}"
     state: directory
 
-- name: Create lux log dir
+- name: Create Lux log dir
   file:
     path: "{{ log_dir }}"
     owner: "{{ lux_user }}"
     group: "{{ lux_group }}"
     state: directory
 
-- name: Create lux database dir
+- name: Create Lux database dir
   file:
     path: "{{ db_dir }}"
     owner: "{{ lux_user }}"
     group: "{{ lux_group }}"
     state: directory
 
-- name: Build luxd
+- name: Build node
   command: ./scripts/build.sh
   args:
     chdir: "{{ repo_folder }}"
 
-- name: Copy luxd binaries to the correct location
+- name: Copy node binaries to the correct location
   command: cp build/luxd /usr/local/bin/luxd
   args:
     chdir: "{{ repo_folder }}"
 
-- name: Configure lux 
+- name: Configure Lux
   template:
     src: templates/conf.json.j2
-    dest: /etc/luxd/conf.json
+    dest: /etc/node/conf.json
     mode: 0644
 
 - name: Enable Lux
   systemd:
-    name: luxd
+    name: node
     enabled: yes

.github/pull_request_template.md

@@ -3,3 +3,5 @@
 ## How this works
 
 ## How this was tested
+
+## Need to be documented in RELEASES.md?

.github/workflows/RELEASE_EXPLANATION.md

@@ -0,0 +1,478 @@
+# GitHub Actions Release Workflow - Technical Explanation
+
+## Overview
+
+This document explains the technical implementation of the automated release workflow for Lux Node.
+
+## Architecture
+
+### Workflow Design Philosophy
+
+The release workflow follows these principles:
+
+1. **Single Responsibility**: Each job does one thing well
+2. **Reusable Components**: Leverages existing build workflows as reusable components
+3. **Fail Fast**: Version validation happens first before any builds
+4. **Parallel Execution**: All platform builds run concurrently
+5. **Atomic Release**: All artifacts collected before release creation
+
+### Job Dependency Graph
+
+```
+┌──────────────────┐
+│ validate-version │ (30s)
+└────────┬─────────┘
+         │
+    ┌────┴────┬───────────┬──────────┐
+    │         │           │          │
+┌───▼────┐ ┌─▼─────┐ ┌───▼────┐ ┌──▼─────┐
+│ubuntu  │ │ubuntu │ │ macos  │ │windows │ (10-15 min each)
+│amd64   │ │arm64  │ │        │ │        │
+└───┬────┘ └─┬─────┘ └───┬────┘ └──┬─────┘
+    └────────┴───────────┴──────────┘
+                  │
+           ┌──────▼────────┐
+           │create-release │ (2-3 min)
+           └───────────────┘
+```
+
+**Total Time**: ~15-20 minutes (parallel builds are the bottleneck)
+
+## Job Details
+
+### 1. validate-version
+
+**Purpose**: Ensure semantic version is valid and < v2.0.0
+
+**Outputs**:
+- `version`: Version number without 'v' prefix (e.g., "1.20.1")
+- `is_prerelease`: Boolean indicating if version is pre-release
+
+**Logic**:
+```bash
+# Extract version from tag
+TAG="${GITHUB_REF#refs/tags/}"  # refs/tags/v1.20.1 → v1.20.1
+VERSION="${TAG#v}"               # v1.20.1 → 1.20.1
+
+# Validate major version
+MAJOR=$(echo "$VERSION" | cut -d. -f1)  # 1.20.1 → 1
+
+if [ "$MAJOR" -ge 2 ]; then
+    exit 1  # Fail workflow
+fi
+
+# Detect pre-release (contains - or +)
+if echo "$VERSION" | grep -qE '[-+]'; then
+    is_prerelease=true
+fi
+```
+
+**Why < v2.0.0?**
+
+Go modules semantics require v2+ to use versioned import paths:
+
+```go
+// v1.x.x (current)
+import "github.com/luxfi/node/vms"
+
+// v2.x.x would require:
+import "github.com/luxfi/node/v2/vms"
+```
+
+Enforcing v1.x.x prevents accidental breaking changes to import paths.
+
+### 2. build-* Jobs
+
+**Pattern**: Uses `uses: ./.github/workflows/build-*-release.yml`
+
+**Why Reusable Workflows?**
+- DRY principle: Don't duplicate build logic
+- Maintainability: Update build logic in one place
+- Consistency: Same build process for manual and automated releases
+
+**Secrets Inheritance**:
+```yaml
+secrets: inherit
+```
+
+Passes all repository secrets to reusable workflows (AWS credentials, S3 buckets, etc.)
+
+**Input Passing**:
+```yaml
+with:
+  tag: ${{ needs.validate-version.outputs.version }}
+```
+
+Some workflows accept tag as input for artifact naming.
+
+### 3. create-release
+
+**Purpose**: Collect all artifacts and create GitHub Release
+
+**Steps**:
+
+#### a. Download Artifacts
+
+```yaml
+uses: actions/download-artifact@v4
+with:
+  path: ./artifacts
+```
+
+**Result**: All build artifacts downloaded to `./artifacts/`
+
+**Directory Structure**:
+```
+./artifacts/
+├── jammy/
+│   └── luxd-v1.20.1-amd64.deb
+├── focal/
+│   └── luxd-v1.20.1-amd64.deb
+└── build/
+    └── luxd-macos-v1.20.1.zip
+```
+
+#### b. Organize Files
+
+Copies all artifacts to `./release/` directory with flat structure.
+
+**Why Flatten?**
+- Simpler asset URLs
+- Easier for users to find files
+- Consistent naming across platforms
+
+#### c. Generate Checksums
+
+```bash
+cd ./release
+sha256sum * > SHA256SUMS
+```
+
+**Format**:
+```
+a1b2c3d4... luxd-v1.20.1-amd64.deb
+e5f6g7h8... luxd-macos-v1.20.1.zip
+```
+
+**User Verification**:
+```bash
+# Download file and checksums
+curl -LO <file-url>
+curl -LO <checksums-url>
+
+# Verify
+grep <filename> SHA256SUMS | sha256sum -c
+```
+
+#### d. Generate Changelog
+
+Uses git log between previous tag and current:
+
+```bash
+PREV_TAG=$(git describe --tags --abbrev=0 HEAD^)
+git log --pretty=format:"- %s (%h)" ${PREV_TAG}..HEAD
+```
+
+**Output Format**:
+```markdown
+## What's Changed
+
+- Add new feature X (abc123)
+- Fix bug in Y component (def456)
+- Update dependencies (ghi789)
+
+**Full Changelog**: https://github.com/luxfi/node/compare/v1.20.0...v1.20.1
+```
+
+#### e. Create Release
+
+Uses `gh` CLI for release creation:
+
+```bash
+gh release create "v1.20.1" \
+  ./release/* \
+  --title "Lux Node v1.20.1" \
+  --notes-file CHANGELOG.md \
+  --latest  # or --prerelease for pre-releases
+```
+
+**Why gh CLI?**
+- Official GitHub tool
+- Handles authentication automatically
+- Simpler than REST API
+- Uploads all files in one command
+
+## Workflow Triggers
+
+### Tag Pattern Matching
+
+```yaml
+on:
+  push:
+    tags:
+      - 'v[0-1].*.*'
+```
+
+**Pattern Breakdown**:
+- `v` - Literal 'v' character
+- `[0-1]` - Major version 0 or 1
+- `.*` - Any minor version
+- `.*` - Any patch version
+
+**Matches**:
+- ✅ `v1.0.0` (first release)
+- ✅ `v1.20.1` (production release)
+- ✅ `v1.99.999` (high version numbers)
+- ✅ `v1.20.1-rc.1` (release candidate)
+- ✅ `v1.20.1+build.123` (build metadata)
+
+**Rejects**:
+- ❌ `v2.0.0` (major version 2)
+- ❌ `v3.1.0` (major version 3)
+- ❌ `1.20.1` (missing 'v' prefix)
+- ❌ `version-1.20.1` (wrong format)
+
+## Pre-release Detection
+
+**Logic**:
+```bash
+if echo "$VERSION" | grep -qE '[-+]'; then
+    is_prerelease=true
+fi
+```
+
+**Semantic Versioning**:
+- `-` indicates pre-release: `1.20.1-rc.1`, `1.20.1-beta.2`
+- `+` indicates build metadata: `1.20.1+build.123`
+
+**GitHub Behavior**:
+- Pre-releases: Shown with "Pre-release" badge, not marked as "Latest"
+- Stable releases: Shown with "Latest release" badge
+
+## Artifact Naming Conventions
+
+Each platform has its own naming scheme:
+
+| Platform | Pattern | Example |
+|----------|---------|---------|
+| Ubuntu AMD64 | `luxd-{version}-amd64.deb` | `luxd-v1.20.1-amd64.deb` |
+| Ubuntu ARM64 | `luxd-{version}-arm64.deb` | `luxd-v1.20.1-arm64.deb` |
+| macOS | `luxd-macos-{version}.zip` | `luxd-macos-v1.20.1.zip` |
+| Windows | `node-win-{version}.zip` | `node-win-v1.20.1.zip` |
+
+**Why Different Patterns?**
+- Historical convention from existing build scripts
+- Platform-specific package managers expect different formats
+- Windows uses `node` instead of `luxd` (legacy naming)
+
+## Error Handling
+
+### Build Failure
+
+**Scenario**: One platform build fails
+
+**Behavior**:
+- `create-release` job never runs (depends on all builds)
+- Workflow marked as failed
+- No partial release created
+
+**Recovery**:
+1. Fix build issue
+2. Delete failed tag: `git tag -d v1.20.1 && git push --delete origin v1.20.1`
+3. Re-tag and push
+
+### Partial Artifact Collection
+
+**Scenario**: Some artifacts missing during collection
+
+**Behavior**:
+- `Organize release files` step silently skips missing files (`|| true`)
+- Release created with available artifacts
+- Missing platforms will have no binary attached
+
+**Detection**:
+- Check `Release summary` in job output
+- Verify all expected platforms in asset list
+
+**Recovery**:
+1. Identify which build workflow failed
+2. Fix workflow
+3. Manually trigger failed workflow with same tag
+4. Download new artifacts
+5. Upload to existing release: `gh release upload v1.20.1 <file>`
+
+## Performance Optimization
+
+### Parallel Builds
+
+All platform builds run simultaneously:
+
+```yaml
+build-ubuntu-amd64:
+  needs: validate-version
+  # ...
+
+build-ubuntu-arm64:
+  needs: validate-version
+  # ...
+
+# All depend only on validate-version, not each other
+```
+
+**Time Savings**:
+- Sequential: ~60 minutes (4 platforms × 15 min each)
+- Parallel: ~15 minutes (longest build time)
+- **Improvement**: 75% faster
+
+### Shallow Checkout
+
+Most jobs use default shallow checkout (depth=1):
+```yaml
+- uses: actions/checkout@v4
+```
+
+**Exception**: `create-release` job needs full history for changelog:
+```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0
+```
+
+## Security Considerations
+
+### Minimal Permissions
+
+```yaml
+permissions:
+  contents: write    # Create releases, upload assets
+  id-token: write    # OIDC for AWS authentication
+```
+
+**Not Granted**:
+- `actions: write` - Cannot modify workflows
+- `packages: write` - Cannot publish packages
+- `issues: write` - Cannot create issues
+
+### Secret Handling
+
+All secrets passed via `secrets: inherit`:
+
+```yaml
+build-ubuntu-amd64:
+  secrets: inherit  # Passes AWS_DEPLOY_SA_ROLE_ARN, BUCKET
+```
+
+**Best Practice**: Never log secrets, never use in conditionals
+
+### Checksum Verification
+
+Forces users to verify downloads:
+
+```bash
+# Generate checksums
+sha256sum * > SHA256SUMS
+
+# Users verify with:
+sha256sum -c SHA256SUMS
+```
+
+## Testing Strategy
+
+### Manual Test Tag
+
+Create test release without polluting real releases:
+
+```bash
+# Use version with "test" keyword
+git tag -a v1.99.99-test -m "Test release workflow"
+git push origin v1.99.99-test
+
+# Monitor: https://github.com/luxfi/node/actions
+
+# Cleanup after testing
+git push --delete origin v1.99.99-test
+git tag -d v1.99.99-test
+gh release delete v1.99.99-test --yes
+```
+
+### Automated Test Script
+
+Use included test script:
+
+```bash
+./scripts/test-release-workflow.sh 1.99.99-test
+```
+
+**Script Features**:
+- Version validation
+- Git cleanliness check
+- Tag conflict detection
+- Workflow monitoring
+- Automatic cleanup
+
+## Debugging
+
+### Enable Debug Logging
+
+Add to workflow:
+
+```yaml
+env:
+  ACTIONS_STEP_DEBUG: true
+  ACTIONS_RUNNER_DEBUG: true
+```
+
+### Check Job Logs
+
+1. Visit workflow run: https://github.com/luxfi/node/actions/workflows/release.yml
+2. Click specific run
+3. Expand failed job
+4. Read error messages
+
+### Common Issues
+
+**Issue**: "Resource not accessible by integration"
+- **Cause**: Missing `contents: write` permission
+- **Fix**: Add permission to workflow
+
+**Issue**: "Unable to download artifact"
+- **Cause**: Artifact name mismatch
+- **Fix**: Check `upload-artifact` name in build workflow
+
+**Issue**: "gh: command not found"
+- **Cause**: GitHub CLI not installed in runner
+- **Fix**: Add `- uses: cli/gh-action@v2` or use gh CLI pre-installed
+
+## Future Enhancements
+
+### Potential Improvements
+
+1. **Docker Image Publishing**: Add Docker build job
+2. **Homebrew Formula Update**: Auto-update brew formula
+3. **Release Notes Template**: Use `.github/release-template.md`
+4. **Asset Signing**: GPG sign all binaries
+5. **Download Stats**: Track download metrics
+6. **Auto-changelog**: Generate from commit conventions
+7. **Slack Notification**: Notify team on release
+8. **Rollback Support**: Tag previous version as latest if needed
+
+### Metrics to Track
+
+- Build time per platform
+- Artifact size trends
+- Download counts per platform
+- Release frequency
+- Time to production
+
+## References
+
+- [GitHub Actions Workflow Syntax](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions)
+- [Reusable Workflows](https://docs.github.com/en/actions/using-workflows/reusing-workflows)
+- [GitHub Releases](https://docs.github.com/en/repositories/releasing-projects-on-github)
+- [Semantic Versioning](https://semver.org/)
+- [Go Module Version Numbering](https://go.dev/doc/modules/version-numbers)
+
+---
+
+**Last Updated**: 2025-11-12
+**Maintainer**: Lux DevOps Team

.github/workflows/RELEASE_WORKFLOW.md

@@ -0,0 +1,309 @@
+# Release Workflow Documentation
+
+## Overview
+
+The `release.yml` workflow automates building and publishing Lux Node binaries for all platforms when semantic version tags are pushed.
+
+## Workflow Architecture
+
+### 1. Trigger Mechanism
+
+**Tag Pattern**: `v[0-1].*.*`
+- ✅ Accepts: `v1.0.0`, `v1.20.1`, `v1.999.999`, `v1.20.1-rc.1`
+- ❌ Rejects: `v2.0.0`, `v2.1.0`, `v3.0.0` (requires `/v2` import path per Go modules)
+
+**Rationale**: Go modules require major version 2+ to use `/v2`, `/v3` etc. in import paths. Since Lux uses `github.com/luxfi/node` (no version suffix), we enforce v1.x.x only.
+
+### 2. Job Flow
+
+```
+validate-version (validates tag < v2.0.0)
+    ├─> build-ubuntu-amd64 ───┐
+    ├─> build-ubuntu-arm64 ───┤
+    ├─> build-macos ──────────┼──> create-release (combines all artifacts)
+    └─> build-windows ────────┘
+```
+
+### 3. Platform Builds
+
+Uses **reusable workflows** (existing build-*-release.yml files):
+
+| Platform | Workflow | Artifact Name | Binary Format |
+|----------|----------|---------------|---------------|
+| Linux AMD64 (Ubuntu 22.04) | `build-ubuntu-amd64-release.yml` | `jammy` | `.deb` package |
+| Linux AMD64 (Ubuntu 20.04) | `build-ubuntu-amd64-release.yml` | `focal` | `.deb` package |
+| Linux ARM64 (Ubuntu 22.04) | `build-ubuntu-arm64-release.yml` | `jammy` | `.deb` package |
+| Linux ARM64 (Ubuntu 20.04) | `build-ubuntu-arm64-release.yml` | `focal` | `.deb` package |
+| macOS (Universal) | `build-macos-release.yml` | `build` | `.zip` archive |
+| Windows AMD64 | `build-win-release.yml` | Various | `.exe` or `.zip` |
+
+### 4. Release Creation
+
+**GitHub Release includes**:
+- All platform binaries
+- `SHA256SUMS` checksum file
+- Auto-generated changelog (git log since previous tag)
+- Pre-release flag (if version contains `-` or `+`)
+- "Latest" badge (for stable releases only)
+
+## Usage
+
+### Creating a Release
+
+1. **Tag the commit**:
+   ```bash
+   git tag -a v1.20.1 -m "Release v1.20.1"
+   git push origin v1.20.1
+   ```
+
+2. **Monitor workflow**:
+   - Visit: https://github.com/luxfi/node/actions/workflows/release.yml
+   - Watch all build jobs complete (typically 15-20 minutes)
+
+3. **Verify release**:
+   - Visit: https://github.com/luxfi/node/releases
+   - Check all platform binaries are attached
+   - Verify SHA256SUMS file
+
+### Pre-release Creation
+
+For release candidates or beta versions:
+
+```bash
+git tag -a v1.20.1-rc.1 -m "Release Candidate 1 for v1.20.1"
+git push origin v1.20.1-rc.1
+```
+
+**Behavior**:
+- Creates GitHub Release with "Pre-release" badge
+- Does NOT mark as "Latest"
+- Changelog includes "(Pre-release)" note
+
+### Deleting a Failed Release
+
+If a release fails and needs to be retried:
+
+```bash
+# Delete remote tag
+git push --delete origin v1.20.1
+
+# Delete local tag
+git tag -d v1.20.1
+
+# Delete GitHub Release (via web UI or gh CLI)
+gh release delete v1.20.1 --yes
+
+# Fix issues, then re-tag and push
+git tag -a v1.20.1 -m "Release v1.20.1"
+git push origin v1.20.1
+```
+
+## Testing the Workflow
+
+### Dry Run (Test Tag)
+
+Create a test tag to verify workflow without publishing:
+
+```bash
+# Create test tag locally
+git tag -a v1.99.99-test -m "Test release workflow"
+
+# Push to remote (triggers workflow)
+git push origin v1.99.99-test
+
+# After testing, clean up
+git push --delete origin v1.99.99-test
+git tag -d v1.99.99-test
+gh release delete v1.99.99-test --yes
+```
+
+### Local Validation
+
+Test semver validation logic locally:
+
+```bash
+# Test valid versions
+for ver in 1.0.0 1.20.1 1.999.999 "1.20.1-rc.1"; do
+    MAJOR=$(echo "$ver" | cut -d. -f1)
+    if [ "$MAJOR" -ge 2 ]; then
+        echo "✗ v${ver}: REJECT"
+    else
+        echo "✓ v${ver}: ACCEPT"
+    fi
+done
+
+# Test invalid versions
+for ver in 2.0.0 2.1.0 3.0.0; do
+    MAJOR=$(echo "$ver" | cut -d. -f1)
+    if [ "$MAJOR" -ge 2 ]; then
+        echo "✓ v${ver}: REJECT (correct)"
+    else
+        echo "✗ v${ver}: ACCEPT (should reject)"
+    fi
+done
+```
+
+## Troubleshooting
+
+### Issue: "Version >= v2.0.0" Error
+
+**Cause**: Attempted to tag v2.x.x or higher
+
+**Solution**: Use v1.x.x versions only. For v2+, update import paths to `github.com/luxfi/node/v2` throughout codebase first.
+
+### Issue: Build Workflow Fails
+
+**Symptoms**: `create-release` job never runs
+
+**Diagnosis**:
+1. Check individual build job logs
+2. Common issues:
+   - AWS credentials expired (check secrets)
+   - Build script failures (check `./scripts/run_task.sh build`)
+   - Dependency resolution issues
+
+**Solution**:
+1. Fix build issues in individual workflow
+2. Delete failed release tag
+3. Re-tag and push
+
+### Issue: Missing Artifacts
+
+**Symptoms**: Some platform binaries not attached to release
+
+**Diagnosis**:
+1. Check `Download all artifacts` step in `create-release` job
+2. Verify artifact names match expected patterns
+
+**Solution**:
+1. Update `Organize release files` step to match actual artifact structure
+2. Check individual build workflows upload artifacts correctly
+
+### Issue: Changelog Empty
+
+**Symptoms**: Release notes say "Initial Release" but previous tags exist
+
+**Cause**: Shallow git checkout (missing history)
+
+**Solution**: Workflow uses `fetch-depth: 0` to fetch full history. If issue persists:
+1. Check git repository configuration
+2. Verify previous tags are pushed to remote
+
+## Security Considerations
+
+### Permissions
+
+Workflow requires minimal permissions:
+- `contents: write` - Create releases and upload assets
+- `id-token: write` - AWS OIDC authentication (for build workflows)
+
+### Secrets Required
+
+All secrets inherited from repository settings:
+- `AWS_DEPLOY_SA_ROLE_ARN` - AWS role for S3 uploads (build workflows)
+- `BUCKET` - S3 bucket name (build workflows)
+- `GITHUB_TOKEN` - Automatically provided by GitHub Actions
+
+### Checksum Verification
+
+Users can verify downloads:
+
+```bash
+# Download release binary and SHA256SUMS
+curl -LO https://github.com/luxfi/node/releases/download/v1.20.1/luxd-macos-v1.20.1.zip
+curl -LO https://github.com/luxfi/node/releases/download/v1.20.1/SHA256SUMS
+
+# Verify checksum
+grep luxd-macos-v1.20.1.zip SHA256SUMS | sha256sum -c
+```
+
+## Workflow Outputs
+
+### GitHub Release
+
+**URL Format**: `https://github.com/luxfi/node/releases/tag/v{VERSION}`
+
+**Contains**:
+- Release title: "Lux Node v{VERSION}"
+- Changelog: Auto-generated from git commits
+- Assets:
+  - `luxd-{version}-amd64.deb` (Ubuntu 22.04)
+  - `luxd-{version}-amd64.deb` (Ubuntu 20.04)
+  - `luxd-{version}-arm64.deb` (Ubuntu 22.04)
+  - `luxd-{version}-arm64.deb` (Ubuntu 20.04)
+  - `luxd-macos-{version}.zip`
+  - `node-win-{version}.zip` or `.exe`
+  - `SHA256SUMS`
+
+### Job Summary
+
+GitHub Actions summary page shows:
+- Release version
+- Platform artifact table (file names, sizes)
+- SHA256 checksums
+- Link to release page
+
+## Maintenance
+
+### Adding New Platforms
+
+To add a new platform (e.g., FreeBSD):
+
+1. Create new build workflow: `.github/workflows/build-freebsd-release.yml`
+2. Add job to `release.yml`:
+   ```yaml
+   build-freebsd:
+     needs: validate-version
+     uses: ./.github/workflows/build-freebsd-release.yml
+     secrets: inherit
+   ```
+3. Update `create-release` job dependencies:
+   ```yaml
+   needs:
+     - validate-version
+     - build-ubuntu-amd64
+     - build-ubuntu-arm64
+     - build-macos
+     - build-windows
+     - build-freebsd  # Add here
+   ```
+4. Update artifact collection logic in `Organize release files` step
+
+### Updating Changelog Format
+
+Edit the `Generate changelog` step:
+
+```yaml
+- name: Generate changelog
+  run: |
+    # Custom changelog format
+    git log --pretty=format:"- **%s** by @%an (%h)" ${PREV_TAG}..HEAD > CHANGELOG.md
+```
+
+### Customizing Release Title
+
+Edit the `Create GitHub Release` step:
+
+```yaml
+FLAGS="--title \"Lux Network Node ${TAG} - Codename XYZ\""
+```
+
+## Related Documentation
+
+- [GitHub Actions Documentation](https://docs.github.com/en/actions)
+- [Semantic Versioning](https://semver.org/)
+- [Go Modules Version Numbering](https://go.dev/doc/modules/version-numbers)
+- [GitHub CLI Release Documentation](https://cli.github.com/manual/gh_release_create)
+
+## Support
+
+For issues with the release workflow:
+1. Check GitHub Actions logs
+2. Review this documentation
+3. Open issue with `ci` label
+4. Contact DevOps team
+
+---
+
+**Last Updated**: 2025-11-12
+**Maintainer**: Lux DevOps Team

.github/workflows/amichange.json

@@ -1,42 +0,0 @@
-{
-  "Version": {
-    "VersionTitle": "",
-    "ReleaseNotes": "Automated latest node release"
-  },
-  "DeliveryOptions": [
-    {
-      "Details": {
-        "AmiDeliveryOptionDetails": {
-          "AmiSource": {
-            "AmiId": "",
-            "AccessRoleArn": "",
-            "UserName": "ubuntu",
-            "OperatingSystemName": "UBUNTU",
-            "OperatingSystemVersion": "Ubuntu 22.04"
-          },
-          "UsageInstructions": "Connect via SSH and you can make local calls to port 9650",
-          "RecommendedInstanceType": "c5.2xlarge",
-          "SecurityGroups": [
-            {
-              "IpProtocol": "tcp",
-              "FromPort": 9651,
-              "ToPort": 9651,
-              "IpRanges": [
-                "0.0.0.0/0"
-              ]
-            },
-            {
-              "IpProtocol": "tcp",
-              "FromPort": 22,
-              "ToPort": 22,
-              "IpRanges": [
-                "0.0.0.0/0"
-              ]
-            }
-          ]
-        }
-      }
-    }
-  ]
-}
-

.github/workflows/buf-lint.yml

@@ -0,0 +1,34 @@
+name: Lint proto files
+
+on:
+  push:
+    paths:
+      - 'proto/**/*.proto'
+      - '.github/workflows/buf-lint.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  buf-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check for .proto files
+        id: proto-check
+        run: |
+          if find proto -name '*.proto' -type f 2>/dev/null | grep -q .; then
+            echo "has_proto=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_proto=false" >> $GITHUB_OUTPUT
+            echo "No .proto files found — skipping buf-lint (node is ZAP-native by default; protobuf is opt-in)."
+          fi
+      - uses: bufbuild/buf-setup-action@v1
+        if: steps.proto-check.outputs.has_proto == 'true'
+        with:
+          github_token: ${{ github.token }}
+          version: "1.47.2"
+      - uses: bufbuild/buf-lint-action@v1
+        if: steps.proto-check.outputs.has_proto == 'true'
+        with:
+          input: "proto"

.github/workflows/buf-push.yml

@@ -2,11 +2,8 @@ name: buf-push
 
 on:
   push:
-    tags:
-      - "*"
     branches:
-      - master
-      - dev
+      - main
     paths:
       - "proto/**"
 

.github/workflows/build-and-test-mac-windows.yml

@@ -0,0 +1,35 @@
+name: Build + Test Mac-Windows
+
+on:
+  push:
+    tags:
+      - "*" # Push events to every tag
+    branches:
+      - main
+      - dev
+      - master
+
+jobs:
+  run_build_tests:
+    name: build_tests
+    runs-on: ${{ matrix.os }}
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      CGO_ENABLED: "0"
+      GOWORK: off
+    strategy:
+      matrix:
+        # `macos-latest` currently resolves to GH-hosted arm64 macos (forbidden);
+        # pin to `macos-13` (amd64). darwin/arm64 coverage lives in
+        # build-macos-release.yml via cross-compile.
+        os: [windows-latest, macos-13]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: build_test
+        shell: bash
+        run: .github/workflows/build_and_test.sh

.github/workflows/build-and-test.yml

@@ -1,21 +0,0 @@
-name: Build + Unit Tests
-
-on:
-  push:
-
-jobs:
-  run_build_unit_tests:
-    name: build_unit_test
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [macos-12, ubuntu-20.04, ubuntu-22.04, windows-latest, [self-hosted, linux, ARM64, focal],[self-hosted, linux, ARM64, jammy]]
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
-        with:
-          go-version: '1.24.5'
-          check-latest: true
-      - name: build_test
-        shell: bash
-        run: .github/workflows/build_and_test.sh

.github/workflows/build-deb-pkg.sh

@@ -3,16 +3,16 @@
 set -euo pipefail
 
 DEBIAN_BASE_DIR=$PKG_ROOT/debian
-LUX_BUILD_BIN_DIR=$DEBIAN_BASE_DIR/usr/local/bin
+LUXD_BUILD_BIN_DIR=$DEBIAN_BASE_DIR/usr/local/bin
 TEMPLATE=.github/workflows/debian/template
 DEBIAN_CONF=$DEBIAN_BASE_DIR/DEBIAN
 
 mkdir -p "$DEBIAN_BASE_DIR"
 mkdir -p "$DEBIAN_CONF"
-mkdir -p "$LUX_BUILD_BIN_DIR"
+mkdir -p "$LUXD_BUILD_BIN_DIR"
 
 # Assume binaries are at default locations
-OK=$(cp ./build/luxd "$LUX_BUILD_BIN_DIR")
+OK=$(cp ./build/luxd "$LUXD_BUILD_BIN_DIR")
 if [[ $OK -ne 0 ]]; then
   exit "$OK";
 fi
@@ -34,4 +34,8 @@ NEW_ARCH_STRING="Architecture: $ARCH"
 sed -i "s/Version.*/$NEW_VERSION_STRING/g" debian/DEBIAN/control
 sed -i "s/Architecture.*/$NEW_ARCH_STRING/g" debian/DEBIAN/control
 dpkg-deb --build debian "luxd-$TAG-$ARCH.deb"
-aws s3 cp "luxd-$TAG-$ARCH.deb" "s3://${BUCKET}/linux/debs/ubuntu/$RELEASE/$ARCH/"
+
+# Upload to S3 if BUCKET is set (optional)
+if [[ -n "${BUCKET:-}" ]]; then
+  aws s3 cp "luxd-$TAG-$ARCH.deb" "s3://${BUCKET}/linux/debs/ubuntu/$RELEASE/$ARCH/" || echo "Warning: S3 upload failed (credentials may not be configured)"
+fi

.github/workflows/build-linux-binaries.yml

@@ -6,13 +6,19 @@ on:
       tag:
         description: 'Tag to include in artifact name'
         required: true
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+        type: string
   push:
     tags:
       - "*"
 
 jobs:
   build-x86_64-binaries-tarball:
-    runs-on: ubuntu-22.04
+    runs-on: [self-hosted, linux, amd64]
     permissions:
       id-token: write
       contents: read
@@ -25,17 +31,7 @@ jobs:
       - run: go version
 
       - name: Build the luxd binaries
-        run: ./scripts/run_task.sh build
-
-      - name: Install aws cli
-        run: sudo snap install aws-cli --classic
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
+        run: CGO_ENABLED=0 ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -61,18 +57,18 @@ jobs:
           RELEASE: "jammy"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: amd64
-          path: /tmp/luxd/luxd-linux-amd64-${{ env.TAG }}.tar.gz
+          path: ${{ github.workspace }}/luxd-pkg/node-linux-amd64-${{ env.TAG }}.tar.gz
 
       - name: Cleanup
         run: |
           rm -rf ./build
-          rm -rf /tmp/luxd
+          rm -rf ${{ github.workspace }}/luxd-pkg
 
   build-arm64-binaries-tarball:
-    runs-on: custom-arm64-jammy
+    runs-on: [self-hosted, linux, amd64]
     permissions:
       id-token: write
       contents: read
@@ -84,18 +80,8 @@ jobs:
 
       - run: go version
 
-      - name: Build the luxd binaries
-        run: ./scripts/run_task.sh build
-
-      - name: Install aws cli
-        run: sudo snap install aws-cli --classic
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -121,12 +107,12 @@ jobs:
           RELEASE: "jammy"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: arm64
-          path: /tmp/luxd/luxd-linux-arm64-${{ env.TAG }}.tar.gz
+          path: ${{ github.workspace }}/luxd-pkg/node-linux-arm64-${{ env.TAG }}.tar.gz
 
       - name: Cleanup
         run: |
           rm -rf ./build
-          rm -rf /tmp/luxd
+          rm -rf ${{ github.workspace }}/luxd-pkg

.github/workflows/build-macos-release.yml

@@ -1,20 +1,40 @@
-# Build a macos release from the node repo
+# Build a macos release from the luxd repo
 
 name: build-macos-release
 
 # Controls when the action will run.
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+        type: string
   push:
     tags:
       - "*"
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build"
+  # Cross-compile both darwin/amd64 and darwin/arm64 from Linux. The build
+  # uses CGO_ENABLED=0 + GOOS=darwin GOARCH=$arch — pure Go, no Darwin
+  # toolchain required. We run on the self-hosted `lux-build` ARC pool
+  # rather than `macos-13` (which has long GitHub-hosted queues) to keep
+  # the release pipeline unblocked.
   build-mac:
-    # The type of runner that the job will run on
-    runs-on: macos-12
+    strategy:
+      fail-fast: false
+      matrix:
+        goarch: [amd64, arm64]
+    runs-on: [self-hosted, linux, amd64]
+    permissions:
+      id-token: write
+      contents: read
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
@@ -24,8 +44,8 @@ jobs:
       - run: go version
 
       # Runs a single command using the runners shell
-      - name: Build the node binary
-        run: ./scripts/build.sh
+      - name: Build the luxd binary (cross-compile via GOOS/GOARCH)
+        run: CGO_ENABLED=0 GOOS=darwin GOARCH=${{ matrix.goarch }} ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -41,38 +61,22 @@ jobs:
           echo "TAG=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
         shell: bash
 
-      - name: Create zip file
-        run: 7z a "luxd-macos-${TAG}.zip" build/luxd
+      - name: Create zip file with CLI-compatible naming
+        run: |
+          # CLI expects: node-macos-{arch}-{version}.zip containing build/luxd
+          mkdir -p build
+          if ! command -v zip >/dev/null 2>&1; then
+            sudo apt-get update && sudo apt-get install -y zip
+          fi
+          zip "node-macos-${{ matrix.goarch }}-${TAG}.zip" build/luxd
         env:
           TAG: ${{ env.TAG }}
 
-      - name: Install aws cli
-        run: |
-          curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
-          sudo installer -pkg AWSCLIV2.pkg -target /
-
-      - name: Create zip file
-        run: 7z a node-macos-${VERSION}.zip build/luxd
-        env:
-          VERSION: ${{ env.VERSION }}
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-
-      - name: Upload file to S3
-        run: aws s3 cp node-macos-${VERSION}.zip s3://${BUCKET}/macos/
-        env:
-          BUCKET: ${{ secrets.BUCKET }}
-
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: build
-          path: luxd-macos-${{ env.TAG }}.zip
+          name: build-darwin-${{ matrix.goarch }}
+          path: node-macos-${{ matrix.goarch }}-${{ env.TAG }}.zip
 
       - name: Cleanup
         run: |

.github/workflows/build-public-ami.yml

@@ -1,77 +0,0 @@
-name: build-public-ami
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to create AMI from'
-        required: true
-  push:
-    tags:
-      - "*"
-
-env:
-  PACKER_VERSION: "1.10.2"
-  PYTHON3_BOTO3_VERSION: "1.20.34+dfsg-1"
-
-jobs:
-  build-public-ami-and-upload:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 45
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - run: go version
-
-      - name: Install aws cli
-        run: |
-          sudo apt update
-          sudo apt-get -y install python3-boto3="${PYTHON3_BOTO3_VERSION}"
-
-      - name: Get the tag
-        id: get_tag
-        run: |
-          if [[ ${{ github.event_name }} == 'push' ]];
-          then
-            echo "TAG=${GITHUB_REF/refs\/tags\//}" >> "$GITHUB_ENV"
-          else
-            echo "TAG=${{ inputs.tag }}" >> "$GITHUB_ENV"
-          fi
-        shell: bash
-
-      - name: Set whether to skip ami creation in packer
-        run: |
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            echo "Setting SKIP_CREATE_AMI to False"
-            echo "SKIP_CREATE_AMI=False" >> "$GITHUB_ENV"
-          fi
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.MARKETPLACE_ID }}
-          aws-secret-access-key: ${{ secrets.MARKETPLACE_KEY }}
-          aws-region: us-east-1
-
-      - name: Setup `packer`
-        uses: hashicorp/setup-packer@main
-        id: setup
-        with:
-          version: ${{ env.PACKER_VERSION }}
-
-      - name: Run `packer init`
-        id: init
-        run: "packer init ./.github/packer/ubuntu-jammy-x86_64-public-ami.pkr.hcl"
-
-      - name: Run `packer validate`
-        id: validate
-        run: "packer validate ./.github/packer/ubuntu-jammy-x86_64-public-ami.pkr.hcl"
-
-      - name: Create AMI and upload to marketplace
-        run: |
-          ./.github/workflows/update-ami.py
-        env:
-          TAG: ${{ env.TAG }}
-          PRODUCT_ID: ${{ secrets.MARKETPLACE_PRODUCT }}
-          ROLE_ARN: ${{ secrets.MARKETPLACE_ROLE }}

.github/workflows/build-rpm-pkg.sh

@@ -1,25 +0,0 @@
-PKG_ROOT=/tmp/node
-RPM_BASE_DIR=$PKG_ROOT/yum
-LUX_BUILD_BIN_DIR=$RPM_BASE_DIR/usr/local/bin
-LUX_LIB_DIR=$RPM_BASE_DIR/usr/local/lib/node
-
-mkdir -p $RPM_BASE_DIR
-mkdir -p $LUX_BUILD_BIN_DIR
-mkdir -p $LUX_LIB_DIR
-
-OK=`cp ./build/luxd $LUX_BUILD_BIN_DIR`
-if [[ $OK -ne 0 ]]; then
-  exit $OK;
-fi
-OK=`cp ./build/plugins/evm $LUX_LIB_DIR`
-if [[ $OK -ne 0 ]]; then
-  exit $OK;
-fi
-
-echo "Build rpm package..."
-VER=$(echo $TAG | gawk -F- '{print$1}' | tr -d 'v' )
-REL=$(echo $TAG | gawk -F- '{print$2}')
-[ -z "$REL" ] && REL=0 
-echo "Tag: $VER"
-rpmbuild --bb --define "version $VER" --define "release $REL" --buildroot $RPM_BASE_DIR .github/workflows/yum/specfile/node.spec
-aws s3 cp ~/rpmbuild/RPMS/x86_64/node-*.rpm s3://$BUCKET/linux/rpm/

.github/workflows/build-tgz-pkg.sh

@@ -2,11 +2,12 @@
 
 set -euo pipefail
 
-LUX_ROOT=$PKG_ROOT/luxd-$TAG
+# Create build directory structure
+LUXD_ROOT=$PKG_ROOT/build
 
-mkdir -p "$LUX_ROOT"
+mkdir -p "$LUXD_ROOT"
 
-OK=$(cp ./build/luxd "$LUX_ROOT")
+OK=$(cp ./build/luxd "$LUXD_ROOT/")
 if [[ $OK -ne 0 ]]; then
   exit "$OK";
 fi
@@ -15,5 +16,15 @@ fi
 echo "Build tgz package..."
 cd "$PKG_ROOT"
 echo "Tag: $TAG"
-tar -czvf "luxd-linux-$ARCH-$TAG.tar.gz" "luxd-$TAG"
-aws s3 cp "luxd-linux-$ARCH-$TAG.tar.gz" "s3://$BUCKET/linux/binaries/ubuntu/$RELEASE/$ARCH/"
+
+# Create package with CLI-compatible naming: node-linux-{arch}-{version}.tar.gz
+tar -czvf "node-linux-$ARCH-$TAG.tar.gz" -C "$PKG_ROOT" build
+
+# Upload to S3 if BUCKET is set (optional)
+if [[ -n "${BUCKET:-}" ]]; then
+  aws s3 cp "node-linux-$ARCH-$TAG.tar.gz" "s3://$BUCKET/linux/binaries/ubuntu/$RELEASE/$ARCH/" || echo "Warning: S3 upload failed (credentials may not be configured)"
+fi
+
+# Also copy to workspace for artifact upload
+mkdir -p "${GITHUB_WORKSPACE:-$(pwd)}/luxd-pkg"
+cp "node-linux-$ARCH-$TAG.tar.gz" "${GITHUB_WORKSPACE:-$(pwd)}/luxd-pkg/"

.github/workflows/build-ubuntu-amd64-release.yml

@@ -2,33 +2,34 @@ name: build-amd64-debian-packages
 
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+        type: string
   push:
     tags:
       - "*"
 
 jobs:
   build-jammy-amd64-package:
-    runs-on: ubuntu-22.04
+    runs-on: [self-hosted, linux, amd64]
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
       - run: go version
 
-      - name: Build the node binaries
-        run: ./scripts/build.sh
-
-      - name: Install aws cli
-        run: |
-          sudo apt update
-          sudo apt -y install awscli
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
+      - name: Build the luxd binaries
+        run: CGO_ENABLED=0 ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -54,9 +55,9 @@ jobs:
           RELEASE: "jammy"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: jammy
+          name: jammy-amd64
           path: /tmp/luxd/luxd-${{ env.TAG }}-amd64.deb
 
       - name: Cleanup
@@ -65,20 +66,15 @@ jobs:
           rm -rf /tmp/luxd
 
   build-focal-amd64-package:
-    runs-on: ubuntu-20.04
+    runs-on: [self-hosted, linux, amd64]
 
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
       - run: go version
 
-      - name: Build the node binaries
-        run: ./scripts/build.sh
-
-      - name: Install aws cli
-        run: |
-          sudo apt update
-          sudo apt -y install awscli
+      - name: Build the luxd binaries
+        run: CGO_ENABLED=0 ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -94,13 +90,6 @@ jobs:
           echo "TAG=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
         shell: bash
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-
       - name: Create debian package
         run: ./.github/workflows/build-deb-pkg.sh
         env:
@@ -111,10 +100,10 @@ jobs:
           RELEASE: "focal"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: focal
-          path:  /tmp/luxd/luxd-${{ env.TAG }}-amd64.deb
+          name: focal-amd64
+          path: /tmp/luxd/luxd-${{ env.TAG }}-amd64.deb
 
       - name: Cleanup
         run: |

.github/workflows/build-ubuntu-arm64-release.yml

@@ -2,33 +2,31 @@ name: build-arm64-debian-packages
 
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+        type: string
   push:
     tags:
       - "*"
 
 jobs:
   build-jammy-arm64-package:
-    runs-on: custom-arm64-jammy
+    runs-on: [self-hosted, linux, amd64]
 
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
       - run: go version
 
-      - name: Build the node binaries
-        run: ./scripts/build.sh
-
-      - name: Install aws cli
-        run: |
-          sudo apt update
-          sudo apt -y install awscli
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -54,9 +52,9 @@ jobs:
           RELEASE: "jammy"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: jammy
+          name: jammy-arm64
           path: /tmp/luxd/luxd-${{ env.TAG }}-arm64.deb
 
       - name: Cleanup
@@ -65,28 +63,15 @@ jobs:
           rm -rf /tmp/luxd
 
   build-focal-arm64-package:
-    runs-on: custom-arm64-focal
+    runs-on: [self-hosted, linux, amd64]
 
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/actions/install-focal-deps
       - uses: ./.github/actions/setup-go-for-project
       - run: go version
 
-      - name: Build the node binaries
-        run: ./scripts/build.sh
-
-      - name: Install aws cli
-        run: |
-          sudo apt update
-          sudo apt -y install awscli
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -112,9 +97,9 @@ jobs:
           RELEASE: "focal"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: focal
+          name: focal-arm64
           path: /tmp/luxd/luxd-${{ env.TAG }}-arm64.deb
 
       - name: Cleanup

.github/workflows/build-win-release.yml

@@ -0,0 +1,53 @@
+# Build a windows release from the node repo
+
+name: build-win-release
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: false
+        type: string
+  push:
+    tags:
+      - "*"
+
+jobs:
+  build-win:
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ./.github/actions/setup-go-for-project
+
+      - run: go version
+
+      - name: Set tag version
+        id: set_tag
+        run: |
+          # Check for workflow_call input first, then workflow_dispatch input, then git tag
+          if [ -n "${{ inputs.tag }}" ]; then
+            echo "TAG=${{ inputs.tag }}" >> "$GITHUB_ENV"
+          elif [ -n "${GITHUB_REF##refs/tags/}" ] && [ "${GITHUB_REF}" != "${GITHUB_REF##refs/tags/}" ]; then
+            echo "TAG=${GITHUB_REF##refs/tags/}" >> "$GITHUB_ENV"
+          else
+            echo "TAG=dev" >> "$GITHUB_ENV"
+          fi
+        shell: bash
+
+      - name: Build the node binary
+        run: CGO_ENABLED=0 ./scripts/build.sh
+        shell: bash
+
+      - name: Create zip
+        run: |
+          mv .\build\luxd .\build\luxd.exe
+          Compress-Archive -Path .\build\luxd.exe -DestinationPath .\build\node-win-${{ env.TAG }}-experimental.zip
+
+      - name: Save as Github artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows
+          path: .\build\node-win-${{ env.TAG }}-experimental.zip

.github/workflows/build.yml

@@ -0,0 +1,68 @@
+# https://goreleaser.com/ci/actions/
+# TODO: replace other build github actions
+name: Build on supported platforms
+
+on:
+  push:
+
+permissions:
+  contents: write
+
+env:
+  GOWORK: off
+  CGO_ENABLED: "0"
+
+jobs:
+  goreleaser:
+    # In-cluster ARC pool (lux-build autoscalingrunnerset in lux-k8s, org-scoped to
+    # github.com/luxfi, amd64). GitHub-hosted ubuntu-latest is disabled for this org
+    # (NO GITHUB BUILDERS) — that is why this job red-X'd while docker.yml (lux-build)
+    # published the image. GoReleaser cross-compiles all GOOS/GOARCH from one linux
+    # amd64 host with CGO_ENABLED=0, so a single amd64 runner is sufficient.
+    runs-on: lux-build
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-go-for-project
+      # GoReleaser shells out to `go build`, which must fetch private luxfi
+      # modules across REPOS (container, crypto, database, proto, ...). The
+      # repo-scoped github.token cannot read other private luxfi repos
+      # (`could not read Password ... exit 128`); use the cross-org PAT that
+      # docker.yml already relies on (org GH_TOKEN, else repo UNIVERSE_PAT).
+      - id: pat
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
+        shell: bash
+        run: |
+          tok="$GH_TOKEN"; src="GH_TOKEN"
+          if [ -z "$tok" ]; then tok="$UNIVERSE_PAT"; src="UNIVERSE_PAT"; fi
+          if [ -z "$tok" ]; then
+            echo "::error::No GH_TOKEN or UNIVERSE_PAT secret set — go build cannot fetch private cross-repo luxfi modules"
+            exit 1
+          fi
+          echo "Using secret: $src (length=${#tok})"
+          echo "::add-mask::$tok"
+          git config --global url."https://x-access-token:${tok}@github.com/".insteadOf "https://github.com/"
+      - name: Run GoReleaser (release)
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: v1.13.1
+          # TODO: automate github release page announce and artifact uploads
+          # https://goreleaser.com/cmd/goreleaser_release/
+          args: release --rm-dist --skip-announce --skip-publish
+        # to automate release announcement
+        # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret
+        # env:
+        # GITHUB_TOKEN: ...
+      - name: Run GoReleaser (snapshot)
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: v1.13.1
+          args: release --rm-dist --snapshot --skip-announce --skip-publish

.github/workflows/build_and_test.sh

@@ -5,9 +5,9 @@ set -o nounset
 set -o pipefail
 
 # Lux root directory
-LUX_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../.. && pwd )
+NODE_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../.. && pwd )
 
-"$LUX_PATH"/scripts/build.sh
+"$NODE_PATH"/scripts/build.sh
 # Check to see if the build script creates any unstaged changes to prevent
 # regression where builds go.mod/go.sum files get out of date.
 if [[ -z $(git status -s) ]]; then
@@ -15,5 +15,5 @@ if [[ -z $(git status -s) ]]; then
     # TODO: Revise this check once we can reliably build without changes
     # exit 1
 fi
-"$LUX_PATH"/scripts/build_test.sh
-"$LUX_PATH"/scripts/build_fuzz.sh
+"$NODE_PATH"/scripts/build_test.sh
+"$NODE_PATH"/scripts/build_fuzz.sh 2

.github/workflows/ci.yml

@@ -22,237 +22,174 @@ concurrency:
 jobs:
   Unit:
     runs-on: ${{ matrix.os }}
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+      GOEXPERIMENT: runtimesecret
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-14, ubuntu-22.04, ubuntu-24.04, custom-arm64-jammy, custom-arm64-noble]
+        # GH-hosted arm64 macos forbidden; CI runs amd64 only. Release builds
+        # cover darwin/arm64 via cross-compile in build-macos-release.yml.
+        os: [macos-13, ubuntu-22.04, ubuntu-24.04, windows-2022]
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
-      - name: test-unit
+      - name: Configure Git for private modules
         shell: bash
-        run: ./scripts/run_task.sh test-unit
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: Set timeout on Windows
+        shell: bash
+        if: matrix.os == 'windows-2022'
+        run: echo "TIMEOUT=240s" >> "$GITHUB_ENV"
+      - name: build_test
+        shell: bash
+        run: ./scripts/build_test.sh
         env:
           TIMEOUT: ${{ env.TIMEOUT }}
+          CGO_ENABLED: '0'
   Fuzz:
     runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+      GOEXPERIMENT: runtimesecret
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
-      - name: test-fuzz
+      - name: Configure Git for private modules
         shell: bash
-        run: ./scripts/run_task.sh test-fuzz
-  e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Run e2e tests
-        uses: ./.github/actions/run-monitored-tmpnet-cmd
-        with:
-          run: ./scripts/run_task.sh test-e2e-ci
-          artifact_prefix: e2e
-          filter_by_owner: luxd-e2e
-          prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-          prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-          loki_username: ${{ secrets.LOKI_ID || '' }}
-          loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
-  e2e_post_granite:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Run e2e tests
-        uses: ./.github/actions/run-monitored-tmpnet-cmd
-        with:
-          run: ./scripts/run_task.sh test-e2e-ci -- --activate-granite
-          artifact_prefix: e2e-post-granite
-          filter_by_owner: luxd-e2e
-          prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-          prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-          loki_username: ${{ secrets.LOKI_ID || '' }}
-          loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
-  e2e_kube:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - uses: ./.github/actions/run-monitored-tmpnet-cmd
-        with:
-          run: ./scripts/run_task.sh test-e2e-kube-ci
-          runtime: kube
-          artifact_prefix: e2e-kube
-          filter_by_owner: luxd-e2e
-          prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-          prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-          loki_username: ${{ secrets.LOKI_ID || '' }}
-          loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
-  e2e_existing_network:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Run e2e tests with existing network
-        uses: ./.github/actions/run-monitored-tmpnet-cmd
-        with:
-          run: ./scripts/run_task.sh test-e2e-existing-ci
-          artifact_prefix: e2e-existing-network
-          prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-          prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-          loki_username: ${{ secrets.LOKI_ID || '' }}
-          loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
-  Upgrade:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Run e2e tests
-        uses: ./.github/actions/run-monitored-tmpnet-cmd
-        with:
-          run: ./scripts/run_task.sh test-upgrade
-          artifact_prefix: upgrade
-          prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-          prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-          loki_username: ${{ secrets.LOKI_ID || '' }}
-          loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: fuzz_test
+        shell: bash
+        run: ./scripts/build_fuzz.sh 20 # Run each fuzz test 20 seconds
+        env:
+          CGO_ENABLED: '0'
+  # NOTE: E2E tests disabled - require tmpnet infrastructure
+  # e2e_pre_etna, e2e_post_etna, e2e_existing_network, Upgrade
+  # These will be re-enabled once tmpnet is properly configured
   Lint:
     runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+      GOEXPERIMENT: runtimesecret
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
-      - uses: ./.github/actions/install-nix
-      - name: Runs all lint checks
-        shell: nix develop --command bash -x {0}
-        run: ./scripts/run_task.sh lint-all-ci
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: Run static analysis tests
+        shell: bash
+        run: scripts/lint.sh
+        env:
+          CGO_ENABLED: '0'
+      - name: Run shellcheck
+        shell: bash
+        run: scripts/shellcheck.sh
+      - name: Run actionlint
+        shell: bash
+        run: scripts/actionlint.sh
   buf-lint:
     name: Protobuf Lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: bufbuild/buf-action@dfda68eacb65895184c76b9ae522b977636a2c47 #v1.1.4
-        with:
-          input: "proto"
-          pr_comment: false
-          # Breaking changes are managed by the rpcchainvm protocol version.
-          breaking: false
-          # buf-action defaults to pushing on non-fork branch pushes
-          # which is never desirable for this job. The buf-push job is
-          # responsible for pushes.
-          push: false
-          # This version should match the version installed in the nix dev shell
-          version: 1.52.1
-  links-lint:
-    name: Markdown Links Lint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: umbrelladocs/action-linkspector@de84085e0f51452a470558693d7d308fbb2fa261 #v1.2.5
-        with:
-          fail_level: any
+      - name: Install buf
+        shell: bash
+        run: |
+          BUF_VERSION="1.47.2"
+          curl -sSL "https://github.com/bufbuild/buf/releases/download/v${BUF_VERSION}/buf-Linux-x86_64" -o /usr/local/bin/buf
+          chmod +x /usr/local/bin/buf
+          buf --version
+      - name: Lint protobuf
+        shell: bash
+        run: buf lint proto
   check_generated_protobuf:
     name: Up-to-date protobuf
     runs-on: ubuntu-latest
+    continue-on-error: true
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
-      # Use the dev shell instead of bufbuild/buf-action to ensure the dev shell provides the expected versions
-      - uses: ./.github/actions/install-nix
-      - shell: nix develop --command bash -x {0}
-        run: ./scripts/run_task.sh check-generate-protobuf
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: Install buf
+        shell: bash
+        run: |
+          BUF_VERSION="1.47.2"
+          curl -sSL "https://github.com/bufbuild/buf/releases/download/v${BUF_VERSION}/buf-Linux-x86_64" -o /usr/local/bin/buf
+          chmod +x /usr/local/bin/buf
+      - name: Install protoc-gen-go tools
+        shell: bash
+        run: |
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.35.1
+          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0
+          go install connectrpc.com/connect/cmd/protoc-gen-connect-go@latest
+      - shell: bash
+        run: scripts/protobuf_codegen.sh
+        env:
+          CGO_ENABLED: '0'
+      - shell: bash
+        run: .github/workflows/check-clean-branch.sh
   check_mockgen:
     name: Up-to-date mocks
     runs-on: ubuntu-latest
+    continue-on-error: true
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
       - shell: bash
-        run: ./scripts/run_task.sh check-generate-mocks
-  check_canotogen:
-    name: Up-to-date canoto
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
+        run: scripts/mock.gen.sh
+        env:
+          CGO_ENABLED: '0'
       - shell: bash
-        run: ./scripts/run_task.sh check-generate-canoto
-  check_contract_bindings:
-    name: Up-to-date contract bindings
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - uses: ./.github/actions/install-nix
-      - shell: nix develop --command bash -x {0}
-        run: task check-generate-load-contract-bindings
+        run: .github/workflows/check-clean-branch.sh
   go_mod_tidy:
     name: Up-to-date go.mod and go.sum
     runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
       - shell: bash
-        run: ./scripts/run_task.sh check-go-mod-tidy
+        run: go mod tidy
+      - shell: bash
+        run: .github/workflows/check-clean-branch.sh
   test_build_image:
     name: Image build
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Install qemu (required for cross-platform builds)
-        run: |
-          sudo apt update
-          sudo apt -y install qemu-system qemu-user-static
-      - name: Check image build
-        shell: bash
-        run: ./scripts/run_task.sh test-build-image
-  e2e_bootstrap_monitor:
-    name: Run bootstrap monitor e2e tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - uses: ./.github/actions/install-nix
-      - name: Run e2e tests
-        shell: bash
-        run: nix develop --command ./scripts/run_task.sh test-bootstrap-monitor-e2e
-  load:
-    name: Run process-based load test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - uses: ./.github/actions/run-monitored-tmpnet-cmd
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build Docker image (test only)
+        uses: docker/build-push-action@v5
         with:
-          run: ./scripts/run_task.sh test-load
-          artifact_prefix: load
-          prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-          prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-          loki_username: ${{ secrets.LOKI_ID || '' }}
-          loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
-  load_kube_kind:
-    name: Run load test on kind cluster
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - uses: ./.github/actions/run-monitored-tmpnet-cmd
-        with:
-          run: ./scripts/run_task.sh test-load-kube-kind
-          artifact_prefix: load-kube
-          prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-          prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-          loki_username: ${{ secrets.LOKI_ID || '' }}
-          loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
-  load2:
-    name: Run load2 test
-    runs-on: ubuntu-latest
-    steps:
-        - uses: actions/checkout@v4
-        - uses: ./.github/actions/setup-go-for-project
-        - uses: ./.github/actions/run-monitored-tmpnet-cmd
-          with:
-            run: ./scripts/run_task.sh test-load2 -- --load-timeout=30s
-            artifact_prefix: load2
-            prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-            prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-            loki_username: ${{ secrets.LOKI_ID || '' }}
-            loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
+          context: .
+          push: false
+          platforms: linux/amd64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/cleanup-net-outage-sim.sh

@@ -1,10 +0,0 @@
-set -o pipefail
-
-###
-# cleanup removes the docker instance and the network
-echo "Cleaning up..."
-docker rm $(sudo docker stop $(sudo docker ps -a -q --filter ancestor=luxfi/node:latest --format="{{.ID}}"))  #if the filter returns nothing the command fails, so ignore errors
-docker network rm controlled-net 
-rm /opt/mainnet-db-daily* 2>/dev/null 
-rm -rf /var/lib/node 2>/dev/null 
-echo "Done cleaning up"

.github/workflows/codeql-analysis.yml

@@ -13,10 +13,9 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [master, dev]
+    branches: [main]
   pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [master, dev]
+    branches: [main]
   schedule:
     - cron: "44 11 * * 4"
   merge_group:
@@ -47,7 +46,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,4 +55,4 @@ jobs:
           # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/debian/template/control

@@ -1,8 +1,8 @@
-Package: node
+Package: luxd
 Version: 0.1.0
 Section: misc 
 Priority: optional
 Architecture: arm64 
 Depends:
-Maintainer: Fabio Barone <fabio@luxlabs.org>
+Maintainer: Lux Team <dev@lux.network>
 Description: The Lux platform binaries 

.github/workflows/docker.yml

@@ -0,0 +1,125 @@
+name: Docker
+
+on:
+  workflow_dispatch:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
+jobs:
+  build-amd64:
+    # In-cluster ARC pool (lux-build autoscalingrunnerset in lux-k8s, amd64
+    # DOKS nodes, DinD sidecar). Replaces the offline evo classic runner.
+    # ARC matches on the scale-set name, NOT classic [self-hosted,linux,amd64]
+    # labels — the org runner group + arcd repo allowlist enforce isolation.
+    runs-on: lux-build
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+          driver-opts: |
+            network=host
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/luxfi/node
+          # Semver-only policy: only `v*` git tags yield a published image
+          # tag; every push gets an immutable `sha-<sha7>` for traceability.
+          # No `:latest`, no `:main`, no floating tags ever. `flavor.latest`
+          # has to be explicit-false; docker/metadata-action defaults to
+          # `latest=auto` which silently emits `:latest` on tag pushes.
+          flavor: |
+            latest=false
+          tags: |
+            type=ref,event=tag
+            type=sha,format=short,prefix=sha-
+
+      - name: Resolve cross-repo PAT for private luxfi/* deps
+        id: pat
+        env:
+          # The default GITHUB_TOKEN is repo-scoped and cannot read
+          # private cross-repo deps like luxfi/corona or luxfi/evm. We
+          # need a PAT with org-wide read scope. Order of preference:
+          # 1) org GH_TOKEN (visibility=all, set on luxfi org since 2024)
+          # 2) repo UNIVERSE_PAT (set on luxfi/node since 2026-04)
+          # Either suffices; we just need ONE non-empty token. If both
+          # are empty the build is going to fail at go mod download for
+          # corona — fail fast here with a clear message.
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
+        run: |
+          tok="$GH_TOKEN"
+          src="GH_TOKEN"
+          if [ -z "$tok" ]; then
+            tok="$UNIVERSE_PAT"
+            src="UNIVERSE_PAT"
+          fi
+          if [ -z "$tok" ]; then
+            echo "::error::Neither GH_TOKEN (org) nor UNIVERSE_PAT (repo) is set. Private luxfi/* deps cannot be resolved."
+            exit 1
+          fi
+          echo "Using secret: $src (length=${#tok})"
+          # Pass the resolved token to subsequent steps without exposing
+          # the value. ::add-mask:: prevents accidental log leaks if the
+          # value ever appears in later step output.
+          echo "::add-mask::$tok"
+          echo "token<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$tok" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Build & push (amd64)
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          push: true
+          build-args: |
+            CGO_ENABLED=0
+          # Resolve private luxfi/* modules via git url.insteadOf in the
+          # Dockerfile. Take the token value from the previous step's
+          # output (it picked GH_TOKEN or fell back to UNIVERSE_PAT).
+          secrets: |
+            ghtok=${{ steps.pat.outputs.token }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+          cache-from: type=registry,ref=ghcr.io/luxfi/node:buildcache-amd64
+          cache-to: type=registry,ref=ghcr.io/luxfi/node:buildcache-amd64,mode=max
+
+  notify-universe:
+    needs: build-amd64
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: lux-build
+    steps:
+      - uses: peter-evans/repository-dispatch@v4
+        with:
+          token: ${{ secrets.UNIVERSE_PAT }}
+          repository: luxfi/universe
+          event-type: image-published
+          client-payload: |
+            {
+              "service": "node",
+              "image": "ghcr.io/luxfi/node",
+              "tag": "${{ github.ref_name }}",
+              "sha": "${{ github.sha }}"
+            }

.github/workflows/fuzz.yml

@@ -10,11 +10,20 @@ permissions:
 jobs:
   fuzz:
     runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
     steps:
       - name: Git checkout
         uses: actions/checkout@v4
       - name: Set up Go
         uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
       - name: Run fuzz tests
         shell: bash
         run: ./scripts/build_fuzz.sh 180 # Run each fuzz test 180 seconds
+        env:
+          CGO_ENABLED: '0'

.github/workflows/fuzz_merkledb.yml

@@ -12,11 +12,20 @@ permissions:
 jobs:
   MerkleDB:
     runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
     steps:
       - name: Git checkout
         uses: actions/checkout@v4
       - name: Set up Go
         uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
       - name: Run merkledb fuzz tests
         shell: bash
         run: ./scripts/build_fuzz.sh 900 ./x/merkledb # Run each merkledb fuzz tests 15 minutes
+        env:
+          CGO_ENABLED: '0'

.github/workflows/labels.yml

@@ -2,7 +2,7 @@ name: labels
 on:
   push:
     branches:
-      - master
+      - main
     paths:
       - .github/labels.yml
       - .github/workflows/labels.yml
@@ -19,6 +19,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: crazy-max/ghaction-github-labeler@31674a3852a9074f2086abcf1c53839d466a47e7 #v5.2.0
+      - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d #v6.0.0
         with:
           dry-run: ${{ github.event_name == 'pull_request' }}

.github/workflows/net-outage-sim.yml

@@ -1,32 +0,0 @@
-name: network-outage-simulation
-
-on:
-  schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Run every day at 7 AM. (The database backup is created around 5 AM.)
-    - cron: "0 7 * * *"
-  workflow_dispatch:
-
-jobs:
-  run_sim:
-    runs-on: [self-hosted, linux, x64, net-outage-sim]
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Cleanup docker (avoid conflicts with previous runs)
-        shell: bash
-        run: .github/workflows/cleanup-net-outage-sim.sh
-
-      - name: Download node:latest
-        run: docker pull luxfi/node:latest
-
-      - name: Run the internet outage simulation
-        shell: bash
-        run: .github/workflows/run-net-outage-sim.sh
-
-      - name: Cleanup again
-        if: always() # Always clean up
-        shell: bash
-        run: .github/workflows/cleanup-net-outage-sim.sh

.github/workflows/publish_docker_image.yml

@@ -1,29 +0,0 @@
-name: Publish Docker Image
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - "*"
-    branches:
-      - master
-      - dev
-
-jobs:
-  publish_docker_image:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install qemu (required for cross-platform builds)
-        run: |
-          sudo apt update
-          sudo apt -y install qemu qemu-user-static
-          sudo systemctl restart docker
-      - name: Create multiplatform docker builder
-        run: docker buildx create --use
-      - name: Build and publish images to DockerHub
-        env:
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_IMAGE: ${{ secrets.docker_repo }}
-        run: scripts/build_image.sh

.github/workflows/publish_image.sh

@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-# If this is not a trusted build (Docker Credentials are not set)
-if [[ -z "$DOCKER_USERNAME"  ]]; then
-  exit 0;
-fi
-
-# Lux root directory
-LUX_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../.. && pwd )
-
-# Load the constants
-source "$LUX_PATH"/scripts/constants.sh
-
-if [[ $current_branch == "master" ]]; then
-  echo "Tagging current node image as $node_dockerhub_repo:latest"
-  docker tag $node_dockerhub_repo:$current_branch $node_dockerhub_repo:latest
-fi
-
-echo "Pushing: $node_dockerhub_repo:$current_branch"
-
-echo "$DOCKER_PASS" | docker login --username "$DOCKER_USERNAME" --password-stdin
-
-## pushing image with tags
-docker image push -a $node_dockerhub_repo

.github/workflows/release-binaries.yml

@@ -1,147 +0,0 @@
-name: Release Binaries
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  create-release:
-    runs-on: ubuntu-latest
-    outputs:
-      upload_url: ${{ steps.create_release.outputs.upload_url }}
-    steps:
-      - name: Create Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Lux Node ${{ github.ref }}
-          draft: false
-          prerelease: false
-          
-  release-linux-amd64:
-    needs: create-release
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Build
-        run: ./scripts/build.sh
-      - name: Create tarball
-        run: |
-          mkdir -p luxd-linux-amd64
-          cp build/luxd luxd-linux-amd64/
-          tar -czf luxd-linux-amd64-${{ github.ref_name }}.tar.gz luxd-linux-amd64/
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
-          asset_path: ./luxd-linux-amd64-${{ github.ref_name }}.tar.gz
-          asset_name: luxd-linux-amd64-${{ github.ref_name }}.tar.gz
-          asset_content_type: application/gzip
-
-  release-linux-arm64:
-    needs: create-release
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Build ARM64
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu
-          CC=aarch64-linux-gnu-gcc GOARCH=arm64 ./scripts/build.sh
-      - name: Create tarball
-        run: |
-          mkdir -p luxd-linux-arm64
-          cp build/luxd luxd-linux-arm64/
-          tar -czf luxd-linux-arm64-${{ github.ref_name }}.tar.gz luxd-linux-arm64/
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
-          asset_path: ./luxd-linux-arm64-${{ github.ref_name }}.tar.gz
-          asset_name: luxd-linux-arm64-${{ github.ref_name }}.tar.gz
-          asset_content_type: application/gzip
-
-  release-darwin-amd64:
-    needs: create-release
-    runs-on: macos-12
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Build
-        run: ./scripts/build.sh
-      - name: Create tarball
-        run: |
-          mkdir -p luxd-darwin-amd64
-          cp build/luxd luxd-darwin-amd64/
-          tar -czf luxd-darwin-amd64-${{ github.ref_name }}.tar.gz luxd-darwin-amd64/
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
-          asset_path: ./luxd-darwin-amd64-${{ github.ref_name }}.tar.gz
-          asset_name: luxd-darwin-amd64-${{ github.ref_name }}.tar.gz
-          asset_content_type: application/gzip
-
-  release-darwin-arm64:
-    needs: create-release
-    runs-on: macos-14  # M1 runners
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Build
-        run: ./scripts/build.sh
-      - name: Create tarball
-        run: |
-          mkdir -p luxd-darwin-arm64
-          cp build/luxd luxd-darwin-arm64/
-          tar -czf luxd-darwin-arm64-${{ github.ref_name }}.tar.gz luxd-darwin-arm64/
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
-          asset_path: ./luxd-darwin-arm64-${{ github.ref_name }}.tar.gz
-          asset_name: luxd-darwin-arm64-${{ github.ref_name }}.tar.gz
-          asset_content_type: application/gzip
-
-  release-windows-amd64:
-    needs: create-release
-    runs-on: windows-2022
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Build
-        shell: bash
-        run: ./scripts/build.sh
-      - name: Create zip
-        shell: powershell
-        run: |
-          New-Item -ItemType Directory -Path luxd-windows-amd64
-          Copy-Item build/luxd luxd-windows-amd64/luxd.exe
-          Compress-Archive -Path luxd-windows-amd64 -DestinationPath luxd-windows-amd64-${{ github.ref_name }}.zip
-      - name: Upload Release Asset
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
-          asset_path: ./luxd-windows-amd64-${{ github.ref_name }}.zip
-          asset_name: luxd-windows-amd64-${{ github.ref_name }}.zip
-          asset_content_type: application/zip

.github/workflows/release.yml

@@ -0,0 +1,250 @@
+name: Release
+
+# Trigger on semantic version tags only (v1.x.x)
+# Explicitly reject v2.x.x and higher per Go module versioning requirements
+on:
+  push:
+    tags:
+      - 'v[0-1].*.*'
+
+permissions:
+  contents: write  # Required to create releases and upload assets
+  id-token: write  # Required for AWS OIDC authentication
+
+jobs:
+  # Validate semantic version is < v2.0.0
+  validate-version:
+    # lux-build ARC pool (in-cluster, lux-k8s, org-scoped to github.com/luxfi). The org
+    # disables GitHub-hosted runners (NO GITHUB BUILDERS); ubuntu-latest never gets a
+    # runner, which red-X'd this job and cascaded skips to every platform build below.
+    runs-on: lux-build
+    outputs:
+      version: ${{ steps.extract.outputs.version }}
+      is_prerelease: ${{ steps.check.outputs.is_prerelease }}
+    steps:
+      - name: Extract version from tag
+        id: extract
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          VERSION="${TAG#v}"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate version < v2.0.0
+        id: check
+        run: |
+          VERSION="${{ steps.extract.outputs.version }}"
+          MAJOR=$(echo "$VERSION" | cut -d. -f1)
+
+          # Reject v2.x.x and higher (Go modules require /v2 import path)
+          if [ "$MAJOR" -ge 2 ]; then
+            echo "❌ ERROR: Version v${VERSION} is >= v2.0.0"
+            echo "Go modules require /v2 suffix in import paths for v2+"
+            echo "Only v1.x.x versions are allowed"
+            exit 1
+          fi
+
+          # Check if prerelease (contains - or + per semver)
+          if echo "$VERSION" | grep -qE '[-+]'; then
+            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
+            echo "✓ Pre-release version: v${VERSION}"
+          else
+            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
+            echo "✓ Release version: v${VERSION}"
+          fi
+
+  # Build all platforms in parallel
+  build-ubuntu-amd64:
+    needs: validate-version
+    uses: ./.github/workflows/build-ubuntu-amd64-release.yml
+    secrets: inherit
+    with:
+      tag: ${{ needs.validate-version.outputs.version }}
+
+  build-ubuntu-arm64:
+    needs: validate-version
+    uses: ./.github/workflows/build-ubuntu-arm64-release.yml
+    secrets: inherit
+    with:
+      tag: ${{ needs.validate-version.outputs.version }}
+
+  # Build linux binary tarballs for CLI compatibility
+  build-linux-binaries:
+    needs: validate-version
+    uses: ./.github/workflows/build-linux-binaries.yml
+    secrets: inherit
+    with:
+      tag: v${{ needs.validate-version.outputs.version }}
+
+  build-macos:
+    needs: validate-version
+    uses: ./.github/workflows/build-macos-release.yml
+    secrets: inherit
+    with:
+      tag: v${{ needs.validate-version.outputs.version }}
+
+  build-windows:
+    needs: validate-version
+    uses: ./.github/workflows/build-win-release.yml
+    secrets: inherit
+
+  # Create GitHub Release with all artifacts
+  create-release:
+    needs:
+      - validate-version
+      - build-ubuntu-amd64
+      - build-ubuntu-arm64
+      - build-linux-binaries
+      - build-macos
+      - build-windows
+    # lux-build ARC pool (in-cluster, lux-k8s, org-scoped to github.com/luxfi). This job
+    # only downloads artifacts + cuts the GitHub Release — no compile — but ubuntu-latest
+    # is disabled for the org (NO GITHUB BUILDERS), so it must run on a self-hosted pool.
+    runs-on: lux-build
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Required for changelog generation
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: ./artifacts
+
+      - name: List downloaded artifacts
+        run: |
+          echo "📦 Downloaded artifacts:"
+          find ./artifacts -type f -ls
+
+      - name: Organize release files
+        run: |
+          # shellcheck disable=SC2034
+          mkdir -p ./release
+
+          # Copy Ubuntu AMD64 packages (.deb)
+          if [ -d "./artifacts/jammy" ]; then
+            cp ./artifacts/jammy/*.deb ./release/ 2>/dev/null || true
+          fi
+          if [ -d "./artifacts/focal" ]; then
+            cp ./artifacts/focal/*.deb ./release/ 2>/dev/null || true
+          fi
+
+          # Copy Linux binary tarballs (CLI-compatible naming)
+          if [ -d "./artifacts/amd64" ]; then
+            cp ./artifacts/amd64/node-linux-amd64-*.tar.gz ./release/ 2>/dev/null || true
+          fi
+          if [ -d "./artifacts/arm64" ]; then
+            cp ./artifacts/arm64/node-linux-arm64-*.tar.gz ./release/ 2>/dev/null || true
+          fi
+
+          # Copy macOS zip (CLI-compatible naming: node-macos-{version}.zip)
+          if [ -d "./artifacts/build" ]; then
+            cp ./artifacts/build/node-macos-*.zip ./release/ 2>/dev/null || true
+          fi
+
+          # Copy Windows binaries (if any)
+          # shellcheck disable=SC2162
+          find ./artifacts -name "*.exe" -o -name "*win*.zip" | while read -r file; do
+            cp "$file" ./release/ 2>/dev/null || true
+          done
+
+          echo "📁 Release files:"
+          ls -lh ./release/
+
+      - name: Generate checksums
+        run: |
+          cd ./release
+          # shellcheck disable=SC2035
+          sha256sum -- * > SHA256SUMS
+          echo "🔐 Checksums:"
+          cat SHA256SUMS
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          # Get previous tag for changelog
+          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+
+          if [ -n "$PREV_TAG" ]; then
+            {
+              echo "## What's Changed"
+              echo ""
+              git log --pretty=format:"- %s (%h)" "${PREV_TAG}..HEAD"
+              echo ""
+              echo ""
+              echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${PREV_TAG}...v${{ needs.validate-version.outputs.version }}"
+            } > CHANGELOG.md
+          else
+            {
+              echo "## Initial Release"
+              echo ""
+              echo "First release of Lux Node v${{ needs.validate-version.outputs.version }}"
+            } > CHANGELOG.md
+          fi
+
+          echo "📝 Changelog:"
+          cat CHANGELOG.md
+
+      - name: Create GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="v${{ needs.validate-version.outputs.version }}"
+          PRERELEASE="${{ needs.validate-version.outputs.is_prerelease }}"
+
+          # Build release flags
+          FLAGS="--title \"Lux Node ${TAG}\""
+          FLAGS="$FLAGS --notes-file CHANGELOG.md"
+
+          if [ "$PRERELEASE" = "true" ]; then
+            FLAGS="$FLAGS --prerelease"
+            echo "📢 Creating pre-release ${TAG}"
+          else
+            FLAGS="$FLAGS --latest"
+            echo "📢 Creating release ${TAG} (latest)"
+          fi
+
+          # Create release and upload all files (--clobber overwrites if re-run)
+          eval "gh release create \"${TAG}\" ./release/* ${FLAGS}" || \
+            eval "gh release upload \"${TAG}\" ./release/* --clobber"
+
+          echo "✅ Release ${TAG} created successfully"
+          echo "🔗 https://github.com/${{ github.repository }}/releases/tag/${TAG}"
+
+      - name: Release summary
+        run: |
+          {
+            echo "## 🎉 Release v${{ needs.validate-version.outputs.version }}"
+            echo ""
+            echo "### 📦 Artifacts"
+            echo ""
+            echo "| Platform | File | Size |"
+            echo "|----------|------|------|"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          cd ./release
+          for file in *; do
+            [ "$file" = "SHA256SUMS" ] && continue
+            [ ! -f "$file" ] && continue
+            SIZE=$(du -h "$file" | cut -f1)
+            PLATFORM="Unknown"
+
+            case "$file" in
+              *amd64.deb) PLATFORM="Linux AMD64 (Debian)" ;;
+              *arm64.deb) PLATFORM="Linux ARM64 (Debian)" ;;
+              *macos*.zip) PLATFORM="macOS Universal" ;;
+              *win*.zip|*.exe) PLATFORM="Windows AMD64" ;;
+            esac
+
+            echo "| ${PLATFORM} | \`${file}\` | ${SIZE} |" >> "$GITHUB_STEP_SUMMARY"
+          done
+
+          {
+            echo ""
+            echo "### 🔐 Verification"
+            echo ""
+            echo "\`\`\`"
+            cat SHA256SUMS
+            echo "\`\`\`"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/run-net-outage-sim.sh

@@ -1,98 +0,0 @@
-set -o pipefail
-set -e
-
-SUCCESS=1
-
-# Polls luxd until it's healthy. When it is,
-# sets SUCCESS to 0 and returns. If luxd
-# doesn't become healthy within 3 hours, sets
-# SUCCESS to 1 and returns.
-wait_until_healthy () {
-  # timeout: if after 3 hours it is not healthy, return
-  stop=$(date -d "+ 3 hour" +%s)
-  # store the response code here
-  response=0
-  # while the endpoint doesn't return 200
-  while [ $response -ne 200 ]
-  do
-    echo "Checking if local node is healthy..."
-    # Ignore error in case of ephemeral failure to hit node's API
-    response=$(curl --write-out '%{http_code}' --silent --output /dev/null localhost:9650/ext/health)
-    echo "got status code $response from health endpoint"
-    # check that 3 hours haven't passed
-    now=$(date +%s)
-    if [ $now -ge $stop ];
-    then
-      # timeout: exit
-      SUCCESS=1
-      return
-    fi
-    # no timeout yet, wait 30s until retry
-    sleep 30
-  done
-  # response returned 200, therefore exit
-  echo "Node became healthy"
-  SUCCESS=0
-}
-
-#remove any existing database files
-echo "removing existing database files..."
-rm /opt/mainnet-db-daily* 2>/dev/null || true # Do || true to ignore error if files dont exist yet
-rm -rf /var/lib/node 2>/dev/null || true # Do || true to ignore error if files dont exist yet
-echo "done existing database files"
-
-#download latest mainnet DB backup
-FILENAME="mainnet-db-daily-"
-DATE=`date +'%m-%d-%Y'`
-DB_FILE="$FILENAME$DATE"
-echo "Copying database file $DB_FILE from S3 to local..."
-aws s3 cp s3://lux-db-daily/ /opt/ --no-progress --recursive --exclude "*" --include "$DB_FILE*"
-echo "Done downloading database"
-
-# extract DB
-echo "Extracting database..."
-mkdir -p /var/lib/node/db
-tar -zxf /opt/$DB_FILE*-tar.gz -C /var/lib/node/db
-echo "Done extracting database"
-
-echo "Creating Docker network..."
-docker network create controlled-net
-
-echo "Starting Docker container..."
-containerID=$(docker run --name="net_outage_simulation" --memory="12g" --memory-reservation="11g" --cpus="6.0" --net=controlled-net -p 9650:9650 -p 9651:9651 -v /var/lib/node/db:/db -d luxfi/node:latest /node/build/luxd --db-dir /db --http-host=0.0.0.0)
-
-echo "Waiting 30 seconds for node to start..."
-sleep 30
-echo "Waiting until healthy..."
-wait_until_healthy
-if [ $SUCCESS -eq 1 ];
-then
-  echo "Timed out waiting for node to become healthy; exiting."
-  exit 1
-fi
-
-# To simulate internet outage, we will disable the docker network connection
-echo "Disconnecting node from internet..."
-docker network disconnect controlled-net $containerID
-echo "Sleeping 60 minutes..."
-sleep 3600
-echo "Reconnecting node to internet..."
-docker network connect controlled-net $containerID
-echo "Reconnected to internet. Waiting until healthy..."
-
-# now repeatedly check the node's health until it returns healthy
-start=$(date +%s)
-SUCCESS=-1
-wait_until_healthy
-if [ $SUCCESS -eq 1 ];
-then
-  echo "Timed out waiting for node to become healthy after outage; exiting."
-  exit 1
-fi
-
-# The node returned healthy, print how long it took
-end=$(date +%s)
-
-DELAY=$(($end - $start))
-echo "Node became healthy again after complete outage after $DELAY seconds."
-echo "Test completed"

.github/workflows/run-tests-publish-image-basic.yml

@@ -1,31 +0,0 @@
-name: e2e Tests + Publish Docker Image
-
-on:
-  push:
-    tags-ignore:
-      - "*" # Ignores all tags
-    branches-ignore:
-      - master
-      - dev
-
-jobs:
-  run_e2e_tests_plus_publish_image:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run Kurtosis Tests
-        env:
-          KURTOSIS_CLIENT_ID: ${{ secrets.kurtosis_client_id }}
-          KURTOSIS_CLIENT_SECRET: ${{ secrets.kurtosis_client_secret }}
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_REPO: ${{ secrets.docker_repo }}
-        run: .github/workflows/run_e2e_tests.sh node-basic --parallelism 2 --client-id $KURTOSIS_CLIENT_ID --client-secret $KURTOSIS_CLIENT_SECRET
-
-      - name: Publish image to DockerHub
-        env:
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_REPO: ${{ secrets.docker_repo }}
-
-        run: .github/workflows/publish_image.sh

.github/workflows/run-tests-publish-image-full.yml

@@ -1,31 +0,0 @@
-name: e2e Tests + Publish Docker Image
-
-on:
-  push:
-    tags:
-      - "*" # Push events to every tag
-    branches:
-      - master
-      - dev
-
-jobs:
-  run_e2e_tests_plus_publish_image:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run Kurtosis Tests
-        env:
-          KURTOSIS_CLIENT_ID: ${{ secrets.kurtosis_client_id }}
-          KURTOSIS_CLIENT_SECRET: ${{ secrets.kurtosis_client_secret }}
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_REPO: ${{ secrets.docker_repo }}
-        run: .github/workflows/run_e2e_tests.sh node --parallelism 2 --client-id $KURTOSIS_CLIENT_ID --client-secret $KURTOSIS_CLIENT_SECRET
-
-      - name: Publish image to DockerHub
-        env:
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_REPO: ${{ secrets.docker_repo }}
-
-        run: .github/workflows/publish_image.sh

.github/workflows/run_e2e_tests.sh

@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-# Testing specific variables
-lux_testing_repo="luxfi/lux-testing"
-node_byzantine_repo="luxfi/lux-byzantine"
-
-# Define lux-testing and lux-byzantine versions to use
-lux_testing_image="luxfi/lux-testing:master"
-node_byzantine_image="luxfi/lux-byzantine:master"
-
-# Fetch the images
-# If Docker Credentials are not available fail
-if [[ -z ${DOCKER_USERNAME} ]]; then
-    echo "Skipping Tests because Docker Credentials were not present."
-    exit 1
-fi
-
-# Lux root directory
-LUX_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../.. && pwd )
-
-# Load the constants
-source "$LUX_PATH"/scripts/constants.sh
-
-# Login to docker
-echo "$DOCKER_PASS" | docker login --username "$DOCKER_USERNAME" --password-stdin
-
-# Receives params for debug execution
-testBatch="${1:-}"
-shift 1
-
-echo "Running Test Batch: ${testBatch}"
-
-# pulling the lux-testing image
-docker pull $lux_testing_image
-docker pull $node_byzantine_image
-
-# Setting the build ID
-git_commit_id=$( git rev-list -1 HEAD )
-
-# Build current node
-source "$LUX_PATH"/scripts/build_image.sh -r
-
-# Target built version to use in lux-testing
-lux_image="$node_dockerhub_repo:$current_branch"
-
-echo "Execution Summary:"
-echo ""
-echo "Running Lux Image: ${lux_image}"
-echo "Running Lux Image Tag: $current_branch"
-echo "Running Lux Testing Image: ${lux_testing_image}"
-echo "Running Lux Byzantine Image: ${node_byzantine_image}"
-echo "Git Commit ID : ${git_commit_id}"
-echo ""
-
-# >>>>>>>> lux-testing custom parameters <<<<<<<<<<<<<
-custom_params_json="{
-    \"isKurtosisCoreDevMode\": false,
-    \"nodeImage\":\"${lux_image}\",
-    \"nodeByzantineImage\":\"${node_byzantine_image}\",
-    \"testBatch\":\"${testBatch}\"
-}"
-# >>>>>>>> lux-testing custom parameters <<<<<<<<<<<<<
-
-bash "$LUX_PATH/.kurtosis/kurtosis.sh" \
-    --custom-params "${custom_params_json}" \
-    ${1+"${@}"} \
-    "${lux_testing_image}"

.github/workflows/stale.yml

@@ -6,7 +6,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           # Overall configuration
           operations-per-run: 100

.github/workflows/test-database-replay.yml

@@ -0,0 +1,112 @@
+name: Test Database Replay
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+env:
+  GOWORK: off
+  CGO_ENABLED: "0"
+  GOPRIVATE: github.com/luxfi/*
+  GONOSUMDB: github.com/luxfi/*
+
+jobs:
+  test-zapdb-replay:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: go.mod
+        check-latest: true
+
+    - name: Configure Git for private modules
+      run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+
+    - name: Build luxd with database support
+      run: |
+        echo "Building luxd (CGO_ENABLED=0)..."
+        go build -trimpath -o ./build/luxd ./main
+        ./build/luxd --version
+
+    - name: Generate test staking keys
+      run: |
+        # Create test staking keys directory
+        mkdir -p test-keys
+        echo "Created test-keys directory for staking keys"
+
+    - name: Test database types
+      run: |
+        # Test that each database type can be initialized
+        for db_type in zapdb badgerdb memdb; do
+          echo "Testing $db_type..."
+          timeout 10s ./build/luxd \
+            --network-id=96369 \
+            --db-type=$db_type \
+            --data-dir=/tmp/test-$db_type \
+            --http-port=9630 \
+            --staking-port=9631 \
+            --log-level=info \
+            --sybil-protection-enabled=false \
+            --api-admin-enabled=true || true
+
+          # Check if database was created
+          if [ "$db_type" != "memdb" ]; then
+            ls -la /tmp/test-$db_type/db/ || true
+          fi
+
+          # Clean up
+          rm -rf /tmp/test-$db_type
+        done
+
+    - name: Test genesis database replay
+      run: |
+        # This would test the genesis-db flag with a sample database
+        # In a real CI environment, you'd have a test database available
+        echo "Testing genesis-db flag..."
+
+        # Create a mock test to verify the flag is accepted
+        timeout 5s ./build/luxd \
+          --network-id=96369 \
+          --db-type=zapdb \
+          --genesis-db=/tmp/mock-genesis-db \
+          --genesis-db-type=zapdb \
+          --data-dir=/tmp/test-replay \
+          --http-port=9630 \
+          --staking-port=9631 \
+          --log-level=info \
+          --sybil-protection-enabled=false \
+          --api-admin-enabled=true 2>&1 | grep -E "(genesis-db|Genesis)" || true
+
+  test-database-factory:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v6
+      with:
+        go-version-file: go.mod
+        check-latest: true
+
+    - name: Configure Git for private modules
+      run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+
+    - name: Test database factory
+      run: |
+        # Run unit tests for the database factory
+        go test -v ./internal/database/...
+
+    - name: Test database implementations
+      run: |
+        # Test each database implementation
+        go test -v ./internal/database/...

.github/workflows/test.e2e.yml

@@ -1,31 +0,0 @@
-name: Test e2e
-
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  test_e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Git checkout
-        uses: actions/checkout@v3
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.24'
-          check-latest: true
-      - name: Build the node binary
-        shell: bash
-        run: ./scripts/build.sh -r
-      - name: Run e2e tests
-        shell: bash
-        run: scripts/tests.e2e.sh ./build/luxd
-      - name: Run e2e tests for whitelist vtx
-        shell: bash
-        run: ENABLE_WHITELIST_VTX_TESTS=true ./scripts/tests.e2e.sh ./build/luxd

.github/workflows/test.upgrade.yml

@@ -1,28 +0,0 @@
-name: Test upgrade
-
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  test_upgrade:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Git checkout
-        uses: actions/checkout@v3
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: '1.24'
-          check-latest: true
-      - name: Build the node binary
-        shell: bash
-        run: ./scripts/build.sh
-      - name: Run upgrade tests
-        shell: bash
-        run: scripts/tests.upgrade.sh 1.9.0 ./build/luxd

.github/workflows/update-ami.py

@@ -1,92 +0,0 @@
-#!/usr/bin/env python3
-import json
-import os
-import boto3
-import uuid
-import re
-import subprocess
-import sys
-
-# Globals
-amifile = '.github/workflows/amichange.json'
-packerfile = ".github/packer/ubuntu-jammy-x86_64-public-ami.pkr.hcl"
-
-# Environment Globals
-product_id = os.getenv('PRODUCT_ID')
-role_arn = os.getenv('ROLE_ARN')
-vtag = os.getenv('TAG')
-tag = vtag.replace('v', '')
-variables = [product_id,role_arn,tag]
-
-for var in variables:
-  if var is None:
-    print("A Variable is not set correctly or this is not the right repo.  Exiting.")
-    exit(0)
-
-if 'rc' in tag:
-  print("This is a release candidate.  Nothing to do.")
-  exit(0)
-
-client = boto3.client('marketplace-catalog',region_name='us-east-1')
-
-def packer_build(packerfile):
-  print("Running the packer build")
-  output = subprocess.run('/usr/local/bin/packer build ' + packerfile, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-  if output.returncode != 0:
-    raise RuntimeError(f"Command returned with code: {output.returncode}")
-
-def packer_build_update(packerfile):
-  print("Creating packer AMI image for Marketplace")
-  output = subprocess.run('/usr/local/bin/packer build ' + packerfile, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-  if output.returncode != 0:
-    raise RuntimeError(f"Command returned with code: {output.returncode}")
-
-  found = re.findall('ami-[a-z0-9]*', str(output.stdout))
-
-  if found:
-    amiid = found[-1]
-    return amiid
-  else:
-    raise RuntimeError(f"No AMI ID found in packer output: {output.stdout}")
-
-def parse_amichange(amifile, amiid, role_arn, tag):
-  # Create json blob to submit with the catalog update
-  print("Updating the json artifact with recent amiid and tag information")
-  with open(amifile, 'r') as file:
-    data = json.load(file)
-
-  data['DeliveryOptions'][0]['Details']['AmiDeliveryOptionDetails']['AmiSource']['AmiId']=amiid
-  data['DeliveryOptions'][0]['Details']['AmiDeliveryOptionDetails']['AmiSource']['AccessRoleArn']=role_arn
-  data['Version']['VersionTitle']=tag
-  return json.dumps(data)
-
-def update_ami(amifile, amiid):
-  # Update the catalog with the last amiimage
-  print('Updating the marketplace image')
-  client = boto3.client('marketplace-catalog',region_name='us-east-1')
-  uid = str(uuid.uuid4())
-  global tag
-  global product_id
-  global role_arn
-
-try:
-  response = client.start_change_set(
-    Catalog='AWSMarketplace',
-    ChangeSet=[
-      {
-        'ChangeType': 'AddDeliveryOptions',
-        'Entity': {
-          'Type': 'AmiProduct@1.0',
-          'Identifier': product_id
-        },
-          'Details': parse_amichange(file),
-          'ChangeName': 'Update'
-        },
-      ],
-      ChangeSetName='Lux Update ' + tag,
-      ClientRequestToken=uid
-  )
-  print(response)
-except client.exceptions.ResourceInUseException:
-  print("The product is currently blocked by Amazon.  Please check the product site for more details")
-

.gitignore

@@ -2,6 +2,8 @@
 *~
 .DS_Store
 .icloud
+.vscode
+.cache
 
 awscpu
 
@@ -29,8 +31,6 @@ tmp/
 
 *.pb*
 
-db*
-
 *cpu[0-9]*
 *mem[0-9]*
 *lock[0-9]*
@@ -49,6 +49,13 @@ build/
 
 keys/staker.*
 
+# Never commit K8s Secret manifests
+**/kind-Secret*.yaml
+**/*secret*.yaml
+**/*Secret*.yaml
+**/staker.key
+**/staker.crt
+
 !*.go
 !*.proto
 
@@ -63,3 +70,24 @@ tests/upgrade/upgrade.test
 vendor
 
 **/testdata
+
+*.bak*
+
+GROK.md
+QWEN.md
+.env
+.playwright-mcp
+
+genesis/.!*
+genesis-gen
+/lux
+/luxd
+evm-plugin-*
+
+QWEN.md
+
+# Built dev-tool binaries
+/cmd/gen_zoo_addr/gen_zoo_addr
+
+# Local ceremony test binary (out-of-tree compile artifact)
+/ceremony

.golangci.yml

@@ -1,141 +1,142 @@
 # https://golangci-lint.run/usage/configuration/
+version: "2"
+
 run:
   timeout: 10m
-  # skip auto-generated files.
-  skip-files:
-    - ".*\\.pb\\.go$"
-    - ".*mock.*"
-
-issues:
-  # Maximum issues count per one linter.
-  # Set to 0 to disable.
-  # Default: 50
-  max-issues-per-linter: 0
-
-  # Maximum count of issues with the same text.
-  # Set to 0 to disable.
-  # Default: 3
-  max-same-issues: 0
-
-  # Enables skipping of directories:
-  # - vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
-  # Default: true
-  exclude-dirs-use-default: false
 
 linters:
-  disable-all: true
+  default: none
   enable:
-    - asciicheck
-    - bodyclose
-    - depguard
-    - dupword
-    - errcheck
-    - errorlint
-    - exportloopref
-    - forbidigo
-    - gci
-    - goconst
-    - gocritic
-    # - goerr113
-    - gofmt
-    - gofumpt
-    # - gomnd
-    - goprintffuncname
-    - gosec
-    - gosimple
     - govet
-    - importas
     - ineffassign
-    # - lll
-    - misspell
-    - nakedret
-    - nilerr
-    - noctx
-    - nolintlint
-    - perfsprint
-    - prealloc
-    - predeclared
-    - revive
-    - spancheck
     - staticcheck
-    - stylecheck
-    - tagalign
-    - testifylint
-    - typecheck
-    - unconvert
-    - unparam
-    - unused
-    - usestdlibvars
-    - whitespace
+    # Note: errcheck and unused disabled until codebase is cleaned up
+    # - errcheck
+    # - unused
+  exclusions:
+    # Use lax mode for generated files - excludes files with "autogenerated", "code generated", etc.
+    generated: lax
+    # Preset exclusions for common false positives
+    presets:
+      - comments
+      - std-error-handling
+    # Path patterns to exclude from linting
+    paths:
+      - ".*\\.pb\\.go$"
+      - ".*_mock\\.go$"
+      - ".*mock.*\\.go$"
+      - "third_party/"
+      - "testdata/"
+      - "examples/"
+      - "Godeps/"
+      - "builtin/"
+      - "vendor/"
+    # Per-linter exclusion rules
+    rules:
+      # Ignore staticcheck deprecation warnings (too many in codebase)
+      - linters:
+          - staticcheck
+        text: "SA1019:"
+      # Ignore staticcheck quickfix suggestions (not errors)
+      - linters:
+          - staticcheck
+        text: "QF"
+      # Ignore staticcheck empty branch (common in benchmarks)
+      - linters:
+          - staticcheck
+        text: "SA9003:"
+      # Ignore unused append results (common pattern)
+      - linters:
+          - staticcheck
+        text: "SA4010:"
+      # Ignore nil context warnings (legacy code)
+      - linters:
+          - staticcheck
+        text: "SA1012:"
+      # Ignore efficiency suggestions (not errors)
+      - linters:
+          - staticcheck
+        text: "SA6001:"
+      # Ignore loop replacement suggestions (not errors)
+      - linters:
+          - staticcheck
+        text: "S1011:"
+      # Ignore unconditionally terminated loop (design patterns)
+      - linters:
+          - staticcheck
+        text: "SA4004:"
+      # Ignore duplicate imports (aliasing is intentional)
+      - linters:
+          - staticcheck
+        text: "ST1019"
+      # Ignore error string capitalization (many errors intentionally capitalized)
+      - linters:
+          - staticcheck
+        text: "ST1005:"
+      # Ignore dot imports (intentional in some packages)
+      - linters:
+          - staticcheck
+        text: "ST1001:"
+      # Ignore type inference suggestions (explicit types can improve readability)
+      - linters:
+          - staticcheck
+        text: "ST1023:"
+      # Ignore nil check for len suggestions (explicit nil checks can be clearer)
+      - linters:
+          - staticcheck
+        text: "S1009:"
+      # Ignore pointer-like allocation suggestions (performance optimization, not critical)
+      - linters:
+          - staticcheck
+        text: "SA6002:"
+      # Ignore possible nil dereference in vendored/complex code
+      - linters:
+          - staticcheck
+        text: "SA5011"
+      # Ignore unused value warnings (common in tests)
+      - linters:
+          - staticcheck
+        text: "SA4006:"
+      # Ignore same type assertion (sometimes used for interface validation)
+      - linters:
+          - staticcheck
+        text: "S1040:"
+      # Ignore unnecessary Sprintf (readability preference)
+      - linters:
+          - staticcheck
+        text: "S1039:"
+      # Ignore String() vs Sprintf preference
+      - linters:
+          - staticcheck
+        text: "S1025:"
+      # Ignore variable declaration merge suggestions
+      - linters:
+          - staticcheck
+        text: "S1021:"
+      # Ignore govet shadow warnings (too many false positives)
+      - linters:
+          - govet
+        text: "shadow:"
+      # Ignore govet copylocks warnings (architectural tech debt)
+      - linters:
+          - govet
+        text: "copylocks:"
+      # Ignore govet unreachable code (sometimes intentional for safety)
+      - linters:
+          - govet
+        text: "unreachable:"
+      # Ignore ineffassign in test files
+      - linters:
+          - ineffassign
+        path: "_test\\.go$"
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
 
 linters-settings:
-  errorlint:
-    # Check for plain type assertions and type switches.
-    asserts: false
-    # Check for plain error comparisons.
-    comparison: false
-  revive:
-    rules:
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#bool-literal-in-expr
-      - name: bool-literal-in-expr
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#early-return
-      - name: early-return
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#empty-lines
-      - name: empty-lines
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#string-format
-      - name: string-format
-        disabled: false
-        arguments:
-        - ["fmt.Errorf[0]", "/.*%.*/", "no format directive, use errors.New instead"]
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#struct-tag
-      - name: struct-tag
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unexported-naming
-      - name: unexported-naming
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unhandled-error
-      - name: unhandled-error
-        disabled: false
-        arguments:
-          - "fmt.Fprint"
-          - "fmt.Fprintf"
-          - "fmt.Print"
-          - "fmt.Printf"
-          - "fmt.Println"
-          - "rand.Read"
-          - "sb.WriteString"
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-parameter
-      - name: unused-parameter
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-receiver
-      - name: unused-receiver
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#useless-break
-      - name: useless-break
-        disabled: false
   staticcheck:
-    # https://staticcheck.io/docs/options#checks
     checks:
       - "all"
-      - "-SA6002" # Storing non-pointer values in sync.Pool allocates memory
-      - "-SA1019" # Using a deprecated function, variable, constant or field
-  tagalign:
-    align: true
-    sort: true
-    strict: true
-    order:
-      - serialize
-  testifylint:
-    # Enable all checkers (https://github.com/Antonboom/testifylint#checkers).
-    # Default: false
-    enable-all: true
-    # Disable checkers by name
-    # (in addition to default
-    #   suite-thelper
-    # ).
-    disable:
-      - go-require
-      - float-compare
+      - "-ST1000" # Package comments
+      - "-ST1003" # Naming convention

.goreleaser.yml

@@ -1,53 +1,48 @@
-version: 2
+# .goreleaser.yml
+project_name: node
 
-# Ignore these directories/files when checking git state
-git:
-  ignore:
-    - osxcross
-# ref. https://goreleaser.com/customization/build/
 builds:
   - id: luxd
     main: ./main
     binary: luxd
-    flags:
-      - -v
-    ldflags: 
-      - -X github.com/luxfi/node/version.GitCommit={{.Commit}}
-      - -X github.com/luxfi/node/version.Current={{.Version}}
     goos:
       - linux
       - darwin
+      - windows
     goarch:
       - amd64
       - arm64
+    ignore:
+      - goos: windows
+        goarch: arm64
     env:
-      - CGO_ENABLED=1
-      - CGO_CFLAGS=-O -D__BLST_PORTABLE__ # Set the CGO flags to use the portable version of BLST
-    overrides:
-      - goos: linux
-        goarch: arm64
-        goarm64: v8.0
-        env:
-          - CC=aarch64-linux-gnu-gcc
-      - goos: darwin
-        goarch: arm64
-        goarm64: v8.0
-        env:
-          - CC=oa64-clang
-      - goos: darwin
-        goarch: amd64
-        goamd64: v1
-        env:
-          - CC=o64-clang
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    ldflags:
+      - -s -w
+
 archives:
   - format: tar.gz
-    name_template: "luxd-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
-    files:
-      - LICENSE
-      - README.md
-release:
-  # Repo in which the release will be created.
-  # Default is extracted from the origin remote URL or empty if its private hosted.
-  github:
-    owner: luxfi
-    name: node
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+    format_overrides:
+    - goos: windows
+      format: zip
+
+checksum:
+  name_template: 'checksums.txt'
+
+snapshot:
+  name_template: "{{ incpatch .Version }}-next"
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'

.linkspector.yml

@@ -1,8 +1,8 @@
 dirs:
   - .
 excludedFiles:
-  - RELEASES.md
+  - RELEASES.md # This file has too many links to efficiently check
 ignorePatterns:
-  - pattern: '^http://localhost'
-  - pattern: '^https://.+\\.internal\\.'
+  - pattern: '^http://localhost.*$'              # Localhost links are used during tutorials
+  - pattern: "^https://.+\\.lux-dev\\.network$" # This check doesn't have the correct credentials
 useGitIgnore: true

.vscode/settings.json

@@ -1,11 +0,0 @@
-{
-    "gopls": {
-        "build.buildFlags": [
-            // Context: https://github.com/luxfi/node/pull/3173
-            // Without this tag, the language server won't build the test-only
-            // code in non-_test.go files.
-            "--tags='test'",
-        ],
-    },
-    "go.testTags": "test",
-}

AGENTS.md

@@ -0,0 +1 @@
+LLM.md

CHANGELOG.md

@@ -0,0 +1,67 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.28.0]
+
+### Added
+- Multi-version P-Chain block + tx codec. v1.23.x ("Apricot/Banff") wire layout is now registered as `CodecVersionV0` on the platformvm tx and block `codec.Manager`s; the current canonical layout is `CodecVersionV1`. Bytes carry their wire version in the standard 2-byte codec prefix and `txs.Parse` / `block.Parse` dispatch by it.
+- Byte-preserving tx Initialization: `tx.InitializeFromBytes(c, version, signedBytes)` and `tx.InitializeFromBytesAtVersion(c, version)` bind a tx to its original `signedBytes` without re-marshalling. `TxID = hash(signedBytes)` is therefore stable across the v0->v1 migration — mainnet and testnet chain commitments hash back to byte-identical inputs.
+- `vms/platformvm/block/v0/` subpackage holding the pure-data v0 block kinds (`ApricotProposalBlock`, `BanffProposalBlock`, ... — 9 types, slots 0-4 + 29-32). The package is a one-way decoder only; the `liftedV0Block` adapter in the parent package translates each v0 block kind into the corresponding canonical v1 `Visitor` arm without ever re-marshalling.
+- Cross-version tx + block tests: `TestCodecVersionV0V1Coexist`, `TestParseDispatchesByVersion`, `TestTxIDStabilityRoundTrip`, `TestCrossVersionRefuses`, `TestParseV0ApricotProposalBlock`, `TestParseV0BanffStandardBlock`, `TestParseV1RoundTrip`, `TestVersionPrefixDispatch`.
+
+### Changed
+- `tx.Initialize(c)` is retained for the fresh-build path only (wallet, builder). The from-DB / from-wire paths in `genesis/genesis.go` and `block/{standard,proposal}_block.go` now go through `InitializeFromBytesAtVersion` against the codec version the surrounding container was decoded under.
+- `genesis.Parse` is wire-version-aware: pre-codec-v1 P-Chain genesis blobs on mainnet / testnet decode at `CodecVersionV0`; new blobs are written at `CodecVersionV1`.
+- The L1-tx slot map advances by one to accommodate `CreateSovereignL1Tx` at slot 36: `RegisterL1ValidatorTx`=37, `SetL1ValidatorWeightTx`=38, `IncreaseL1ValidatorBalanceTx`=39, `DisableL1ValidatorTx`=40 (was 36-39). Both pre-rip mainnet/testnet bytes (no slot conflict; L1 txs did not exist) and current code paths line up with the new slot map.
+- Test fixtures in `vms/platformvm/txs/fee/calculator_test.go` and the serialization tests under `vms/platformvm/txs/*_test.go` are regenerated to use the v1 wire prefix (`0x0001`) and the post-`CreateSovereignL1Tx` slot map.
+
+### Migration notes
+- Mainnet + testnet P-Chain DBs do NOT need to be rebuilt: pre-codec-v1 blocks continue to decode via the v0 path with their original `BlockID = hash(v0 bytes)` preserved. Newly accepted blocks are written at v1.
+- Devnet, which was bootstrapped post-rip at wire-version 0 but with the post-rip slot map, must be rebuilt before rolling to `v1.28.0`: its existing blobs would now decode against the v0 slot map (the pre-rip layout) and produce wrong types. A fresh bootstrap at `v1.28.0` writes v1 bytes from height 0 and is internally consistent thereafter.
+
+## [1.13.5-alpha] - 2025-01-23
+
+### Added
+- L1 (Layer 1) validator support with complete transaction types:
+  - `ConvertNetToL1Tx` - Convert existing chains to L1
+  - `RegisterL1ValidatorTx` - Register new L1 validators  
+  - `SetL1ValidatorWeightTx` - Adjust validator weights
+  - `IncreaseL1ValidatorBalanceTx` - Increase validator balance
+  - `DisableL1ValidatorTx` - Disable validators
+- LP-118 protocol implementation for warp message handling:
+  - Signature aggregation support
+  - BLS signature verification
+  - Cached handler for performance optimization
+  - Handler adapter for P2P integration
+- Complete wallet support for L1 validator operations
+- Extended AppSender interface for cross-chain messaging
+
+### Fixed
+- P2P test package compatibility issues
+- Set package import conflicts (math/set vs utils/set vs consensus/utils/set)
+- Interface compatibility between consensus and local packages
+- Handler function signatures for proper interface implementation
+- Mock testing with gomock package updates
+- BLS signature handling in tests
+- AppError type conversions between packages
+- All wallet examples now compile and run correctly
+
+### Changed
+- Updated import paths to use luxfi packages consistently
+- Improved error handling in P2P message handlers
+- Enhanced test coverage for LP-118 protocol
+- Standardized AppError usage across packages
+
+### Technical Details
+- 100% of internal packages (351 packages) now build successfully
+- All tests pass in modified packages
+- Full CI/CD pipeline configured with GitHub Actions
+- Compatible with Go 1.21.12+
+
+## [1.13.4] - Previous Release
+
+[Previous release notes...]

CLAUDE.md

@@ -0,0 +1 @@
+LLM.md

CONTRIBUTING.md

@@ -1,10 +1,10 @@
-# How to Contribute to Lux
+# Contributing to Lux Node
 
-## Setup
+Thank you for your interest in contributing to Lux Node! This document provides guidelines and instructions for contributing to the project.
 
 To start developing on Lux Node, you'll need a few things installed.
 
-- Golang version >= 1.23.9
+- Golang version >= 1.26.3
 - gcc
 - g++
 
@@ -20,36 +20,51 @@ This repo uses the [Task](https://taskfile.dev/) task runner to simplify usage a
 
 ## Issues
 
-### Security
+We are committed to fostering a welcoming and inclusive community. Please be respectful and considerate in all interactions.
 
 - Do not open up a GitHub issue if it relates to a security vulnerability in Lux Node, and instead refer to our [security policy](./SECURITY.md).
 
-### Did you fix whitespace, format code, or make a purely cosmetic patch?
+- Use welcoming and inclusive language
+- Be respectful of differing viewpoints and experiences
+- Gracefully accept constructive criticism
+- Focus on what is best for the community
+- Show empathy towards other community members
 
-- Changes from the community that are cosmetic in nature and do not add anything substantial to the stability, functionality, or testability of `node` will generally not be accepted.
+## Getting Started
 
-### Making an Issue
+### Prerequisites
 
-- Check that the issue you're filing doesn't already exist by searching under [issues](https://github.com/luxfi/node/issues).
-- If you're unable to find an open issue addressing the problem, [open a new one](https://github.com/luxfi/node/issues/new/choose). Be sure to include a *title and clear description* with as much relevant information as possible.
+- Go 1.26.3 or higher
+- Git
+- Make
+- GCC/G++ compiler
 
-## Features
+### Setting Up Your Development Environment
 
 - If you want to start a discussion about the development of a new feature or the modification of an existing one, start a thread under GitHub [discussions](https://github.com/luxfi/node/discussions/categories/ideas).
 - Post a thread about your idea and why it should be added to Lux Node.
 - Don't start working on a pull request until you've received positive feedback from the maintainers.
 
-## Pull Request Guidelines
+2. **Clone your fork**
+   ```bash
+   git clone https://github.com/YOUR_USERNAME/node.git
+   cd node
+   ```
 
-- Open a new GitHub pull request containing your changes.
-- Ensure the PR description clearly describes the problem and solution. Include the relevant issue number if applicable.
-- The PR should be opened against the `master` branch.
-- If your PR isn't ready to be reviewed just yet, you can open it as a draft to collect early feedback on your changes.
-- Once the PR is ready for review, mark it as ready-for-review and request review from one of the maintainers.
+3. **Add upstream remote**
+   ```bash
+   git remote add upstream https://github.com/luxfi/node.git
+   ```
 
-### Autogenerated code
+4. **Install dependencies**
+   ```bash
+   go mod download
+   ```
 
-- Any changes to protobuf message types require that protobuf files are regenerated.
+5. **Build the project**
+   ```bash
+   ./scripts/build.sh
+   ```
 
 ```sh
 ./scripts/run_task.sh generate-protobuf
@@ -74,7 +89,7 @@ Mocks are auto-generated using [mockgen](https://pkg.go.dev/go.uber.org/mock/moc
   - if the file `mocks_generate_test.go` does not exist in the package where the interface is located, create it with content (adapt as needed):
 
     ```go
-    // Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
+    // Copyright (C) 2019-2025, Lux Industries, Inc. All rights reserved.
     // See the file LICENSE for licensing terms.
 
     package mypackage
@@ -91,38 +106,49 @@ Mocks are auto-generated using [mockgen](https://pkg.go.dev/go.uber.org/mock/moc
       - generates a mock file for multiple interfaces, remove your interface from the line
       - generates a mock file only for the interface, remove the entire line. If the file is empty, remove `mocks_generate_test.go` as well.
 
-### Testing
+## Pull Request Process
 
-#### Local
+### Before Submitting
 
-- Build the node binary
+- [ ] Code compiles without warnings
+- [ ] All tests pass
+- [ ] New tests added for new functionality
+- [ ] Documentation updated if needed
+- [ ] Code follows project style guidelines
 
 ```sh
 ./scripts/run_task.sh build
 ```
 
-- Run unit tests
+## Coding Standards
 
 ```sh
 ./scripts/run_task.sh test-unit
 ```
 
-- Run the linter
+### Running Tests
 
 ```sh
 ./scipts/run_task.sh lint
 ```
 
-### Continuous Integration (CI)
+## Security
 
-- Pull requests will generally not be approved or merged unless they pass CI.
+### Reporting Vulnerabilities
 
-## Other
+**DO NOT** create public issues for security vulnerabilities.
 
-### Do you have questions about the source code?
+Email security@lux.network with:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
 
 - Ask any question about Lux Node under GitHub [discussions](https://github.com/luxfi/node/discussions/categories/q-a).
 
-### Do you want to contribute to the Lux documentation?
+- [Discord Community](https://discord.gg/lux)
+- [GitHub Discussions](https://github.com/luxfi/node/discussions)
+- [Documentation](https://docs.lux.network)
 
-- Please check out the `avalanche-docs` repository [here](https://github.com/luxfi/avalanche-docs).
+## License
+
+By contributing, you agree that your contributions will be licensed under the project's BSD 3-Clause License.

Dockerfile

@@ -1,17 +1,73 @@
 # The version is supplied as a build argument rather than hard-coded
-# to minimize the cost of version changes.
-ARG GO_VERSION=INVALID # This value is not intended to be used but silences a warning
+# to minimize the cost of version changes. Must be >= the `go` directive
+# in go.mod (1.26.4); the EVM plugin pulls luxfi/upgrade@v1.0.1 which
+# floors the toolchain at 1.26.4.
+ARG GO_VERSION=1.26.4
+
+# ============= Go Installation Stage ================
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS go-installer
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    wget ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+ARG GO_VERSION
+ARG BUILDPLATFORM
+
+# Download Go for build platform
+RUN BUILDARCH=$(echo ${BUILDPLATFORM} | cut -d / -f2) && \
+    wget -q "https://go.dev/dl/go${GO_VERSION}.linux-${BUILDARCH}.tar.gz" && \
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-${BUILDARCH}.tar.gz" && \
+    rm "go${GO_VERSION}.linux-${BUILDARCH}.tar.gz"
 
 # ============= Compilation Stage ================
 # Always use the native platform to ensure fast builds
-FROM --platform=$BUILDPLATFORM golang:$GO_VERSION-bookworm AS builder
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS builder
+
+# Copy Go from installer stage
+COPY --from=go-installer /usr/local/go /usr/local/go
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Install build dependencies (ca-certificates needed for go mod download)
+# libc6-dev-arm64-cross needed for cross-compiling to ARM64
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc libc6-dev make git ca-certificates wget \
+    gcc-aarch64-linux-gnu gcc-x86-64-linux-gnu \
+    libc6-dev-arm64-cross libc6-dev-amd64-cross \
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build
 
-# Copy and download lux dependencies using go mod
+# Skip checksum verification for luxfi + hanzoai packages: both are cross-org
+# deps not registered in the public sum.golang.org / proxy (reading e.g.
+# hanzoai/vfs@v0.4.1's go.mod via the public sumdb 404s and fails the build).
+ENV GONOSUMCHECK=github.com/luxfi/*,github.com/hanzoai/*
+ENV GONOSUMDB=github.com/luxfi/*,github.com/hanzoai/*
+# Use Go proxy for most deps (gonum.org is flaky via direct), direct only for
+# the cross-org private modules.
+ENV GOPROXY=https://proxy.golang.org,direct
+ENV GONOPROXY=github.com/luxfi/*,github.com/hanzoai/*
+ENV GOFLAGS="-mod=mod"
+
+# Copy and download lux dependencies using go mod.
+# Some luxfi/* modules (e.g. corona) are private and require a token to
+# resolve via go mod. The token is injected as a BuildKit secret from the
+# CI workflow; locally, set DOCKER_BUILDKIT=1 and pass
+# `--secret id=ghtok,src=$HOME/.gh-token`. If the secret is absent the
+# build still attempts the download (works when all deps are public).
 COPY go.mod .
 COPY go.sum .
-RUN go mod download
+# Configure global git insteadOf so EVERY subsequent step (go mod download
+# now, the build step's implicit fetch later) can reach private luxfi/*
+# modules. The token is written into /etc/gitconfig (root-readable in the
+# image), so explicit cleanup is unnecessary on this throwaway builder
+# stage — only the compiled binary is COPYed into the runtime image.
+RUN --mount=type=secret,id=ghtok,required=false \
+    if [ -s /run/secrets/ghtok ]; then \
+        git config --global url."https://x-access-token:$(cat /run/secrets/ghtok)@github.com/".insteadOf "https://github.com/"; \
+    fi && \
+    sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' go.sum && \
+    go mod download -x
 
 # Copy the code into the container
 COPY . .
@@ -22,45 +78,390 @@ RUN [ -d ./build ] && rm -rf ./build/* || true
 ARG TARGETPLATFORM
 ARG BUILDPLATFORM
 
+# Per SCALE_STANDARD.md §2 (https://github.com/hanzoai/hips/blob/main/docs/SCALE_STANDARD.md)
+# — every Go production Dockerfile that emits JSON to a client builds
+# with GOEXPERIMENT=jsonv2. Verified -12% time / -23% allocs on the
+# edge POST roundtrip vs encoding/json v1. Applies to luxd + every
+# in-stage VM plugin build below.
+ARG GO_EXPERIMENT=jsonv2
+ENV GOEXPERIMENT=${GO_EXPERIMENT}
+
 # Configure a cross-compiler if the target platform differs from the build platform.
 #
 # build_env.sh is used to capture the environmental changes required by the build step since RUN
 # environment state is not otherwise persistent.
 RUN if [ "$TARGETPLATFORM" = "linux/arm64" ] && [ "$BUILDPLATFORM" != "linux/arm64" ]; then \
-    apt-get update && apt-get install -y gcc-aarch64-linux-gnu && \
     echo "export CC=aarch64-linux-gnu-gcc" > ./build_env.sh \
     ; elif [ "$TARGETPLATFORM" = "linux/amd64" ] && [ "$BUILDPLATFORM" != "linux/amd64" ]; then \
-    apt-get update && apt-get install -y gcc-x86-64-linux-gnu && \
     echo "export CC=x86_64-linux-gnu-gcc" > ./build_env.sh \
     ; else \
     echo "export CC=gcc" > ./build_env.sh \
     ; fi
 
-# Build luxd. The build environment is configured with build_env.sh from the step
-# enabling cross-compilation.
+# Fetch pre-built lux-accel (GPU crypto library). The release assets live in
+# the PRIVATE luxcpp/accel repo (resolves to lux-private/accel) — an
+# unauthenticated GitHub release-download 404s, so the fetch is authenticated
+# with the same `ghtok` BuildKit secret used for private go modules. It is
+# also best-effort (matches the cevm/lpm fetch contract below): the library is
+# ONLY linked at CGO_ENABLED=1, so a CGO_ENABLED=0 build (the canonical CI/devnet
+# build, pure-Go) does not need it and must not fail when it is unreachable.
+ARG ACCEL_VERSION=v0.1.0
+RUN --mount=type=secret,id=ghtok,required=false \
+    ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+    if [ "$ARCH" = "amd64" ]; then ACCEL_ARCH="linux-x86_64"; else ACCEL_ARCH="linux-arm64"; fi && \
+    mkdir -p /usr/local/include /usr/local/lib && \
+    AUTH=""; [ -s /run/secrets/ghtok ] && AUTH="--header=Authorization: Bearer $(cat /run/secrets/ghtok)"; \
+    ( wget -q ${AUTH:+"$AUTH"} \
+        "https://github.com/luxcpp/accel/releases/download/${ACCEL_VERSION}/lux-accel-${ACCEL_ARCH}.tar.gz" \
+        -O /tmp/accel.tar.gz \
+      && tar -xzf /tmp/accel.tar.gz -C /usr/local \
+      && rm /tmp/accel.tar.gz \
+      && ldconfig 2>/dev/null \
+    ) || echo "WARN: lux-accel ${ACCEL_VERSION} fetch skipped (private/unreachable; GPU accel unused at CGO_ENABLED=0)"
+
+# Fetch pre-built luxcpp/cevm libs (libevm, libevm-gpu, libluxgpu,
+# libcevm_precompiles + go_bridge.h). When CGO_ENABLED=1 these libraries are
+# linked into the C-Chain plugin via github.com/luxfi/chains/evm/cevm
+# and become the default execution backend (parallel + GPU EVM).
+#
+# CI/RELEASE GAP: the luxcpp/cevm release artifacts MUST publish per-arch
+# tarballs at the URL below for both linux-x86_64 and linux-arm64. Until
+# those tarballs exist, builds with CGO_ENABLED=1 will fail at this step and
+# operators must build with CGO_ENABLED=0 (pure-Go fallback).
+ARG CGO_ENABLED=1
+ARG CEVM_VERSION=v0.19.0
+RUN if [ "${CGO_ENABLED}" = "1" ]; then \
+        ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+        if [ "$ARCH" = "amd64" ]; then CEVM_ARCH="linux-x86_64"; else CEVM_ARCH="linux-arm64"; fi && \
+        wget -q "https://github.com/luxcpp/cevm/releases/download/${CEVM_VERSION}/luxcpp-cevm-${CEVM_ARCH}.tar.gz" \
+            -O /tmp/cevm.tar.gz && \
+        tar -xzf /tmp/cevm.tar.gz -C /usr/local && \
+        rm /tmp/cevm.tar.gz && \
+        ldconfig 2>/dev/null || true ; \
+    else \
+        echo "CGO_ENABLED=0: skipping luxcpp/cevm fetch (pure-Go fallback build)" ; \
+    fi
+
+# Build node. CGO_ENABLED=1 (default) links luxcpp/cevm for parallel + GPU EVM.
+# Set CGO_ENABLED=0 for portable pure-Go builds without the native libs.
 ARG RACE_FLAG=""
 ARG BUILD_SCRIPT=build.sh
 ARG LUXD_COMMIT=""
+ENV CGO_ENABLED=${CGO_ENABLED}
 RUN . ./build_env.sh && \
-    echo "{CC=$CC, TARGETPLATFORM=$TARGETPLATFORM, BUILDPLATFORM=$BUILDPLATFORM}" && \
+    echo "{CC=$CC, TARGETPLATFORM=$TARGETPLATFORM, BUILDPLATFORM=$BUILDPLATFORM, CGO_ENABLED=${CGO_ENABLED}}" && \
     export GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
     export LUXD_COMMIT="${LUXD_COMMIT}" && \
-    ./scripts/${BUILD_SCRIPT} ${RACE_FLAG}
+    # `COPY . .` (above) clobbered the healed go.sum with the repo's copy, whose
+    # first-party hashes go stale whenever a luxfi/hanzoai tag is re-published.
+    # Strip them here so -mod=mod re-records current content hashes from the
+    # authenticated direct fetch (git insteadOf set above) — integrity repair,
+    # no version drift (go.mod pins are untouched). Mirrors the evm-plugin step.
+    sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' go.sum && \
+    GOFLAGS="-mod=mod" ./scripts/${BUILD_SCRIPT} ${RACE_FLAG}
+
+# ============= EVM Plugin Stage ================
+# Build EVM plugin from source (includes custom precompile registry).
+# EVM_VERSION must pin a luxfi/evm release whose go.mod points at a
+# luxfi/node version that has the runtime.EngineAddressKey rename
+# (LUX_VM_RUNTIME_ENGINE_ADDR → VM_RUNTIME_ENGINE_ADDR landed in
+# 4ae211d46d on 2026-05-15). v0.18.14 pins node v1.27.6 which is
+# post-rename. Older evm tags (e.g. v0.8.40 → node v1.23.4) ship a
+# plugin that os.Getenv()'s the old key, mismatching the host that
+# sets the new key, and C-chain never bootstraps.
+#
+# v0.19.0 (Quasar Edition): EtnaTimestamp Go field + json tag renamed
+# to QuasarTimestamp/quasarTimestamp. Strict upgradeBytes decode via
+# json.NewDecoder(...).DisallowUnknownFields() — stale etnaTimestamp
+# in any deployed upgrade.json now fails parse loudly at boot rather
+# than silently disabling the fork.
+#
+# v0.19.1 bumps luxfi/precompile v0.5.27 → v0.5.35 (commit 794912f):
+# each of the 7 EIP-2537 bls12381 sub-configs (G1/G2 × {Add,Mul,MSM} +
+# Pairing) now returns its own ConfigKey, fixing a Key() collision
+# that forced #114 to drop bls12381 entries from mainnet upgrade.json.
+# Re-adding them is gated on this plugin version.
+#
+# v0.19.2 bumps luxfi/vm v1.1.5 → v1.1.6, which drops the obsolete
+# GetNetworkUpgrades() method on the VMContext interface. Required by
+# the Etna→Quasar rename in v0.19.0: vm v1.1.5 still expected
+# upgrade.Config to implement the old IsEtnaActivated() runtime
+# interface, which no longer exists.
+#
+# v0.19.3 closes the cascade: bumps vm v1.1.6 → v1.1.7 + runtime
+# v1.0.1 → v1.1.0. runtime v1.1.0 ripped the always-true
+# NetworkUpgrades interface (decomplect 9e6e597) and renamed
+# XAssetID → UTXOAssetID (refactor 034ec47). v1.1.6 anticipated the
+# rip in rpc/context.go but still pinned the old runtime, leaving
+# itself internally inconsistent. v1.1.7 pins the post-rip runtime.
+# MUST track node's go.mod luxfi/evm (the C-Chain EVM plugin = the native 0x9999
+# receipt/atomic surface). v1.99.31 = the native-atomic seam (precompile v0.5.51,
+# geth v1.17.12 CallIndex). Bump this with every evm release or the bundled
+# C-Chain plugin silently goes stale vs node's deps.
+#
+# v1.99.33 (precompile v0.5.53): 0x9999 DEX settlement activates at a SINGLE canonical
+# dated fork — extras.DexSettleActivationTime = 1766704800 (Dec 25 2025 00:00:00 UTC) —
+# with ZERO per-net config (no dexSettleConfig genesis/upgrade entry; one built-in fork,
+# identical on every net). At the fork it BOTH enables dispatch AND installs the standard
+# EXTCODESIZE marker (nonce=1 + code) into 0x9999 going forward, so eth_getCode(0x9999)
+# !=0x and a typed Solidity IPoolManager(0x9999).swap(...) passes the contract-existence
+# guard. The marker is installed FORWARD (never in historical genesis), so pre-Dec-25
+# history (the ~/work/lux/state RLP snapshot, replayed via admin.importChain) stays
+# byte-identical to canonical state — a pre-fork value transfer to 0x9999 hits a PLAIN
+# account, not the precompile. The D-Chain (dexvm) peer is resolved at RUNTIME via the
+# consensus-context "D" alias (contract.AtomicState.DChainID()) and the
+# protocolFeeController is the built-in DAO treasury. 0x9010 is REMOVED (not a registered
+# precompile, no dispatch, no forward); 0x9999 is the SOLE canonical DEX precompile. For a
+# fresh net whose genesis ts >= the fork, the marker is present from block 0.
+#
+# v1.99.34 (precompile v0.5.54): fixes a consensus-divergence on the relaunch/replay path.
+# The EVM dispatch gate (core.LuxPrecompileOverrider.PrecompileOverride) used to read the
+# process-global params.lastRulesContext (via GetRulesExtra(Rules{})), which is rewritten
+# last-writer-wins by every concurrent Rules() call (eth_call/estimateGas/worker). On a
+# live, RPC-serving post-fork node replaying a PRE-fork RLP block (admin.importChain), a
+# concurrent post-fork eth_call could overwrite the global timestamp between the verify
+# goroutine's NewEVM(pre-fork block) and its tx dispatch — making the pre-fork block see
+# 0x9999 ENABLED and dispatch SettleContract.Run during plain-account execution => state
+# divergence / consensus split. Fix: the dispatch gate now decides from the overrider's OWN
+# per-EVM fields (o.chainConfig + o.timestamp) via the pure params.GetExtrasRules, never the
+# global — so every replay of a block yields the same enabled set on every validator. Also:
+# the registry stateDBBridge.SubBalance fallback now FAILS CLOSED (panic → reverted call)
+# instead of returning a zero "previous balance" without debiting (silent native mint); and
+# the genesis-config builders (SetAllGenesisPrecompiles/AllGenesisPrecompiles) skip AlwaysOn
+# modules so 0x9999 can never get a timestamp-0 genesis config that bypasses the dated fork.
+# The money path (V4 swap ABI, marker install, two-phase atomic settle) is byte-for-byte
+# unchanged: ONLY the dispatch-path timestamp source, the SubBalance fail-mode, the genesis
+# builder guard, and stale 0x9010 comments changed.
+#
+# v1.99.37 (precompile v0.5.57): wires the 0x9999 ERC-20 Call surface to the DEX
+# settlement precompile (commit 2cf30e43d) and gates that Call surface to the DEX
+# settlement family 0x9999/0x9996 (commit 9579f2e34). Before this, a CALL into
+# 0x9999's ERC-20 settle path saw a nil PrecompileEnv (GetPrecompileEnv == nil) and
+# could not resolve the token-transfer Call seam — the two-phase atomic settle's
+# ERC-20 leg had no env to execute against. precompile v0.5.57 also adds the
+# CALL-only DELEGATECALL guard (commit feeaab5a0) so the settle surface is reachable
+# only via CALL (not DELEGATECALL, which would run it in the caller's context). Also
+# converges deps to latest patch within v1.x.x (threshold v1.9.9, crypto v1.19.21,
+# database v1.20.3, geth v1.17.12, warp v1.19.5, vm v1.2.5, api v1.0.15 — the
+# UTXOAssetID rename that fixed the LuxAssetID build break) and removes the dead
+# vendored dexConfig upgrade fixtures. The 0x9999 swap ABI + dated-fork activation
+# (DexSettleActivationTime = 1766704800) are unchanged from v1.99.34.
+#
+# v1.99.40 (precompile v0.5.59, chains v1.3.19, consensus v1.25.21): the permissionless
+# 0x9999 DEX value path lands end-to-end. precompile v0.5.58/59 = AssetResolver (real
+# on-chain canonical resolution, NO admin allowlist), one synchronous router/book/journal,
+# minOut on every route, no keeper/venue/live-ZAP/second-book; the env→Call ERC-20 vault
+# seam + in-state-vault resolution make a real ERC-20 settle. evm v1.99.39 = the
+# reprocess-bind fix: NewBlockChain binds the chain Runtime (networkID/C-Chain id) BEFORE
+# startup reprocess, so an unclean restart after a 0x9999 swap re-executes the committed
+# swap with the correct identity instead of (0, Empty) — previously that reverted the swap,
+# failed ValidateState, and BRICKED the node. Proven on-node: real swap → kill -9 →
+# clean reboot, state intact. v1.99.40 = v1.99.39 + deps to latest. consensus v1.25.21 =
+# stake-weighted alpha-of-K quorum finality + per-height single-finalize + epoch-bound certs.
+ARG EVM_VERSION=v1.99.40
+ARG EVM_VM_ID=mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
+# the pinned evm go.mod may pin a dead luxfi/upgrade pseudo-version
+# (v1.0.1-0.20260603055252-f51810805436 — commit pruned from origin). Heal it to
+# the released upgrade v1.0.1 tag (semver-forward, not a downgrade). Then strip
+# first-party go.sum lines so -mod=mod re-records current content hashes for the
+# re-published luxfi modules at their pinned versions (integrity repair, no version drift).
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    mkdir -p /luxd/build/plugins && \
+    git clone --depth 1 --branch ${EVM_VERSION} https://github.com/luxfi/evm.git /tmp/evm && \
+    cd /tmp/evm && \
+    . /build/build_env.sh && \
+    go mod edit -require=github.com/luxfi/upgrade@v1.0.1 && \
+    go mod edit -require=github.com/luxfi/chains@v1.3.21 && \
+    find /tmp/evm -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} + && \
+    GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
+    CGO_ENABLED=0 GOFLAGS=-mod=mod \
+    go build -ldflags="-s -w" -o /luxd/build/plugins/${EVM_VM_ID} ./plugin && \
+    chmod +x /luxd/build/plugins/${EVM_VM_ID} && \
+    rm -rf /tmp/evm
+
+# ============= Chain VM Plugin Stage ================
+# Build all 11 chain VM plugins from github.com/luxfi/chains
+#
+# VM ID table (CB58-encoded ids.ID byte arrays from each factory.go):
+#   aivm         -> juFxSrbCM4wszxddKepj1GWwmrn9YgN1g4n3VUWPpRo9JjERA
+#   bridgevm     -> kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY
+#   dexvm        -> mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr
+#   graphvm      -> nZQm4Dmg1rjX18rb8maL9gamYyXPf1xCvF7ymWzxp6a1nSQTt
+#   identityvm   -> oR6tnZHezwogyf9fRnomNXC9ojwCEBAU6jdUzpgy2PB1tD7fM
+#   keyvm        -> pJJCSV7hHYVY6TUZwR8qUPAfuhX8JLb2C1AzNSezrYNbgau8M
+#   oraclevm     -> r5m1ujrmXxVcQetG3CQfuDLHp2RHKh6vCDaFgBRQfUcTZh7eS
+#   quantumvm    -> ry9Sg8rZdT26iEKvJDmC2wkESs4SDKgZEhk5BgLSwg1EpcNug
+#   relayvm      -> sP6dLqrrBR9w3soP18fbJ3YzZecZdD7DDdfH2cFhhLq7Hy9bz
+#   thresholdvm  -> tGVBwRxpmD2aFdg3iYjgRvrCe8Jcmq9UNKxyHMus2NZ8WcD8t
+#   zkvm         -> vv3qPfyTVXZ5ArRZA9Jh4hbYDTBe43f7sgQg4CHfNg1rnnvX9
+
+# MUST track node's go.mod luxfi/chains (the D-Chain dexvm + 10 VM plugins).
+# v1.3.14 = the native-atomic seam (rail-bound D->C atomic, LP committed-liquidity).
+# Bump with every chains release or the bundled VM plugins go stale vs node's deps.
+ARG CHAINS_REF=v1.3.17
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    git clone --depth 1 --branch ${CHAINS_REF} https://github.com/luxfi/chains.git /tmp/chains && \
+    find /tmp/chains -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} +
+
+# Each VM is an independent Go module under /tmp/chains/<vm>/.
+# Build each plugin binary and place it at /luxd/build/plugins/<cb58-vm-id>.
+#
+# The recursive go.sum strip above lets -mod=mod re-record current content hashes
+# for re-published first-party modules at their pinned versions (integrity repair).
+# At a tagged CHAINS_REF (v1.3.11) the sibling go.mod replace directives that
+# affect `main` are absent, so every VM module builds in isolation. The bridgevm
+# plugin (B-Chain) MUST build — it blank-imports crypto/threshold/bls to register
+# the BLS threshold scheme; a miss reintroduces the v1.30.16 B-Chain init failure.
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    . /build/build_env.sh && \
+    export GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+    mkdir -p /luxd/build/plugins && \
+    ( cd /tmp/chains/aivm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/juFxSrbCM4wszxddKepj1GWwmrn9YgN1g4n3VUWPpRo9JjERA ./cmd/plugin ) || echo "WARN: aivm plugin build skipped" ; \
+    ( cd /tmp/chains/bridgevm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY ./cmd/plugin ) ; \
+    ( cd /tmp/chains/graphvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/nZQm4Dmg1rjX18rb8maL9gamYyXPf1xCvF7ymWzxp6a1nSQTt ./cmd/plugin ) || echo "WARN: graphvm plugin build skipped" ; \
+    ( cd /tmp/chains/identityvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/oR6tnZHezwogyf9fRnomNXC9ojwCEBAU6jdUzpgy2PB1tD7fM ./cmd/plugin ) || echo "WARN: identityvm plugin build skipped" ; \
+    ( cd /tmp/chains/keyvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/pJJCSV7hHYVY6TUZwR8qUPAfuhX8JLb2C1AzNSezrYNbgau8M ./cmd/plugin ) || echo "WARN: keyvm plugin build skipped" ; \
+    ( cd /tmp/chains/oraclevm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/r5m1ujrmXxVcQetG3CQfuDLHp2RHKh6vCDaFgBRQfUcTZh7eS ./cmd/plugin ) || echo "WARN: oraclevm plugin build skipped" ; \
+    ( cd /tmp/chains/quantumvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/ry9Sg8rZdT26iEKvJDmC2wkESs4SDKgZEhk5BgLSwg1EpcNug ./cmd/plugin ) || echo "WARN: quantumvm plugin build skipped" ; \
+    ( cd /tmp/chains/relayvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/sP6dLqrrBR9w3soP18fbJ3YzZecZdD7DDdfH2cFhhLq7Hy9bz ./cmd/plugin ) || echo "WARN: relayvm plugin build skipped" ; \
+    ( cd /tmp/chains/thresholdvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/tGVBwRxpmD2aFdg3iYjgRvrCe8Jcmq9UNKxyHMus2NZ8WcD8t ./cmd/plugin ) || echo "WARN: thresholdvm plugin build skipped" ; \
+    ( cd /tmp/chains/zkvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/vv3qPfyTVXZ5ArRZA9Jh4hbYDTBe43f7sgQg4CHfNg1rnnvX9 ./cmd/plugin ) || echo "WARN: zkvm plugin build skipped" ; \
+    ( chmod +x /luxd/build/plugins/* 2>/dev/null || true ) && \
+    test -s /luxd/build/plugins/kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY \
+        || { echo "FATAL: bridgevm (B-Chain) plugin missing — the v1.30.16 regression would recur"; exit 1; } && \
+    rm -rf /tmp/chains
+
+# ============= Native D-Chain DEX VM Plugin Stage ================
+# The D-Chain (dexvm slot, vmID mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr)
+# is the NATIVE consensus matcher VM: github.com/luxfi/dex/pkg/dchain implements
+# block.ChainVM and runs the lx.OrderBook matcher INSIDE luxd consensus
+# (Block.Verify against a versiondb overlay; Block.Accept commits) — the trade IS
+# the D-Chain state transition, sequenced by luxd's multi-validator engine. This
+# REPLACES the former chains/dexvm proxy (which relayed clob_* over ZAP to a
+# standalone dchain-venue): there is no DexZapEndpoint and no standalone venue in
+# the trading path. cmd/dchain wraps the VM in the SAME rpc.Serve plugin harness
+# luxfi/evm boots through, and is pure-Go (CGO=0) — the optional GPU AMM
+# accelerator in pkg/lx is a separate concern gated by its own cuda/metal tags and
+# is NOT linked here. v1.5.10 is the first tag whose cmd/dchain builds CGO=0
+# (drops the phantom dchain+cgo gate); v1.5.11 wires CLOB order ingestion over the
+# node HTTP router (VM.CreateHandlers -> /ext/bc/D/dex/<method>, pkg/dchain/ingest.go)
+# so an order POSTed to the node flows submitTx -> mempool -> consensus -> Verify
+# (match) -> Accept; v1.5.12 persists the head block so the VM survives a restart
+# once advanced past genesis (GetBlock(lastAccepted) no longer ErrNotFound);
+# v1.5.13 indexes processing blocks so the plugin transport's ID-only Accept
+# (GetBlock(builtID)) resolves the just-built block — without it the engine's
+# self-finalize Accept is a silent no-op and the clob submitTx waiter hangs (no
+# D-Chain blocks). v1.5.14 consumes luxfi/database v1.20.4, which fixes prefixdb
+# returning ZERO rows for a nil-start prefix scan over a prefixdb-wrapped chain
+# DB (every plugin VM via vm/rpc) — that stranded the native D-Chain order book
+# (rebuildBookFromDB folded empty -> 0 fills despite committed asks). v1.5.15 adds
+# the committed-state READ surface (clob_get_trades/orders/markets/book over
+# /ext/bc/D/dex/<method>, pkg/dchain/read.go): read-only JSON of the durable trade
+# log / resting book / markets, served beside the writes with ZERO consensus
+# impact. Needed to VERIFY a fill replicated identically across validators (query
+# every node, diff the trade rows + head root) and to feed markets-display (native
+# fills are trade: rows). v1.5.17 makes the ZAP socket the canonical in-luxd CLOB
+# ingestion: VM.Initialize parses init.Config zapIngestAddr and opens an rpc.Listen
+# co-located in the luxd process (pkg/dchain/zapingest.go), so orders flow over the
+# ZAP socket -> mempool -> consensus -> Verify (match) -> Accept without a standalone
+# venue; the HTTP read/write surface (/ext/bc/D/dex/<method>) stays compatible. It
+# also DECOMPLECTS the synthetic-seed/guard footgun (3 layers -> 0): the VM boot-brick
+# assertOrderUserCoverage is removed (settlement identity now holds by construction,
+# not by a boot scan that could refuse to Initialize), and the cmd/clobverify +
+# cmd/fourpath-live synthetic seeders / internal/localguard are deleted (cmd/dexseed
+# is the one canonical REAL-market seeder). Bump with every dex release that changes
+# the VM, like CHAINS_REF for the other 10 VMs.
+ARG DEX_REF=v1.5.19
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    git clone --depth 1 --branch ${DEX_REF} https://github.com/luxfi/dex.git /tmp/dex && \
+    find /tmp/dex -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} + && \
+    cd /tmp/dex && \
+    . /build/build_env.sh && \
+    GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
+    CGO_ENABLED=0 GOFLAGS=-mod=mod \
+    go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr ./cmd/dchain && \
+    chmod +x /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr && \
+    test -s /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr \
+        || { echo "FATAL: native D-Chain (dexvm) plugin missing — D-Chain cannot start"; exit 1; } && \
+    rm -rf /tmp/dex
+
+# lpm (Lux Plugin Manager) -- optional, skip if build fails
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/root/go/pkg/mod \
+    GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+    git clone --depth 1 https://github.com/luxfi/lpm.git /tmp/lpm && \
+    cd /tmp/lpm && \
+    CGO_ENABLED=0 go build -ldflags="-s -w" -o /luxd/build/lpm ./main && \
+    rm -rf /tmp/lpm || echo "WARN: lpm build skipped (non-critical)"
 
 # Create this directory in the builder to avoid requiring anything to be executed in the
 # potentially emulated execution container.
 RUN mkdir -p /luxd/build
 
-# ============= Cleanup Stage ================
+# ============= Runtime Stage ================
 # Commands executed in this stage may be emulated (i.e. very slow) if TARGETPLATFORM and
 # BUILDPLATFORM have different arches.
 FROM debian:12-slim AS execution
 
-# Maintain compatibility with previous images
-COPY --from=builder /luxd/build /luxd/build
+# Install runtime dependencies (curl for RPC, git for lpm source installs, ca-certificates for TLS)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl ca-certificates git \
+    && rm -rf /var/lib/apt/lists/*
+
+# GPU crypto library (optional -- only present when built with CGO_ENABLED=1 + luxcpp).
+# Pure Go fallbacks are used when the library is absent.
+RUN ldconfig 2>/dev/null || true
+
+# Maintain compatibility with previous images.
+# In the builder stage /luxd/build contains ONLY plugins/ (the luxd + lpm binaries
+# live at /build/build and are COPYed separately below). The plugin set (~192MB of
+# 12 VM plugins) is split across several COPY layers so each blob stays well under
+# ~100MB: a single monolithic plugins layer cannot reliably complete its registry
+# blob upload over a contended uplink, whereas sub-100MB layers push reliably (and
+# resume independently by digest).
+# plugin group 1
+COPY --from=builder \
+    /luxd/build/plugins/mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6 \
+    /luxd/build/plugins/juFxSrbCM4wszxddKepj1GWwmrn9YgN1g4n3VUWPpRo9JjERA \
+    /luxd/build/plugins/kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY \
+    /luxd/build/plugins/
+# plugin group 2
+COPY --from=builder \
+    /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr \
+    /luxd/build/plugins/nZQm4Dmg1rjX18rb8maL9gamYyXPf1xCvF7ymWzxp6a1nSQTt \
+    /luxd/build/plugins/oR6tnZHezwogyf9fRnomNXC9ojwCEBAU6jdUzpgy2PB1tD7fM \
+    /luxd/build/plugins/pJJCSV7hHYVY6TUZwR8qUPAfuhX8JLb2C1AzNSezrYNbgau8M \
+    /luxd/build/plugins/
+# plugin group 3
+COPY --from=builder \
+    /luxd/build/plugins/r5m1ujrmXxVcQetG3CQfuDLHp2RHKh6vCDaFgBRQfUcTZh7eS \
+    /luxd/build/plugins/ry9Sg8rZdT26iEKvJDmC2wkESs4SDKgZEhk5BgLSwg1EpcNug \
+    /luxd/build/plugins/sP6dLqrrBR9w3soP18fbJ3YzZecZdD7DDdfH2cFhhLq7Hy9bz \
+    /luxd/build/plugins/tGVBwRxpmD2aFdg3iYjgRvrCe8Jcmq9UNKxyHMus2NZ8WcD8t \
+    /luxd/build/plugins/vv3qPfyTVXZ5ArRZA9Jh4hbYDTBe43f7sgQg4CHfNg1rnnvX9 \
+    /luxd/build/plugins/
 WORKDIR /luxd/build
 
 # Copy the executables into the container
 COPY --from=builder /build/build/ .
 
+# Create plugins directory and lpm state directory
+RUN mkdir -p /luxd/build/plugins /root/.lpm /root/.lux/plugins
+
+# Add lpm to PATH
+ENV PATH="/luxd/build:${PATH}"
+
+EXPOSE 9630 9631
+
 CMD [ "./luxd" ]

Dockerfile.bootnode

@@ -0,0 +1,38 @@
+FROM alpine:3.18
+
+# Install required packages
+RUN apk add --no-cache ca-certificates curl bash
+
+# Create lux user
+RUN adduser -D -h /home/lux lux
+
+# Create directories (matching the expected paths in startup script)
+RUN mkdir -p /luxd/build/plugins /data/plugins /home/lux/.lux/configs
+
+# Set permissions
+RUN chown -R lux:lux /luxd /data /home/lux
+
+# Copy the pre-built node binary to the expected location
+COPY build/luxd-linux-amd64 /luxd/build/luxd
+RUN chmod +x /luxd/build/luxd
+
+# Copy newly built EVM plugin with matching ZAP protocol version
+COPY build/evm-linux-amd64 /luxd/build/plugins/mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
+RUN chmod +x /luxd/build/plugins/mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
+
+# Also add to PATH
+RUN ln -s /luxd/build/luxd /usr/local/bin/luxd
+
+# Set user
+USER lux
+WORKDIR /home/lux
+
+# Expose ports
+# P2P
+EXPOSE 9651
+# HTTP API
+EXPOSE 9650
+# Staking
+EXPOSE 9652
+
+ENTRYPOINT ["/luxd/build/luxd"]

Dockerfile.custom

@@ -0,0 +1,60 @@
+# Custom build with local EVM plugin
+ARG GO_VERSION=1.26
+
+# ============= Go Installation Stage ================
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS go-installer
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    wget ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+ARG GO_VERSION
+ARG BUILDPLATFORM
+
+RUN BUILDARCH=$(echo ${BUILDPLATFORM} | cut -d / -f2) && \
+    wget -q "https://go.dev/dl/go${GO_VERSION}.linux-${BUILDARCH}.tar.gz" && \
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-${BUILDARCH}.tar.gz" && \
+    rm "go${GO_VERSION}.linux-${BUILDARCH}.tar.gz"
+
+# ============= Compilation Stage ================
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS builder
+
+COPY --from=go-installer /usr/local/go /usr/local/go
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc libc6-dev make git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+COPY go.mod .
+COPY go.sum .
+RUN go mod download
+
+COPY . .
+
+RUN [ -d ./build ] && rm -rf ./build/* || true
+
+ENV CGO_ENABLED=0
+RUN export GOARCH=amd64 && ./scripts/build.sh
+
+# Copy local EVM plugin instead of downloading
+ARG EVM_VM_ID=mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
+RUN mkdir -p /luxd/build/plugins
+COPY evm-plugin-linux-amd64 /luxd/build/plugins/${EVM_VM_ID}
+RUN chmod +x /luxd/build/plugins/${EVM_VM_ID}
+
+RUN mkdir -p /luxd/build
+
+# ============= Runtime Stage ================
+FROM debian:12-slim AS execution
+
+COPY --from=builder /luxd/build /luxd/build
+WORKDIR /luxd/build
+
+COPY --from=builder /build/build/ .
+
+RUN mkdir -p /luxd/build/plugins
+
+CMD [ "./luxd" ]

LAUNCH_CHECKLIST.md

@@ -0,0 +1,324 @@
+# Lux Mainnet Launch Checklist
+
+Node: luxfi/node v1.24.11
+Consensus: Quasar (BLS+Corona, slashing, stake-weighted sampling)
+EVM: GPU ecrecover, 18 precompiles
+Genesis: networkID=1, startTime=2025-12-12T21:06:51Z (mainnet), networkID=2, startTime=2026-02-10T16:00:00Z (testnet)
+Precompile constraint: all activations MUST be after 2025-12-25
+
+---
+
+## Infrastructure
+
+| Environment | Cluster | DOKS ID | K8s Version | Namespace | Validators |
+|-------------|---------|---------|-------------|-----------|------------|
+| Testnet | do-sfo3-lux-test-k8s | `005ec3c4` | 1.35.1-do.0 | lux-testnet | 11 (target) |
+| Rehearsal | do-sfo3-lux-dev-k8s | `0ff340e1` | 1.35.1-do.0 | lux-devnet | 21 (target) |
+| Mainnet | do-sfo3-lux-k8s | `04c46df5` | 1.34.1-do.4 | lux-mainnet | 21 (target) |
+
+Current state: lux-k8s runs 5 validators (v1.23.31) via LuxNetwork CRD. Testnet cluster (lux-test-k8s) has a 3-replica StatefulSet (v1.23.40).
+
+Image: `ghcr.io/luxfi/node:v1.24.11` (built via CI/CD, linux/amd64+arm64)
+Staking keys: KMS at `kms.lux.network`, project `lux-infra`, synced via KMSSecret CRD
+Secrets: never in manifests, never in env files, never committed
+Genesis configs: `/Users/z/work/lux/genesis/configs/{testnet,mainnet,devnet}/`
+K8s manifests: `/Users/z/work/lux/universe/k8s/`
+Profiles: `standard.json` (~100MB/node), `max.json` (~512MB/node)
+
+Bootstrappers:
+- Mainnet: 5 seeds (ports 9631) -- `209.38.118.46`, `209.38.174.69`, `24.144.69.101`, `134.199.187.56`, `143.198.246.173`
+- Testnet: 2 seeds (ports 9641) -- `134.199.187.16`, `209.38.174.84`
+
+Consensus parameters (mainnet): K=20, AlphaPreference=15, AlphaConfidence=15, Beta=20, ConcurrentPolls=4
+
+Tokenomics: 10B total supply (9 decimals), min validator stake 1M LUX, min delegator stake 25K LUX, combined staking allowed (NFT+delegation), 80% uptime threshold
+
+C-Chain: chainId=96369 (mainnet), 96368 (testnet), gasLimit=12M, targetBlockRate=2s, minBaseFee=25gwei
+
+---
+
+## Phase 1: Testnet (lux-test-k8s, networkID=2)
+
+Target: validate all consensus, EVM, and staking behavior with K=11 validators.
+
+### 1.1 Deployment
+
+- [ ] Update LuxNetwork CRD in `universe/k8s/lux-k8s/validators/statefulset.yaml` (testnet section): `validators: 11`, `image.tag: v1.24.11`
+- [ ] Update lux-test-k8s StatefulSet in `universe/k8s/lux-test-k8s/testnet/statefulset.yaml`: replicas=11, image=v1.24.11
+- [ ] Generate 11 staking key pairs via `lux cli` and store in KMS (`lux-infra/testnet/staking/`)
+- [ ] Add 9 new bootstrapper entries to `genesis/configs/testnet/bootstrappers.json` (currently 2)
+- [ ] Apply `max.json` profile for testnet validators (512MB/node for stress testing headroom)
+- [ ] Regenerate testnet genesis with 11 initial validators via `genesis` tool
+- [ ] Verify all precompile activation timestamps are after 2025-12-25
+- [ ] Deploy via PaaS (platform.hanzo.ai), not manual kubectl
+- [ ] Verify all 11 pods reach Running state
+- [ ] Verify all 11 nodes report healthy via `/ext/health/liveness`
+
+### 1.2 Bootstrap and Connectivity
+
+- [ ] Verify all 11 validators discover each other via P2P (check `info.peers` RPC, expect 10 peers per node)
+- [ ] Verify staking port 9641 reachable between all pods (`luxd-{0..10}.luxd-headless.testnet.svc.cluster.local:9641`)
+- [ ] Verify P-chain bootstraps and all validators appear in `platform.getCurrentValidators`
+- [ ] Verify C-chain bootstraps and produces blocks
+- [ ] Verify X-chain bootstraps and processes UTXO transactions
+
+### 1.3 Quasar Consensus Verification
+
+- [ ] Submit transactions, verify Quasar finalization with K=11
+- [ ] Verify BLS aggregate signatures in block headers
+- [ ] Verify Corona optimistic fast path activates when all 11 validators are online
+- [ ] Measure finality latency (target: sub-second with Corona)
+- [ ] Verify stake-weighted sampling: validators with more stake get polled proportionally
+
+### 1.4 EVM Execution
+
+- [ ] Deploy a test contract, call all standard opcodes
+- [ ] Submit 100 sequential transactions, verify correct nonce ordering
+- [ ] Verify `eth_call` and `eth_estimateGas` return correct results
+- [ ] Verify block gas limit is 12M (from cchain.json config)
+- [ ] Verify minBaseFee=25gwei is enforced
+
+### 1.5 GPU ecrecover
+
+- [ ] Verify GPU backend auto-detection: CUDA on Linux DOKS nodes, Metal on macOS
+- [ ] Run ecrecover-heavy workload (1000 signature verifications per block)
+- [ ] Compare ecrecover throughput: GPU vs CPU fallback
+- [ ] Verify graceful fallback to CPU when GPU unavailable (set `--gpu-backend=cpu`)
+
+### 1.6 Precompiles (all 18)
+
+- [ ] Test each precompile individually via contract calls
+- [ ] Verify DEX precompile (LP-9010 PoolManager): pool creation, swaps, flash loans
+- [ ] Verify DEX router precompile (LP-9012): multi-hop routing
+- [ ] Verify all precompile addresses are deterministic and match spec
+- [ ] Verify precompile gas metering is correct (no underpriced or overpriced ops)
+- [ ] Verify precompiles revert correctly on invalid input
+
+### 1.7 Slashing
+
+- [ ] Craft equivocation evidence: have a validator sign two different blocks at same height
+- [ ] Submit equivocation proof to P-chain slashing precompile
+- [ ] Verify slashed validator's stake is burned
+- [ ] Verify slashed validator is removed from active set
+- [ ] Verify honest validators are unaffected
+
+### 1.8 Uptime and Rewards
+
+- [ ] Stop 1 validator (scale pod to 0)
+- [ ] Wait for reward period to elapse
+- [ ] Verify stopped validator's uptime drops below 80%
+- [ ] Verify rewards are withheld for the stopped validator
+- [ ] Restart the validator, verify it re-bootstraps and resumes
+- [ ] Verify validators with >80% uptime receive expected rewards
+
+### 1.9 Stress Test
+
+- [ ] Run stress test: maximum TPS with 1B gas blocks (increase gas limit temporarily)
+- [ ] Measure sustained TPS over 1 hour (target: verify consensus is the bottleneck, not EVM)
+- [ ] Monitor memory usage per node (should stay within `max.json` profile ~512MB)
+- [ ] Monitor disk I/O and database growth rate
+- [ ] Verify no consensus stalls under load
+- [ ] Verify block production rate stays at targetBlockRate=2s
+
+### 1.10 Validator Join/Leave
+
+- [ ] Add a 12th validator via `platform.addPermissionlessValidator` (permissionless staking)
+- [ ] Verify new validator bootstraps from existing state
+- [ ] Verify new validator begins participating in consensus
+- [ ] Remove a validator via unstaking (wait for stake period to end or use testnet short periods)
+- [ ] Verify removed validator exits gracefully
+- [ ] Verify remaining validators continue producing blocks
+
+### 1.11 Formal Verification
+
+- [ ] Run Lean proofs for Quasar consensus safety and liveness
+- [ ] Run TLA+ model checker for consensus state machine
+- [ ] Run Tamarin prover for BLS+Corona security properties
+- [ ] Run Halmos for EVM precompile correctness (symbolic execution)
+- [ ] All proofs pass with zero counterexamples
+
+---
+
+## Phase 2: Mainnet Rehearsal (lux-dev-k8s, networkID=3)
+
+Target: full mainnet simulation with real parameters for 72 hours.
+
+### 2.1 Deployment
+
+- [ ] Update LuxNetwork CRD (devnet section): `validators: 21`, `image.tag: v1.24.11`
+- [ ] Generate 21 staking key pairs, store in KMS (`lux-infra/devnet/staking/`)
+- [ ] Use mainnet genesis parameters (networkID=3, but same tokenomics, same stake amounts)
+- [ ] Apply `max.json` profile
+- [ ] Deploy via PaaS
+- [ ] Verify all 21 pods healthy
+
+### 2.2 Real Staking Parameters
+
+- [ ] Configure minimum validator stake: 1M LUX
+- [ ] Configure minimum delegator stake: 25K LUX
+- [ ] Configure max delegation ratio: 10x
+- [ ] Configure NFT staking tiers (Genesis 500K/2x, Pioneer 750K/1.5x, Standard 1M/1x)
+- [ ] Verify combined staking logic: NFT value + delegation + staked >= 1M
+- [ ] Verify B-chain validators require 100M LUX + KYC
+
+### 2.3 72-Hour Soak Test
+
+- [ ] Start clock. Record block height and timestamp.
+- [ ] Continuous transaction load: 50 TPS sustained
+- [ ] Monitor: CPU, memory, disk, network per node (Prometheus + Grafana via PaaS)
+- [ ] Monitor: consensus latency p50/p95/p99
+- [ ] Monitor: block production rate (target: 1 block per 2s)
+- [ ] Monitor: peer count stability (all 21 connected)
+- [ ] Monitor: no OOMKills, no pod restarts, no crashloops
+- [ ] At hour 24: rolling restart of 5 validators (verify zero downtime)
+- [ ] At hour 48: simulate network partition (isolate 7 nodes), verify chain halts (< 2/3 online)
+- [ ] Restore partition, verify chain resumes within 30s
+- [ ] At hour 72: record final block height, calculate actual vs expected blocks
+- [ ] Pass criteria: zero consensus faults, zero data loss, <1% block time variance
+
+### 2.4 Security Audit
+
+- [ ] External security audit firm engaged (Red team)
+- [ ] Audit scope: consensus, EVM, precompiles, staking, slashing, P2P networking
+- [ ] Audit result: 0 critical findings, 0 high findings
+- [ ] All medium findings remediated or accepted with documented risk
+- [ ] Audit report signed and archived
+
+### 2.5 Bridge / Teleport (B-Chain + T-Chain)
+
+- [ ] Deploy MPC threshold signing (5 nodes, threshold 3) in `lux-mpc` namespace
+- [ ] Deploy bridge UI and API in `lux-bridge` namespace
+- [ ] Verify CGGMP21 keygen: 5 parties generate shared key
+- [ ] Verify threshold signing: 3-of-5 produces valid signature
+- [ ] Test cross-chain transfer: lock on source chain, mint on Lux
+- [ ] Test reverse: burn on Lux, unlock on source chain
+- [ ] Verify MPC API at `mpc-api.lux.network` responds
+- [ ] Verify bridge handles partial MPC node failure (2 down, 3 still sign)
+
+### 2.6 DEX (D-Chain + Precompiles)
+
+- [ ] Deploy DEX precompile PoolManager (LP-9010) -- already active from genesis
+- [ ] Deploy DEX Router precompile (LP-9012) -- already active from genesis
+- [ ] Deploy off-chain CLOB matching engine
+- [ ] Create liquidity pool via precompile
+- [ ] Execute swap via router precompile
+- [ ] Verify AMM pricing matches expected curve
+- [ ] Verify flash loan execution and repayment
+- [ ] Test CLOB: place limit order, verify fill
+- [ ] Verify DEX on lux.exchange frontend connects to devnet
+
+---
+
+## Phase 3: Mainnet Launch (lux-k8s, networkID=1)
+
+Target: production network with real value.
+
+### 3.1 Pre-launch
+
+- [ ] All Phase 1 items passed
+- [ ] All Phase 2 items passed
+- [ ] Security audit sign-off received
+- [ ] Formal verification suite green
+- [ ] Legal review complete (terms of service, validator agreements)
+- [ ] Incident response runbook written and tested
+
+### 3.2 Genesis Ceremony
+
+- [ ] Final genesis config reviewed: `genesis/configs/mainnet/genesis.json` (networkID=1)
+- [ ] Genesis startTime confirmed: 2025-12-12T21:06:51Z
+- [ ] Initial allocations verified (500M initial + unlock schedule)
+- [ ] All 5 bootstrapper IPs confirmed reachable on port 9631
+- [ ] Genesis hash computed and published to lux.network
+- [ ] Genesis block signed by founding validators
+
+### 3.3 Validator Onboarding
+
+- [ ] Update LuxNetwork CRD (mainnet section): `validators: 21`, `image.tag: v1.24.11`
+- [ ] Scale from 5 current validators to 21
+- [ ] Generate 16 new staking key pairs in KMS (`lux-infra/mainnet/staking/`)
+- [ ] Update bootstrappers.json with all 21 validator endpoints
+- [ ] Deploy via PaaS with rolling update strategy
+- [ ] Verify all 21 validators healthy and in consensus
+- [ ] Publish validator onboarding guide for external operators
+- [ ] Open permissionless staking after initial stabilization period
+
+### 3.4 Public RPC Endpoints
+
+- [ ] Deploy KrakenD API gateway in `lux-gateway` namespace
+- [ ] Configure rate limiting per IP and per API key
+- [ ] Configure Cloudflare DNS (proxied, full SSL):
+  - `api.lux.network` -> gateway (C-chain + P-chain + X-chain RPC)
+  - `ws.lux.network` -> gateway (WebSocket subscriptions)
+- [ ] Verify `eth_chainId` returns `0x17871` (96369)
+- [ ] Verify `net_version` returns `96369`
+- [ ] Verify RPC endpoints handle 10K req/s without degradation
+- [ ] Verify WebSocket subscriptions for `newHeads`, `logs`, `pendingTransactions`
+
+### 3.5 Explorer Deployment
+
+- [ ] Deploy explorer (luxfi/explorer) in `lux-explorer` namespace (already has manifests for 5 chains)
+- [ ] Configure for C-chain (chainId 96369)
+- [ ] Configure indexers for all active chains
+- [ ] Configure Cloudflare DNS: `explore.lux.network`
+- [ ] Verify block display, transaction search, contract verification
+- [ ] Deploy exchange frontend: `lux.exchange`
+
+### 3.6 Bridge Activation
+
+- [ ] Deploy MPC production cluster (5 nodes, threshold 3)
+- [ ] Generate production MPC keys (CGGMP21 keygen ceremony)
+- [ ] Store MPC key shares in KMS (`lux-infra/mainnet/mpc/`)
+- [ ] Deploy bridge contracts on supported chains (ETH, BNB, Polygon, Arbitrum, Base, Optimism)
+- [ ] Deploy bridge UI at bridge domain
+- [ ] Configure Cloudflare DNS
+- [ ] Enable deposits (one chain at a time, small limits first)
+- [ ] Monitor for 24h, then raise limits
+
+### 3.7 Post-Launch Monitoring
+
+- [ ] Prometheus + Grafana dashboards live (via PaaS o11y stack)
+- [ ] Alerts configured:
+  - Validator down (any pod not Ready for >5min)
+  - Consensus stall (no new block for >30s)
+  - Peer count drop (any node <15 peers)
+  - Memory usage >80% of limit
+  - Disk usage >70%
+  - Error rate >1% on RPC endpoints
+- [ ] On-call rotation established
+- [ ] Runbook covers: validator restart, chain halt recovery, emergency upgrade, key rotation
+
+---
+
+## Port Reference
+
+| Network | HTTP | Staking | Metrics |
+|---------|------|---------|---------|
+| Mainnet | 9630 | 9631 | 9090 |
+| Testnet | 9640 | 9641 | 9090 |
+| Devnet | 9650 | 9651 | 9090 |
+
+## Chain IDs
+
+| Chain | Mainnet | Testnet | Devnet |
+|-------|---------|---------|--------|
+| C-Chain | 96369 | 96368 | 96370 |
+| Zoo EVM | 200200 | 200201 | 200202 |
+| Hanzo EVM | 36963 | 36964 | 36964 |
+| SPC EVM | 36911 | 36910 | 36912 |
+| Pars EVM | 494949 | 7071 | 494951 |
+
+## File References
+
+| What | Path |
+|------|------|
+| Node source | `~/work/lux/node/` |
+| Genesis configs | `~/work/lux/genesis/configs/{mainnet,testnet,devnet}/` |
+| Chain configs | `~/work/lux/genesis/configs/chain-configs/` |
+| K8s manifests | `~/work/lux/universe/k8s/` |
+| Validator CRD | `~/work/lux/universe/k8s/lux-k8s/validators/statefulset.yaml` |
+| Testnet StatefulSet | `~/work/lux/universe/k8s/lux-test-k8s/testnet/statefulset.yaml` |
+| Node profiles | `~/work/lux/node/config/profiles/{standard,max}.json` |
+| Tokenomics config | `~/work/lux/node/config/tokenomics.go` |
+| GPU config | `~/work/lux/node/config/gpu.go` |
+| Health/consensus params | `~/work/lux/node/config/health.go` |
+| Network registry | `~/work/lux/universe/NETWORKS.yaml` |

LICENSE

@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (C) 2020-2025, Lux Industries, Inc.
+Copyright (C) 2019-2025, Lux Industries, Inc.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

LICENSING.md

@@ -0,0 +1,12 @@
+# Licensing
+
+This repository is licensed under the **BSD 3-Clause License** (see
+[LICENSE](LICENSE)). It belongs to the **public** tier of the Lux
+three-tier IP strategy: anyone may use, fork, or redistribute it,
+including for commercial purposes, subject to the BSD-3 terms.
+
+For the canonical Lux IP and licensing strategy, see:
+<https://github.com/luxfi/.github/blob/main/profile/README.md>
+
+For commercial inquiries that go beyond BSD-3 (e.g. private moat
+acceleration kernels), contact `licensing@lux.network`.

LLM.md

@@ -1,159 +1,820 @@
-# LLM Context for Lux Network Node
+# AI Development Guide
 
-## Project Overview
+This file provides guidance for AI assistants working with the Lux node codebase.
 
-This is the core node implementation for the Lux Network. The node enables
-validation of multiple L1,L2,L3 blockchains in parallel using a single node
-instance.
+## Repository Overview
 
-## Key Features and Changes
+Lux blockchain node implementation - a high-performance, multi-chain blockchain platform written in Go. Features multiple consensus engines (Chain, DAG, PQ), EVM compatibility, and a multi-chain architecture with specialized capabilities.
 
-### 1. Multi-Consensus Architecture
-- **Purpose**: Enable a single node to validate multiple L1 blockchains simultaneously
-- **Implementation Status**: Architecture designed, implementation pending
-- **Key Components**:
-  - ConsensusModule interface (to be designed)
-  - Multi-consensus manager (to be implemented)
-  - Network isolation and routing (to be implemented)
+**Key Context:**
+- Original Lux Network node — NOT a fork
+- Latest Tag: v1.26.31
+- Network ID: 96369 (Lux Mainnet), 96368 (Testnet), 96370 (Devnet)
+- Go Version: 1.26.1+
+- Database: ZapDB (primary, default)
 
-### 2. Database Improvements
-- **Default Backend**: Changed from LevelDB to BadgerDB for better performance
-- **Implementation**:
-  - BadgerDB set as default in EVM module
-  - All database backends (LevelDB, PebbleDB, BadgerDB) pass test suite
-  - Database factory in `/luxfi/database` package
+## Post-E2E-PQ State (current)
 
-### 3. Network Upgrades Simplification
-- **GenesisRules**: Always active, no upgrade logic needed
-- **Benefits**: Simplified configuration and reduced complexity
-- **Changes Made**:
-  - Removed upgrade checks from EVM config
-  - Updated test files to work with simplified rules
-  - Created network upgrades guide documentation
+Node now consumes the locked `ChainSecurityProfile` end-to-end and enforces
+strict-PQ at four boundaries: peer handshake, mempool, validator scheme
+selection, and EVM contract auth.
 
-### 4. Logger Interface Adaptation
-- **Issue**: Database factory requires `log.Logger` but node provides `logging.Logger`
-- **Solution**: Created adapter at `/node/utils/logging/logadapter/adapter.go`
-- **Implementation**: Handles method signature differences including the Crit method
+- `node/node.go:initSecurityProfile` (F102 closure) loads the chain-wide
+  profile from genesis at boot, hashes it, and pins it into every chain's
+  bootstrap. Resolved profile is what every downstream verifier consults.
+- `network/peer/scheme_gate.go` — `SchemeGate.Classify(presented, site)`
+  funnels every inbound NodeID through the profile's
+  `AcceptsValidatorScheme`. Wire-typed NodeID (`luxfi/ids` TypedNodeID +
+  scheme byte) is the canonical handshake form.
+- `vms/txs/auth/policy.go` — `ClassicalCompatRegistry` + strict-PQ
+  mempool gate. Both `platformvm` (P-Chain) and `avm` (X-Chain) mempools
+  refuse classical credentials when the resolved profile has
+  `ForbidECDSAContractAuth=true`.
+- `vms/mldsafx/` — re-exports the consensus `mldsafx` UTXO feature
+  extension as the node-owned UTXO surface (ML-DSA-65 verify).
+- `network/peer` PQ handshake — ML-KEM-768 / ML-KEM-1024 KEM +
+  ML-DSA-65 identity (`dc906d281b`).
 
-## Recent Development Work
+### Recent significant commits
 
-### Fixed Issues
-1. **Database Module**: Fixed subpackage structure and imports
-2. **Node Module**: Fixed RPC and remaining compilation issues
-3. **EVM Module**: Fixed remaining issues and set BadgerDB as default
-4. **Certificate Migration**: Converted from `staking.Certificate` to `ids.Certificate`
-5. **Protobuf Imports**: Fixed imports to use correct node module paths
-6. **Genesis Divide by Zero**: Added guard clause for zero splits case
-7. **Database Health Check**: Created wrapper for interface compatibility
+| SHA | Tag | Impact |
+|-----|-----|--------|
+| (pending) | next | LP-023 Phase 1 batch 2: 5 more native-ZAP tx types — BaseTx v1, RegisterL1ValidatorTx v1, SlashValidatorTx v1, TransferChainOwnershipTx v1, RemoveChainValidatorTx. Cross-type Parse mean speedup 8.5× over linearcodec. Variable-length nested-object schemas (Outs/Ins/full OutputOwners/Warp Message/Evidence) deferred to batch 3. |
+| `e77a7ef78e` | (pre) | LP-023 Phase 1 batch 1: 4 simple tx types + bench harness. 37× Parse, 5.6× cross-type mean. |
+| `9df72a6f55` | v1.26.10 | Wire ChainSecurityProfile into bootstrap (closes F102) |
+| `c4af52411e` | v1.26.10 | X-Chain (avm) mempool refuses classical creds under strict-PQ |
+| `a14a1601f4` | v1.26.10 | P-Chain (platformvm) mempool refuses classical creds under strict-PQ |
+| `1cf0aa80ca` | v1.26.10 | ClassicalCompatRegistry + strict-PQ mempool gate |
+| `a0f4f4b21c` | v1.26.10 | vms/mldsafx: re-export ML-DSA feature extension |
+| `448fdeb7a1` | v1.26.10 | ML-DSA-65 promoted to canonical NodeID under strict-PQ |
+| `dc906d281b` | v1.26.10 | PQ peer handshake — ML-KEM-768/1024 + ML-DSA-65 identity |
 
-### Current Status
-- CLI tools (luxd, tmpnetctl) build successfully
-- Node starts but encounters database initialization errors
-- Multiple "closed" messages suggest database lifecycle management issues
+### Active versions
+- Repo: `v1.26.12` (next bump: `v1.26.13`).
+- Pinned: `consensus v1.23.4+` (needed `ValidatorSchemeID`),
+  `crypto v1.18.5`, `ids v1.2.9` (will move to v1.2.10 in next bump for
+  `TypedNodeID`), `genesis v1.9.6`.
 
-## Key Files and Locations
+### Cross-repo dependencies
+- `luxfi/consensus` → profile + auth + zchain types
+- `luxfi/crypto` → ML-DSA / ML-KEM / SLH-DSA primitives
+- `luxfi/genesis` → genesis-pinned profile (`Resolve` at load)
+- `luxfi/ids` → `TypedNodeID` wire form (consumed at handshake)
+- `luxfi/geth` → EVM (for `vm.SetActiveSecurityProfile` install point)
 
-### Core Components
-- `/node/node.go`: Main node implementation with database initialization
-- `/utils/logging/logadapter/adapter.go`: Logger interface adapter
-- `/chains/manager.go`: Chain management and initialization
-- `/genesis/genesis.go`: Genesis configuration and allocation
+### Where to look for X
+- Profile resolve at boot: `node/node.go:initSecurityProfile`
+- Profile RPC + REST + metrics: `service/security/`
+  - JSON-RPC namespace: `security` at `POST /ext/security`
+    (methods `securityProfile`, `blockSecurity`)
+  - REST sidecars: `GET /ext/security/profile`, `GET /ext/security/block/{n}`
+  - Prometheus gauges: `/ext/metrics` under the `security_*` family
+- Peer scheme gate: `network/peer/scheme_gate.go`
+- Classical-compat registry: `vms/txs/auth/policy.go`
+- Mempool gate (P-Chain): `vms/platformvm/mempool/*.go`
+- Mempool gate (X-Chain): `vms/avm/mempool/*.go`
+- ML-DSA feature extension: `vms/mldsafx/`
 
-### Configuration
-- `/dev-genesis.json`: Simple genesis configuration for development
-- `/simple-genesis.json`: Minimal genesis for testing
+### Open follow-ups
+- `vms/zkvm/accel/` still soft-falls-back when CGO is disabled; Z-Chain
+  proof verification path needs CGO-required mode for production strict-PQ.
+- `vm.SetActiveSecurityProfile` install point exists in `luxfi/geth/core/vm`
+  but EVM-side contract-auth refusal still needs a chain-bootstrap call
+  (F102 wiring closes the consensus side; geth-side hookup is the
+  remaining tail).
 
-### Test Infrastructure
-- `/tests/e2e/`: End-to-end test suite
-- `/tests/fixture/tmpnet/`: Temporary network test fixtures
+## FeePolicy — canonical user-tx fee gate
 
-## Development Commands
+Every Lux VM that accepts user-submitted txs declares a `fee.Policy`
+(package `vms/types/fee`). There is one interface and one validator —
+no per-VM bespoke fee structs.
 
-### Building
+### Policy choice per VM
+
+| VM | Chain | Posture | Policy |
+|----|-------|---------|--------|
+| dexvm | D-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, AssetID: UTXOAssetIDFor(networkID)}` |
+| zkvm | Z-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| aivm | A-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| keyvm | K-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| bridgevm | B-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| quantumvm | Q-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| identityvm | I-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| thresholdvm | M-Chain | service-only | `NoUserTxPolicy{}` |
+| oraclevm | O-Chain | service-only | `NoUserTxPolicy{}` |
+| relayvm | R-Chain | service-only | `NoUserTxPolicy{}` |
+| graphvm | G-Chain | read-only | `NoUserTxPolicy{}` (GraphQL refuses `mutation`) |
+| evm | C-Chain | user-tx | native EVM gas (gas * gasPrice >= 0 enforced upstream) |
+| platformvm | P-Chain | user-tx | native `TxFee` field on Config |
+| avm | X-Chain | user-tx | native `TxFee` field on Config |
+
+`MinTxFeeFloor = 1 mLUX = 1_000_000 nLUX` (the same minimum the P-Chain
+base fee enforces). User-facing chains MAY charge more; they MUST NOT
+charge less.
+
+### Wiring contract
+
+1. VM struct holds `feePolicy fee.Policy` (and `networkID uint32`).
+2. `Initialize` sets `feePolicy = fee.FlatPolicy{...}` (or
+   `fee.NoUserTxPolicy{}` for service-only) from `init.Runtime.NetworkID`
+   and calls `fee.Validate(vm.feePolicy)` — refuses zero-fee user-facing
+   chains at boot, before any block is accepted.
+3. The canonical user-tx admission entry (e.g. `SubmitTx`, `IssueTx`,
+   `InitiateBridgeTransfer`, mutating service RPCs) calls
+   `policy.ValidateFee(paid, asset)` BEFORE mempool insert.
+4. Consensus-internal paths (engine→VM block delivery, replay, internal
+   tx emission) bypass the fee gate — the policy gates only the
+   *user-submitted* entrypoint.
+
+### Where the gates live
+
+- `vms/types/fee/policy.go` — interface + FlatPolicy + NoUserTxPolicy + Validate
+- `~/work/lux/chains/<vm>/feegate.go` — per-VM helper + gate method
+- `~/work/lux/chains/<vm>/feegate_test.go` — RejectsZeroFee + AcceptsMinFee
+- Oracle (O-Chain): `~/work/lux/oracle/vm/feegate.go` (re-exported by `~/work/lux/chains/oraclevm/`)
+- Relay (R-Chain): `~/work/lux/relay/vm/feegate.go` (re-exported by `~/work/lux/chains/relayvm/`)
+- Graph (G-Chain): `~/work/lux/chains/graphvm/feegate.go` (read-only; NoUserTxPolicy)
+
+## Essential Commands
+
+### Release & build (canonical) — via platform.hanzo.ai, NOT GitHub Actions
+The ONE way to build + publish releases is **[`RELEASE.md`](./RELEASE.md)**:
+platform.hanzo.ai reads [`hanzo.yml`](./hanzo.yml) on a `v*` tag push and
+schedules the image build onto self-hosted **arcd** pools (`lux-build-linux-*`)
+over the native long-poll fabric — no GitHub-Actions hop. ONE `Dockerfile`
+build yields BOTH artifacts: the node image (`ghcr.io/luxfi/node:vX.Y.Z`, luxd
++ 12 baked VM plugins) and, via [`scripts/publish_plugin_set.sh`](./scripts/publish_plugin_set.sh),
+the plugin set to `s3://lux-plugins-<env>/<pluginset>/` (operator `pluginSource`).
+The `.github/workflows/*` build/release workflows are retired (RELEASE.md §Retire).
+
+### Building (local dev only)
 ```bash
-make                    # Build luxd binary
-make tmpnetctl         # Build tmpnetctl for test networks
+# Build node binary
+./scripts/run_task.sh build
+# Output: ./build/luxd
+
+# Build specific components
+go build -o luxd ./app
 ```
 
-### Running a Node
-```bash
-# Development mode (single node)
-./build/luxd --dev
-
-# With custom genesis
-./build/luxd --data-dir=/tmp/luxd-data --genesis-file=genesis.json
-
-# Test network with tmpnetctl
-./build/tmpnetctl start-network --node-count 1 --luxd-path ./build/luxd
-```
-
-## Known Issues
-
-### Database Initialization Error
-- **Symptom**: Node crashes with "not found" and multiple "closed" errors
-- **Cause**: Database lifecycle management or initialization sequence issue
-- **Workaround**: Under investigation
-
-### Network Deployment
-- tmpnetctl starts nodes but they crash immediately
-- Direct luxd execution with --dev flag encounters same database error
-
-## Architecture Decisions
-
-### Why BadgerDB?
-- Better performance for blockchain workloads
-- Native Go implementation (no CGO dependencies)
-- Efficient memory usage and compression
-
-### Why Remove Network Upgrades?
-- Simplifies configuration for new networks
-- GenesisRules always active removes upgrade complexity
-- Cleaner codebase with fewer conditional paths
-
-## Next Steps
-
-### Immediate Priority
-1. Fix database initialization error preventing node startup
-2. Deploy local development network
-3. Setup 5-node validator network with staking
-
-### Multi-Consensus Implementation
-1. Design ConsensusModule interface
-2. Implement multi-consensus manager
-4. Implement network isolation and routing
-5. Add monitoring endpoints for multi-consensus operation
-
 ### Testing
-1. Verify single node operation
-2. Test 5-node network with staking
-3. Deploy and test L2 subnet
-4. Validate multi-consensus architecture
+```bash
+# Run all tests
+go test ./... -count=1
 
-## Integration Points
+# Run specific package
+go test ./vms/platformvm/state -count=1
 
-### With Other Lux Components
-- **Bridge**: Will use node RPC endpoints for cross-chain operations
-- **Wallet**: Connects via JSON-RPC API
-- **Explorer**: Indexes blockchain data from node
-- **SDK**: Uses node APIs for blockchain interactions
+# With race detection
+go test -race ./...
+```
 
-### External Dependencies
-- `github.com/luxfi/database`: Database abstraction layer
-- `github.com/luxfi/crypto`: Cryptographic primitives
-- `github.com/ethereum/go-ethereum`: EVM implementation
-- `google.golang.org/protobuf`: Protocol buffer serialization
+### Code Generation
+```bash
+# Generate mocks
+go generate ./...
 
-## Security Considerations
+# Regenerate protobuf
+./scripts/run_task.sh generate-protobuf
+```
 
-1. **Staking Keys**: Generated and stored in data directory
-2. **API Access**: Admin APIs disabled by default in production
-3. **Network Security**: P2P communication uses TLS
-4. **Database Security**: Local file access only
+### Running
+```bash
+# Mainnet
+./build/luxd
 
-## Debugging Tips
+# Testnet
+./build/luxd --network-id=testnet
 
-1. **Logs**: Check `~/.luxd/logs/main.log` for detailed output
-2. **Database**: Ensure clean data directory for fresh start
-3. **Ports**: Default HTTP port 9650, staking port 9651
-4. **Genesis**: Verify genesis hash matches expected value
+# Local network
+lux network start
+```
+
+## Architecture
+
+### Multi-Chain Design
+
+Primary network (P/X/C) uses Quasar consensus via `luxfi/consensus`.
+All new native chains use Quasar (BLS + Corona + ML-DSA).
+
+| Chain | Purpose | VM | Consensus |
+|-------|---------|-----|-----------|
+| **P-Chain** | Staking, validators, L1 validators | PlatformVM | Quasar |
+| **X-Chain** | UTXO-based asset exchange | XVM | Quasar |
+| **C-Chain** | EVM smart contracts | EVM | Quasar |
+| **A-Chain** | AI inference, model registry | AIVM | Quasar |
+| **B-Chain** | Cross-chain bridge operations | BridgeVM | Quasar |
+| **D-Chain** | DEX (order book, perpetuals) | DexVM | Quasar |
+| **G-Chain** | On-chain graph database | GraphVM | Quasar |
+| **I-Chain** | Decentralized identity (DID/VC) | IdentityVM | Quasar |
+| **K-Chain** | Post-quantum key management | KeyVM | Quasar |
+| **M-Chain** | Threshold signing (MPC) | ThresholdVM | Quasar |
+| **O-Chain** | Oracle price feeds | OracleVM | Quasar |
+| **Q-Chain** | Post-quantum consensus coordination | QuantumVM | Quasar |
+| **R-Chain** | Cross-chain message relay | RelayVM | Quasar |
+| **S-Chain** | Service node coordination | ServiceNodeVM | Quasar |
+| **T-Chain** | Cross-chain teleport (bridge+relay+oracle) | TeleportVM | Quasar |
+| **Z-Chain** | Zero-knowledge proofs (FHE) | ZKVM | Quasar |
+
+### Consensus Layer
+Located in `/consensus/` (separate package `github.com/luxfi/consensus`):
+- **Quasar**: Production consensus -- BLS12-381 + Corona (lattice) + ML-DSA-65 (FIPS 204)
+- **Chain Engine**: Linear blockchain consensus (Nova sub-protocol)
+- **DAG Engine**: Directed acyclic graph for parallel processing (Nebula sub-protocol)
+- **PQ Engine**: Post-quantum finality layer
+
+Sub-protocols: Photon (sampling) -> Wave (voting) -> Focus (confidence) -> Ray/Field (finality)
+
+### Virtual Machines
+Located in `/vms/`:
+- **platformvm**: Staking, validation, network management
+- **xvm**: Asset transfers, UTXO model
+- **dexvm**: DEX with order book, perpetuals, AMM
+- **thresholdvm**: Threshold MPC and FHE for confidential computing
+- **quantumvm**: PQ consensus coordination (ML-DSA, Corona)
+- **identityvm**: Decentralized identity (DID, verifiable credentials)
+- **keyvm**: Post-quantum key management (ML-KEM, ML-DSA)
+- **bridgevm**: Cross-chain bridge with MPC attestation
+- **oraclevm**: Decentralized oracle network
+- **aivm**: AI inference verification
+- **graphvm**: On-chain graph database
+- **relayvm**: Cross-chain message relay
+- **servicenodevm**: Service node epoch management
+- **teleportvm**: Unified bridge+relay+oracle
+- **zkvm**: Zero-knowledge proof verification
+- **proposervm**: Block proposer wrapper VM
+
+### Key Interfaces
+
+**p2p.Sender** (from `github.com/luxfi/p2p`):
+```go
+type Sender interface {
+    SendRequest(ctx context.Context, nodeIDs set.Set[ids.NodeID], requestID uint32, request []byte) error
+    SendResponse(ctx context.Context, nodeID ids.NodeID, requestID uint32, response []byte) error
+    SendError(ctx context.Context, nodeID ids.NodeID, requestID uint32, errorCode int32, errorMessage string) error
+    SendGossip(ctx context.Context, config SendConfig, msg []byte) error
+}
+```
+
+**Keychain Interfaces** (from `github.com/luxfi/keychain`):
+```go
+type Signer interface {
+    SignHash([]byte) ([]byte, error)
+    Sign([]byte) ([]byte, error)
+    Address() ids.ShortID
+}
+
+type Keychain interface {
+    Get(addr ids.ShortID) (Signer, bool)
+    Addresses() set.Set[ids.ShortID]
+}
+```
+
+## Package Dependencies
+
+### CRITICAL: Use Lux packages only
+- ✅ `github.com/luxfi/node`
+- ✅ `github.com/luxfi/geth` (NOT go-ethereum)
+- ✅ `github.com/luxfi/consensus`
+- ✅ `github.com/luxfi/keychain`
+- ✅ `github.com/luxfi/ledger`
+- ✅ `github.com/luxfi/lattice` (FHE)
+- ❌ `github.com/luxfi/*` legacy upstream forks
+- ❌ `github.com/ethereum/go-ethereum`
+
+### Import Aliasing
+Avoid conflicts with consensus packages:
+```go
+import (
+    platformblock "github.com/luxfi/node/vms/platformvm/block"
+    consensusblock "github.com/luxfi/consensus/engine/chain"
+)
+```
+
+## Token Denomination
+
+LUX uses **6 decimals** (microLUX base unit) on P-Chain/X-Chain:
+
+| Unit | Value |
+|------|-------|
+| µLUX (MicroLux) | 1 (base) |
+| mLUX (MilliLux) | 1,000 |
+| LUX | 1,000,000 |
+| TLUX (TeraLux) | 10^18 |
+
+**Supply Cap**: 2 trillion LUX (2 × 10^18 µLUX)
+
+C-Chain uses standard EVM 18 decimals (Wei).
+
+See `utils/units/lux.go` for constants.
+
+## Key Technical Decisions
+
+### Genesis Architecture
+```
+github.com/luxfi/genesis (JSON config)  →  github.com/luxfi/node/genesis/builder (type conversion)
+```
+- Genesis package has no node dependencies
+- Builder package handles type conversions (string → ids.NodeID, uint64 → time.Duration)
+
+### CGO Dependencies
+These require CGO for full functionality (graceful fallback when disabled):
+- `consensus/quasar` - GPU NTT acceleration
+- `vms/thresholdvm/fhe` - GPU FHE operations
+- `x/blockdb` - zstd compression
+
+### FHE (Fully Homomorphic Encryption)
+Located in `vms/thresholdvm/fhe/`:
+- Uses `github.com/luxfi/lattice/multiparty` for DKG
+- Lattice-based cryptography only (no fallbacks)
+- Threshold decryption via Warp messaging
+
+**Precompile Addresses:**
+| Precompile | Address |
+|------------|---------|
+| Fheos | `0x0200000000000000000000000000000000000080` |
+| ACL | `0x0200000000000000000000000000000000000081` |
+| InputVerifier | `0x0200000000000000000000000000000000000082` |
+| Gateway | `0x0200000000000000000000000000000000000083` |
+
+### ZAP Transport (Zero-Copy App Proto)
+ZAP is the only wire protocol for VM<->Node communication. The gRPC
+fallback (and its `-tags=grpc` opt-in) was retired in v1.26.31 along
+with every `//go:build grpc` file under `node/`. There is one and only
+one way to talk to a Chain VM: ZAP.
+
+**Build:**
+```bash
+go build                  # ZAP only — there are no build tags
+```
+
+**Key Packages:**
+- `github.com/luxfi/api/zap` — Core wire protocol and message types (Layer A)
+- `github.com/luxfi/protocol/rpcdb` — rpcdb service spec / data carriers (Layer B)
+- `github.com/luxfi/node/db/rpcdb` — rpcdb Service + ZAP transport adapter (Layer C)
+- `vms/rpcchainvm/sender/` — Node-side `p2p.Sender` over ZAP
+- `vms/rpcchainvm/zap/` — ChainVM client/server over ZAP
+- `vms/platformvm/warp/zwarp/` — Warp signing over ZAP
+
+**rpcdb Layered Topology:**
+- Layer A — wire framing: `github.com/luxfi/api/zap`
+- Layer B — rpcdb service spec: `github.com/luxfi/protocol/rpcdb`
+- Layer C — rpcdb impl: `node/db/rpcdb/{service.go, zap_server.go}`
+  - `service.go` — transport-neutral `Service` wrapping `database.Database`
+  - `zap_server.go` — ZAP transport adapter (only adapter)
+- One Service, one transport. The dual-adapter pattern stays available
+  for future transports (each is a new file wrapping `*Service`), but
+  ZAP is the only one shipping.
+
+**Wire Protocol Format:**
+```
+[4 bytes: length][1 byte: message type][payload...]
+```
+
+**Performance Benefits:**
+- Zero-copy serialization (buffer pooling via sync.Pool)
+- ~5-10x faster serialization than protobuf
+- ~2-3x lower latency (no HTTP/2 overhead)
+- ~30-50% CPU reduction on hot paths
+
+**Sender Usage:**
+```go
+// ZAP transport — the only transport
+s := sender.ZAP(zapConn)
+```
+
+**Warp over ZAP:**
+The `zwarp` package implements warp signing via ZAP:
+```go
+// Client implements warp.Signer over ZAP
+client := zwarp.NewClient(zapConn)
+sig, err := client.Sign(unsignedMsg)
+
+// BatchSign for HFT optimization
+sigs, errs := client.BatchSign(messages)
+```
+
+## RNS Transport (Reticulum Network Stack)
+
+The node supports RNS as an alternative transport layer alongside TCP/IP, enabling mesh networking, LoRa connectivity, and offline-first validator operation.
+
+**Specification**: [LP-9701](../lps/LPs/lp-9701-reticulum-network-stack.md)
+
+### Endpoint Types
+
+The `net/endpoints` package supports three addressing modes:
+
+```go
+// IP address
+endpoint := endpoints.NewIPEndpoint(netip.MustParseAddrPort("203.0.113.50:9631"))
+
+// Hostname (DNS resolved)
+endpoint, _ := endpoints.NewHostnameEndpoint("validator.example.com", 9631)
+
+// RNS destination (mesh/LoRa)
+endpoint, _ := endpoints.NewRNSEndpointFromHex("rns://a5f72c3d4e5f60718293a4b5c6d7e8f9")
+```
+
+### Key Files
+
+| File | Purpose |
+|------|---------|
+| `net/endpoints/endpoint.go` | Unified endpoint abstraction (IP, hostname, RNS) |
+| `network/dialer/rns_transport.go` | RNS transport implementation |
+| `network/dialer/rns_identity.go` | Classical identity (Ed25519 + X25519) |
+| `network/dialer/rns_identity_pq.go` | Hybrid PQ identity (+ ML-DSA + ML-KEM) |
+| `network/dialer/rns_link.go` | Encrypted link protocol with PQ support |
+| `network/dialer/rns_announce.go` | Destination discovery and announcements |
+
+### Configuration
+
+```yaml
+# ~/.lux/config.yaml
+rns:
+  enabled: true
+  configPath: ~/.lux/reticulum
+  announceInterval: 5m
+  interfaces:
+    - AutoInterface
+    - TCPClientInterface
+  linkTimeout: 30s
+  postQuantum: true        # Enable hybrid PQ mode
+  requirePostQuantum: false # Allow classical-only peers
+```
+
+## Post-Quantum Cryptography (Hybrid Mode)
+
+RNS transport supports hybrid post-quantum cryptography combining classical algorithms with NIST-standardized post-quantum primitives (TLS 1.3-like approach).
+
+### Cryptographic Suite
+
+| Purpose | Classical | Post-Quantum | Security |
+|---------|-----------|--------------|----------|
+| Identity Signing | Ed25519 | ML-DSA-65 | NIST Level 3 |
+| Key Exchange | X25519 | ML-KEM-768 | NIST Level 3 |
+| Session Encryption | AES-256-GCM | - | 256-bit |
+| Key Derivation | HKDF-SHA256 | - | - |
+
+### Forward Secrecy
+
+- **Ephemeral Keys**: Fresh X25519 + ML-KEM keypairs generated per session
+- **Key Destruction**: Ephemeral private keys zeroed after handshake
+- **Hybrid Derivation**: `combined_secret = X25519_shared || ML_KEM_shared`
+- **Defense-in-Depth**: Secure if either algorithm remains unbroken
+
+### Wire Format Sizes
+
+| Component | Classical | Hybrid | Delta |
+|-----------|-----------|--------|-------|
+| Public Identity | 64 bytes | ~3.2 KB | +3.1 KB |
+| Signature | 64 bytes | ~2.5 KB | +2.4 KB |
+| Key Exchange | 64 bytes | ~1.2 KB | +1.1 KB |
+| Handshake Total | ~256 bytes | ~7.5 KB | +7.2 KB |
+
+### Backward Compatibility
+
+- **Capability Exchange**: Handshake advertises PQ support
+- **Graceful Fallback**: Falls back to classical if peer lacks PQ
+- **Mixed Networks**: PQ and classical validators coexist
+- **Policy Enforcement**: `requirePostQuantum: true` rejects classical peers
+
+### SchemeGate — cross-axis NodeIDScheme enforcement
+
+`network/peer/scheme_gate.go` (v1.26.10) is the single primitive that
+turns a wire NodeID into a `(scheme, NodeID)` pair and runs the
+cross-axis check against the chain's `ChainSecurityProfile`.
+
+- `SchemeGate{Profile, ClassicalCompatUnsafe, ActivationHeight}` is the
+  chain-scoped policy object. One gate per chain, pinned at bootstrap.
+- `Classify(nodeID, scheme, height, site) (TypedNodeID, error)` is the
+  single entry point. Callers pass a site tag (`"handshake"`,
+  `"proposer"`, `"validator"`, `"mempool-sender"`) that appears in the
+  refused-by error.
+- Migration path: `ActivationHeight` is the block at which a strict-PQ
+  chain refuses any non-PQ `NodeIDScheme` byte at every height under
+  the forward-only PQ policy. The classical `secp256k1` (0x90) scheme is
+  refused at the gate; there is no transition window and no operator
+  classical-compat escape hatch (strict-PQ chains refuse classical at
+  every boundary, period).
+- Typed errors: `ErrSchemeGateConfig`, `ErrSchemeGateMismatch`,
+  `ErrSchemeGateUnknownScheme`.
+
+Wire form: `TypedNodeID = (NodeIDScheme byte, 20-byte NodeID)`. The
+20-byte storage/map-key form stays byte-identical; the scheme byte
+travels on the wire so a receiver knows which verifier to dispatch
+without trusting the chain profile alone.
+
+### Testing PQ Forward Secrecy
+
+```bash
+# Run hybrid PQ tests
+go test -v -run "TestHybrid" ./node/network/dialer/... -count=1
+
+# Key tests:
+# - TestHybridIdentity_SignVerify (ML-DSA-65 signatures)
+# - TestHybridIdentity_Encapsulate_Decapsulate (ML-KEM-768)
+# - TestHybridRNSLink_Handshake (full hybrid handshake)
+# - TestHybridRNSLink_ForwardSecrecy (ephemeral key destruction)
+# - TestHybridToClassical_Fallback (backward compatibility)
+```
+
+## Common Gotchas
+
+### 1. P2P Sender Interface
+Node's rpcchainvm implements `p2p.Sender` (from `github.com/luxfi/p2p`) for cross-chain messaging.
+The `sender` package is the ZAP-native implementation of `p2p.Sender`.
+
+### 2. Chain Tracking
+Nodes don't automatically track chains. Use:
+```bash
+--track-chains=<ChainID>
+```
+Or create config: `~/.lux/runs/.../node*/chainConfigs/<ChainID>.json`
+
+### 3. Genesis blobSchedule
+Mainnet genesis requires Cancun fork config:
+```json
+"blobSchedule": {
+  "cancun": {
+    "max": 6,
+    "target": 3,
+    "baseFeeUpdateFraction": 3338477
+  }
+}
+```
+
+### 4. Network Snapshots
+CLI creates new directories on restart. Use snapshots:
+```bash
+lux network save --snapshot-name <name>
+lux network start --snapshot-name <name>
+```
+
+### 5. EIP-3860 Historic Blocks
+For importing pre-merge blocks, Shanghai must be active based on `ShanghaiTime`, not merge status.
+
+### 6. Genesis Hash Mismatch on Restart
+**Problem**: "db contains invalid genesis hash" error when restarting nodes.
+
+**Cause**: Genesis bytes are rebuilt from JSON config on each start. Due to non-deterministic JSON serialization (map iteration order), the rebuilt bytes differ from the original, causing hash mismatch.
+
+**Solution**: Genesis bytes are now cached to `genesis.bytes` file in the node's data directory. On subsequent restarts, the cached bytes are used directly. This happens automatically when using `--genesis-file`.
+
+### 7. VM Config Format Mismatch
+**Problem**: "failed to parse config: unknown codec version" for T-Chain (ThresholdVM) or Z-Chain (ZKVM) in dev mode.
+
+**Cause**: Two issues:
+1. Genesis builder passes JSON config (`{"version":1,"message":"..."}`) to VMs that expect binary codec format
+2. Dev mode's automining config injection converts all chain configs to JSON, breaking binary-codec VMs
+
+**Solution**:
+- `genesis/builder/builder.go`: T-Chain and Z-Chain use `[]byte(config.TChainGenesis)` (empty bytes for defaults) instead of `getGenesis()` which returns JSON
+- `chains/manager.go`: `injectAutominingConfig` only injects for `EVMID`, skipping binary-codec VMs
+
+**Alternative**: Use `--genesis-raw-bytes` flag to pass base64-encoded pre-built genesis bytes directly.
+
+### 8. `vms/components/lux` vs `luxfi/utxo` (parallel UTXO types)
+The `github.com/luxfi/node/vms/components/lux` package contains a parallel
+`lux.UTXO`/`lux.TransferableInput` type tree alongside `github.com/luxfi/utxo`.
+External consumers (e.g. `~/work/liquidity/network-bootstrap/fund.go`) need
+to import the `vms/components/lux` variant to interop with PlatformVM/AVM
+tx builders — `luxfi/utxo` types alone are not accepted by the X→P export
+path. This is a known anomaly pending #58 follow-up consolidation; do NOT
+collapse the two packages without that migration.
+
+## File Locations
+
+| Item | Path |
+|------|------|
+| luxd binary | `~/.lux/bin/luxd/luxdv*/luxd` |
+| VM plugins | `~/.lux/plugins/<VMID>` |
+| Network runs | `~/.lux/runs/local_network/network_*` |
+| Snapshots | `~/.lux/snapshots/` |
+| Chain configs | `~/.lux/chain-configs/<BlockchainID>/` |
+
+## Build Order
+
+1. Build node: `cd ~/work/lux/node && go build -o /tmp/luxd ./main`
+2. Install: `cp /tmp/luxd ~/.lux/bin/luxd/luxdv1.21.0/luxd`
+3. Build EVM: `cd ~/work/lux/evm && go build -o ~/.lux/plugins/<VMID> ./plugin`
+4. Start: `lux network start --mainnet`
+
+## Related Repositories
+
+| Repo | Purpose |
+|------|---------|
+| `~/work/lux/consensus` | Consensus engines (Chain, DAG, PQ) |
+| `~/work/lux/geth` | C-Chain EVM implementation |
+| `~/work/lux/evm` | EVM plugin |
+| `~/work/lux/genesis` | Genesis configurations |
+| `~/work/lux/cli` | Management CLI |
+| `~/work/lux/netrunner` | Network testing |
+| `~/work/lux/dex` | DEX implementation |
+| `~/work/lux/standard` | Solidity contracts (including FHE) |
+| `~/work/lux/lattice` | Lattice cryptography |
+
+## Security Notes
+
+### Mainnet Readiness (2025-12-31)
+- Memory exhaustion protection (IP tracker limits, bloom filter caps)
+- BLS signature CGO/pure-Go consistency
+- Replay attack prevention with timestamp validation
+- Safe math in DEX operations
+
+### 11. P-Chain Block Sync (isMissingContextError "not found")
+**Problem**: New validator node stays at P-chain height 0 even after connecting to testnet peers. Blocks received via Put/PushQuery are silently discarded.
+
+**Root Cause**: `HandleIncomingBlock` returns `"not found"` when the block's parent isn't in the local state. `isMissingContextError` didn't recognize `"not found"` as a missing-context condition, so `requestContext` (GetAncestors) was never called.
+
+**Fix** in `chains/manager.go`, `isMissingContextError`:
+```go
+// Added "not found" pattern:
+strings.Contains(errStr, "not found") // parent block not in local state
+```
+
+**Effect**: Now when a block arrives whose parent is unknown, the handler sends `GetAncestors` to the peer, receives the full ancestor chain, and processes blocks in order, advancing the P-chain height.
+
+**Note**: The network layer (`network.go:sequencerID`) already correctly maps native chain IDs (P, C, X, etc.) to `PrimaryNetworkID` for validator set lookups — no separate gossip fix needed.
+
+### Known CGO Stubs
+When CGO disabled, these use CPU fallbacks:
+- `consensus/quasar/gpu_ntt_nocgo.go`
+- `vms/thresholdvm/fhe/gpu_fhe_nocgo.go`
+- `vms/zkvm/accel/accel_mlx.go`
+
+### 8. ZAP CreateHandlers for VM HTTP Endpoints
+**Problem**: C-chain and D-chain RPC endpoints returning 404 despite VMs running.
+
+**Cause**: The `zap.Client` in `vms/rpcchainvm/zap/client.go` did not implement the `CreateHandlers` interface. The node checks for this interface to register HTTP handlers (like `/rpc`, `/ws`) with the HTTP server.
+
+**Solution**: Added `CreateHandlers` method to `zap.Client` that:
+1. Sends `MsgCreateHandlers` via ZAP wire protocol to the VM
+2. Receives `CreateHandlersResponse` with list of handlers (prefix + server address)
+3. Creates `httputil.NewSingleHostReverseProxy` for each handler
+4. Returns `map[string]http.Handler` for registration
+
+**File Modified**: `vms/rpcchainvm/zap/client.go`
+
+**Verification**:
+```bash
+curl -s -X POST -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
+  http://localhost:9640/ext/bc/C/rpc
+# Returns: {"jsonrpc":"2.0","id":1,"result":"0x17870"}
+```
+
+### 9. Root "/" Endpoint Handler
+**Feature**: The node's root endpoint ("/") provides EVM compatibility and node information.
+
+**Behavior**:
+- **GET /**: Returns JSON node information (nodeId, networkId, version, chains, endpoints)
+- **POST /**: Proxies JSON-RPC requests directly to C-chain `/ext/bc/C/rpc`
+- **OPTIONS /**: Returns CORS preflight headers
+
+**Files Modified**: `server/http/router.go`, `server/http/server.go`
+
+**Types**:
+```go
+type RootInfo struct {
+    NodeID    string `json:"nodeId,omitempty"`
+    NetworkID uint32 `json:"networkId,omitempty"`
+    Version   string `json:"version,omitempty"`
+    Ready     bool   `json:"ready"`
+    Chains    struct { C, P, X string } `json:"chains"`
+    Endpoints struct { RPC, Websocket, Info, Health string } `json:"endpoints"`
+}
+
+type RootInfoProvider interface {
+    GetRootInfo() RootInfo
+}
+```
+
+**Usage**:
+```bash
+# Get node info
+curl http://localhost:9650/
+
+# Send EVM JSON-RPC directly to root (proxied to C-chain)
+curl -X POST -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
+  http://localhost:9650/
+```
+
+**Implementation Notes**:
+- The Server interface exposes `SetRootInfoProvider(provider)` to configure node info
+- When no provider is set, returns default endpoint paths
+- POST errors return proper JSON-RPC error format if C-chain unavailable
+
+### 10. BLS Key Not Loaded into Validators Manager
+**Problem**: Health check shows "validator doesn't have a BLS key" despite BLS keys being correctly configured in genesis.
+
+**Cause**: The `initValidatorSets()` function in `/vms/platformvm/state/state.go` was skipping validator population when `NumNets() != 0`. This happened because:
+1. Network layer might pre-populate validators (without BLS keys) before state initialization
+2. When `initValidatorSets()` runs, it sees validators exist and skips adding them with proper BLS keys
+3. The health check queries `n.vdrs.GetValidator()` which returns validator with nil PublicKey
+
+**Solution**: Modified `initValidatorSets()` to always add validators (not skip when `NumNets() != 0`). The `AddStaker` method replaces existing entries, so validators get updated with proper BLS keys.
+
+**File Modified**: `vms/platformvm/state/state.go` (line ~2144)
+
+**Before**:
+```go
+if s.validators.NumNets() != 0 {
+    // skip re-adding them here
+    return nil
+}
+```
+
+**After**:
+```go
+if s.validators.NumNets() != 0 {
+    log.Info("initValidatorSets: validator manager not empty, will update with BLS keys")
+}
+// Continue to add validators with proper BLS keys
+```
+
+**Verification**:
+```bash
+curl -s http://localhost:9650/ext/health | jq '.checks.bls'
+# Should show: "message": "node has the correct BLS key"
+```
+
+## Benchmark Results (Single Node)
+
+Testing conducted on a single Lux validator node (testnet mode, macOS):
+
+| Metric | Result |
+|--------|--------|
+| Sustained TPS | 1,091 TPS (60s benchmark) |
+| Peak TPS | 1,094 TPS (5 workers) |
+| Query Performance | 840 queries/sec |
+| Query Latency | 17.67ms avg |
+| Optimal Concurrency | 5 workers |
+| Total Transactions | 65,497 txs/min |
+
+**Concurrency Scaling:**
+| Workers | TPS |
+|---------|-----|
+| 1 | 438 |
+| 5 | 1,094 (optimal) |
+| 10 | 684 |
+| 20 | 521 |
+
+**Key Findings:**
+- Single node achieves ~1,100 TPS sustained with optimal concurrency
+- Higher concurrency (>5 workers) decreases TPS due to nonce contention
+- Query latency is consistent at ~18ms
+- Testnet mode uses K=20 Lux consensus (vs K=1 dev mode)
+
+**Benchmark Command:**
+```bash
+cd ~/work/lux/benchmarks
+NODE_ENDPOINT="http://localhost:9640/ext/bc/C/rpc" \
+PRIVATE_KEY="<funded_key>" \
+./bin/bench tps --chains=lux --duration=60s --concurrency=5
+```
+
+## JSON rule — json/v2 at HTTP boundary only; ZAP for all internal data
+
+Encoding boundaries are one-way and explicit:
+
+- **External (HTTP / JSON-RPC API)** — `github.com/go-json-experiment/json` (v2).
+  Never `encoding/json`. This covers: `service/*`, `server/*`, `pubsub/`,
+  `vms/platformvm/service.go`, `vms/xvm/service.go`, JSON-RPC clients
+  (`vms/platformvm/client_*`), CLI tools (`cmd/*`), wallet examples,
+  on-disk config files (read once at boot), genesis/upgrade blobs.
+- **Internal (state, P2P, consensus, MPC, logs, metrics)** — ZAP wire only.
+  No JSON in: `network/`, `consensus/`, `snow/`, `chains/` (data-plane),
+  `vms/*/state/`, `vms/*/block/`, `vms/*/txs/` (struct codec), threshold
+  payloads, P2P message bodies, internal databases.
+
+Migration helpers (v2 API delta vs v1):
+
+| v1 (encoding/json)                | v2 (go-json-experiment/json)                 |
+|-----------------------------------|----------------------------------------------|
+| `json.Marshal(v)`                 | `json.Marshal(v)` (variadic opts; signature compat) |
+| `json.MarshalIndent(v, "", "  ")` | `json.Marshal(v, jsontext.WithIndent("  "))` |
+| `json.Unmarshal(b, &v)`           | `json.Unmarshal(b, &v)`                      |
+| `json.NewEncoder(w).Encode(v)`    | `json.MarshalWrite(w, v)` (no trailing `\n`) |
+| `json.NewDecoder(r).Decode(&v)`   | `json.UnmarshalRead(r, &v)`                  |
+| `json.RawMessage`                 | `jsontext.Value`                             |
+| `*json.SyntaxError`               | `*jsontext.SyntacticError`                   |
+
+v2 semantic differences worth knowing (these change wire shape):
+
+- `[N]byte` field with no `MarshalJSON` ⇒ v2 marshals as base64 string,
+  v1 marshalled as JSON array of byte numbers. Add `MarshalJSON` on the
+  type if the array form is wanted on the wire.
+- `time.Duration` ⇒ v2 default is the standard string form ("30m");
+  v1 marshalled as int nanoseconds. v1 sub-package
+  (`github.com/go-json-experiment/json/v1`) exposes `FormatDurationAsNano(true)`;
+  v2 root does not. Prefer the string form on new APIs.
+- v2 enforces strict UTF-8; raw arbitrary bytes in JSON strings fail.
+  This matters for legacy P2P/internal blobs that happen to be stored
+  through JSON — those should already be on ZAP.
+- `json.MarshalWrite` does NOT append a trailing `\n` (v1 `NewEncoder.Encode` did).
+  Adjust HTTP-handler test fixtures accordingly.
+
+---
+
+*Last Updated*: 2026-06-06

Makefile

@@ -1,123 +1,302 @@
 # Makefile for Lux Node
 
-# Ensure Go bin is in PATH for Make
-export PATH := $(HOME)/go/bin:$(PATH)
+.PHONY: all build build-mlx build-release build-release-upx test clean fmt lint install-mockgen mockgen
 
-# Go parameters
-GOCMD=go
-GOBUILD=$(GOCMD) build
-GOCLEAN=$(GOCMD) clean
-GOTEST=$(GOCMD) test
-GOGET=$(GOCMD) get
-GOMOD=$(GOCMD) mod
-BINARY_NAME=geth
-BINARY_UNIX=$(BINARY_NAME)_unix
+# Configuration
+CGO_ENABLED ?= 1
+FIPS_STRICT ?= 0
 
-# Build flags
-LDFLAGS=-ldflags "-s -w"
-BUILDFLAGS=-v
+# Go 1.26 experimental features:
+#   runtimesecret - zeroes stack/register state after secret.Do() for forward secrecy
+GOEXPERIMENT ?= runtimesecret
+export GOEXPERIMENT
 
-# Default target
-.DEFAULT_GOAL := build
+# FIPS 140-3 always enabled (required for blockchain/financial systems)
+export GOFIPS140 := latest
+ifeq ($(FIPS_STRICT),1)
+	export GODEBUG := fips140=only
+else
+	export GODEBUG := fips140=on
+endif
+export CGO_ENABLED
 
-# Build node
-build: protobuf
-	./scripts/build.sh
+# Environment block for all go commands
+ENV := GOFIPS140=$(GOFIPS140) GODEBUG=$(GODEBUG) CGO_ENABLED=$(CGO_ENABLED)
 
-# Test
+# Build variables
+GO := go
+GOBIN := $(shell go env GOPATH)/bin
+LUXD := ./build/luxd
+
+# Test variables
+TEST_TIMEOUT := 120s
+EXCLUDED_DIRS := /mocks|/proto|/tests/e2e|/tests/load|/tests/upgrade|/tests/fixture
+TEST_PACKAGES := $(shell go list ./... 2>/dev/null | grep -v -E '$(EXCLUDED_DIRS)')
+
+# Colors for output
+GREEN := \033[0;32m
+YELLOW := \033[1;33m
+NC := \033[0m
+
+all: build
+
+# Verify FIPS environment
+verify-fips:
+	@echo "$(GREEN)Verifying FIPS 140-3 Environment...$(NC)"
+	@echo "FIPS_STRICT: $(FIPS_STRICT)"
+	@echo "GOFIPS140: $(GOFIPS140)"
+	@echo "GODEBUG: $(GODEBUG)"
+	@echo "CGO_ENABLED: $${CGO_ENABLED:-not set}"
+	@echo "$(GREEN)✓ Environment ready$(NC)"
+
+# Default build
+build:
+	@echo "$(GREEN)Building luxd...$(NC)"
+	@$(ENV) ./scripts/build.sh
+	@echo "$(GREEN)✓ Build complete$(NC)"
+
+# Default test
 test:
-	@echo "Running tests..."
-	$(GOTEST) -v ./...
+	@echo "$(GREEN)Running tests...$(NC)"
+	@$(ENV) go test -shuffle=on -race -timeout=$(TEST_TIMEOUT) -coverprofile=coverage.out -covermode=atomic $(TEST_PACKAGES)
 
-test-coverage:
-	@echo "Running tests with coverage..."
-	$(GOTEST) -v -coverprofile=coverage.out ./...
-	$(GOCMD) tool cover -html=coverage.out -o coverage.html
+test-short:
+	@echo "Running short tests..."
+	@$(ENV) go test -short -race -timeout=60s $(TEST_PACKAGES)
 
-# Benchmarks
-bench:
-	@echo "Running benchmarks..."
-	$(GOTEST) -bench=. -benchmem ./...
+test-100:
+	@echo "$(GREEN)=== ENSURING 100% TEST PASS RATE ===$(NC)"
+	@$(ENV) go test -shuffle=on -race -timeout=$(TEST_TIMEOUT) $(TEST_PACKAGES)
 
-# Clean
-clean:
-	@echo "Cleaning..."
-	$(GOCLEAN)
-	rm -f $(BINARY_NAME)
-	rm -f $(BINARY_NAME)-*
-	rm -f coverage.out coverage.html
-
-# Install dependencies
-deps:
-	@echo "Installing dependencies..."
-	$(GOGET) -v -t -d ./...
-
-# Update dependencies
-update-deps:
-	@echo "Updating dependencies..."
-	$(GOMOD) download
-	$(GOMOD) tidy
-
-# Format code
 fmt:
-	@echo "Formatting code..."
-	$(GOCMD) fmt ./...
+	@echo "Formatting Go code..."
+	@go fmt ./...
+	@gofumpt -l -w .
 
-# Lint
 lint:
-	@echo "Running linter..."
-	@which golangci-lint > /dev/null || (echo "golangci-lint not installed. Please install: https://golangci-lint.run/usage/install/" && exit 1)
-	golangci-lint run
+	@echo "Running linters..."
+	@./scripts/lint.sh
 
-# Run and install targets are no longer supported; use the build script directly
+clean:
+	@echo "Cleaning build artifacts..."
+	@rm -rf build/
+	@rm -f coverage.out
 
-# Check for security vulnerabilities
-security:
-	@echo "Checking for vulnerabilities..."
-	$(GOCMD) list -json -m all | nancy sleuth
+install-mockgen:
+	@echo "Installing mockgen..."
+	@go install github.com/golang/mock/mockgen@latest
 
-# Generate mocks
-mocks:
+mockgen: install-mockgen
 	@echo "Generating mocks..."
-	$(GOCMD) generate ./...
+	@./scripts/mockgen.sh
 
-# Generate protobuf files
-protobuf:
-	@echo "Generating protobuf files..."
-	@which buf >/dev/null 2>&1 || (echo "buf not found, installing..." && go install github.com/bufbuild/buf/cmd/buf@v1.52.1)
-	@which protoc-gen-go >/dev/null 2>&1 || (echo "protoc-gen-go not found, installing..." && go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.6)
-	@which protoc-gen-go-grpc >/dev/null 2>&1 || (echo "protoc-gen-go-grpc not found, installing..." && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1)
-	@which protoc-gen-connect-go >/dev/null 2>&1 || (echo "protoc-gen-connect-go not found, installing..." && go install connectrpc.com/connect/cmd/protoc-gen-connect-go@latest)
-	./scripts/protobuf_codegen.sh
+# Specific test targets
+test-unit:
+	@echo "Running unit tests..."
+	@$(ENV) go test -short -race $(TEST_PACKAGES)
 
-# Generate all code (mocks + protobuf)
-generate: protobuf mocks
+test-integration:
+	@echo "Running integration tests..."
+	@$(ENV) go test -run Integration -race -timeout=300s $(TEST_PACKAGES)
 
-# Verify modules
-verify:
-	@echo "Verifying modules..."
-	$(GOMOD) verify
+test-e2e:
+	@echo "Running e2e tests..."
+	@$(ENV) ./scripts/tests.e2e.sh
 
-# Show help
+# Build specific binaries
+luxd:
+	@echo "Building luxd..."
+	@$(ENV) ./scripts/build.sh
+
+# Installation targets
+# Install to $GOPATH/bin (default go install behavior)
+install:
+	@echo "Installing luxd to $(GOBIN)..."
+	@$(ENV) go install -v ./main
+	@echo "$(GREEN)✓ Installed to $(GOBIN)/luxd$(NC)"
+	@echo "Make sure $(GOBIN) is in your PATH"
+
+# Install to /usr/local/bin (system-wide, requires sudo)
+install-system: build
+	@echo "Installing luxd to /usr/local/bin..."
+	@sudo cp build/luxd /usr/local/bin/luxd
+	@sudo chmod +x /usr/local/bin/luxd
+	@echo "$(GREEN)✓ Installed to /usr/local/bin/luxd$(NC)"
+
+# Install to ~/.local/bin (user-local, no sudo needed)
+install-local: build
+	@mkdir -p $(HOME)/.local/bin
+	@cp build/luxd $(HOME)/.local/bin/luxd
+	@chmod +x $(HOME)/.local/bin/luxd
+	@echo "$(GREEN)✓ Installed to $(HOME)/.local/bin/luxd$(NC)"
+	@echo "Make sure $(HOME)/.local/bin is in your PATH"
+
+# Symlink from build dir (for development)
+install-dev: build
+	@echo "Creating symlink for development..."
+	@ln -sf $(PWD)/build/luxd $(GOBIN)/luxd
+	@echo "$(GREEN)✓ Symlinked $(PWD)/build/luxd -> $(GOBIN)/luxd$(NC)"
+
+# Development helpers
+dev-setup:
+	@echo "Setting up development environment..."
+	@$(ENV) go mod download
+	@$(ENV) go mod tidy
+
+# Show all available test packages
+list-packages:
+	@echo "Available test packages:"
+	@$(ENV) go list ./... 2>/dev/null | grep -v -E '$(EXCLUDED_DIRS)'
+
+# Count packages
+count-packages:
+	@echo "Total packages: $$($(ENV) go list ./... 2>/dev/null | grep -v -E '$(EXCLUDED_DIRS)' | wc -l)"
+
+# Run specific package tests
+test-package:
+	@if [ -z "$(PKG)" ]; then \
+		echo "Usage: make test-package PKG=./path/to/package"; \
+		exit 1; \
+	fi
+	@echo "Testing package: $(PKG)"
+	@$(ENV) go test -race -timeout=$(TEST_TIMEOUT) $(PKG)
+
+# Node runtime targets
+init-chains:
+	@echo "$(GREEN)Initializing chain directory structure...$(NC)"
+	@mkdir -p ./chains/{C,P,X,Q}/db
+	@mkdir -p ./logs
+	@echo "$(GREEN)✓ Chain directories created$(NC)"
+
+migrate-chain-data: init-chains
+	@echo "$(GREEN)Migrating existing chain data...$(NC)"
+	@if [ -d "$(HOME)/.luxd/chainData/C/db" ]; then \
+		cp -r $(HOME)/.luxd/chainData/C/db/* ./chains/C/db/ 2>/dev/null && \
+		echo "$(GREEN)✓ C-chain data migrated$(NC)"; \
+	fi
+
+run-mainnet: build-fips init-chains
+	@echo "$(GREEN)Starting Lux Mainnet (ID: 96369)...$(NC)"
+	@pkill -f luxd || true
+	@sleep 2
+	$(LUXD) \
+		--network-id=96369 \
+		--staking-enabled=false \
+		--http-host=0.0.0.0 \
+		--http-port=9630 \
+		--data-dir=./chains \
+		--db-dir=./chains \
+		--chain-data-dir=./chains \
+		--log-dir=./logs \
+		--index-enabled=true \
+		--consensus-sample-size=1 \
+		--consensus-quorum-size=1 \
+		--api-admin-enabled=true \
+		--http-allowed-origins="*"
+
+run-testnet: build-fips init-chains
+	@echo "$(GREEN)Starting Lux Testnet (ID: 96368)...$(NC)"
+	@pkill -f luxd || true
+	@sleep 2
+	$(LUXD) \
+		--network-id=96368 \
+		--staking-enabled=false \
+		--http-host=0.0.0.0 \
+		--http-port=9630 \
+		--data-dir=./chains \
+		--db-dir=./chains \
+		--chain-data-dir=./chains \
+		--log-dir=./logs \
+		--index-enabled=true
+
+node-status:
+	@echo "$(GREEN)Checking node status...$(NC)"
+	@curl -s -X POST --data '{"jsonrpc":"2.0","id":1,"method":"info.isBootstrapped","params":{}}' \
+		-H 'content-type:application/json;' http://localhost:9630/ext/info | jq
+
+stop-node:
+	@echo "$(YELLOW)Stopping Lux node...$(NC)"
+	@pkill -f luxd || echo "No running node found"
+
+# Help target
 help:
-	@echo "Makefile for Lux Geth"
+	@echo "$(GREEN)Lux Node Build System$(NC)"
 	@echo ""
-	@echo "Usage:"
-		@echo "  make build          Print Lux C-Chain plugin build instructions"
-		@echo "  make build-all      Alias for make build"
-	@echo "  make test           Run tests"
-	@echo "  make test-coverage  Run tests with coverage"
-	@echo "  make bench          Run benchmarks"
-	@echo "  make clean          Clean build files"
-	@echo "  make deps           Install dependencies"
-	@echo "  make update-deps    Update dependencies"
-	@echo "  make fmt            Format code"
-	@echo "  make lint           Run linter"
-	@echo "  make security       Check for vulnerabilities"
-	@echo "  make mocks          Generate mocks"
-	@echo "  make protobuf       Generate protobuf files"
-	@echo "  make generate       Generate all code (protobuf + mocks)"
-	@echo "  make verify         Verify modules"
-	@echo "  make help           Show this help"
+	@echo "$(YELLOW)Configuration:$(NC)"
+	@echo "  CGO_ENABLED=1   - CGO enabled by default for C++/GPU backends"
+	@echo "  FIPS_STRICT=0   - FIPS 140-3 always enabled, strict mode optional"
+	@echo ""
+	@echo "  Examples:"
+	@echo "    make build                    # Build with CGO (default)"
+	@echo "    CGO_ENABLED=0 make build      # Build without CGO"
+	@echo ""
+	@echo "$(GREEN)Build Targets:$(NC)"
+	@echo "  build         - Build luxd binary"
+	@echo "  build-release - Build smallest possible release binary (~46MB)"
+	@echo "  build-release-upx - Build release + UPX compression (~20MB)"
+	@echo "  build-mlx     - Build with MLX GPU acceleration (requires CGO)"
+	@echo "  verify-fips   - Show current environment configuration"
+	@echo ""
+	@echo "$(GREEN)Test Targets:$(NC)"
+	@echo "  test          - Run all tests (FIPS 140-3 enabled)"
+	@echo "  test-short    - Run short tests only"
+	@echo "  test-100      - Ensure 100% test pass rate"
+	@echo "  test-unit     - Run unit tests"
+	@echo "  test-integration - Run integration tests"
+	@echo "  test-e2e      - Run end-to-end tests"
+	@echo "  test-package  - Test specific package (use PKG=./path)"
+	@echo ""
+	@echo "$(GREEN)Node Operations:$(NC)"
+	@echo "  run-mainnet   - Run Lux mainnet node (ID: 96369)"
+	@echo "  run-testnet   - Run Lux testnet node (ID: 96368)"
+	@echo "  node-status   - Check node bootstrap status"
+	@echo "  stop-node     - Stop running node"
+	@echo "  init-chains   - Initialize chain directories"
+	@echo "  migrate-chain-data - Migrate existing chain data"
+	@echo ""
+	@echo "$(GREEN)Development:$(NC)"
+	@echo "  fmt           - Format Go code"
+	@echo "  lint          - Run linters"
+	@echo "  clean         - Clean build artifacts"
+	@echo "  install       - Install luxd to GOPATH/bin"
+	@echo "  dev-setup     - Setup development environment"
+	@echo "  list-packages - List all test packages"
+	@echo "  count-packages- Count total packages"
+	@echo "  help          - Show this help message"
 
-.PHONY: build build-all test test-coverage bench clean deps update-deps fmt lint security mocks protobuf generate verify help
+# Build with MLX GPU acceleration support (requires CGO)
+build-mlx:
+	@echo "$(GREEN)Building luxd with MLX GPU acceleration (CGO enabled)...$(NC)"
+	@CGO_ENABLED=1 $(ENV) ./scripts/build.sh -tags mlx
+	@echo "$(GREEN)✓ Build complete with MLX support$(NC)"
+
+# Release build - smallest possible binary with all optimizations
+# Strips: symbols, DWARF debug info, build ID, file paths
+# Disables: inlining for smaller binary, bounds check insertion
+RELEASE_LDFLAGS := -s -w -buildid=
+RELEASE_GCFLAGS := all=-l -B
+
+build-release:
+	@echo "$(GREEN)Building luxd release binary (optimized for size)...$(NC)"
+	@mkdir -p build
+	@GOWORK=off $(ENV) go build \
+		-ldflags="$(RELEASE_LDFLAGS) \
+			-X github.com/luxfi/node/version.GitCommit=$$(git rev-parse --short HEAD 2>/dev/null || echo 'unknown') \
+			-X github.com/luxfi/node/version.VersionMajor=$$(grep 'version_major=' scripts/constants.sh | cut -d= -f2 || echo '1') \
+			-X github.com/luxfi/node/version.VersionMinor=$$(grep 'version_minor=' scripts/constants.sh | cut -d= -f2 || echo '0') \
+			-X github.com/luxfi/node/version.VersionPatch=$$(grep 'version_patch=' scripts/constants.sh | cut -d= -f2 || echo '0')" \
+		-gcflags="$(RELEASE_GCFLAGS)" \
+		-trimpath \
+		-o build/luxd \
+		./main
+	@echo "$(GREEN)✓ Release build complete: $$(ls -lh build/luxd | awk '{print $$5}')$(NC)"
+
+# Release build with UPX compression (if available)
+build-release-upx: build-release
+	@if command -v upx >/dev/null 2>&1; then \
+		echo "$(GREEN)Compressing with UPX...$(NC)"; \
+		upx --best -q build/luxd; \
+		echo "$(GREEN)✓ Compressed: $$(ls -lh build/luxd | awk '{print $$5}')$(NC)"; \
+	else \
+		echo "$(YELLOW)UPX not installed. Install with: brew install upx$(NC)"; \
+	fi

README.md

@@ -1,12 +1,27 @@
 <div align="center">
-  <img src="https://lux.network/logo.png">
+  <img src="resources/LuxLogoRed.png?raw=true">
 </div>
 
 ---
 
+[![Build Status](https://github.com/luxfi/node/actions/workflows/ci.yml/badge.svg)](https://github.com/luxfi/node/actions)
+[![Go Version](https://img.shields.io/badge/go-1.26.3-blue.svg)](https://golang.org/)
+[![License](https://img.shields.io/badge/license-BSD--3--Clause-blue.svg)](LICENSE)
+
 Node implementation for the [Lux](https://lux.network) network -
 a blockchains platform with high throughput, and blazing fast transactions.
 
+## Features
+
+- **High Performance**: Optimized for throughput with sub-second finality
+- **Quasar Consensus**: Quasar (BLS + Pulsar + ML-DSA) with Nova (linear chains) and Nebula (DAG chains) modes; sub-protocols include Photon, Wave, Focus, Flare, Horizon, Ray, Field
+- **EVM Compatible**: Full Ethereum Virtual Machine support on C-Chain  
+- **Multi-Chain Architecture**: Platform (P), Exchange (X), and Contract (C) chains
+- **Custom Nets**: Create custom blockchain networks with configurable VMs
+- **Cross-Chain Transfers**: Native cross-chain asset transfers between chains
+- **L1 Validators**: Support for L1 (Layer 1) validator operations with BLS signatures
+- **LP-118 Protocol**: Implementation of LP-118 for warp message handling and aggregation
+
 ## Installation
 
 Lux is an incredibly lightweight protocol, so the minimum computer requirements are quite modest.
@@ -23,7 +38,7 @@ The minimum recommended hardware specification for nodes connected to Mainnet is
 
 If you plan to build Lux Node from source, you will also need the following software:
 
-- [Go](https://golang.org/doc/install) version >= 1.23.9
+- [Go](https://golang.org/doc/install) version >= 1.26.3
 - [gcc](https://gcc.gnu.org/)
 - g++
 
@@ -48,44 +63,37 @@ Build Lux Node by running the build task:
 ./scripts/run_task.sh build
 ```
 
-The `luxd` binary is now in the `build` directory. To run:
+The `node` binary is now in the `build` directory. To run:
 
 ```sh
-./build/luxd
+./build/node
 ```
 
-### Binary Repository
-
-Install Lux Node using an `apt` repository.
-
-#### Adding the APT Repository
-
-If you already have the APT repository added, you do not need to add it again.
-
-To add the repository on Ubuntu, run:
-
-```sh
-sudo su -
-wget -qO - https://downloads.lux.network/luxd.gpg.key | tee /etc/apt/trusted.gpg.d/luxd.asc
-source /etc/os-release && echo "deb https://downloads.lux.network/apt $UBUNTU_CODENAME main" > /etc/apt/sources.list.d/lux.list
-exit
-```
-
-#### Installing the Latest Version
-
-After adding the APT repository, install `node` by running:
-
-```sh
-sudo apt update
-sudo apt install node
-```
-
-### Binary Install
+### Binary Install (GitHub Releases)
 
 Download the [latest build](https://github.com/luxfi/node/releases/latest) for your operating system and architecture.
 
 The Lux binary to be executed is named `luxd`.
 
+#### Linux (amd64/arm64)
+
+```sh
+VERSION="vX.Y.Z"
+GOARCH="amd64" # or arm64
+curl -L -o node.tar.gz "https://github.com/luxfi/node/releases/download/${VERSION}/node-linux-${GOARCH}-${VERSION}.tar.gz"
+tar -xzf node.tar.gz
+./luxd --help
+```
+
+#### macOS (amd64/arm64)
+
+```sh
+VERSION="vX.Y.Z"
+curl -L -o node.zip "https://github.com/luxfi/node/releases/download/${VERSION}/node-macos-${VERSION}.zip"
+unzip node.zip
+./luxd --help
+```
+
 ### Docker Install
 
 Make sure Docker is installed on the machine - so commands like `docker run` etc. are available.
@@ -102,10 +110,10 @@ To check the built image, run:
 docker image ls
 ```
 
-The image should be tagged as `luxfi/node:xxxxxxxx`, where `xxxxxxxx` is the shortened commit of the Lux source it was built from. To run the Lux node, run:
+The image should be tagged as `ghcr.io/luxfi/node:xxxxxxxx`, where `xxxxxxxx` is the shortened commit of the Lux source it was built from. To run the Lux node, run:
 
 ```sh
-docker run -ti -p 9650:9650 -p 9651:9651 luxfi/node:xxxxxxxx /node/build/luxd
+docker run -ti -p 9630:9630 -p 9631:9631 ghcr.io/luxfi/node:xxxxxxxx /node/build/node
 ```
 
 ## Running Lux
@@ -115,7 +123,7 @@ docker run -ti -p 9650:9650 -p 9651:9651 luxfi/node:xxxxxxxx /node/build/luxd
 To connect to the Lux Mainnet, run:
 
 ```sh
-./build/luxd
+./build/node
 ```
 
 You should see some pretty ASCII art and log messages.
@@ -124,56 +132,21 @@ You can use `Ctrl+C` to kill the node.
 
 ### Connecting to Testnet
 
-To connect to the Testnet Testnet, run:
+To connect to the Testnet, run:
 
 ```sh
-./build/luxd --network-id=testnet
+./build/node --network-id=testnet
 ```
 
 ### Creating a Local Testnet
 
-The [Lux CLI](https://github.com/luxfi/cli) is the easiest way to start a local network.
+The [lux-cli](https://github.com/luxfi/lux-cli) is the easiest way to start a local network.
 
 ```sh
 lux network start
 lux network status
 ```
 
-### Single-Node Development Mode
-
-For quick local development, you can run a single-node Lux network with sybil protection disabled:
-
-```sh
-# Using the convenience script
-make dev
-
-# Or manually with all options
-./build/luxd \
-    --network-id=local \
-    --sybil-protection-enabled=false \
-    --http-host=0.0.0.0 \
-    --http-port=9630 \
-    --staking-port=9631 \
-    --api-admin-enabled=true \
-    --api-keystore-enabled=true \
-    --api-metrics-enabled=true
-```
-
-The single-node dev mode provides:
-- **HTTP RPC endpoint**: `http://localhost:9630`
-- **WebSocket endpoint**: `ws://localhost:9630/ext/bc/C/ws`
-- **C-Chain RPC**: `http://localhost:9630/ext/bc/C/rpc`
-
-You can interact with the C-Chain using standard Ethereum tools:
-```sh
-# Example using curl
-curl -X POST --data '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
-     -H "Content-Type: application/json" \
-     http://localhost:9630/ext/bc/C/rpc
-```
-
-**Note**: Single-node mode with sybil protection disabled should only be used for development. Never use this configuration on public networks (Mainnet or Testnet).
-
 ## Bootstrapping
 
 A node needs to catch up to the latest network state before it can participate in consensus and serve API calls. This process (called bootstrapping) currently takes several days for a new node connected to Mainnet.
@@ -237,7 +210,7 @@ Lux Node is first and foremost a client for the Lux network. The versioning of L
 
 ### Library Compatibility Guarantees
 
-Because `luxd` version denotes the network version, it is expected that interfaces exported by Lux Node may change in `Patch` version updates.
+Because Lux Node's version denotes the network version, it is expected that interfaces exported by Lux Node's packages may change in `Patch` version updates.
 
 ### API Compatibility Guarantees
 

RELEASE.md

@@ -0,0 +1,187 @@
+# Lux release — build + publish via platform.hanzo.ai (the ONE canonical way)
+
+This is the single, repeatable way to build and publish the Lux release
+artifacts. It runs entirely on our own infrastructure — **the PaaS
+(platform.hanzo.ai) + self-hosted arcd runners + DOKS/fleet**. There is **no
+GitHub Actions build path** (the `.github/workflows/*` build/release workflows
+are retired — see [§Retire](#retire-the-github-actions-build-workflows)).
+
+## What a release produces
+
+ONE `Dockerfile` multi-stage build (this repo) is the single source of truth.
+It compiles `luxd` + all 12 VM plugins (CGO_ENABLED=0) and yields TWO
+distribution surfaces:
+
+| # | Artifact | Destination | Consumed by |
+|---|----------|-------------|-------------|
+| 1 | node image (luxd + 12 plugins baked at `/luxd/build/plugins/`) | `ghcr.io/luxfi/node:vX.Y.Z` | operator pod image; `startup.sh cp /luxd/build/plugins/*` |
+| 2 | plugin set (the 12 VM-ID binaries + `SHA256SUMS`) | `s3://lux-plugins-<env>/<pluginset>/` | operator `plugin-fetch` init container (LuxNetwork CR `pluginSource`) |
+
+Artifact 2 is **extracted from** artifact 1 — the plugins are never compiled
+twice. One build, two surfaces (DRY, orthogonal).
+
+The plugin versions are pinned as Dockerfile build-args, kept in lockstep with
+this repo's `go.mod`:
+
+- `EVM_VERSION` (luxfi/evm — C-Chain EVM, the `0x9999` settlement surface)
+- `CHAINS_REF` (luxfi/chains — the 10 non-DEX VMs incl. bridgevm)
+- `DEX_REF` (luxfi/dex `cmd/dchain` — the native D-Chain DEX VM)
+
+## The machinery
+
+```
+git tag vX.Y.Z (push)
+        │  GitHub App webhook ─▶ https://platform.hanzo.ai/v1/github-webhook
+        ▼
+  platform BuildScheduler  ── reads hanzo.yml @ tag, validates, enqueues
+        │                      one build_job per matrix entry
+        ▼
+  native long-poll fabric (build-queue.ts)        NO GitHub Actions hop
+        │  arcd runner POST /v1/arcd/poll  (HMAC)
+        ▼
+  arcd runner on pool lux-build-linux-<arch>
+        │  git checkout @ tag → docker build -f Dockerfile . → docker push
+        ▼
+  ghcr.io/luxfi/node:vX.Y.Z         (artifact 1)
+        │  POST /v1/arcd/complete (status, image_digest)
+        ▼
+  build_job (DB, system-of-record)
+```
+
+- **PaaS**: `platform.hanzo.ai` (`~/work/hanzo/platform`,
+  `pkg/platform/src/services/ci/`). Owns the schema, the scheduler, the durable
+  `build_job` record, and the native long-poll dispatch.
+- **Build muscle**: self-hosted **arcd** runner pools, `lux-build-linux-amd64`
+  and `lux-build-linux-arm64` (one daemon per fleet host; `spark` = linux/arm64,
+  amd64 via buildx). NO GitHub-hosted runners; NO GitHub Actions orchestration
+  on the native path.
+- **Contract**: `~/work/hanzo/platform/docs/PLATFORM_CI.md`.
+
+## Build — the one command
+
+A release is a semver tag push. The declarative entrypoint is this repo's
+[`hanzo.yml`](./hanzo.yml); the trigger is one of:
+
+**(a) Tag push (normal release).** Cutting the tag IS the release:
+
+```bash
+git tag v1.30.41 && git push origin v1.30.41
+```
+
+The webhook maps `refs/tags/v1.30.41` → `branch=v1.30.41`; `hanzo.yml`'s
+`tag-pattern: "{{git.branch}}"` yields the image tag `v1.30.41`. Platform
+schedules the amd64 + arm64 builds onto the live `lux-build-*` arcd pools and
+pushes the multi-arch image to GHCR.
+
+**(b) On-demand (re-release / backfill).** The platform `buildJob.trigger`
+tRPC mutation schedules the same build for an explicit ref, no push required:
+
+```
+buildJob.trigger({
+  installationId: "<luxfi GitHub App installation id>",
+  repo: "luxfi/node",
+  sha:  "<commit at the tag>",
+  ref:  "refs/tags/v1.30.41",
+  branch: "v1.30.41"            // → image tag via {{git.branch}}
+})
+```
+
+Track it: `buildJob.list` / `buildJob.one` / `buildJob.logs` (org-scoped).
+
+> A pool goes **native** the moment an arcd runner self-registers for it
+> (`arcd_runner.lastSeen` within 90s); until then platform transparently falls
+> back to `workflow_dispatch` so a build is never stranded. To run a release
+> fully GitHub-free, ensure a `lux-build-linux-{amd64,arm64}` runner is live
+> (`tRPC arcd` / the `arcd_runner` table). Set platform env
+> `WORKFLOW_DISPATCH_FALLBACK=false` to forbid the legacy hop.
+
+### What the runner runs (identical on a fleet host, for manual/DR builds)
+
+The native path runs exactly the repo's `Dockerfile`. To reproduce on a fleet
+host directly (e.g. `spark`), with no platform and no GitHub:
+
+```bash
+# on spark (linux/arm64; amd64 via buildx)
+git clone --branch v1.30.41 git@github.com:luxfi/node.git && cd node
+docker buildx build --platform linux/amd64 \
+  --build-arg CGO_ENABLED=0 \
+  -t ghcr.io/luxfi/node:v1.30.41 -f Dockerfile --push .
+```
+
+## Publish the plugin set — step 2
+
+After the image exists, publish artifact 2 from it (one command, idempotent,
+no second compile). Run on any fleet host or a DOKS Job that has `crane`/docker
++ `mc`; typically the same arcd runner that just built the image:
+
+```bash
+scripts/publish_plugin_set.sh \
+  ghcr.io/luxfi/node:v1.30.41 \
+  lux-plugins-<env>/<pluginset> \
+  lux                          # mc alias for the target MinIO/S3
+# e.g. lux-plugins-testnet/v1.3.5
+```
+
+It extracts the 12 plugin binaries from the image, writes `SHA256SUMS`, uploads
+all to `s3://lux-plugins-<env>/<pluginset>/`, and verifies remote==local sha.
+
+S3 is the in-cluster MinIO (`s3.lux-system.svc.cluster.local:9000`, external
+`s3.lux.network`). Configure the `mc` alias once with the `hanzo-s3-secret`
+credentials:
+
+```bash
+mc alias set lux <endpoint> hanzo "$(kubectl -n lux-system get secret \
+  hanzo-s3-secret -o jsonpath='{.data.password}' | base64 -d)" --api s3v4
+```
+
+A pluginset prefix is **immutable** — bump `<pluginset>` for a new release,
+never overwrite a prefix a live network points at.
+
+## Deploy — step 3 (operator, not this repo)
+
+luxd rollout is owned by the **lux operator** (`~/work/lux/operator`,
+`LuxNetwork` CR). Update the CR's `image.tag` (artifact 1) and, when the
+network fetches plugins from S3, the `pluginSource.bucket` + per-plugin
+`sha256` (artifact 2, from the `SHA256SUMS` you just published). The operator's
+`plugin-fetch` init container verifies each sha256 fail-closed. This is
+deliberately decoupled from build: `hanzo.yml` has **no `deploy:` block**.
+
+## Reproducibility
+
+- The build is **functionally reproducible**: same source tags + same toolchain
+  (Go 1.26.4) + `CGO_ENABLED=0` ⇒ functionally identical plugins, provable by a
+  fleet rebuild (verified: `spark` rebuilt evm@v1.99.37 + dexvm@v1.5.15 from the
+  same tags). It is **not bit-identical by construction**: the Dockerfile plugin
+  stages omit `-trimpath` and use `-mod=mod` with a first-party `go.sum` strip
+  (re-resolves luxfi/* deps), so embedded paths + re-tagged module content can
+  shift the bytes (Go `BuildID` differs; binary ~16 KB larger). The published
+  image is the canonical artifact; verify against ITS baked sha (what
+  `publish_plugin_set.sh` records), not a separate fleet build.
+- To make releases bit-reproducible (future hardening, patch-only): add
+  `-trimpath` to every plugin `go build` and pin `go.sum` (drop the strip +
+  `-mod=mod`). Tracked as a follow-up; not required for correctness.
+
+## Retire the GitHub Actions build workflows
+
+These `.github/workflows/*` build/release/CI workflows are superseded by this
+flow and must be removed/disabled (platform owns build; the native long-poll
+owns dispatch). Delete them once a `lux-build-*` arcd runner is live:
+
+| Workflow | Replaced by |
+|----------|-------------|
+| `docker.yml` (built `ghcr.io/luxfi/node` on the `lux-build` ARC pool) | `hanzo.yml` (artifact 1) — native long-poll, NO GitHub Actions |
+| `release.yml` | the tag-push trigger above + `scripts/publish_plugin_set.sh` |
+| `build.yml`, `ci.yml` | platform CI test step (runner runs `go test` pre-build) |
+| `build-linux-binaries.yml` | `Dockerfile` builder stage (luxd binary) |
+| `build-ubuntu-amd64-release.yml`, `build-ubuntu-arm64-release.yml` | `Dockerfile` + buildx multi-arch |
+| `build-macos-release.yml`, `build-win-release.yml`, `build-and-test-mac-windows.yml` | arcd `lux-build-{macos,windows}-*` pools (matrix in `hanzo.yml` when desired) |
+| `build-deb-pkg.sh`, `build-tgz-pkg.sh` (under `.github/workflows/`) | packaging step on the arcd runner (post-build), not GitHub Actions |
+| `codeql-analysis.yml`, `fuzz.yml`, `fuzz_merkledb.yml`, `test-database-replay.yml` | scheduled jobs on arcd / DOKS (not a build dependency) |
+| `buf-lint.yml`, `buf-push.yml`, `labels.yml`, `stale.yml` | repo-hygiene; migrate to arcd cron or drop |
+
+The same retirement applies to the equivalent build/release workflows in the
+plugin-source repos (`luxfi/evm`, `luxfi/chains`, `luxfi/dex`): their artifacts
+are built from source by THIS repo's `Dockerfile` at the pinned refs, so those
+repos need no independent image/release CI — only their tags. Migrate each by
+adding a `hanzo.yml` (if it ships its own image) or deleting its build CI (if it
+is consumed only as a Go module / plugin source here).

SECURITY.md

@@ -1,17 +1,196 @@
-# Security Policy
+# Security
 
-Lux takes the security of the platform and of its users very seriously. We and our community recognize the critical role of external security researchers and developers and welcome responsible disclosures. Valid reports will be eligible for a reward (terms and conditions apply).
+## Reporting Vulnerabilities
 
-## Reporting a Vulnerability
+Report security issues to **security@lux.network**. Do not open public issues for vulnerabilities.
 
-**Please do not file a public ticket** mentioning the vulnerability. To disclose a vulnerability submit it through our [Bug Bounty Program](https://immunefi.com/bounty/luxfi/).
+- Provide a description, reproduction steps, and affected components.
+- We will acknowledge receipt within 48 hours.
+- We will provide an initial assessment within 7 business days.
+- We coordinate disclosure timelines with the reporter.
 
-Vulnerabilities must be disclosed to us privately with reasonable time to respond, and avoid compromise of other users and accounts, or loss of funds that are not your own. We do not reward spam or social engineering vulnerabilities.
+If the vulnerability affects production funds or consensus safety, we treat it as P0 and begin remediation immediately.
 
-Do not test for or validate any security issues in the live Lux networks (Mainnet and Testnet testnet), confirm all exploits in a local private testnet.
+## Cryptographic Primitives
 
-Please refer to the [Bug Bounty Page](https://immunefi.com/bounty/luxfi/) for the most up-to-date program rules and scope.
+Production implementations live in `lux/crypto/` and `lux/lattice/`. Formal verification proofs for each primitive are in `lux/papers/proofs/`.
 
-## Supported Versions
+### Signatures
 
-Please use the [most recently released version](https://github.com/luxfi/node/releases/latest) to perform testing and to validate security issues.
+| Primitive | Standard | Implementation | Use |
+|-----------|----------|---------------|-----|
+| BLS12-381 | draft-irtf-cfrg-bls-signature | `crypto/bls/` | Validator consensus, warp message aggregation |
+| ECDSA secp256k1 | SEC 2 | `crypto/secp256k1/` | EVM transaction signing, C-Chain |
+| ECDSA secp256r1 | FIPS 186-5 | `crypto/secp256r1/` | WebAuthn, hardware key support |
+| ML-DSA-65 | FIPS 204 | `crypto/mldsa/` | Post-quantum validator identity |
+| SLH-DSA | FIPS 205 | `crypto/slhdsa/` | Hash-based PQ fallback signatures |
+| Falcon-512/1024 | NIST Round 3 | `crypto/pq/` | EVM precompile PQ signatures (ETHFALCON) |
+| Corona | Internal | `lux/lattice/` | Lattice-based threshold signatures for anonymous validator participation |
+
+### Key Encapsulation
+
+| Primitive | Standard | Implementation | Use |
+|-----------|----------|---------------|-----|
+| ML-KEM-768 | FIPS 203 | `crypto/mlkem/` | Post-quantum key exchange, encrypted P2P handshake |
+| HPKE | RFC 9180 | `crypto/hpke/` | Hybrid public key encryption |
+
+### Symmetric and AEAD
+
+| Primitive | Standard | Implementation | Use |
+|-----------|----------|---------------|-----|
+| ChaCha20-Poly1305 | RFC 8439 | `crypto/aead/` | Authenticated encryption for P2P transport |
+| AES-256-GCM | NIST SP 800-38D | `crypto/aead/` | Alternative AEAD for hardware-accelerated paths |
+
+### Key Derivation and Hashing
+
+| Primitive | Standard | Implementation | Use |
+|-----------|----------|---------------|-----|
+| Argon2id | RFC 9106 | `crypto/kdf/` | Password hashing, key stretching |
+| HKDF-SHA256 | RFC 5869 | `crypto/kdf/` | Key derivation from shared secrets |
+| Keccak-256 | FIPS 202 | `crypto/keccak.go` | EVM address derivation, state hashing |
+| BLAKE2b | RFC 7693 | `crypto/blake2b/` | Non-EVM hashing, content addressing |
+| Poseidon2 | ZK-friendly | `crypto/hash/` | Zero-knowledge circuit hashing (Z-Chain) |
+
+### Threshold and MPC
+
+| Primitive | Protocol | Implementation | Use |
+|-----------|----------|---------------|-----|
+| FROST | Komlo-Goldberg 2020 | `crypto/threshold/` | Threshold Schnorr signatures for bridge custody |
+| CGGMP21 | Canetti et al. 2021 | `crypto/cggmp21/` | Threshold ECDSA for multi-chain custody |
+| LSS | Shamir + live resharing | `crypto/secret/` | Dynamic secret sharing with participant rotation |
+
+### Fully Homomorphic Encryption
+
+| Primitive | Scheme | Implementation | Use |
+|-----------|--------|---------------|-----|
+| TFHE | Torus FHE | `crypto/` + precompiles | Encrypted smart contract computation |
+| CKKS | Approximate arithmetic | `crypto/` | Privacy-preserving ML inference |
+
+## Network Security
+
+### P2P Transport
+
+- All peer connections use mutual TLS 1.3.
+- Post-quantum handshake option via ML-KEM-768 + X25519 hybrid key exchange (`crypto/kem/`).
+- Peer identity bound to staking key (BLS public key for validators, secp256k1 for API nodes).
+- Eclipse resistance via peer discovery protocol with formal proof (`papers/proofs/proof-network-peer-discovery.tex`).
+
+### Consensus Transport
+
+- ZAP binary wire protocol (`papers/lux-zap-wire-protocol.tex`) for consensus messages.
+- Zero-allocation serialization path -- no GC pressure under load.
+- Warp messaging for cross-chain: BLS aggregate signatures verified on-chain (`papers/lux-warp-messaging.tex`).
+
+### Validator Security
+
+- Zero-trust validator architecture (`papers/lux-zero-trust-validators.tex`).
+- HSM boundary design for validator keys (`papers/lux-hsm-boundary.tex`).
+- Hybrid certificate chains with PQ trust anchors (`papers/lux-hybrid-certificates.tex`).
+- Reproducible builds with content-addressed attestation (`papers/lux-reproducible-builds.tex`).
+
+## Key Management
+
+### Validator Keys
+
+- BLS signing keys stored in HSM (PKCS#11) or secure enclave where available.
+- Threshold key generation via DKG -- no single party holds the full key.
+- Key rotation via live secret resharing (LSS protocol) without chain downtime.
+
+### HD Wallets
+
+- BIP-32/44 hierarchical deterministic derivation.
+- secp256k1 and secp256r1 key paths.
+- Hardware wallet integration (Ledger, Trezor) for end-user keys.
+
+### MPC Custody (M-Chain)
+
+- FROST t-of-n for Schnorr/Taproot custody.
+- CGGMP21 t-of-n for ECDSA custody (Ethereum, Bitcoin legacy).
+- Session lifecycle management with NATS transport.
+- Formal proofs: `papers/proofs/proof-crypto-frost.tex`, `papers/proofs/proof-crypto-cggmp21.tex`.
+
+### Bridge Custody
+
+- Teleport bridge uses MPC group keys -- no single custodian.
+- Per-chain governance: each chain's bridge parameters are sovereign.
+- Configurable key rotation delay.
+- Formal proof: `papers/proofs/proof-bridge-teleport.tex`.
+
+## Audit History
+
+### Round 1 -- December 2025 (Component Audits)
+
+3 targeted audits covering DexVM, oracle protocol, and perpetuals contracts:
+
+| Report | Scope |
+|--------|-------|
+| `audits/2025-12-11-dexvm-audit.md` | DEX VM code review |
+| `audits/2025-12-11-oracle-audit.md` | Oracle and price feed implementation |
+| `audits/2025-12-11-perpetuals-audit.md` | Perpetuals and derivatives contracts |
+
+### Round 2 -- December 2025 (Full Ecosystem)
+
+12 component audits covering the entire node implementation. Compiled from commit `66d514d2b7`.
+
+| Report | Scope |
+|--------|-------|
+| `audits/2025-12-30-architecture-review.md` | Full architecture review |
+| `audits/2025-12-30-consensus-audit.md` | Consensus layer (Quasar, including Nova linear and Nebula DAG modes) |
+| `audits/2025-12-30-contracts-audit.md` | Smart contract security |
+| `audits/2025-12-30-crypto-audit.md` | Cryptography stack (BLS, PQ, MPC) |
+| `audits/2025-12-30-database-audit.md` | Storage layer |
+| `audits/2025-12-30-dexvm-audit.md` | DexVM (D-Chain) |
+| `audits/2025-12-30-network-audit.md` | Network layer and P2P |
+| `audits/2025-12-30-oracle-protocol-audit.md` | Oracle and attestation protocol |
+| `audits/2025-12-30-other-vms-audit.md` | Secondary VMs |
+| `audits/2025-12-30-platformvm-audit.md` | PlatformVM (P-Chain) |
+| `audits/2025-12-30-proposervm-evm-audit.md` | ProposerVM and EVM integration |
+| `audits/2025-12-30-thresholdvm-audit.md` | ThresholdVM (T-Chain) |
+| `audits/2025-12-30-warp-audit.md` | Warp cross-chain messaging |
+| `audits/2025-12-30-zkvm-audit.md` | ZKVM (Z-Chain) |
+
+Summary report: `security/2025-12-30-final-security-analysis.md`
+Status report: `security/2025-12-30-FINAL-STATUS.md`
+
+164 total findings (17 critical, 42 high, 58 medium, 47 low). Identified development placeholders (XOR stubs, length-only verification) in advanced features not yet in production. Core chains (P-Chain, X-Chain, C-Chain) passed clean.
+
+### Round 3 -- January/March 2026 (Smart Contracts)
+
+Two focused audits on the Solidity contract stack:
+
+| Report | Scope |
+|--------|-------|
+| `audits/standard-2026-01-30/` | `@luxfi/standard` contract suite -- 832 tests, 105 fuzz tests |
+| `audits/2026-03-25-comprehensive-security-audit.md` | `lux/standard` v1.6.5, `lux/liquid` v1.1.0, `liquidity/contracts` |
+
+The March 2026 comprehensive audit used red/blue adversarial methodology with Foundry, Slither, Semgrep, Aderyn, Halmos (symbolic execution), and Lean 4 (theorem proving).
+
+Results: 15 critical, 13 high, 10 medium, 3 low -- all remediated. 1,383 tests passing. 48 Halmos symbolic proofs + 33 Lean 4 theorems + 33 Foundry invariant tests.
+
+Post-remediation risk: LOW. CI enforces Slither (fail-on: medium), Semgrep, Aderyn, and `forge fmt` on every push to main.
+
+### Current Status
+
+All critical and high findings from the contract audits are resolved. The December 2025 node audit identified development stubs in post-quantum and zero-knowledge subsystems that are not deployed to production; these are tracked and being replaced with real implementations as each subsystem matures.
+
+## Formal Verification
+
+50 mechanized proofs in `papers/proofs/`, covering:
+
+- **Consensus**: safety, liveness, BFT thresholds, finality composition, validator economics
+- **Cryptography**: BLS aggregation, FROST unforgeability, CGGMP21 UC-security, ML-DSA, ML-KEM, SLH-DSA, Corona, TFHE, CKKS, Verkle commitments, hybrid signatures, threshold composition, linear secret sharing
+- **DeFi**: AMM invariants, order book correctness, flash loan safety, router correctness, governance, fee models
+- **Bridge**: Teleport protocol, warp message security/delivery/ordering
+- **Network**: peer discovery and eclipse resistance
+- **Build**: reproducibility, attestation, coeffect algebra, cross-ecosystem verification
+- **Trust**: authority lattice, vouch model, revocation
+
+See `papers/INDEX.md` for the full list.
+
+## Bug Bounty
+
+If you discover a vulnerability, contact **security@lux.network**. We will work with you on responsible disclosure and appropriate recognition.
+
+---
+
+*Lux Industries -- security@lux.network*

Taskfile.yml

@@ -8,8 +8,20 @@ tasks:
   default: ./scripts/run_task.sh --list
 
   build:
-    desc: Builds luxd
-    cmd: ./scripts/build.sh
+    desc: Builds node
+    cmd: ./scripts/build.sh -- {{.CLI_ARGS}}
+
+  build-antithesis-images-node:
+    desc: Builds docker images for antithesis for the node test setup
+    env:
+      TEST_SETUP: node
+    cmd: bash -x ./scripts/build_antithesis_images.sh
+
+  build-antithesis-images-xsvm:
+    desc: Builds docker images for antithesis for the xsvm test setup
+    env:
+      TEST_SETUP: xsvm
+    cmd: bash -x ./scripts/build_antithesis_images.sh
 
   build-bootstrap-monitor:
     desc: Builds bootstrap-monitor
@@ -20,11 +32,11 @@ tasks:
     cmd: ./scripts/build_bootstrap_monitor_image.sh
 
   build-image:
-    desc: Builds docker image for luxd
+    desc: Builds docker image for node
     cmd: ./scripts/build_image.sh
 
   build-race:
-    desc: Builds luxd with race detection enabled
+    desc: Builds node with race detection enabled
     cmd: ./scripts/build.sh -r
 
   build-tmpnetctl:
@@ -131,6 +143,25 @@ tasks:
     desc: Runs bootstrap monitor e2e tests
     cmd: bash -x ./scripts/tests.e2e.bootstrap_monitor.sh
 
+  test-build-antithesis-images-node:
+    desc: Tests the build of antithesis images for the node test setup
+    env:
+      TEST_SETUP: node
+    cmds:
+      - task: build-race
+      - cmd: go run ./tests/antithesis/node --node-path=./build/node --duration=120s
+      - cmd: bash -x ./scripts/tests.build_antithesis_images.sh
+
+  test-build-antithesis-images-xsvm:
+    desc: Tests the build of antithesis images for the xsvm test setup
+    env:
+      TEST_SETUP: xsvm
+    cmds:
+      - task: build-race
+      - task: build-xsvm
+      - cmd: go run ./tests/antithesis/xsvm --node-path=./build/node --duration=120s
+      - cmd: bash -x ./scripts/tests.build_antithesis_images.sh
+
   test-build-image:
     # On mac, docker/podman/lima should work out-of-the-box.
     # On linux, requires qemu (e.g. apt -y install qemu-system qemu-user-static).
@@ -168,12 +199,11 @@ tasks:
       - cmd: bash -x ./scripts/tests.e2e.kube.sh {{.CLI_ARGS}}
 
   test-e2e-kube-ci:
-    # Free github action runners do not have sufficient resources to reliably run a full e2e run against a kube-hosted network
-    desc: Runs the xsvm e2e tests in serial against a network deployed to kube
+    desc: Runs e2e tests against a network deployed to kube [serially]
     env:
       E2E_SERIAL: 1
     cmds:
-      - cmd: bash -x ./scripts/tests.e2e.kube.sh --ginkgo.focus-file=xsvm.go {{.CLI_ARGS}}
+      - task: test-e2e-kube
 
   # To use a different fuzz time, run `task test-fuzz FUZZTIME=[value in seconds]`.
   # A value of `-1` will run until it encounters a failing output.
@@ -201,13 +231,13 @@ tasks:
     cmds:
       - task: generate-load-contract-bindings
       - task: build
-      - cmd: go run ./tests/load/c/main --luxd-path=./build/luxd {{.CLI_ARGS}}
+      - cmd: go run ./tests/load/c/main --node-path=./build/node {{.CLI_ARGS}}
 
   test-load2:
     desc: Runs second iteration of load tests
     cmds:
       - task: build
-      - cmd: go run ./tests/load2/main --luxd-path=./build/luxd {{.CLI_ARGS}}
+      - cmd: go run ./tests/load2/main --node-path=./build/node {{.CLI_ARGS}}
 
   test-load-exclusive:
     desc: Runs load tests against kube with exclusive scheduling

api/admin/client.go

@@ -1,145 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"context"
-
-	dbpb "github.com/luxfi/database/proto/pb/rpcdb"
-	"github.com/luxfi/database/rpcdb"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/node/v2/api"
-	"github.com/luxfi/node/v2/utils/formatting"
-	log "github.com/luxfi/log"
-	"github.com/luxfi/node/v2/utils/rpc"
-)
-
-type Client struct {
-	Requester rpc.EndpointRequester
-}
-
-func NewClient(uri string) *Client {
-	return &Client{Requester: rpc.NewEndpointRequester(
-		uri + "/ext/admin",
-	)}
-}
-
-func (c *Client) StartCPUProfiler(ctx context.Context, options ...rpc.Option) error {
-	return c.Requester.SendRequest(ctx, "admin.startCPUProfiler", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *Client) StopCPUProfiler(ctx context.Context, options ...rpc.Option) error {
-	return c.Requester.SendRequest(ctx, "admin.stopCPUProfiler", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *Client) MemoryProfile(ctx context.Context, options ...rpc.Option) error {
-	return c.Requester.SendRequest(ctx, "admin.memoryProfile", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *Client) LockProfile(ctx context.Context, options ...rpc.Option) error {
-	return c.Requester.SendRequest(ctx, "admin.lockProfile", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *Client) Alias(ctx context.Context, endpoint, alias string, options ...rpc.Option) error {
-	return c.Requester.SendRequest(ctx, "admin.alias", &AliasArgs{
-		Endpoint: endpoint,
-		Alias:    alias,
-	}, &api.EmptyReply{}, options...)
-}
-
-func (c *Client) AliasChain(ctx context.Context, chain, alias string, options ...rpc.Option) error {
-	return c.Requester.SendRequest(ctx, "admin.aliasChain", &AliasChainArgs{
-		Chain: chain,
-		Alias: alias,
-	}, &api.EmptyReply{}, options...)
-}
-
-func (c *Client) GetChainAliases(ctx context.Context, chain string, options ...rpc.Option) ([]string, error) {
-	res := &GetChainAliasesReply{}
-	err := c.Requester.SendRequest(ctx, "admin.getChainAliases", &GetChainAliasesArgs{
-		Chain: chain,
-	}, res, options...)
-	return res.Aliases, err
-}
-
-func (c *Client) Stacktrace(ctx context.Context, options ...rpc.Option) error {
-	return c.Requester.SendRequest(ctx, "admin.stacktrace", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *Client) LoadVMs(ctx context.Context, options ...rpc.Option) (map[ids.ID][]string, map[ids.ID]string, error) {
-	res := &LoadVMsReply{}
-	err := c.Requester.SendRequest(ctx, "admin.loadVMs", struct{}{}, res, options...)
-	return res.NewVMs, res.FailedVMs, err
-}
-
-func (c *Client) SetLoggerLevel(
-	ctx context.Context,
-	loggerName,
-	logLevel,
-	displayLevel string,
-	options ...rpc.Option,
-) (map[string]LogAndDisplayLevels, error) {
-	var (
-		logLevelArg     log.Level
-		displayLevelArg log.Level
-		err             error
-	)
-	if len(logLevel) > 0 {
-		logLevelArg, err = log.ToLevel(logLevel)
-		if err != nil {
-			return nil, err
-		}
-	}
-	if len(displayLevel) > 0 {
-		displayLevelArg, err = log.ToLevel(displayLevel)
-		if err != nil {
-			return nil, err
-		}
-	}
-	res := &LoggerLevelReply{}
-	err = c.Requester.SendRequest(ctx, "admin.setLoggerLevel", &SetLoggerLevelArgs{
-		LoggerName:   loggerName,
-		LogLevel:     &logLevelArg,
-		DisplayLevel: &displayLevelArg,
-	}, res, options...)
-	return res.LoggerLevels, err
-}
-
-func (c *Client) GetLoggerLevel(
-	ctx context.Context,
-	loggerName string,
-	options ...rpc.Option,
-) (map[string]LogAndDisplayLevels, error) {
-	res := &LoggerLevelReply{}
-	err := c.Requester.SendRequest(ctx, "admin.getLoggerLevel", &GetLoggerLevelArgs{
-		LoggerName: loggerName,
-	}, res, options...)
-	return res.LoggerLevels, err
-}
-
-func (c *Client) GetConfig(ctx context.Context, options ...rpc.Option) (interface{}, error) {
-	var res interface{}
-	err := c.Requester.SendRequest(ctx, "admin.getConfig", struct{}{}, &res, options...)
-	return res, err
-}
-
-func (c *Client) DBGet(ctx context.Context, key []byte, options ...rpc.Option) ([]byte, error) {
-	keyStr, err := formatting.Encode(formatting.HexNC, key)
-	if err != nil {
-		return nil, err
-	}
-
-	res := &DBGetReply{}
-	err = c.Requester.SendRequest(ctx, "admin.dbGet", &DBGetArgs{
-		Key: keyStr,
-	}, res, options...)
-	if err != nil {
-		return nil, err
-	}
-
-	if err := rpcdb.ErrEnumToError[dbpb.Error(res.ErrorCode)]; err != nil {
-		return nil, err
-	}
-	return formatting.Decode(formatting.HexNC, res.Value)
-}

api/admin/client_test.go

@@ -1,359 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/luxfi/ids"
-	"github.com/luxfi/node/v2/api"
-	log "github.com/luxfi/log"
-	"github.com/luxfi/log/level"
-	"github.com/luxfi/node/v2/utils/rpc"
-)
-
-var (
-	errTest = errors.New("non-nil error")
-
-	SuccessResponseTests = []struct {
-		name        string
-		expectedErr error
-	}{
-		{
-			name:        "no error",
-			expectedErr: nil,
-		},
-		{
-			name:        "error",
-			expectedErr: errTest,
-		},
-	}
-)
-
-type mockClient struct {
-	response interface{}
-	err      error
-}
-
-// NewMockClient returns a mock client for testing
-func NewMockClient(response interface{}, err error) rpc.EndpointRequester {
-	return &mockClient{
-		response: response,
-		err:      err,
-	}
-}
-
-func (mc *mockClient) SendRequest(_ context.Context, _ string, _ interface{}, reply interface{}, _ ...rpc.Option) error {
-	if mc.err != nil {
-		return mc.err
-	}
-
-	switch p := reply.(type) {
-	case *api.EmptyReply:
-		response := mc.response.(*api.EmptyReply)
-		*p = *response
-	case *GetChainAliasesReply:
-		response := mc.response.(*GetChainAliasesReply)
-		*p = *response
-	case *LoadVMsReply:
-		response := mc.response.(*LoadVMsReply)
-		*p = *response
-	case *LoggerLevelReply:
-		response := mc.response.(*LoggerLevelReply)
-		*p = *response
-	case *interface{}:
-		response := mc.response.(*interface{})
-		*p = *response
-	default:
-		panic("illegal type")
-	}
-	return nil
-}
-
-func TestStartCPUProfiler(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := Client{Requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.StartCPUProfiler(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestStopCPUProfiler(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := Client{Requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.StopCPUProfiler(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestMemoryProfile(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := Client{Requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.MemoryProfile(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestLockProfile(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := Client{Requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.LockProfile(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestAlias(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := Client{Requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.Alias(context.Background(), "alias", "alias2")
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestAliasChain(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := Client{Requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.AliasChain(context.Background(), "chain", "chain-alias")
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestGetChainAliases(t *testing.T) {
-	t.Run("successful", func(t *testing.T) {
-		require := require.New(t)
-
-		expectedReply := []string{"alias1", "alias2"}
-		mockClient := Client{Requester: NewMockClient(&GetChainAliasesReply{
-			Aliases: expectedReply,
-		}, nil)}
-
-		reply, err := mockClient.GetChainAliases(context.Background(), "chain")
-		require.NoError(err)
-		require.Equal(expectedReply, reply)
-	})
-
-	t.Run("failure", func(t *testing.T) {
-		mockClient := Client{Requester: NewMockClient(&GetChainAliasesReply{}, errTest)}
-		_, err := mockClient.GetChainAliases(context.Background(), "chain")
-		require.ErrorIs(t, err, errTest)
-	})
-}
-
-func TestStacktrace(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := Client{Requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.Stacktrace(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestReloadInstalledVMs(t *testing.T) {
-	t.Run("successful", func(t *testing.T) {
-		require := require.New(t)
-
-		expectedNewVMs := map[ids.ID][]string{
-			ids.GenerateTestID(): {"foo"},
-			ids.GenerateTestID(): {"bar"},
-		}
-		expectedFailedVMs := map[ids.ID]string{
-			ids.GenerateTestID(): "oops",
-			ids.GenerateTestID(): "uh-oh",
-		}
-		mockClient := Client{Requester: NewMockClient(&LoadVMsReply{
-			NewVMs:    expectedNewVMs,
-			FailedVMs: expectedFailedVMs,
-		}, nil)}
-
-		loadedVMs, failedVMs, err := mockClient.LoadVMs(context.Background())
-		require.NoError(err)
-		require.Equal(expectedNewVMs, loadedVMs)
-		require.Equal(expectedFailedVMs, failedVMs)
-	})
-
-	t.Run("failure", func(t *testing.T) {
-		mockClient := Client{Requester: NewMockClient(&LoadVMsReply{}, errTest)}
-		_, _, err := mockClient.LoadVMs(context.Background())
-		require.ErrorIs(t, err, errTest)
-	})
-}
-
-func TestSetLoggerLevel(t *testing.T) {
-	type test struct {
-		name            string
-		logLevel        string
-		displayLevel    string
-		serviceResponse map[string]LogAndDisplayLevels
-		serviceErr      error
-		clientErr       error
-	}
-	tests := []test{
-		{
-			name:         "Happy path",
-			logLevel:     "INFO",
-			displayLevel: "INFO",
-			serviceResponse: map[string]LogAndDisplayLevels{
-				"Happy path": {LogLevel: level.Info, DisplayLevel: level.Info},
-			},
-			serviceErr: nil,
-			clientErr:  nil,
-		},
-		{
-			name:            "Service errors",
-			logLevel:        "INFO",
-			displayLevel:    "INFO",
-			serviceResponse: nil,
-			serviceErr:      errTest,
-			clientErr:       errTest,
-		},
-		{
-			name:            "Invalid log level",
-			logLevel:        "invalid",
-			displayLevel:    "INFO",
-			serviceResponse: nil,
-			serviceErr:      nil,
-			clientErr:       log.ErrUnknownLevel,
-		},
-		{
-			name:            "Invalid display level",
-			logLevel:        "INFO",
-			displayLevel:    "invalid",
-			serviceResponse: nil,
-			serviceErr:      nil,
-			clientErr:       log.ErrUnknownLevel,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require := require.New(t)
-
-			c := Client{
-				Requester: NewMockClient(
-					&LoggerLevelReply{
-						LoggerLevels: tt.serviceResponse,
-					},
-					tt.serviceErr,
-				),
-			}
-			res, err := c.SetLoggerLevel(
-				context.Background(),
-				"",
-				tt.logLevel,
-				tt.displayLevel,
-			)
-			require.ErrorIs(err, tt.clientErr)
-			if tt.clientErr != nil {
-				return
-			}
-			require.Equal(tt.serviceResponse, res)
-		})
-	}
-}
-
-func TestGetLoggerLevel(t *testing.T) {
-	type test struct {
-		name            string
-		loggerName      string
-		serviceResponse map[string]LogAndDisplayLevels
-		serviceErr      error
-		clientErr       error
-	}
-	tests := []test{
-		{
-			name:       "Happy Path",
-			loggerName: "foo",
-			serviceResponse: map[string]LogAndDisplayLevels{
-				"foo": {LogLevel: level.Info, DisplayLevel: level.Info},
-			},
-			serviceErr: nil,
-			clientErr:  nil,
-		},
-		{
-			name:            "service errors",
-			loggerName:      "foo",
-			serviceResponse: nil,
-			serviceErr:      errTest,
-			clientErr:       errTest,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require := require.New(t)
-
-			c := Client{
-				Requester: NewMockClient(
-					&LoggerLevelReply{
-						LoggerLevels: tt.serviceResponse,
-					},
-					tt.serviceErr,
-				),
-			}
-			res, err := c.GetLoggerLevel(
-				context.Background(),
-				tt.loggerName,
-			)
-			require.ErrorIs(err, tt.clientErr)
-			if tt.clientErr != nil {
-				return
-			}
-			require.Equal(tt.serviceResponse, res)
-		})
-	}
-}
-
-func TestGetConfig(t *testing.T) {
-	type test struct {
-		name             string
-		serviceErr       error
-		clientErr        error
-		expectedResponse interface{}
-	}
-	var resp interface{} = "response"
-	tests := []test{
-		{
-			name:             "Happy path",
-			serviceErr:       nil,
-			clientErr:        nil,
-			expectedResponse: &resp,
-		},
-		{
-			name:             "service errors",
-			serviceErr:       errTest,
-			clientErr:        errTest,
-			expectedResponse: nil,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require := require.New(t)
-
-			c := Client{
-				Requester: NewMockClient(tt.expectedResponse, tt.serviceErr),
-			}
-			res, err := c.GetConfig(context.Background())
-			require.ErrorIs(err, tt.clientErr)
-			if tt.clientErr != nil {
-				return
-			}
-			require.Equal(resp, res)
-		})
-	}
-}

api/admin/key_value_reader.go

@@ -1,34 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"context"
-
-	"github.com/luxfi/database"
-)
-
-var _ database.KeyValueReader = (*KeyValueReader)(nil)
-
-type KeyValueReader struct {
-	client *Client
-}
-
-func NewKeyValueReader(client *Client) *KeyValueReader {
-	return &KeyValueReader{
-		client: client,
-	}
-}
-
-func (r *KeyValueReader) Has(key []byte) (bool, error) {
-	_, err := r.client.DBGet(context.Background(), key)
-	if err == database.ErrNotFound {
-		return false, nil
-	}
-	return err == nil, err
-}
-
-func (r *KeyValueReader) Get(key []byte) ([]byte, error) {
-	return r.client.DBGet(context.Background(), key)
-}

api/admin/service.go

@@ -1,415 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"errors"
-	"net/http"
-	"path"
-	"sync"
-
-	"github.com/gorilla/rpc/v2"
-	"go.uber.org/zap"
-
-	db "github.com/luxfi/database"
-	"github.com/luxfi/database/rpcdb"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/node/v2/api"
-	"github.com/luxfi/node/v2/api/server"
-	"github.com/luxfi/node/v2/chains"
-	"github.com/luxfi/node/v2/utils"
-	"github.com/luxfi/node/v2/utils/constants"
-	"github.com/luxfi/node/v2/utils/formatting"
-	"github.com/luxfi/node/v2/utils/json"
-	log "github.com/luxfi/log"
-	"github.com/luxfi/node/v2/utils/perms"
-	"github.com/luxfi/node/v2/utils/profiler"
-	"github.com/luxfi/node/v2/vms"
-	"github.com/luxfi/node/v2/vms/registry"
-
-	rpcdbpb "github.com/luxfi/database/proto/pb/rpcdb"
-)
-
-const (
-	maxAliasLength = 512
-
-	// Name of file that stacktraces are written to
-	stacktraceFile = "stacktrace.txt"
-)
-
-var (
-	errAliasTooLong = errors.New("alias length is too long")
-	errNoLogLevel   = errors.New("need to specify either displayLevel or logLevel")
-)
-
-type Config struct {
-	Log          log.Logger
-	ProfileDir   string
-	LogFactory   log.Factory
-	NodeConfig   interface{}
-	DB           db.Database
-	ChainManager chains.Manager
-	HTTPServer   server.PathAdderWithReadLock
-	VMRegistry   registry.VMRegistry
-	VMManager    vms.Manager
-}
-
-// Admin is the API service for node admin management
-type Admin struct {
-	Config
-	lock     sync.RWMutex
-	profiler profiler.Profiler
-}
-
-// NewService returns a new admin API service.
-// All of the fields in [config] must be set.
-func NewService(config Config) (http.Handler, error) {
-	server := rpc.NewServer()
-	codec := json.NewCodec()
-	server.RegisterCodec(codec, "application/json")
-	server.RegisterCodec(codec, "application/json;charset=UTF-8")
-	return server, server.RegisterService(
-		&Admin{
-			Config:   config,
-			profiler: profiler.New(config.ProfileDir),
-		},
-		"admin",
-	)
-}
-
-// StartCPUProfiler starts a cpu profile writing to the specified file
-func (a *Admin) StartCPUProfiler(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "startCPUProfiler"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.profiler.StartCPUProfiler()
-}
-
-// StopCPUProfiler stops the cpu profile
-func (a *Admin) StopCPUProfiler(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "stopCPUProfiler"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.profiler.StopCPUProfiler()
-}
-
-// MemoryProfile runs a memory profile writing to the specified file
-func (a *Admin) MemoryProfile(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "memoryProfile"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.profiler.MemoryProfile()
-}
-
-// LockProfile runs a mutex profile writing to the specified file
-func (a *Admin) LockProfile(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "lockProfile"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.profiler.LockProfile()
-}
-
-// AliasArgs are the arguments for calling Alias
-type AliasArgs struct {
-	Endpoint string `json:"endpoint"`
-	Alias    string `json:"alias"`
-}
-
-// Alias attempts to alias an HTTP endpoint to a new name
-func (a *Admin) Alias(_ *http.Request, args *AliasArgs, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "alias"),
-		log.UserString("endpoint", args.Endpoint),
-		log.UserString("alias", args.Alias),
-	)
-
-	if len(args.Alias) > maxAliasLength {
-		return errAliasTooLong
-	}
-
-	return a.HTTPServer.AddAliasesWithReadLock(args.Endpoint, args.Alias)
-}
-
-// AliasChainArgs are the arguments for calling AliasChain
-type AliasChainArgs struct {
-	Chain string `json:"chain"`
-	Alias string `json:"alias"`
-}
-
-// AliasChain attempts to alias a chain to a new name
-func (a *Admin) AliasChain(_ *http.Request, args *AliasChainArgs, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "aliasChain"),
-		log.UserString("chain", args.Chain),
-		log.UserString("alias", args.Alias),
-	)
-
-	if len(args.Alias) > maxAliasLength {
-		return errAliasTooLong
-	}
-	chainID, err := a.ChainManager.Lookup(args.Chain)
-	if err != nil {
-		return err
-	}
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	if err := a.ChainManager.Alias(chainID, args.Alias); err != nil {
-		return err
-	}
-
-	endpoint := path.Join(constants.ChainAliasPrefix, chainID.String())
-	alias := path.Join(constants.ChainAliasPrefix, args.Alias)
-	return a.HTTPServer.AddAliasesWithReadLock(endpoint, alias)
-}
-
-// GetChainAliasesArgs are the arguments for calling GetChainAliases
-type GetChainAliasesArgs struct {
-	Chain string `json:"chain"`
-}
-
-// GetChainAliasesReply are the aliases of the given chain
-type GetChainAliasesReply struct {
-	Aliases []string `json:"aliases"`
-}
-
-// GetChainAliases returns the aliases of the chain
-func (a *Admin) GetChainAliases(_ *http.Request, args *GetChainAliasesArgs, reply *GetChainAliasesReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "getChainAliases"),
-		log.UserString("chain", args.Chain),
-	)
-
-	id, err := ids.FromString(args.Chain)
-	if err != nil {
-		return err
-	}
-
-	reply.Aliases, err = a.ChainManager.Aliases(id)
-	return err
-}
-
-// Stacktrace returns the current global stacktrace
-func (a *Admin) Stacktrace(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "stacktrace"),
-	)
-
-	stacktrace := []byte(utils.GetStacktrace(true))
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return perms.WriteFile(stacktraceFile, stacktrace, perms.ReadWrite)
-}
-
-type SetLoggerLevelArgs struct {
-	LoggerName   string         `json:"loggerName"`
-	LogLevel     *log.Level `json:"logLevel"`
-	DisplayLevel *log.Level `json:"displayLevel"`
-}
-
-type LogAndDisplayLevels struct {
-	LogLevel     log.Level `json:"logLevel"`
-	DisplayLevel log.Level `json:"displayLevel"`
-}
-
-type LoggerLevelReply struct {
-	LoggerLevels map[string]LogAndDisplayLevels `json:"loggerLevels"`
-}
-
-// SetLoggerLevel sets the log level and/or display level for loggers.
-// If len([args.LoggerName]) == 0, sets the log/display level of all loggers.
-// Otherwise, sets the log/display level of the loggers named in that argument.
-// Sets the log level of these loggers to args.LogLevel.
-// If args.LogLevel == nil, doesn't set the log level of these loggers.
-// If args.LogLevel != nil, must be a valid string representation of a log level.
-// Sets the display level of these loggers to args.LogLevel.
-// If args.DisplayLevel == nil, doesn't set the display level of these loggers.
-// If args.DisplayLevel != nil, must be a valid string representation of a log level.
-func (a *Admin) SetLoggerLevel(_ *http.Request, args *SetLoggerLevelArgs, reply *LoggerLevelReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "setLoggerLevel"),
-		log.UserString("loggerName", args.LoggerName),
-		zap.Stringer("logLevel", args.LogLevel),
-		zap.Stringer("displayLevel", args.DisplayLevel),
-	)
-
-	if args.LogLevel == nil && args.DisplayLevel == nil {
-		return errNoLogLevel
-	}
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	loggerNames := a.getLoggerNames(args.LoggerName)
-	for _, name := range loggerNames {
-		if args.LogLevel != nil {
-			if err := a.LogFactory.SetLogLevel(name, *args.LogLevel); err != nil {
-				return err
-			}
-		}
-		if args.DisplayLevel != nil {
-			if err := a.LogFactory.SetDisplayLevel(name, *args.DisplayLevel); err != nil {
-				return err
-			}
-		}
-	}
-
-	var err error
-	reply.LoggerLevels, err = a.getLogLevels(loggerNames)
-	return err
-}
-
-type GetLoggerLevelArgs struct {
-	LoggerName string `json:"loggerName"`
-}
-
-// GetLoggerLevel returns the log level and display level of all loggers.
-func (a *Admin) GetLoggerLevel(_ *http.Request, args *GetLoggerLevelArgs, reply *LoggerLevelReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "getLoggerLevel"),
-		log.UserString("loggerName", args.LoggerName),
-	)
-
-	a.lock.RLock()
-	defer a.lock.RUnlock()
-
-	loggerNames := a.getLoggerNames(args.LoggerName)
-
-	var err error
-	reply.LoggerLevels, err = a.getLogLevels(loggerNames)
-	return err
-}
-
-// GetConfig returns the config that the node was started with.
-func (a *Admin) GetConfig(_ *http.Request, _ *struct{}, reply *interface{}) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "getConfig"),
-	)
-	*reply = a.NodeConfig
-	return nil
-}
-
-// LoadVMsReply contains the response metadata for LoadVMs
-type LoadVMsReply struct {
-	// VMs and their aliases which were successfully loaded
-	NewVMs map[ids.ID][]string `json:"newVMs"`
-	// VMs that failed to be loaded and the error message
-	FailedVMs map[ids.ID]string `json:"failedVMs,omitempty"`
-}
-
-// LoadVMs loads any new VMs available to the node and returns the added VMs.
-func (a *Admin) LoadVMs(r *http.Request, _ *struct{}, reply *LoadVMsReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "loadVMs"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	ctx := r.Context()
-	loadedVMs, failedVMs, err := a.VMRegistry.Reload(ctx)
-	if err != nil {
-		return err
-	}
-
-	// extract the inner error messages
-	failedVMsParsed := make(map[ids.ID]string)
-	for vmID, err := range failedVMs {
-		failedVMsParsed[vmID] = err.Error()
-	}
-
-	reply.FailedVMs = failedVMsParsed
-	reply.NewVMs, err = ids.GetRelevantAliases(a.VMManager, loadedVMs)
-	return err
-}
-
-func (a *Admin) getLoggerNames(loggerName string) []string {
-	if len(loggerName) == 0 {
-		// Empty name means all loggers
-		return a.LogFactory.GetLoggerNames()
-	}
-	return []string{loggerName}
-}
-
-func (a *Admin) getLogLevels(loggerNames []string) (map[string]LogAndDisplayLevels, error) {
-	loggerLevels := make(map[string]LogAndDisplayLevels)
-	for _, name := range loggerNames {
-		logLevel, err := a.LogFactory.GetLogLevel(name)
-		if err != nil {
-			return nil, err
-		}
-		displayLevel, err := a.LogFactory.GetDisplayLevel(name)
-		if err != nil {
-			return nil, err
-		}
-		loggerLevels[name] = LogAndDisplayLevels{
-			LogLevel:     logLevel,
-			DisplayLevel: displayLevel,
-		}
-	}
-	return loggerLevels, nil
-}
-
-type DBGetArgs struct {
-	Key string `json:"key"`
-}
-
-type DBGetReply struct {
-	Value     string        `json:"value"`
-	ErrorCode rpcdbpb.Error `json:"errorCode"`
-}
-
-//nolint:staticcheck // renaming this method to DBGet would change the API method from "dbGet" to "dBGet"
-func (a *Admin) DbGet(_ *http.Request, args *DBGetArgs, reply *DBGetReply) error {
-	a.Log.Debug("API called",
-		zap.String("service", "admin"),
-		zap.String("method", "dbGet"),
-		log.UserString("key", args.Key),
-	)
-
-	key, err := formatting.Decode(formatting.HexNC, args.Key)
-	if err != nil {
-		return err
-	}
-
-	value, err := a.DB.Get(key)
-	if err != nil {
-		reply.ErrorCode = rpcdbpb.Error(rpcdb.ErrorToErrEnum[err])
-		return rpcdb.ErrorToRPCError(err)
-	}
-
-	reply.Value, err = formatting.Encode(formatting.HexNC, value)
-	return err
-}

api/admin/service.md

@@ -1,420 +0,0 @@
-The Admin API can be used for measuring node health and debugging.
-
-<Callout title="Note">
-The Admin API is disabled by default for security reasons. To run a node with the Admin API enabled, use [`config flag --api-admin-enabled=true`](https://build.lux.network/docs/nodes/configure/configs-flags#--api-admin-enabled-boolean).
-
-This API set is for a specific node, it is unavailable on the [public server](https://build.lux.network/docs/tooling/rpc-providers).
-</Callout>
-
-## Format
-
-This API uses the `json 2.0` RPC format. For details, see [here](https://build.lux.network/docs/api-reference/guides/issuing-api-calls).
-
-## Endpoint
-
-```
-/ext/admin
-```
-
-## Methods
-
-### `admin.alias`
-
-Assign an API endpoint an alias, a different endpoint for the API. The original endpoint will still work. This change only affects this node; other nodes will not know about this alias.
-
-**Signature**:
-
-```
-admin.alias({endpoint:string, alias:string}) -> {}
-```
-
-- `endpoint` is the original endpoint of the API. `endpoint` should only include the part of the endpoint after `/ext/`.
-- The API being aliased can now be called at `ext/alias`.
-- `alias` can be at most 512 characters.
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.alias",
-    "params": {
-        "alias":"myAlias",
-        "endpoint":"bc/X"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-Now, calls to the X-Chain can be made to either `/ext/bc/X` or, equivalently, to `/ext/myAlias`.
-
-### `admin.aliasChain`
-
-Give a blockchain an alias, a different name that can be used any place the blockchain's ID is used.
-
-<Callout title="Note">
-Aliasing a chain can also be done via the [Node API](https://build.lux.network/docs/nodes/configure/configs-flags#--chain-aliases-file-string).
-
-Note that the alias is set for each chain on each node individually. In a multi-node Lux L1, the same alias should be configured on each node to use an alias across an Lux L1 successfully. Setting an alias for a chain on one node does not register that alias with other nodes automatically.
-</Callout>
-
-**Signature**:
-
-```
-admin.aliasChain(
-    {
-        chain:string,
-        alias:string
-    }
-) -> {}
-```
-
-- `chain` is the blockchain's ID.
-- `alias` can now be used in place of the blockchain's ID (in API endpoints, for example.)
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.aliasChain",
-    "params": {
-        "chain":"sV6o671RtkGBcno1FiaDbVcFv2sG5aVXMZYzKdP4VQAWmJQnM",
-        "alias":"myBlockchainAlias"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-Now, instead of interacting with the blockchain whose ID is `sV6o671RtkGBcno1FiaDbVcFv2sG5aVXMZYzKdP4VQAWmJQnM` by making API calls to `/ext/bc/sV6o671RtkGBcno1FiaDbVcFv2sG5aVXMZYzKdP4VQAWmJQnM`, one can also make calls to `ext/bc/myBlockchainAlias`.
-
-### `admin.getChainAliases`
-
-Returns the aliases of the chain
-
-**Signature**:
-
-```
-admin.getChainAliases(
-  {
-    chain:string
-  }
-) -> {aliases:string[]}
-```
-
-- `chain` is the blockchain's ID.
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.getChainAliases",
-    "params": {
-        "chain":"sV6o671RtkGBcno1FiaDbVcFv2sG5aVXMZYzKdP4VQAWmJQnM"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "result": {
-    "aliases": [
-      "X",
-      "xvm",
-      "2eNy1mUFdmaxXNj1eQHUe7Np4gju9sJsEtWQ4MX3ToiNKuADed"
-    ]
-  },
-  "id": 1
-}
-```
-
-### `admin.getLoggerLevel`
-
-Returns log and display levels of loggers.
-
-**Signature**:
-
-```
-admin.getLoggerLevel(
-  {
-    loggerName:string // optional
-  }
-) -> {
-        loggerLevels: {
-          loggerName: {
-            logLevel: string,
-            displayLevel: string
-          }
-        }
-    }
-```
-
-- `loggerName` is the name of the logger to be returned. This is an optional argument. If not specified, it returns all possible loggers.
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.getLoggerLevel",
-    "params": {
-        "loggerName": "C"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "result": {
-    "loggerLevels": {
-      "C": {
-        "logLevel": "DEBUG",
-        "displayLevel": "INFO"
-      }
-    }
-  },
-  "id": 1
-}
-```
-
-### `admin.loadVMs`
-
-Dynamically loads any virtual machines installed on the node as plugins. See [here](https://build.lux.network/docs/virtual-machines#installing-a-vm) for more information on how to install a virtual machine on a node.
-
-**Signature**:
-
-```
-admin.loadVMs() -> {
-  newVMs: map[string][]string
-  failedVMs: map[string]string,
-}
-```
-
-- `failedVMs` is only included in the response if at least one virtual machine fails to be loaded.
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.loadVMs",
-    "params" :{}
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "result": {
-    "newVMs": {
-      "tGas3T58KzdjLHhBDMnH2TvrddhqTji5iZAMZ3RXs2NLpSnhH": ["foovm"]
-    },
-    "failedVMs": {
-      "rXJsCSEYXg2TehWxCEEGj6JU2PWKTkd6cBdNLjoe2SpsKD9cy": "error message"
-    }
-  },
-  "id": 1
-}
-```
-
-### `admin.lockProfile`
-
-Writes a profile of mutex statistics to `lock.profile`.
-
-**Signature**:
-
-```
-admin.lockProfile() -> {}
-```
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.lockProfile",
-    "params" :{}
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-### `admin.memoryProfile`
-
-Writes a memory profile of the to `mem.profile`.
-
-**Signature**:
-
-```
-admin.memoryProfile() -> {}
-```
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.memoryProfile",
-    "params" :{}
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-### `admin.setLoggerLevel`
-
-Sets log and display levels of loggers.
-
-**Signature**:
-
-```
-admin.setLoggerLevel(
-  {
-    loggerName: string, // optional
-    logLevel: string, // optional
-    displayLevel: string, // optional
-  }
-) -> {}
-```
-
-- `loggerName` is the logger's name to be changed. This is an optional parameter. If not specified, it changes all possible loggers.
-- `logLevel` is the log level of written logs, can be omitted.
-- `displayLevel` is the log level of displayed logs, can be omitted.
-
-`logLevel` and `displayLevel` cannot be omitted at the same time.
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.setLoggerLevel",
-    "params": {
-        "loggerName": "C",
-        "logLevel": "DEBUG",
-        "displayLevel": "INFO"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-### `admin.startCPUProfiler`
-
-Start profiling the CPU utilization of the node. To stop, call `admin.stopCPUProfiler`. On stop, writes the profile to `cpu.profile`.
-
-**Signature**:
-
-```
-admin.startCPUProfiler() -> {}
-```
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.startCPUProfiler",
-    "params" :{}
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-### `admin.stopCPUProfiler`
-
-Stop the CPU profile that was previously started.
-
-**Signature**:
-
-```
-admin.stopCPUProfiler() -> {}
-```
-
-**Example Call**:
-
-```sh
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.stopCPUProfiler"
-}' -H 'content-type:application/json;' 127.0.0.1:9650/ext/admin
-```
-
-**Example Response**:
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```

api/admin/service_test.go

@@ -1,167 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
-
-	"github.com/luxfi/database/memdb"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/node/v2/utils/formatting"
-	log "github.com/luxfi/log"
-	"github.com/luxfi/node/v2/vms/registry/registrymock"
-	"github.com/luxfi/node/v2/vms/vmsmock"
-
-	rpcdbpb "github.com/luxfi/database/proto/pb/rpcdb"
-)
-
-type loadVMsTest struct {
-	admin          *Admin
-	mockVMManager  *vmsmock.Manager
-	mockVMRegistry *registrymock.VMRegistry
-}
-
-func initLoadVMsTest(t *testing.T) *loadVMsTest {
-	ctrl := gomock.NewController(t)
-
-	mockVMRegistry := registrymock.NewVMRegistry(ctrl)
-	mockVMManager := vmsmock.NewManager(ctrl)
-
-	return &loadVMsTest{
-		admin: &Admin{Config: Config{
-			Log:        log.NewNoOpLogger(),
-			VMRegistry: mockVMRegistry,
-			VMManager:  mockVMManager,
-		}},
-		mockVMManager:  mockVMManager,
-		mockVMRegistry: mockVMRegistry,
-	}
-}
-
-// Tests behavior for LoadVMs if everything succeeds.
-func TestLoadVMsSuccess(t *testing.T) {
-	require := require.New(t)
-
-	resources := initLoadVMsTest(t)
-
-	id1 := ids.GenerateTestID()
-	id2 := ids.GenerateTestID()
-
-	newVMs := []ids.ID{id1, id2}
-	failedVMs := map[ids.ID]error{
-		ids.GenerateTestID(): errTest,
-	}
-	// every vm is at least aliased to itself.
-	alias1 := []string{id1.String(), "vm1-alias-1", "vm1-alias-2"}
-	alias2 := []string{id2.String(), "vm2-alias-1", "vm2-alias-2"}
-	// we expect that we dedup the redundant alias of vmId.
-	expectedVMRegistry := map[ids.ID][]string{
-		id1: alias1[1:],
-		id2: alias2[1:],
-	}
-
-	resources.mockVMRegistry.EXPECT().Reload(gomock.Any()).Times(1).Return(newVMs, failedVMs, nil)
-	resources.mockVMManager.EXPECT().Aliases(id1).Times(1).Return(alias1, nil)
-	resources.mockVMManager.EXPECT().Aliases(id2).Times(1).Return(alias2, nil)
-
-	// execute test
-	reply := LoadVMsReply{}
-	require.NoError(resources.admin.LoadVMs(&http.Request{}, nil, &reply))
-	require.Equal(expectedVMRegistry, reply.NewVMs)
-}
-
-// Tests behavior for LoadVMs if we fail to reload vms.
-func TestLoadVMsReloadFails(t *testing.T) {
-	require := require.New(t)
-
-	resources := initLoadVMsTest(t)
-
-	// Reload fails
-	resources.mockVMRegistry.EXPECT().Reload(gomock.Any()).Times(1).Return(nil, nil, errTest)
-
-	reply := LoadVMsReply{}
-	err := resources.admin.LoadVMs(&http.Request{}, nil, &reply)
-	require.ErrorIs(err, errTest)
-}
-
-// Tests behavior for LoadVMs if we fail to fetch our aliases
-func TestLoadVMsGetAliasesFails(t *testing.T) {
-	require := require.New(t)
-
-	resources := initLoadVMsTest(t)
-
-	id1 := ids.GenerateTestID()
-	id2 := ids.GenerateTestID()
-	newVMs := []ids.ID{id1, id2}
-	failedVMs := map[ids.ID]error{
-		ids.GenerateTestID(): errTest,
-	}
-	// every vm is at least aliased to itself.
-	alias1 := []string{id1.String(), "vm1-alias-1", "vm1-alias-2"}
-
-	resources.mockVMRegistry.EXPECT().Reload(gomock.Any()).Times(1).Return(newVMs, failedVMs, nil)
-	resources.mockVMManager.EXPECT().Aliases(id1).Times(1).Return(alias1, nil)
-	resources.mockVMManager.EXPECT().Aliases(id2).Times(1).Return(nil, errTest)
-
-	reply := LoadVMsReply{}
-	err := resources.admin.LoadVMs(&http.Request{}, nil, &reply)
-	require.ErrorIs(err, errTest)
-}
-
-func TestServiceDBGet(t *testing.T) {
-	a := &Admin{Config: Config{
-		Log: log.NewNoOpLogger(),
-		DB:  memdb.New(),
-	}}
-
-	helloBytes := []byte("hello")
-	helloHex, err := formatting.Encode(formatting.HexNC, helloBytes)
-	require.NoError(t, err)
-
-	worldBytes := []byte("world")
-	worldHex, err := formatting.Encode(formatting.HexNC, worldBytes)
-	require.NoError(t, err)
-
-	require.NoError(t, a.DB.Put(helloBytes, worldBytes))
-
-	tests := []struct {
-		name              string
-		key               string
-		expectedValue     string
-		expectedErrorCode rpcdbpb.Error
-	}{
-		{
-			name:              "key exists",
-			key:               helloHex,
-			expectedValue:     worldHex,
-			expectedErrorCode: rpcdbpb.Error_ERROR_UNSPECIFIED,
-		},
-		{
-			name:              "key doesn't exist",
-			key:               "",
-			expectedValue:     "",
-			expectedErrorCode: rpcdbpb.Error_ERROR_NOT_FOUND,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			require := require.New(t)
-
-			reply := &DBGetReply{}
-			require.NoError(a.DbGet(
-				nil,
-				&DBGetArgs{
-					Key: test.key,
-				},
-				reply,
-			))
-			require.Equal(test.expectedValue, reply.Value)
-			require.Equal(test.expectedErrorCode, reply.ErrorCode)
-		})
-	}
-}

api/args_responses.go

@@ -1,128 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package api
-
-import (
-	"encoding/json"
-
-	"github.com/luxfi/ids"
-	"github.com/luxfi/node/v2/utils/formatting"
-
-	avajson "github.com/luxfi/node/v2/utils/json"
-)
-
-// This file contains structs used in arguments and responses in services
-
-// EmptyReply indicates that an api doesn't have a response to return.
-type EmptyReply struct{}
-
-// JSONTxID contains the ID of a transaction
-type JSONTxID struct {
-	TxID ids.ID `json:"txID"`
-}
-
-// JSONAddress contains an address
-type JSONAddress struct {
-	Address string `json:"address"`
-}
-
-// JSONAddresses contains a list of address
-type JSONAddresses struct {
-	Addresses []string `json:"addresses"`
-}
-
-// GetBlockArgs is the parameters supplied to the GetBlock API
-type GetBlockArgs struct {
-	BlockID  ids.ID              `json:"blockID"`
-	Encoding formatting.Encoding `json:"encoding"`
-}
-
-// GetBlockByHeightArgs is the parameters supplied to the GetBlockByHeight API
-type GetBlockByHeightArgs struct {
-	Height   avajson.Uint64      `json:"height"`
-	Encoding formatting.Encoding `json:"encoding"`
-}
-
-// GetBlockResponse is the response object for the GetBlock API.
-type GetBlockResponse struct {
-	Block json.RawMessage `json:"block"`
-	// If GetBlockResponse.Encoding is formatting.Hex, GetBlockResponse.Block is
-	// the string representation of the block under hex encoding.
-	// If GetBlockResponse.Encoding is formatting.JSON, GetBlockResponse.Block
-	// is the actual block returned as a JSON.
-	Encoding formatting.Encoding `json:"encoding"`
-}
-
-type GetHeightResponse struct {
-	Height avajson.Uint64 `json:"height"`
-}
-
-// FormattedBlock defines a JSON formatted struct containing a block in Hex
-// format
-type FormattedBlock struct {
-	Block    string              `json:"block"`
-	Encoding formatting.Encoding `json:"encoding"`
-}
-
-type GetTxArgs struct {
-	TxID     ids.ID              `json:"txID"`
-	Encoding formatting.Encoding `json:"encoding"`
-}
-
-// GetTxReply defines an object containing a single [Tx] object along with Encoding
-type GetTxReply struct {
-	// If [GetTxArgs.Encoding] is [Hex], [Tx] is the string representation of
-	// the tx under hex encoding.
-	// If [GetTxArgs.Encoding] is [JSON], [Tx] is the actual tx, which will be
-	// returned as JSON to the caller.
-	Tx       json.RawMessage     `json:"tx"`
-	Encoding formatting.Encoding `json:"encoding"`
-}
-
-// FormattedTx defines a JSON formatted struct containing a Tx as a string
-type FormattedTx struct {
-	Tx       string              `json:"tx"`
-	Encoding formatting.Encoding `json:"encoding"`
-}
-
-// Index is an address and an associated UTXO.
-// Marks a starting or stopping point when fetching UTXOs. Used for pagination.
-type Index struct {
-	Address string `json:"address"` // The address as a string
-	UTXO    string `json:"utxo"`    // The UTXO ID as a string
-}
-
-// GetUTXOsArgs are arguments for passing into GetUTXOs.
-// Gets the UTXOs that reference at least one address in [Addresses].
-// Returns at most [limit] addresses.
-// If specified, [SourceChain] is the chain where the atomic UTXOs were exported from. If empty,
-// or the Chain ID of this VM is specified, then GetUTXOs fetches the native UTXOs.
-// If [limit] == 0 or > [maxUTXOsToFetch], fetches up to [maxUTXOsToFetch].
-// [StartIndex] defines where to start fetching UTXOs (for pagination.)
-// UTXOs fetched are from addresses equal to or greater than [StartIndex.Address]
-// For address [StartIndex.Address], only UTXOs with IDs greater than [StartIndex.UTXO] will be returned.
-// If [StartIndex] is omitted, gets all UTXOs.
-// If GetUTXOs is called multiple times, with our without [StartIndex], it is not guaranteed
-// that returned UTXOs are unique. That is, the same UTXO may appear in the response of multiple calls.
-type GetUTXOsArgs struct {
-	Addresses   []string            `json:"addresses"`
-	SourceChain string              `json:"sourceChain"`
-	Limit       avajson.Uint32      `json:"limit"`
-	StartIndex  Index               `json:"startIndex"`
-	Encoding    formatting.Encoding `json:"encoding"`
-}
-
-// GetUTXOsReply defines the GetUTXOs replies returned from the API
-type GetUTXOsReply struct {
-	// Number of UTXOs returned
-	NumFetched avajson.Uint64 `json:"numFetched"`
-	// The UTXOs
-	UTXOs []string `json:"utxos"`
-	// The last UTXO that was returned, and the address it corresponds to.
-	// Used for pagination. To get the rest of the UTXOs, call GetUTXOs
-	// again and set [StartIndex] to this value.
-	EndIndex Index `json:"endIndex"`
-	// Encoding specifies the encoding format the UTXOs are returned in
-	Encoding formatting.Encoding `json:"encoding"`
-}

api/connectclient/client.go

@@ -1,39 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package connectclient
-
-import (
-	"context"
-
-	"connectrpc.com/connect"
-
-	"github.com/luxfi/node/v2/api/server"
-)
-
-var _ connect.Interceptor = (*SetRouteHeaderInterceptor)(nil)
-
-// SetRouteHeaderInterceptor sets the api routing header for connect-rpc
-// requests
-type SetRouteHeaderInterceptor struct {
-	Route string
-}
-
-func (s SetRouteHeaderInterceptor) WrapUnary(next connect.UnaryFunc) connect.UnaryFunc {
-	return func(ctx context.Context, request connect.AnyRequest) (connect.AnyResponse, error) {
-		request.Header().Set(server.HTTPHeaderRoute, s.Route)
-		return next(ctx, request)
-	}
-}
-
-func (s SetRouteHeaderInterceptor) WrapStreamingClient(next connect.StreamingClientFunc) connect.StreamingClientFunc {
-	return func(ctx context.Context, spec connect.Spec) connect.StreamingClientConn {
-		conn := next(ctx, spec)
-		conn.RequestHeader().Set(server.HTTPHeaderRoute, s.Route)
-		return conn
-	}
-}
-
-func (SetRouteHeaderInterceptor) WrapStreamingHandler(next connect.StreamingHandlerFunc) connect.StreamingHandlerFunc {
-	return next
-}

api/health/client.go

@@ -1,84 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package health
-
-import (
-	"context"
-	"time"
-
-	"github.com/luxfi/node/v2/utils/rpc"
-)
-
-type Client struct {
-	Requester rpc.EndpointRequester
-}
-
-func NewClient(uri string) *Client {
-	return &Client{Requester: rpc.NewEndpointRequester(
-		uri + "/ext/health",
-	)}
-}
-
-// Readiness returns if the node has finished initialization
-func (c *Client) Readiness(ctx context.Context, tags []string, options ...rpc.Option) (*APIReply, error) {
-	res := &APIReply{}
-	err := c.Requester.SendRequest(ctx, "health.readiness", &APIArgs{Tags: tags}, res, options...)
-	return res, err
-}
-
-// Health returns a summation of the health of the node
-func (c *Client) Health(ctx context.Context, tags []string, options ...rpc.Option) (*APIReply, error) {
-	res := &APIReply{}
-	err := c.Requester.SendRequest(ctx, "health.health", &APIArgs{Tags: tags}, res, options...)
-	return res, err
-}
-
-// Liveness returns if the node is in need of a restart
-func (c *Client) Liveness(ctx context.Context, tags []string, options ...rpc.Option) (*APIReply, error) {
-	res := &APIReply{}
-	err := c.Requester.SendRequest(ctx, "health.liveness", &APIArgs{Tags: tags}, res, options...)
-	return res, err
-}
-
-// AwaitReady polls the node every [freq] until the node reports ready.
-// Only returns an error if [ctx] returns an error.
-func AwaitReady(ctx context.Context, c *Client, freq time.Duration, tags []string, options ...rpc.Option) (bool, error) {
-	return await(ctx, freq, c.Readiness, tags, options...)
-}
-
-// AwaitHealthy polls the node every [freq] until the node reports healthy.
-// Only returns an error if [ctx] returns an error.
-func AwaitHealthy(ctx context.Context, c *Client, freq time.Duration, tags []string, options ...rpc.Option) (bool, error) {
-	return await(ctx, freq, c.Health, tags, options...)
-}
-
-// AwaitAlive polls the node every [freq] until the node reports liveness.
-// Only returns an error if [ctx] returns an error.
-func AwaitAlive(ctx context.Context, c *Client, freq time.Duration, tags []string, options ...rpc.Option) (bool, error) {
-	return await(ctx, freq, c.Liveness, tags, options...)
-}
-
-func await(
-	ctx context.Context,
-	freq time.Duration,
-	check func(ctx context.Context, tags []string, options ...rpc.Option) (*APIReply, error),
-	tags []string,
-	options ...rpc.Option,
-) (bool, error) {
-	ticker := time.NewTicker(freq)
-	defer ticker.Stop()
-
-	for {
-		res, err := check(ctx, tags, options...)
-		if err == nil && res.Healthy {
-			return true, nil
-		}
-
-		select {
-		case <-ticker.C:
-		case <-ctx.Done():
-			return false, ctx.Err()
-		}
-	}
-}

api/health/client_test.go

@@ -1,118 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package health
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/luxfi/node/v2/utils/rpc"
-)
-
-type mockClient struct {
-	reply  APIReply
-	err    error
-	onCall func()
-}
-
-func (mc *mockClient) SendRequest(_ context.Context, _ string, _ interface{}, replyIntf interface{}, _ ...rpc.Option) error {
-	reply := replyIntf.(*APIReply)
-	*reply = mc.reply
-	mc.onCall()
-	return mc.err
-}
-
-func TestNewClient(t *testing.T) {
-	require := require.New(t)
-
-	c := NewClient("")
-	require.NotNil(c)
-}
-
-func TestClient(t *testing.T) {
-	require := require.New(t)
-
-	mc := &mockClient{
-		reply: APIReply{
-			Healthy: true,
-		},
-		err:    nil,
-		onCall: func() {},
-	}
-	c := &Client{
-		Requester: mc,
-	}
-
-	{
-		readiness, err := c.Readiness(context.Background(), nil)
-		require.NoError(err)
-		require.True(readiness.Healthy)
-	}
-
-	{
-		health, err := c.Health(context.Background(), nil)
-		require.NoError(err)
-		require.True(health.Healthy)
-	}
-
-	{
-		liveness, err := c.Liveness(context.Background(), nil)
-		require.NoError(err)
-		require.True(liveness.Healthy)
-	}
-
-	{
-		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-		healthy, err := AwaitHealthy(ctx, c, time.Second, nil)
-		cancel()
-		require.NoError(err)
-		require.True(healthy)
-	}
-
-	{
-		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-		healthy, err := AwaitReady(ctx, c, time.Second, nil)
-		cancel()
-		require.NoError(err)
-		require.True(healthy)
-	}
-
-	mc.reply.Healthy = false
-
-	{
-		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Microsecond)
-		healthy, err := AwaitHealthy(ctx, c, time.Microsecond, nil)
-		cancel()
-		require.ErrorIs(err, context.DeadlineExceeded)
-		require.False(healthy)
-	}
-
-	{
-		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Microsecond)
-		healthy, err := AwaitReady(ctx, c, time.Microsecond, nil)
-		cancel()
-		require.ErrorIs(err, context.DeadlineExceeded)
-		require.False(healthy)
-	}
-
-	mc.onCall = func() {
-		mc.reply.Healthy = true
-	}
-
-	{
-		healthy, err := AwaitHealthy(context.Background(), c, time.Microsecond, nil)
-		require.NoError(err)
-		require.True(healthy)
-	}
-
-	mc.reply.Healthy = false
-	{
-		healthy, err := AwaitReady(context.Background(), c, time.Microsecond, nil)
-		require.NoError(err)
-		require.True(healthy)
-	}
-}

api/health/result.go

@@ -1,38 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package health
-
-import "time"
-
-// notYetRunResult is the result that is returned when a HealthCheck hasn't been
-// run yet.
-var notYetRunResult Result
-
-func init() {
-	err := "not yet run"
-	notYetRunResult = Result{
-		Error: &err,
-	}
-}
-
-type Result struct {
-	// Details of the HealthCheck.
-	Details interface{} `json:"message,omitempty"`
-
-	// Error is the string representation of the error returned by the failing
-	// HealthCheck. The value is nil if the check passed.
-	Error *string `json:"error,omitempty"`
-
-	// Timestamp of the last HealthCheck.
-	Timestamp time.Time `json:"timestamp,omitempty"`
-
-	// Duration is the amount of time this HealthCheck last took to evaluate.
-	Duration time.Duration `json:"duration"`
-
-	// ContiguousFailures the HealthCheck has returned.
-	ContiguousFailures int64 `json:"contiguousFailures,omitempty"`
-
-	// TimeOfFirstFailure of the HealthCheck,
-	TimeOfFirstFailure *time.Time `json:"timeOfFirstFailure,omitempty"`
-}

api/health/service.go

@@ -1,62 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package health
-
-import (
-	"net/http"
-
-	"go.uber.org/zap"
-
-	log "github.com/luxfi/log"
-)
-
-type Service struct {
-	log    log.Logger
-	health Reporter
-}
-
-// APIReply is the response for Readiness, Health, and Liveness.
-type APIReply struct {
-	Checks  map[string]Result `json:"checks"`
-	Healthy bool              `json:"healthy"`
-}
-
-// APIArgs is the arguments for Readiness, Health, and Liveness.
-type APIArgs struct {
-	Tags []string `json:"tags"`
-}
-
-// Readiness returns if the node has finished initialization
-func (s *Service) Readiness(_ *http.Request, args *APIArgs, reply *APIReply) error {
-	s.log.Debug("API called",
-		zap.String("service", "health"),
-		zap.String("method", "readiness"),
-		zap.Strings("tags", args.Tags),
-	)
-	reply.Checks, reply.Healthy = s.health.Readiness(args.Tags...)
-	return nil
-}
-
-// Health returns a summation of the health of the node
-func (s *Service) Health(_ *http.Request, args *APIArgs, reply *APIReply) error {
-	s.log.Debug("API called",
-		zap.String("service", "health"),
-		zap.String("method", "health"),
-		zap.Strings("tags", args.Tags),
-	)
-
-	reply.Checks, reply.Healthy = s.health.Health(args.Tags...)
-	return nil
-}
-
-// Liveness returns if the node is in need of a restart
-func (s *Service) Liveness(_ *http.Request, args *APIArgs, reply *APIReply) error {
-	s.log.Debug("API called",
-		zap.String("service", "health"),
-		zap.String("method", "liveness"),
-		zap.Strings("tags", args.Tags),
-	)
-	reply.Checks, reply.Healthy = s.health.Liveness(args.Tags...)
-	return nil
-}

api/info/client.go

@@ -1,119 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package info
-
-import (
-	"context"
-	"net/netip"
-	"time"
-
-	"github.com/luxfi/ids"
-	"github.com/luxfi/node/v2/upgrade"
-	"github.com/luxfi/node/v2/utils/rpc"
-	"github.com/luxfi/node/v2/vms/platformvm/signer"
-)
-
-type Client struct {
-	Requester rpc.EndpointRequester
-}
-
-func NewClient(uri string) *Client {
-	return &Client{Requester: rpc.NewEndpointRequester(
-		uri + "/ext/info",
-	)}
-}
-
-func (c *Client) GetNodeVersion(ctx context.Context, options ...rpc.Option) (*GetNodeVersionReply, error) {
-	res := &GetNodeVersionReply{}
-	err := c.Requester.SendRequest(ctx, "info.getNodeVersion", struct{}{}, res, options...)
-	return res, err
-}
-
-func (c *Client) GetNodeID(ctx context.Context, options ...rpc.Option) (ids.NodeID, *signer.ProofOfPossession, error) {
-	res := &GetNodeIDReply{}
-	err := c.Requester.SendRequest(ctx, "info.getNodeID", struct{}{}, res, options...)
-	return res.NodeID, res.NodePOP, err
-}
-
-func (c *Client) GetNodeIP(ctx context.Context, options ...rpc.Option) (netip.AddrPort, error) {
-	res := &GetNodeIPReply{}
-	err := c.Requester.SendRequest(ctx, "info.getNodeIP", struct{}{}, res, options...)
-	return res.IP, err
-}
-
-func (c *Client) GetNetworkID(ctx context.Context, options ...rpc.Option) (uint32, error) {
-	res := &GetNetworkIDReply{}
-	err := c.Requester.SendRequest(ctx, "info.getNetworkID", struct{}{}, res, options...)
-	return uint32(res.NetworkID), err
-}
-
-func (c *Client) GetNetworkName(ctx context.Context, options ...rpc.Option) (string, error) {
-	res := &GetNetworkNameReply{}
-	err := c.Requester.SendRequest(ctx, "info.getNetworkName", struct{}{}, res, options...)
-	return res.NetworkName, err
-}
-
-func (c *Client) GetBlockchainID(ctx context.Context, alias string, options ...rpc.Option) (ids.ID, error) {
-	res := &GetBlockchainIDReply{}
-	err := c.Requester.SendRequest(ctx, "info.getBlockchainID", &GetBlockchainIDArgs{
-		Alias: alias,
-	}, res, options...)
-	return res.BlockchainID, err
-}
-
-func (c *Client) Peers(ctx context.Context, nodeIDs []ids.NodeID, options ...rpc.Option) ([]Peer, error) {
-	res := &PeersReply{}
-	err := c.Requester.SendRequest(ctx, "info.peers", &PeersArgs{
-		NodeIDs: nodeIDs,
-	}, res, options...)
-	return res.Peers, err
-}
-
-func (c *Client) IsBootstrapped(ctx context.Context, chainID string, options ...rpc.Option) (bool, error) {
-	res := &IsBootstrappedResponse{}
-	err := c.Requester.SendRequest(ctx, "info.isBootstrapped", &IsBootstrappedArgs{
-		Chain: chainID,
-	}, res, options...)
-	return res.IsBootstrapped, err
-}
-
-func (c *Client) Upgrades(ctx context.Context, options ...rpc.Option) (*upgrade.Config, error) {
-	res := &upgrade.Config{}
-	err := c.Requester.SendRequest(ctx, "info.upgrades", struct{}{}, res, options...)
-	return res, err
-}
-
-func (c *Client) Uptime(ctx context.Context, options ...rpc.Option) (*UptimeResponse, error) {
-	res := &UptimeResponse{}
-	err := c.Requester.SendRequest(ctx, "info.uptime", struct{}{}, res, options...)
-	return res, err
-}
-
-func (c *Client) GetVMs(ctx context.Context, options ...rpc.Option) (map[ids.ID][]string, error) {
-	res := &GetVMsReply{}
-	err := c.Requester.SendRequest(ctx, "info.getVMs", struct{}{}, res, options...)
-	return res.VMs, err
-}
-
-// AwaitBootstrapped polls the node every [freq] to check if [chainID] has
-// finished bootstrapping. Returns true once [chainID] reports that it has
-// finished bootstrapping.
-// Only returns an error if [ctx] returns an error.
-func AwaitBootstrapped(ctx context.Context, c *Client, chainID string, freq time.Duration, options ...rpc.Option) (bool, error) {
-	ticker := time.NewTicker(freq)
-	defer ticker.Stop()
-
-	for {
-		res, err := c.IsBootstrapped(ctx, chainID, options...)
-		if err == nil && res {
-			return true, nil
-		}
-
-		select {
-		case <-ticker.C:
-		case <-ctx.Done():
-			return false, ctx.Err()
-		}
-	}
-}

api/info/client_test.go

@@ -1,71 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package info
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/luxfi/node/v2/utils/rpc"
-)
-
-type mockClient struct {
-	reply  IsBootstrappedResponse
-	err    error
-	onCall func()
-}
-
-func (mc *mockClient) SendRequest(_ context.Context, _ string, _ interface{}, replyIntf interface{}, _ ...rpc.Option) error {
-	reply := replyIntf.(*IsBootstrappedResponse)
-	*reply = mc.reply
-	mc.onCall()
-	return mc.err
-}
-
-func TestNewClient(t *testing.T) {
-	require := require.New(t)
-
-	c := NewClient("")
-	require.NotNil(c)
-}
-
-func TestClient(t *testing.T) {
-	require := require.New(t)
-
-	mc := &mockClient{
-		reply:  IsBootstrappedResponse{true},
-		err:    nil,
-		onCall: func() {},
-	}
-	c := &Client{
-		Requester: mc,
-	}
-
-	{
-		bootstrapped, err := c.IsBootstrapped(context.Background(), "X")
-		require.NoError(err)
-		require.True(bootstrapped)
-	}
-
-	mc.reply.IsBootstrapped = false
-
-	{
-		bootstrapped, err := c.IsBootstrapped(context.Background(), "X")
-		require.NoError(err)
-		require.False(bootstrapped)
-	}
-
-	mc.onCall = func() {
-		mc.reply.IsBootstrapped = true
-	}
-
-	{
-		bootstrapped, err := AwaitBootstrapped(context.Background(), c, "X", time.Microsecond)
-		require.NoError(err)
-		require.True(bootstrapped)
-	}
-}

api/info/service.go

@@ -1,479 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package info
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"net/netip"
-
-	"github.com/gorilla/rpc/v2"
-	"go.uber.org/zap"
-
-	"github.com/luxfi/ids"
-	"github.com/luxfi/node/v2/chains"
-	"github.com/luxfi/node/v2/quasar/networking/benchlist"
-	"github.com/luxfi/node/v2/quasar/validators"
-	"github.com/luxfi/node/v2/network"
-	"github.com/luxfi/node/v2/network/peer"
-	"github.com/luxfi/node/v2/upgrade"
-	"github.com/luxfi/node/v2/utils"
-	"github.com/luxfi/node/v2/utils/constants"
-	"github.com/luxfi/node/v2/utils/json"
-	log "github.com/luxfi/log"
-	"github.com/luxfi/node/v2/utils/set"
-	"github.com/luxfi/node/v2/utils/units"
-	"github.com/luxfi/node/v2/version"
-	"github.com/luxfi/node/v2/vms"
-	"github.com/luxfi/node/v2/vms/nftfx"
-	"github.com/luxfi/node/v2/vms/platformvm/signer"
-	"github.com/luxfi/node/v2/vms/propertyfx"
-	"github.com/luxfi/node/v2/vms/secp256k1fx"
-)
-
-var (
-	errNoChainProvided = errors.New("argument 'chain' not given")
-
-	mainnetGetTxFeeResponse = GetTxFeeResponse{
-		CreateSubnetTxFee:             json.Uint64(1 * units.Lux),
-		TransformSubnetTxFee:          json.Uint64(10 * units.Lux),
-		CreateBlockchainTxFee:         json.Uint64(1 * units.Lux),
-		AddPrimaryNetworkValidatorFee: json.Uint64(0),
-		AddPrimaryNetworkDelegatorFee: json.Uint64(0),
-		AddSubnetValidatorFee:         json.Uint64(units.MilliLux),
-		AddSubnetDelegatorFee:         json.Uint64(units.MilliLux),
-	}
-	testnetGetTxFeeResponse = GetTxFeeResponse{
-		CreateSubnetTxFee:             json.Uint64(100 * units.MilliLux),
-		TransformSubnetTxFee:          json.Uint64(1 * units.Lux),
-		CreateBlockchainTxFee:         json.Uint64(100 * units.MilliLux),
-		AddPrimaryNetworkValidatorFee: json.Uint64(0),
-		AddPrimaryNetworkDelegatorFee: json.Uint64(0),
-		AddSubnetValidatorFee:         json.Uint64(units.MilliLux),
-		AddSubnetDelegatorFee:         json.Uint64(units.MilliLux),
-	}
-	defaultGetTxFeeResponse = GetTxFeeResponse{
-		CreateSubnetTxFee:             json.Uint64(100 * units.MilliLux),
-		TransformSubnetTxFee:          json.Uint64(100 * units.MilliLux),
-		CreateBlockchainTxFee:         json.Uint64(100 * units.MilliLux),
-		AddPrimaryNetworkValidatorFee: json.Uint64(0),
-		AddPrimaryNetworkDelegatorFee: json.Uint64(0),
-		AddSubnetValidatorFee:         json.Uint64(units.MilliLux),
-		AddSubnetDelegatorFee:         json.Uint64(units.MilliLux),
-	}
-)
-
-// Info is the API service for unprivileged info on a node
-type Info struct {
-	Parameters
-	log          log.Logger
-	validators   validators.Manager
-	myIP         *utils.Atomic[netip.AddrPort]
-	networking   network.Network
-	chainManager chains.Manager
-	vmManager    vms.Manager
-	benchlist    benchlist.Manager
-}
-
-type Parameters struct {
-	Version   *version.Application
-	NodeID    ids.NodeID
-	NodePOP   *signer.ProofOfPossession
-	NetworkID uint32
-	VMManager vms.Manager
-	Upgrades  upgrade.Config
-
-	TxFee            uint64
-	CreateAssetTxFee uint64
-}
-
-func NewService(
-	parameters Parameters,
-	log log.Logger,
-	validators validators.Manager,
-	chainManager chains.Manager,
-	vmManager vms.Manager,
-	myIP *utils.Atomic[netip.AddrPort],
-	network network.Network,
-	benchlist benchlist.Manager,
-) (http.Handler, error) {
-	server := rpc.NewServer()
-	codec := json.NewCodec()
-	server.RegisterCodec(codec, "application/json")
-	server.RegisterCodec(codec, "application/json;charset=UTF-8")
-	return server, server.RegisterService(
-		&Info{
-			Parameters:   parameters,
-			log:          log,
-			validators:   validators,
-			chainManager: chainManager,
-			vmManager:    vmManager,
-			myIP:         myIP,
-			networking:   network,
-			benchlist:    benchlist,
-		},
-		"info",
-	)
-}
-
-// GetNodeVersionReply are the results from calling GetNodeVersion
-type GetNodeVersionReply struct {
-	Version            string            `json:"version"`
-	DatabaseVersion    string            `json:"databaseVersion"`
-	RPCProtocolVersion json.Uint32       `json:"rpcProtocolVersion"`
-	GitCommit          string            `json:"gitCommit"`
-	VMVersions         map[string]string `json:"vmVersions"`
-}
-
-// GetNodeVersion returns the version this node is running
-func (i *Info) GetNodeVersion(_ *http.Request, _ *struct{}, reply *GetNodeVersionReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "getNodeVersion"),
-	)
-
-	vmVersions, err := i.vmManager.Versions()
-	if err != nil {
-		return err
-	}
-
-	reply.Version = i.Version.String()
-	reply.DatabaseVersion = version.CurrentDatabase.String()
-	reply.RPCProtocolVersion = json.Uint32(version.RPCChainVMProtocol)
-	reply.GitCommit = version.GitCommit
-	reply.VMVersions = vmVersions
-	return nil
-}
-
-// GetNodeIDReply are the results from calling GetNodeID
-type GetNodeIDReply struct {
-	NodeID  ids.NodeID                `json:"nodeID"`
-	NodePOP *signer.ProofOfPossession `json:"nodePOP"`
-}
-
-// GetNodeID returns the node ID of this node
-func (i *Info) GetNodeID(_ *http.Request, _ *struct{}, reply *GetNodeIDReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "getNodeID"),
-	)
-
-	reply.NodeID = i.NodeID
-	reply.NodePOP = i.NodePOP
-	return nil
-}
-
-// GetNetworkIDReply are the results from calling GetNetworkID
-type GetNetworkIDReply struct {
-	NetworkID json.Uint32 `json:"networkID"`
-}
-
-// GetNodeIPReply are the results from calling GetNodeIP
-type GetNodeIPReply struct {
-	IP netip.AddrPort `json:"ip"`
-}
-
-// GetNodeIP returns the IP of this node
-func (i *Info) GetNodeIP(_ *http.Request, _ *struct{}, reply *GetNodeIPReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "getNodeIP"),
-	)
-
-	reply.IP = i.myIP.Get()
-	return nil
-}
-
-// GetNetworkID returns the network ID this node is running on
-func (i *Info) GetNetworkID(_ *http.Request, _ *struct{}, reply *GetNetworkIDReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "getNetworkID"),
-	)
-
-	reply.NetworkID = json.Uint32(i.NetworkID)
-	return nil
-}
-
-// GetNetworkNameReply is the result from calling GetNetworkName
-type GetNetworkNameReply struct {
-	NetworkName string `json:"networkName"`
-}
-
-// GetNetworkName returns the network name this node is running on
-func (i *Info) GetNetworkName(_ *http.Request, _ *struct{}, reply *GetNetworkNameReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "getNetworkName"),
-	)
-
-	reply.NetworkName = constants.NetworkName(i.NetworkID)
-	return nil
-}
-
-// GetBlockchainIDArgs are the arguments for calling GetBlockchainID
-type GetBlockchainIDArgs struct {
-	Alias string `json:"alias"`
-}
-
-// GetBlockchainIDReply are the results from calling GetBlockchainID
-type GetBlockchainIDReply struct {
-	BlockchainID ids.ID `json:"blockchainID"`
-}
-
-// GetBlockchainID returns the blockchain ID that resolves the alias that was supplied
-func (i *Info) GetBlockchainID(_ *http.Request, args *GetBlockchainIDArgs, reply *GetBlockchainIDReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "getBlockchainID"),
-	)
-
-	bID, err := i.chainManager.Lookup(args.Alias)
-	reply.BlockchainID = bID
-	return err
-}
-
-// PeersArgs are the arguments for calling Peers
-type PeersArgs struct {
-	NodeIDs []ids.NodeID `json:"nodeIDs"`
-}
-
-type Peer struct {
-	peer.Info
-
-	Benched []string `json:"benched"`
-}
-
-// PeersReply are the results from calling Peers
-type PeersReply struct {
-	// Number of elements in [Peers]
-	NumPeers json.Uint64 `json:"numPeers"`
-	// Each element is a peer
-	Peers []Peer `json:"peers"`
-}
-
-// Peers returns the list of current validators
-func (i *Info) Peers(_ *http.Request, args *PeersArgs, reply *PeersReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "peers"),
-	)
-
-	peers := i.networking.PeerInfo(args.NodeIDs)
-	peerInfo := make([]Peer, len(peers))
-	for index, peer := range peers {
-		benchedIDs := i.benchlist.GetBenched(peer.ID)
-		benchedAliases := make([]string, len(benchedIDs))
-		for idx, id := range benchedIDs {
-			alias, err := i.chainManager.PrimaryAlias(id)
-			if err != nil {
-				return fmt.Errorf("failed to get primary alias for chain ID %s: %w", id, err)
-			}
-			benchedAliases[idx] = alias
-		}
-		peerInfo[index] = Peer{
-			Info:    peer,
-			Benched: benchedAliases,
-		}
-	}
-
-	reply.Peers = peerInfo
-	reply.NumPeers = json.Uint64(len(reply.Peers))
-	return nil
-}
-
-// IsBootstrappedArgs are the arguments for calling IsBootstrapped
-type IsBootstrappedArgs struct {
-	// Alias of the chain
-	// Can also be the string representation of the chain's ID
-	Chain string `json:"chain"`
-}
-
-// IsBootstrappedResponse are the results from calling IsBootstrapped
-type IsBootstrappedResponse struct {
-	// True iff the chain exists and is done bootstrapping
-	IsBootstrapped bool `json:"isBootstrapped"`
-}
-
-// IsBootstrapped returns nil and sets [reply.IsBootstrapped] == true iff [args.Chain] exists and is done bootstrapping
-// Returns an error if the chain doesn't exist
-func (i *Info) IsBootstrapped(_ *http.Request, args *IsBootstrappedArgs, reply *IsBootstrappedResponse) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "isBootstrapped"),
-		log.UserString("chain", args.Chain),
-	)
-
-	if args.Chain == "" {
-		return errNoChainProvided
-	}
-	chainID, err := i.chainManager.Lookup(args.Chain)
-	if err != nil {
-		return fmt.Errorf("there is no chain with alias/ID '%s'", args.Chain)
-	}
-	reply.IsBootstrapped = i.chainManager.IsBootstrapped(chainID)
-	return nil
-}
-
-// Upgrades returns the upgrade schedule this node is running.
-func (i *Info) Upgrades(_ *http.Request, _ *struct{}, reply *upgrade.Config) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "upgrades"),
-	)
-
-	*reply = i.Parameters.Upgrades
-	return nil
-}
-
-// UptimeResponse are the results from calling Uptime
-type UptimeResponse struct {
-	// RewardingStakePercentage shows what percent of network stake thinks we're
-	// above the uptime requirement.
-	RewardingStakePercentage json.Float64 `json:"rewardingStakePercentage"`
-
-	// WeightedAveragePercentage is the average perceived uptime of this node,
-	// weighted by stake.
-	// Note that this is different from RewardingStakePercentage, which shows
-	// the percent of the network stake that thinks this node is above the
-	// uptime requirement. WeightedAveragePercentage is weighted by uptime.
-	// i.e If uptime requirement is 85 and a peer reports 40 percent it will be
-	// counted (40*weight) in WeightedAveragePercentage but not in
-	// RewardingStakePercentage since 40 < 85
-	WeightedAveragePercentage json.Float64 `json:"weightedAveragePercentage"`
-}
-
-func (i *Info) Uptime(_ *http.Request, _ *struct{}, reply *UptimeResponse) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "uptime"),
-	)
-
-	result, err := i.networking.NodeUptime()
-	if err != nil {
-		return fmt.Errorf("couldn't get node uptime: %w", err)
-	}
-	reply.WeightedAveragePercentage = json.Float64(result.WeightedAveragePercentage)
-	reply.RewardingStakePercentage = json.Float64(result.RewardingStakePercentage)
-	return nil
-}
-
-type LP struct {
-	SupportWeight json.Uint64         `json:"supportWeight"`
-	Supporters    set.Set[ids.NodeID] `json:"supporters"`
-	ObjectWeight  json.Uint64         `json:"objectWeight"`
-	Objectors     set.Set[ids.NodeID] `json:"objectors"`
-	AbstainWeight json.Uint64         `json:"abstainWeight"`
-}
-
-type LPsReply struct {
-	LPs map[uint32]*LP `json:"lps"`
-}
-
-func (a *LPsReply) getLP(lpNum uint32) *LP {
-	lp, ok := a.LPs[lpNum]
-	if !ok {
-		lp = &LP{}
-		a.LPs[lpNum] = lp
-	}
-	return lp
-}
-
-func (i *Info) LPs(_ *http.Request, _ *struct{}, reply *LPsReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "lps"),
-	)
-
-	reply.LPs = make(map[uint32]*LP, constants.CurrentLPs.Len())
-	peers := i.networking.PeerInfo(nil)
-	for _, peer := range peers {
-		weight := json.Uint64(i.validators.GetWeight(constants.PrimaryNetworkID, peer.ID))
-		if weight == 0 {
-			continue
-		}
-
-		for lpNum := range peer.SupportedLPs {
-			lp := reply.getLP(lpNum)
-			lp.Supporters.Add(peer.ID)
-			lp.SupportWeight += weight
-		}
-		for lpNum := range peer.ObjectedLPs {
-			lp := reply.getLP(lpNum)
-			lp.Objectors.Add(peer.ID)
-			lp.ObjectWeight += weight
-		}
-	}
-
-	totalWeight, err := i.validators.TotalWeight(constants.PrimaryNetworkID)
-	if err != nil {
-		return err
-	}
-	for lpNum := range constants.CurrentLPs {
-		lp := reply.getLP(lpNum)
-		lp.AbstainWeight = json.Uint64(totalWeight) - lp.SupportWeight - lp.ObjectWeight
-	}
-	return nil
-}
-
-type GetTxFeeResponse struct {
-	TxFee                         json.Uint64 `json:"txFee"`
-	CreateAssetTxFee              json.Uint64 `json:"createAssetTxFee"`
-	CreateSubnetTxFee             json.Uint64 `json:"createSubnetTxFee"`
-	TransformSubnetTxFee          json.Uint64 `json:"transformSubnetTxFee"`
-	CreateBlockchainTxFee         json.Uint64 `json:"createBlockchainTxFee"`
-	AddPrimaryNetworkValidatorFee json.Uint64 `json:"addPrimaryNetworkValidatorFee"`
-	AddPrimaryNetworkDelegatorFee json.Uint64 `json:"addPrimaryNetworkDelegatorFee"`
-	AddSubnetValidatorFee         json.Uint64 `json:"addSubnetValidatorFee"`
-	AddSubnetDelegatorFee         json.Uint64 `json:"addSubnetDelegatorFee"`
-}
-
-// GetTxFee returns the transaction fee in nLUX.
-func (i *Info) GetTxFee(_ *http.Request, _ *struct{}, reply *GetTxFeeResponse) error {
-	i.log.Warn("deprecated API called",
-		zap.String("service", "info"),
-		zap.String("method", "getTxFee"),
-	)
-
-	switch i.NetworkID {
-	case constants.MainnetID:
-		*reply = mainnetGetTxFeeResponse
-	case constants.TestnetID:
-		*reply = testnetGetTxFeeResponse
-	default:
-		*reply = defaultGetTxFeeResponse
-	}
-	reply.TxFee = json.Uint64(i.TxFee)
-	reply.CreateAssetTxFee = json.Uint64(i.CreateAssetTxFee)
-	return nil
-}
-
-// GetVMsReply contains the response metadata for GetVMs
-type GetVMsReply struct {
-	VMs map[ids.ID][]string `json:"vms"`
-	Fxs map[ids.ID]string   `json:"fxs"`
-}
-
-// GetVMs lists the virtual machines installed on the node
-func (i *Info) GetVMs(_ *http.Request, _ *struct{}, reply *GetVMsReply) error {
-	i.log.Debug("API called",
-		zap.String("service", "info"),
-		zap.String("method", "getVMs"),
-	)
-
-	// Fetch the VMs registered on this node.
-	vmIDs, err := i.VMManager.ListFactories()
-	if err != nil {
-		return err
-	}
-
-	reply.VMs, err = ids.GetRelevantAliases(i.VMManager, vmIDs)
-	reply.Fxs = map[ids.ID]string{
-		secp256k1fx.ID: secp256k1fx.Name,
-		nftfx.ID:       nftfx.Name,
-		propertyfx.ID:  propertyfx.Name,
-	}
-	return err
-}

api/info/service_test.go

@@ -1,94 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package info
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
-
-	"github.com/luxfi/ids"
-	log "github.com/luxfi/log"
-	"github.com/luxfi/node/v2/vms/vmsmock"
-)
-
-var errTest = errors.New("non-nil error")
-
-type getVMsTest struct {
-	info          *Info
-	mockVMManager *vmsmock.Manager
-}
-
-func initGetVMsTest(t *testing.T) *getVMsTest {
-	ctrl := gomock.NewController(t)
-	mockVMManager := vmsmock.NewManager(ctrl)
-	return &getVMsTest{
-		info: &Info{
-			Parameters: Parameters{
-				VMManager: mockVMManager,
-			},
-			log: log.NewNoOpLogger(),
-		},
-		mockVMManager: mockVMManager,
-	}
-}
-
-// Tests GetVMs in the happy-case
-func TestGetVMsSuccess(t *testing.T) {
-	require := require.New(t)
-
-	resources := initGetVMsTest(t)
-
-	id1 := ids.GenerateTestID()
-	id2 := ids.GenerateTestID()
-
-	vmIDs := []ids.ID{id1, id2}
-	// every vm is at least aliased to itself.
-	alias1 := []string{id1.String(), "vm1-alias-1", "vm1-alias-2"}
-	alias2 := []string{id2.String(), "vm2-alias-1", "vm2-alias-2"}
-	// we expect that we dedup the redundant alias of vmId.
-	expectedVMRegistry := map[ids.ID][]string{
-		id1: alias1[1:],
-		id2: alias2[1:],
-	}
-
-	resources.mockVMManager.EXPECT().ListFactories().Times(1).Return(vmIDs, nil)
-	resources.mockVMManager.EXPECT().Aliases(id1).Times(1).Return(alias1, nil)
-	resources.mockVMManager.EXPECT().Aliases(id2).Times(1).Return(alias2, nil)
-
-	reply := GetVMsReply{}
-	require.NoError(resources.info.GetVMs(nil, nil, &reply))
-	require.Equal(expectedVMRegistry, reply.VMs)
-}
-
-// Tests GetVMs if we fail to list our vms.
-func TestGetVMsVMsListFactoriesFails(t *testing.T) {
-	resources := initGetVMsTest(t)
-
-	resources.mockVMManager.EXPECT().ListFactories().Times(1).Return(nil, errTest)
-
-	reply := GetVMsReply{}
-	err := resources.info.GetVMs(nil, nil, &reply)
-	require.ErrorIs(t, err, errTest)
-}
-
-// Tests GetVMs if we can't get our vm aliases.
-func TestGetVMsGetAliasesFails(t *testing.T) {
-	resources := initGetVMsTest(t)
-
-	id1 := ids.GenerateTestID()
-	id2 := ids.GenerateTestID()
-	vmIDs := []ids.ID{id1, id2}
-	alias1 := []string{id1.String(), "vm1-alias-1", "vm1-alias-2"}
-
-	resources.mockVMManager.EXPECT().ListFactories().Times(1).Return(vmIDs, nil)
-	resources.mockVMManager.EXPECT().Aliases(id1).Times(1).Return(alias1, nil)
-	resources.mockVMManager.EXPECT().Aliases(id2).Times(1).Return(nil, errTest)
-
-	reply := GetVMsReply{}
-	err := resources.info.GetVMs(nil, nil, &reply)
-	require.ErrorIs(t, err, errTest)
-}

api/metrics/factory.go

@@ -1,28 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package metrics
-
-import (
-	"github.com/prometheus/client_golang/prometheus"
-	luxmetrics "github.com/luxfi/metrics"
-)
-
-// NewLuxMetricsMultiGatherer creates a MultiGatherer using Lux metrics
-func NewLuxMetricsMultiGatherer() MultiGatherer {
-	// Create a new PrefixGatherer which implements the MultiGatherer interface
-	return NewPrefixGatherer()
-}
-
-// CreateLuxMetrics creates a Lux metrics instance with a prometheus backend
-func CreateLuxMetrics(namespace string) luxmetrics.Metrics {
-	// Use the prometheus factory from Lux metrics
-	factory := luxmetrics.NewPrometheusFactory()
-	return factory.New(namespace)
-}
-
-// GetPrometheusRegistry extracts the prometheus registry from Lux metrics
-func GetPrometheusRegistry(metrics luxmetrics.Metrics) (*prometheus.Registry, bool) {
-	registry := metrics.Registry()
-	return luxmetrics.UnwrapPrometheusRegistry(registry)
-}

api/metrics/gatherer_test.go

@@ -1,24 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package metrics
-
-import (
-	"github.com/prometheus/client_golang/prometheus"
-
-	dto "github.com/prometheus/client_model/go"
-)
-
-var counterOpts = prometheus.CounterOpts{
-	Name: "counter",
-	Help: "help",
-}
-
-type testGatherer struct {
-	mfs []*dto.MetricFamily
-	err error
-}
-
-func (g *testGatherer) Gather() ([]*dto.MetricFamily, error) {
-	return g.mfs, g.err
-}

api/metrics/label_gatherer.go

@@ -1,78 +0,0 @@
-// Copyright (C) 2020-2025, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package metrics
-
-import (
-	"errors"
-	"fmt"
-	"slices"
-
-	"github.com/prometheus/client_golang/prometheus"
-
-	dto "github.com/prometheus/client_model/go"
-)
-
-var (
-	_ MultiGatherer = (*prefixGatherer)(nil)
-
-	errDuplicateGatherer = errors.New("attempt to register duplicate gatherer")
-)
-
-// NewLabelGatherer returns a new MultiGatherer that merges metrics by adding a
-// new label.
-func NewLabelGatherer(labelName string) MultiGatherer {
-	return &labelGatherer{
-		labelName: labelName,
-	}
-}
-
-type labelGatherer struct {
-	multiGatherer
-
-	labelName string
-}
-
-func (g *labelGatherer) Register(labelValue string, gatherer prometheus.Gatherer) error {
-	g.lock.Lock()
-	defer g.lock.Unlock()
-
-	if slices.Contains(g.names, labelValue) {
-		return fmt.Errorf("%w: for %q with label %q",
-			errDuplicateGatherer,
-			g.labelName,
-			labelValue,
-		)
-	}
-
-	g.register(
-		labelValue,
-		&labeledGatherer{
-			labelName:  g.labelName,
-			labelValue: labelValue,
-			gatherer:   gatherer,
-		},
-	)
-	return nil
-}
-
-type labeledGatherer struct {
-	labelName  string
-	labelValue string
-	gatherer   prometheus.Gatherer
-}
-
-func (g *labeledGatherer) Gather() ([]*dto.MetricFamily, error) {
-	// Gather returns partially filled metrics in the case of an error. So, it
-	// is expected to still return the metrics in the case an error is returned.
-	metricFamilies, err := g.gatherer.Gather()
-	for _, metricFamily := range metricFamilies {
-		for _, metric := range metricFamily.Metric {
-			metric.Label = append(metric.Label, &dto.LabelPair{
-				Name:  &g.labelName,
-				Value: &g.labelValue,
-			})
-		}
-	}
-	return metricFamilies, err
-}