deps: bump luxfi/consensus v1.25.30 -> v1.25.31 (dynamic K/α committee clamp)

Pulls the validator-count clamp that scales an oversized consensus committee
down to the live set (fixes testnet finality wedge where TestnetParams K=11/α=8
was unsatisfiable with 5 validators; also protects mainnet from the same brick
when it runs fewer than 21 validators).

.ci-status-check.md

@@ -0,0 +1 @@
+# CI Status Check - 2025-09-23 23:30:58

.github/CLOUD_IMAGE_SETUP.md

@@ -0,0 +1,393 @@
+# Multi-Cloud Image Build Setup
+
+This document explains how to set up the CI/CD pipeline for building Lux Network node images on AWS, GCP, and Azure.
+
+## Overview
+
+The workflows automatically build machine images when:
+- A new version tag is pushed (`v*`)
+- A GitHub release is published
+- Manually triggered via workflow dispatch
+
+## Required GitHub Secrets
+
+### AWS Secrets
+
+| Secret | Description | How to Obtain |
+|--------|-------------|---------------|
+| `AWS_AMI_ROLE_ARN` | IAM role ARN for OIDC authentication | See AWS Setup below |
+
+### GCP Secrets
+
+| Secret | Description | How to Obtain |
+|--------|-------------|---------------|
+| `GCP_PROJECT_ID` | Google Cloud project ID | GCP Console |
+| `GCP_WORKLOAD_IDENTITY_PROVIDER` | Workload Identity Federation provider | See GCP Setup below |
+| `GCP_SERVICE_ACCOUNT` | Service account email | See GCP Setup below |
+
+### Azure Secrets
+
+| Secret | Description | How to Obtain |
+|--------|-------------|---------------|
+| `AZURE_CLIENT_ID` | Azure AD application ID | See Azure Setup below |
+| `AZURE_CLIENT_SECRET` | Azure AD application secret | See Azure Setup below |
+| `AZURE_TENANT_ID` | Azure AD tenant ID | Azure Portal |
+| `AZURE_SUBSCRIPTION_ID` | Azure subscription ID | Azure Portal |
+| `AZURE_RESOURCE_GROUP` | Resource group for images | Create in Azure |
+
+---
+
+## AWS Setup
+
+### 1. Create OIDC Identity Provider
+
+```bash
+# Create the OIDC provider for GitHub Actions
+aws iam create-open-id-connect-provider \
+  --url https://token.actions.githubusercontent.com \
+  --client-id-list sts.amazonaws.com \
+  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1
+```
+
+### 2. Create IAM Role
+
+```bash
+# Create trust policy file
+cat > trust-policy.json << 'EOF'
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Federated": "arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
+      },
+      "Action": "sts:AssumeRoleWithWebIdentity",
+      "Condition": {
+        "StringEquals": {
+          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+        },
+        "StringLike": {
+          "token.actions.githubusercontent.com:sub": "repo:luxfi/node:*"
+        }
+      }
+    }
+  ]
+}
+EOF
+
+# Create the role
+aws iam create-role \
+  --role-name GitHubActionsLuxAMI \
+  --assume-role-policy-document file://trust-policy.json
+```
+
+### 3. Attach Permissions
+
+```bash
+# Create policy for Packer AMI building
+cat > packer-policy.json << 'EOF'
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:AttachVolume",
+        "ec2:AuthorizeSecurityGroupIngress",
+        "ec2:CopyImage",
+        "ec2:CreateImage",
+        "ec2:CreateKeypair",
+        "ec2:CreateSecurityGroup",
+        "ec2:CreateSnapshot",
+        "ec2:CreateTags",
+        "ec2:CreateVolume",
+        "ec2:DeleteKeyPair",
+        "ec2:DeleteSecurityGroup",
+        "ec2:DeleteSnapshot",
+        "ec2:DeleteVolume",
+        "ec2:DeregisterImage",
+        "ec2:DescribeImageAttribute",
+        "ec2:DescribeImages",
+        "ec2:DescribeInstances",
+        "ec2:DescribeInstanceStatus",
+        "ec2:DescribeRegions",
+        "ec2:DescribeSecurityGroups",
+        "ec2:DescribeSnapshots",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeTags",
+        "ec2:DescribeVolumes",
+        "ec2:DetachVolume",
+        "ec2:GetPasswordData",
+        "ec2:ModifyImageAttribute",
+        "ec2:ModifyInstanceAttribute",
+        "ec2:ModifySnapshotAttribute",
+        "ec2:RegisterImage",
+        "ec2:RunInstances",
+        "ec2:StopInstances",
+        "ec2:TerminateInstances"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+EOF
+
+aws iam put-role-policy \
+  --role-name GitHubActionsLuxAMI \
+  --policy-name PackerAMIBuilder \
+  --policy-document file://packer-policy.json
+```
+
+### 4. Add Secret to GitHub
+
+```bash
+# Get the role ARN
+aws iam get-role --role-name GitHubActionsLuxAMI --query 'Role.Arn' --output text
+
+# Add to GitHub secrets:
+# AWS_AMI_ROLE_ARN = arn:aws:iam::YOUR_ACCOUNT_ID:role/GitHubActionsLuxAMI
+```
+
+---
+
+## GCP Setup
+
+### 1. Create Service Account
+
+```bash
+PROJECT_ID="your-gcp-project"
+
+# Create service account
+gcloud iam service-accounts create github-packer \
+  --project=$PROJECT_ID \
+  --display-name="GitHub Actions Packer"
+
+# Grant permissions
+gcloud projects add-iam-policy-binding $PROJECT_ID \
+  --member="serviceAccount:github-packer@$PROJECT_ID.iam.gserviceaccount.com" \
+  --role="roles/compute.instanceAdmin.v1"
+
+gcloud projects add-iam-policy-binding $PROJECT_ID \
+  --member="serviceAccount:github-packer@$PROJECT_ID.iam.gserviceaccount.com" \
+  --role="roles/compute.imageAdmin"
+
+gcloud projects add-iam-policy-binding $PROJECT_ID \
+  --member="serviceAccount:github-packer@$PROJECT_ID.iam.gserviceaccount.com" \
+  --role="roles/iam.serviceAccountUser"
+```
+
+### 2. Setup Workload Identity Federation
+
+```bash
+# Create workload identity pool
+gcloud iam workload-identity-pools create github-pool \
+  --project=$PROJECT_ID \
+  --location="global" \
+  --display-name="GitHub Actions Pool"
+
+# Create provider
+gcloud iam workload-identity-pools providers create-oidc github-provider \
+  --project=$PROJECT_ID \
+  --location="global" \
+  --workload-identity-pool="github-pool" \
+  --display-name="GitHub Provider" \
+  --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository" \
+  --issuer-uri="https://token.actions.githubusercontent.com"
+
+# Allow GitHub to impersonate service account
+gcloud iam service-accounts add-iam-policy-binding \
+  github-packer@$PROJECT_ID.iam.gserviceaccount.com \
+  --project=$PROJECT_ID \
+  --role="roles/iam.workloadIdentityUser" \
+  --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/attribute.repository/luxfi/node"
+```
+
+### 3. Get Provider URL
+
+```bash
+# Get the provider resource name
+gcloud iam workload-identity-pools providers describe github-provider \
+  --project=$PROJECT_ID \
+  --location="global" \
+  --workload-identity-pool="github-pool" \
+  --format="value(name)"
+
+# Output format: projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/providers/github-provider
+```
+
+### 4. Add Secrets to GitHub
+
+```
+GCP_PROJECT_ID = your-gcp-project
+GCP_WORKLOAD_IDENTITY_PROVIDER = projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/github-pool/providers/github-provider
+GCP_SERVICE_ACCOUNT = github-packer@your-gcp-project.iam.gserviceaccount.com
+```
+
+---
+
+## Azure Setup
+
+### 1. Create Resource Group
+
+```bash
+az group create --name luxfi-images --location eastus
+```
+
+### 2. Create App Registration
+
+```bash
+# Create app registration
+az ad app create --display-name "GitHub Actions Lux Packer"
+
+# Get the app ID
+APP_ID=$(az ad app list --display-name "GitHub Actions Lux Packer" --query "[0].appId" -o tsv)
+
+# Create service principal
+az ad sp create --id $APP_ID
+
+# Create client secret
+az ad app credential reset --id $APP_ID --display-name "github-actions"
+```
+
+### 3. Assign Permissions
+
+```bash
+SUBSCRIPTION_ID=$(az account show --query id -o tsv)
+RESOURCE_GROUP="luxfi-images"
+
+# Grant Contributor on resource group
+az role assignment create \
+  --assignee $APP_ID \
+  --role "Contributor" \
+  --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP"
+
+# Grant permissions to create VMs (for Packer)
+az role assignment create \
+  --assignee $APP_ID \
+  --role "Virtual Machine Contributor" \
+  --scope "/subscriptions/$SUBSCRIPTION_ID"
+```
+
+### 4. Create Shared Image Gallery (Optional)
+
+```bash
+# Create gallery for image distribution
+az sig create \
+  --resource-group $RESOURCE_GROUP \
+  --gallery-name luxdGallery
+
+# Create image definition
+az sig image-definition create \
+  --resource-group $RESOURCE_GROUP \
+  --gallery-name luxdGallery \
+  --gallery-image-definition luxd \
+  --publisher luxfi \
+  --offer luxd \
+  --sku node \
+  --os-type Linux \
+  --os-state Generalized \
+  --hyper-v-generation V2
+```
+
+### 5. Add Secrets to GitHub
+
+```
+AZURE_CLIENT_ID = <App ID from step 2>
+AZURE_CLIENT_SECRET = <Secret from step 2>
+AZURE_TENANT_ID = <Your Azure AD tenant ID>
+AZURE_SUBSCRIPTION_ID = <Your subscription ID>
+AZURE_RESOURCE_GROUP = luxfi-images
+```
+
+---
+
+## Testing
+
+### Manual Workflow Trigger
+
+```bash
+# Trigger AWS build
+gh workflow run build-aws-ami.yml -f tag=v1.21.15
+
+# Trigger GCP build
+gh workflow run build-gcp-image.yml -f tag=v1.21.15
+
+# Trigger Azure build
+gh workflow run build-azure-image.yml -f tag=v1.21.15
+
+# Trigger all clouds
+gh workflow run build-all-cloud-images.yml -f tag=v1.21.15
+```
+
+### Verify Images
+
+```bash
+# AWS
+aws ec2 describe-images --owners self --filters "Name=name,Values=luxd-*"
+
+# GCP
+gcloud compute images list --filter="family:luxd"
+
+# Azure
+az image list --resource-group luxfi-images
+```
+
+---
+
+## Launching Nodes
+
+### AWS
+
+```bash
+aws ec2 run-instances \
+  --image-id ami-XXXXXXXXX \
+  --instance-type c5.xlarge \
+  --key-name your-key \
+  --security-group-ids sg-XXXXXXXX \
+  --subnet-id subnet-XXXXXXXX \
+  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=luxd-node}]'
+```
+
+### GCP
+
+```bash
+gcloud compute instances create luxd-node \
+  --image-family=luxd \
+  --image-project=your-project \
+  --machine-type=n2-standard-4 \
+  --boot-disk-size=500GB \
+  --zone=us-central1-a
+```
+
+### Azure
+
+```bash
+az vm create \
+  --resource-group luxfi \
+  --name luxd-node \
+  --image luxfi-images/luxd-ubuntu-22-04-v1-21-15 \
+  --size Standard_D4s_v3 \
+  --admin-username ubuntu \
+  --generate-ssh-keys \
+  --os-disk-size-gb 500
+```
+
+---
+
+## Recommended Instance Sizes
+
+| Cloud | Minimum | Recommended | Archive Node |
+|-------|---------|-------------|--------------|
+| AWS | c5.large | c5.xlarge | c5.2xlarge |
+| GCP | n2-standard-2 | n2-standard-4 | n2-standard-8 |
+| Azure | Standard_D2s_v3 | Standard_D4s_v3 | Standard_D8s_v3 |
+
+## Ports to Open
+
+| Port | Protocol | Purpose |
+|------|----------|---------|
+| 9630 | TCP | HTTP RPC |
+| 9631 | TCP | Staking |
+| 9632 | TCP | HTTP API |
+| 22 | TCP | SSH (optional) |

.github/actionlint.yml

@@ -1,5 +1,5 @@
 self-hosted-runner:
   labels:
+    - custom-arm64-focal
     - custom-arm64-jammy
-    - custom-arm64-noble
-    - lux-luxd-runner # Github Action Runner Controller
+    - hanzo-build-linux-amd64

.github/actions/c-chain-reexecution-benchmark/action.yml

@@ -0,0 +1,116 @@
+name: 'C-Chain Re-Execution Benchmark'
+description: 'Run C-Chain re-execution benchmark'
+
+inputs:
+  runner_name:
+    description: 'The name of the runner to use and include in the Golang Benchmark name.'
+    required: true
+  config:
+    description: 'The config to pass to the VM for the benchmark. See BenchmarkReexecuteRange for details.'
+    default: ''
+  start-block:
+    description: 'The start block for the benchmark.'
+    default: '101'
+  end-block:
+    description: 'The end block for the benchmark.'
+    default: '250000'
+  block-dir-src:
+    description: 'The source block directory. Supports S3 directory/zip and local directories.'
+    default: 's3://luxd-bootstrap-testing/cchain-mainnet-blocks-1m-ldb/**'
+  current-state-dir-src:
+    description: 'The current state directory. Supports S3 directory/zip and local directories.'
+    default: 's3://luxd-bootstrap-testing/cchain-current-state-hashdb-full-100/**'
+  aws-role:
+    description: 'AWS role to assume for S3 access.'
+    required: true
+  aws-region:
+    description: 'AWS region to use for S3 access.'
+    required: true
+  aws-role-duration-seconds:
+    description: 'The duration of the AWS role to assume for S3 access.'
+    required: true
+    default: '43200' # 12 hours
+  prometheus-push-url:
+    description: 'The push URL of the prometheus instance.'
+    required: true
+    default: ''
+  prometheus-username:
+    description: 'The username for the Prometheus instance.'
+    required: true
+    default: ''
+  prometheus-password:
+    description: 'The password for the Prometheus instance.'
+    required: true
+    default: ''
+  workspace:
+    description: 'Working directory to use for the benchmark.'
+    required: true
+    default: ${{ github.workspace }}
+  github-token:
+    description: 'GitHub token provided to GitHub Action Benchmark.'
+    required: true
+  push-github-action-benchmark:
+    description: 'Whether to push the benchmark result to GitHub.'
+    required: true
+    default: false
+  push-post-state:
+    description: 'S3 destination to copy the current-state directory after completing re-execution. If empty, this will be skipped.'
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-go-for-project
+    - name: Set task env
+      shell: bash
+      run: |
+        {
+          echo "EXECUTION_DATA_DIR=${{ inputs.workspace }}/reexecution-data"
+          echo "BENCHMARK_OUTPUT_FILE=output.txt"
+          echo "START_BLOCK=${{ inputs.start-block }}"
+          echo "END_BLOCK=${{ inputs.end-block }}"
+          echo "BLOCK_DIR_SRC=${{ inputs.block-dir-src }}"
+          echo "CURRENT_STATE_DIR_SRC=${{ inputs.current-state-dir-src }}"
+        } >> $GITHUB_ENV
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ inputs.aws-role }}
+        aws-region: ${{ inputs.aws-region }}
+        role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
+    - name: Run C-Chain Re-Execution
+      uses: ./.github/actions/run-monitored-tmpnet-cmd
+      with:
+        run: |
+          ./scripts/run_task.sh reexecute-cchain-range-with-copied-data \
+            CONFIG=${{ inputs.config }} \
+            EXECUTION_DATA_DIR=${{ env.EXECUTION_DATA_DIR }} \
+            BLOCK_DIR_SRC=${{ env.BLOCK_DIR_SRC }} \
+            CURRENT_STATE_DIR_SRC=${{ env.CURRENT_STATE_DIR_SRC }} \
+            START_BLOCK=${{ env.START_BLOCK }} \
+            END_BLOCK=${{ env.END_BLOCK }} \
+            LABELS=${{ env.LABELS }} \
+            BENCHMARK_OUTPUT_FILE=${{ env.BENCHMARK_OUTPUT_FILE }} \
+            RUNNER_NAME=${{ inputs.runner_name }} \
+            METRICS_ENABLED=true
+        prometheus_push_url: ${{ inputs.prometheus-push-url }}
+        prometheus_username: ${{ inputs.prometheus-username }}
+        prometheus_password: ${{ inputs.prometheus-password }}
+        grafana_dashboard_id: 'Gl1I20mnk/c-chain'
+        runtime: "" # Set runtime input to empty string to disable log collection
+
+    - name: Compare Benchmark Results
+      uses: benchmark-action/github-action-benchmark@v1
+      with:
+        tool: 'go'
+        output-file-path: ${{ env.BENCHMARK_OUTPUT_FILE }}
+        summary-always: true
+        github-token: ${{ inputs.github-token }}
+        auto-push: ${{ inputs.push-github-action-benchmark }}
+
+    - uses: ./.github/actions/install-nix
+      if: ${{ inputs.push-post-state != '' }}
+    - name: Push Post-State to S3 (if not exists)
+      if: ${{ inputs.push-post-state != '' }}
+      shell: nix develop --command bash -x {0}
+      run: ./scripts/run_task.sh export-dir-to-s3 LOCAL_SRC=${{ env.EXECUTION_DATA_DIR }}/current-state/ S3_DST=${{ inputs.push-post-state }}

.github/actions/install-focal-deps/action.yml

@@ -0,0 +1,16 @@
+# This action installs dependencies missing from the default
+# focal image used by arm64 github workers.
+#
+# TODO(marun): Find an image with the required dependencies already installed.
+
+name: 'Install focal arm64 dependencies'
+description: 'Installs the dependencies required to build luxd on an arm64 github worker running Ubuntu 20.04 (focal)'
+
+runs:
+  using: composite
+  steps:
+    - name: Install build-essential
+      run: |
+        sudo apt update
+        sudo apt -y install build-essential
+      shell: bash

.github/actions/run-monitored-tmpnet-cmd/action.yml

@@ -3,29 +3,21 @@ description: 'Run the provided command in an environment configured to monitor t
 
 inputs:
   run:
-    description: "the bash script to run e.g. ./scripts/my-script.sh"
+    description: "the bash command to run"
     required: true
-  run_env:
-    description: 'a string containing env vars for the command e.g. "MY_VAR1=foo MY_VAR2=bar"'
-    default: ''
-  runtime:
-    description: 'the tmpnet runtime being used'
-    default: 'process'
   filter_by_owner:
     default: ''
-  artifact_prefix:
-    default: ''
-  prometheus_username:
+  prometheus_id:
     required: true
   prometheus_password:
     required: true
-  loki_username:
+  loki_id:
     required: true
   loki_password:
     required: true
   # The following inputs need never be provided by the caller. They
   # default to context values that the action's steps are unable to
-  # access directly.
+  # acccess directly.
   repository_owner:
     default: ${{ github.repository_owner }}
   repository_name:
@@ -40,77 +32,40 @@ inputs:
     default: ${{ github.run_attempt }}
   job:
     default: ${{ github.job }}
-  grafana_dashboard_id:
-    description: 'The identifier of the Grafana dashboard to use, in the format <UID>/<dashboard-name>.'
-    default: 'kBQpRdWnk/lux-main-dashboard'
 
 runs:
   using: composite
   steps:
-    # - Ensure promtail and prometheus are available
-    # - Avoid using the install-nix custom action since a relative
-    #   path wouldn't be resolveable from other repos and an absolute
-    #   path would require setting a version.
-    - uses: cachix/install-nix-action@02a151ada4993995686f9ed4f1be7cfbb229e56f #v31
-      with:
-        github_access_token: ${{ inputs.github_token }}
-    - run: $GITHUB_ACTION_PATH/nix-develop.sh --command echo "dependencies installed"
+    - name: Start prometheus
+      # Only run for the original repo; a forked repo won't have access to the monitoring credentials
+      if: (inputs.prometheus_id != '')
       shell: bash
-    - name: Notify of metrics availability
-      if: (inputs.prometheus_username != '')
-      shell: bash
-      run: $GITHUB_ACTION_PATH/notify-metrics-availability.sh
+      run: bash -x ./scripts/run_prometheus.sh
       env:
-        GRAFANA_URL: https://grafana-poc.lux-dev.network/d/${{ inputs.grafana_dashboard_id }}?orgId=1&refresh=10s&var-filter=is_ephemeral_node%7C%3D%7Cfalse&var-filter=gh_repo%7C%3D%7C${{ inputs.repository_owner }}%2F${{ inputs.repository_name }}&var-filter=gh_run_id%7C%3D%7C${{ inputs.run_id }}&var-filter=gh_run_attempt%7C%3D%7C${{ inputs.run_attempt }}
+        PROMETHEUS_ID: ${{ inputs.prometheus_id }}
+        PROMETHEUS_PASSWORD: ${{ inputs.prometheus_password }}
+    - name: Start promtail
+      if: (inputs.prometheus_id != '')
+      shell: bash
+      run: bash -x ./scripts/run_promtail.sh
+      env:
+        LOKI_ID: ${{ inputs.loki_id }}
+        LOKI_PASSWORD: ${{ inputs.loki_password }}
+    - name: Notify of metrics availability
+      if: (inputs.prometheus_id != '')
+      shell: bash
+      run: ${{ github.action_path }}/notify-metrics-availability.sh
+      env:
+        GRAFANA_URL: https://grafana-poc.lux-dev.network/d/kBQpRdWnk/lux-main-dashboard?orgId=1&refresh=10s&var-filter=is_ephemeral_node%7C%3D%7Cfalse&var-filter=gh_repo%7C%3D%7C${{ inputs.repository_owner }}%2F${{ inputs.repository_name }}&var-filter=gh_run_id%7C%3D%7C${{ inputs.run_id }}&var-filter=gh_run_attempt%7C%3D%7C${{ inputs.run_attempt }}
         GH_JOB_ID: ${{ inputs.job }}
         FILTER_BY_OWNER: ${{ inputs.filter_by_owner }}
-    - name: Warn that collection of metrics and logs will not be performed
-      if: (inputs.prometheus_username == '')
-      shell: bash
-      run: echo "::warning::Monitoring credentials not found. Skipping collector start. Is the PR from a fork branch?"
     - name: Run command
       shell: bash
-      # --impure ensures the env vars are accessible to the command
-      run: ${{ inputs.run_env }} $GITHUB_ACTION_PATH/nix-develop.sh --impure --command bash -x ${{ inputs.run }}
+      run: ${{ inputs.run }}
       env:
-        # Always collect metrics locally even when nodes are running in kube to enable collection from the test workload
-        TMPNET_START_METRICS_COLLECTOR: ${{ inputs.prometheus_username != '' }}
-        # Skip local log collection when nodes are running in kube since collection will occur in-cluster.
-        TMPNET_START_LOGS_COLLECTOR: ${{ inputs.loki_username != '' && inputs.runtime == 'process' }}
-        TMPNET_CHECK_METRICS_COLLECTED: ${{ inputs.prometheus_username != '' }}
-        TMPNET_CHECK_LOGS_COLLECTED: ${{ inputs.loki_username != '' }}
-        LOKI_USERNAME: ${{ inputs.loki_username }}
-        LOKI_PASSWORD: ${{ inputs.loki_password }}
-        PROMETHEUS_USERNAME: ${{ inputs.prometheus_username }}
-        PROMETHEUS_PASSWORD: ${{ inputs.prometheus_password }}
         GH_REPO: ${{ inputs.repository_owner }}/${{ inputs.repository_name }}
         GH_WORKFLOW: ${{ inputs.workflow }}
         GH_RUN_ID: ${{ inputs.run_id }}
         GH_RUN_NUMBER: ${{ inputs.run_number }}
         GH_RUN_ATTEMPT: ${{ inputs.run_attempt }}
         GH_JOB_ID: ${{ inputs.job }}
-    # This step is duplicated from upload-tmpnet-artifact for the same
-    # reason as the nix installation. There doesn't appear to be an
-    # easy way to compose custom actions for use by other repos
-    # without running into versioning issues.
-    - name: Upload tmpnet data
-      if: always() && (inputs.runtime == 'process')
-      uses: actions/upload-artifact@v4
-      with:
-        name: ${{ inputs.artifact_prefix }}-tmpnet-data
-        path: |
-          ~/.tmpnet/networks
-          ~/.tmpnet/prometheus/prometheus.log
-          ~/.tmpnet/promtail/promtail.log
-        if-no-files-found: error
-    - name: Export kind logs
-      if: always() && (inputs.runtime == 'kube')
-      shell: bash
-      run: kind export logs /tmp/kind-logs
-    - name: Upload kind logs
-      if: always() && (inputs.runtime == 'kube')
-      uses: actions/upload-artifact@v4
-      with:
-        name: ${{ inputs.artifact_prefix }}-kind-logs
-        path: /tmp/kind-logs
-        if-no-files-found: error

.github/actions/run-monitored-tmpnet-cmd/nix-develop.sh

@@ -12,9 +12,9 @@ else
   MODULE_DETAILS="$(go list -m "github.com/luxfi/node" 2>/dev/null)"
 
   # Extract the version part
-  LUX_VERSION="$(echo "${MODULE_DETAILS}" | awk '{print $2}')"
+  NODE_VERSION="$(echo "${MODULE_DETAILS}" | awk '{print $2}')"
 
-  if [[ -z "${LUX_VERSION}" ]]; then
+  if [[ -z "${NODE_VERSION}" ]]; then
     echo "Failed to get luxd version from go.mod"
     exit 1
   fi
@@ -23,12 +23,12 @@ else
   # v*YYYYMMDDHHMMSS-abcdef123456
   #
   # If not, the value is assumed to represent a tag
-  if [[ "${LUX_VERSION}" =~ ^v.*[0-9]{14}-[0-9a-f]{12}$ ]]; then
+  if [[ "${NODE_VERSION}" =~ ^v.*[0-9]{14}-[0-9a-f]{12}$ ]]; then
     # Use the module hash as the version
-    LUX_VERSION="$(echo "${LUX_VERSION}" | cut -d'-' -f3)"
+    NODE_VERSION="$(echo "${NODE_VERSION}" | cut -d'-' -f3)"
   fi
 
-  FLAKE="github:luxfi/node?ref=${LUX_VERSION}"
+  FLAKE="github:luxfi/node?ref=${NODE_VERSION}"
   echo "Starting nix shell for ${FLAKE}"
 fi
 

.github/actions/run-monitored-tmpnet-cmd/notify-metrics-availability.sh

@@ -16,4 +16,4 @@ if [[ -n "${FILTER_BY_OWNER:-}" ]]; then
   metrics_url="${metrics_url}&var-filter=network_owner%7C%3D%7C${FILTER_BY_OWNER}"
 fi
 
-echo "grafana link for shared network logs and metrics: ${metrics_url}"
+echo "::notice links::metrics ${metrics_url}"

.github/actions/run-monitored-tmpnet-cmd/output-metrics-url.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Timestamps are in seconds
+from_timestamp="$(date '+%s')"
+monitoring_period=900 # 15 minutes
+to_timestamp="$((from_timestamp + monitoring_period))"
+
+# Grafana expects microseconds, so pad timestamps with 3 zeros
+metrics_url="${GRAFANA_URL}&var-filter=gh_job_id%7C%3D%7C${GH_JOB_ID}&from=${from_timestamp}000&to=${to_timestamp}000"
+
+# Optionally ensure that the link displays metrics only for the shared
+# network rather than mixing it with the results for private networks.
+if [[ -n "${FILTER_BY_OWNER:-}" ]]; then
+  metrics_url="${metrics_url}&var-filter=network_owner%7C%3D%7C${FILTER_BY_OWNER}"
+fi
+
+echo "${metrics_url}"

.github/actions/set-go-version-in-env/action.yml

@@ -0,0 +1,22 @@
+# This action sets GO_VERSION from the project's go.mod.
+#
+# Must be run after actions/checkout to ensure go.mod is available to
+# source the project's go version from.
+
+name: 'Set GO_VERSION env var from go.mod'
+description: 'Read the go version from go.mod and add it as env var GO_VERSION in the github env'
+
+runs:
+  using: composite
+  steps:
+    - name: Set the project Go version in the environment
+      # A script works across different platforms but attempting to replicate the script directly in
+      # the run statement runs into platform-specific path handling issues.
+      run: .github/actions/set-go-version-in-env/go_version_env.sh >> $GITHUB_ENV
+      shell: bash
+    - name: Set GOPRIVATE for luxfi packages
+      # Some luxfi packages have large zip files that exceed Go proxy limits
+      run: |
+        echo "GOPRIVATE=github.com/luxfi/*" >> $GITHUB_ENV
+        echo "GONOSUMDB=github.com/luxfi/*" >> $GITHUB_ENV
+      shell: bash

.github/actions/set-go-version-in-env/go_version_env.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Prints the go version defined in the repo's go.mod. This is useful
+# for configuring the correct version of go to install in CI.
+#
+# `go list -m -f '{{.GoVersion}}'` should be preferred outside of CI
+# when go is already installed.
+
+# 3 directories above this script
+NODE_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../../.. && pwd )
+
+echo GO_VERSION="~$(sed -n -e 's/^go //p' "${NODE_PATH}"/go.mod)"

.github/actions/setup-go-for-project/action.yml

@@ -1,5 +1,5 @@
 # This action targets the project default version of setup-go. For
-# workers with old NodeJS incompatible with newer versions of
+# workers with old NodeJS incompabible with newer versions of
 # setup-go, try setup-go-for-project-v3.
 #
 # Since github actions do not support dynamically configuring the
@@ -13,10 +13,29 @@
 name: 'Install Go toolchain with project defaults'
 description: 'Install a go toolchain with project defaults'
 
+inputs:
+  github-token:
+    description: 'GitHub token for private repo access'
+    required: false
+    default: ''
+
 runs:
   using: composite
   steps:
+    - name: Set the project Go version in the environment
+      uses: ./.github/actions/set-go-version-in-env
+    - name: Set GOPRIVATE and GONOSUMDB for luxfi packages
+      shell: bash
+      run: |
+        echo "GOPRIVATE=github.com/luxfi/*" >> $GITHUB_ENV
+        echo "GONOSUMDB=github.com/luxfi/*" >> $GITHUB_ENV
+    - name: Configure git for private repo access
+      if: inputs.github-token != ''
+      shell: bash
+      run: |
+        git config --global url."https://x-access-token:${{ inputs.github-token }}@github.com/".insteadOf "https://github.com/"
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version-file: 'go.mod'
+        go-version: '${{ env.GO_VERSION }}'
+        check-latest: true

.github/dependabot.yml

@@ -14,4 +14,3 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
-    open-pull-requests-limit: 0 # Disable non-security version updates

.github/labels.yml

@@ -67,9 +67,6 @@
   description: "This involves consensus"
 - name: "continuous staking"
   color: "f9d0c4"
-- name: "Durango"
-  color: "DAF894"
-  description: "durango fork"
 - name: "gossiping upgrade"
   color: "c2e0c6"
 - name: "merkledb"
@@ -93,16 +90,16 @@
 - name: "Warp Signature API"
   color: "68A7EA"
 
-# ACP labels
-- name: "acp103"
+# LP labels
+- name: "lp103"
   color: "AB2C58"
-- name: "acp113"
+- name: "lp113"
   color: "3359BA"
-- name: "acp118"
+- name: "lp118"
   color: "DFC715"
-- name: "acp125"
+- name: "lp125"
   color: "bfdadc"
-- name: "acp20"
+- name: "lp20"
   color: "DB7D37"
-- name: "acp77"
+- name: "lp77"
   color: "45CDF2"

.github/packer/luxd-multicloud.pkr.hcl

@@ -0,0 +1,300 @@
+packer {
+  required_plugins {
+    amazon = {
+      source  = "github.com/hashicorp/amazon"
+      version = "~> 1"
+    }
+    googlecompute = {
+      source  = "github.com/hashicorp/googlecompute"
+      version = "~> 1"
+    }
+    azure = {
+      source  = "github.com/hashicorp/azure"
+      version = "~> 2"
+    }
+    ansible = {
+      source  = "github.com/hashicorp/ansible"
+      version = "~> 1"
+    }
+  }
+}
+
+# ============================================================================
+# Variables
+# ============================================================================
+
+variable "tag" {
+  type        = string
+  description = "Git tag/version to build"
+  default     = env("TAG")
+}
+
+variable "cloud" {
+  type        = string
+  description = "Target cloud: aws, gcp, azure, or all"
+  default     = env("CLOUD")
+}
+
+variable "skip_create_image" {
+  type    = bool
+  default = false
+}
+
+# AWS Variables
+variable "aws_region" {
+  type    = string
+  default = "us-east-1"
+}
+
+variable "aws_instance_type" {
+  type    = string
+  default = "c5.large"
+}
+
+# GCP Variables
+variable "gcp_project_id" {
+  type    = string
+  default = env("GCP_PROJECT_ID")
+}
+
+variable "gcp_zone" {
+  type    = string
+  default = "us-central1-a"
+}
+
+variable "gcp_machine_type" {
+  type    = string
+  default = "n2-standard-2"
+}
+
+# Azure Variables
+variable "azure_subscription_id" {
+  type    = string
+  default = env("AZURE_SUBSCRIPTION_ID")
+}
+
+variable "azure_resource_group" {
+  type    = string
+  default = env("AZURE_RESOURCE_GROUP")
+}
+
+variable "azure_location" {
+  type    = string
+  default = "eastus"
+}
+
+variable "azure_vm_size" {
+  type    = string
+  default = "Standard_D2s_v3"
+}
+
+# ============================================================================
+# Locals
+# ============================================================================
+
+locals {
+  timestamp  = regex_replace(timestamp(), "[- TZ:]", "")
+  clean_name = regex_replace(var.tag, "[^a-zA-Z0-9-]", "-")
+  image_name = "luxd-ubuntu-22-04-${local.clean_name}-${local.timestamp}"
+
+  # Build targets based on cloud variable
+  build_aws   = var.cloud == "aws" || var.cloud == "all"
+  build_gcp   = var.cloud == "gcp" || var.cloud == "all"
+  build_azure = var.cloud == "azure" || var.cloud == "all"
+}
+
+# ============================================================================
+# Data Sources
+# ============================================================================
+
+# AWS - Find latest Ubuntu 22.04 AMI
+data "amazon-ami" "ubuntu" {
+  filters = {
+    architecture        = "x86_64"
+    name                = "ubuntu/images/*ubuntu-jammy-22.04-*-server-*"
+    root-device-type    = "ebs"
+    virtualization-type = "hvm"
+  }
+  most_recent = true
+  owners      = ["099720109477"]  # Canonical
+  region      = var.aws_region
+}
+
+# ============================================================================
+# Sources
+# ============================================================================
+
+# AWS EC2 AMI
+source "amazon-ebs" "luxd" {
+  ami_name        = local.image_name
+  ami_description = "Lux Network Node ${var.tag} - Ubuntu 22.04"
+  ami_groups      = ["all"]  # Make public
+  instance_type   = var.aws_instance_type
+  region          = var.aws_region
+  source_ami      = data.amazon-ami.ubuntu.id
+  ssh_username    = "ubuntu"
+  skip_create_ami = var.skip_create_image
+
+  ami_regions = [
+    "us-east-1",
+    "us-west-2",
+    "eu-west-1",
+    "eu-central-1",
+    "ap-southeast-1",
+    "ap-northeast-1"
+  ]
+
+  tags = {
+    Name        = local.image_name
+    Version     = var.tag
+    OS          = "Ubuntu 22.04"
+    Application = "luxd"
+    ManagedBy   = "Packer"
+  }
+
+  run_tags = {
+    Name = "packer-builder-luxd"
+  }
+}
+
+# GCP Compute Image
+source "googlecompute" "luxd" {
+  project_id          = var.gcp_project_id
+  zone                = var.gcp_zone
+  machine_type        = var.gcp_machine_type
+  source_image_family = "ubuntu-2204-lts"
+  ssh_username        = "ubuntu"
+  image_name          = local.image_name
+  image_description   = "Lux Network Node ${var.tag} - Ubuntu 22.04"
+  image_family        = "luxd"
+  skip_create_image   = var.skip_create_image
+
+  image_labels = {
+    version     = replace(lower(var.tag), ".", "-")
+    os          = "ubuntu-22-04"
+    application = "luxd"
+    managed-by  = "packer"
+  }
+
+  labels = {
+    name = "packer-builder-luxd"
+  }
+}
+
+# Azure Managed Image
+source "azure-arm" "luxd" {
+  subscription_id                   = var.azure_subscription_id
+  managed_image_resource_group_name = var.azure_resource_group
+  managed_image_name                = local.image_name
+
+  os_type         = "Linux"
+  image_publisher = "Canonical"
+  image_offer     = "0001-com-ubuntu-server-jammy"
+  image_sku       = "22_04-lts-gen2"
+  location        = var.azure_location
+  vm_size         = var.azure_vm_size
+
+  ssh_username = "ubuntu"
+
+  skip_create_image = var.skip_create_image
+
+  azure_tags = {
+    Name        = local.image_name
+    Version     = var.tag
+    OS          = "Ubuntu 22.04"
+    Application = "luxd"
+    ManagedBy   = "Packer"
+  }
+}
+
+# ============================================================================
+# Build
+# ============================================================================
+
+build {
+  name = "luxd"
+
+  # Conditionally include sources based on target cloud
+  dynamic "source" {
+    for_each = local.build_aws ? ["amazon-ebs.luxd"] : []
+    labels   = ["amazon-ebs.luxd"]
+    content {}
+  }
+
+  dynamic "source" {
+    for_each = local.build_gcp ? ["googlecompute.luxd"] : []
+    labels   = ["googlecompute.luxd"]
+    content {}
+  }
+
+  dynamic "source" {
+    for_each = local.build_azure ? ["azure-arm.luxd"] : []
+    labels   = ["azure-arm.luxd"]
+    content {}
+  }
+
+  # Wait for cloud-init to complete
+  provisioner "shell" {
+    inline = [
+      "echo 'Waiting for cloud-init to complete...'",
+      "while [ ! -f /var/lib/cloud/instance/boot-finished ]; do sleep 1; done",
+      "echo 'Cloud-init complete!'",
+      "echo 'Waiting for apt locks...'",
+      "while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1; do sleep 1; done",
+      "while fuser /var/lib/apt/lists/lock >/dev/null 2>&1; do sleep 1; done",
+      "echo 'APT ready!'"
+    ]
+  }
+
+  # Install base dependencies
+  provisioner "shell" {
+    inline = [
+      "sudo apt-get update",
+      "sudo apt-get install -y software-properties-common curl wget git jq",
+      "sudo add-apt-repository -y ppa:longsleep/golang-backports",
+      "sudo apt-get update",
+      "sudo apt-get install -y golang-go"
+    ]
+  }
+
+  # Use Ansible for main provisioning
+  provisioner "ansible" {
+    playbook_file   = ".github/packer/create_public_ami.yml"
+    roles_path      = ".github/packer/roles/"
+    use_proxy       = false
+    extra_arguments = [
+      "-e", "component=public-ami",
+      "-e", "build=packer",
+      "-e", "os_release=jammy",
+      "-e", "tag=${var.tag}"
+    ]
+  }
+
+  # Cleanup
+  provisioner "shell" {
+    execute_command = "sudo bash -x {{ .Path }}"
+    inline = [
+      "apt-get clean",
+      "rm -rf /var/lib/apt/lists/*",
+      "rm -rf /tmp/*",
+      "rm -rf /var/tmp/*",
+      "truncate -s 0 /var/log/*.log",
+      "history -c"
+    ]
+  }
+
+  # Azure specific: Deprovision
+  provisioner "shell" {
+    only = ["azure-arm.luxd"]
+    execute_command = "chmod +x {{ .Path }}; {{ .Vars }} sudo -E sh '{{ .Path }}'"
+    inline = [
+      "/usr/sbin/waagent -force -deprovision+user && export HISTSIZE=0 && sync"
+    ]
+    inline_shebang = "/bin/sh -x"
+  }
+
+  post-processor "manifest" {
+    output     = "packer-manifest.json"
+    strip_path = true
+  }
+}

.github/packer/roles/public-ami/tasks/main.yml

@@ -0,0 +1,82 @@
+- name: Setup gpg key
+  apt_key:
+    url: https://downloads.lux.network/node.gpg.key
+    state: present
+
+- name: Setup node repo
+  apt_repository:
+    repo: deb https://downloads.lux.network/apt jammy main
+    state: present
+
+- name: Setup golang repo
+  apt_repository:
+    repo: ppa:longsleep/golang-backports
+    state: present
+
+- name: Install go
+  apt:
+    name: golang
+    state: latest
+
+- name: Update git clone
+  git:
+    repo: "{{ repo_url }}"
+    dest: "{{ repo_folder }}"
+    version: "{{ tag }}"
+    update: yes
+    force: yes
+
+- name: Setup systemd
+  template:
+    src: templates/node.service.j2
+    dest: /etc/systemd/system/node.service
+    mode: 0755
+
+- name: Create Lux user
+  user:
+    name: "{{ lux_user }}"
+    shell: /bin/bash
+    uid: "{{ lux_uid }}"
+    group: "{{ lux_group }}"
+
+- name: Create Lux config dir
+  file:
+    path: /etc/node
+    owner: "{{ lux_user }}"
+    group: "{{ lux_group }}"
+    state: directory
+
+- name: Create Lux log dir
+  file:
+    path: "{{ log_dir }}"
+    owner: "{{ lux_user }}"
+    group: "{{ lux_group }}"
+    state: directory
+
+- name: Create Lux database dir
+  file:
+    path: "{{ db_dir }}"
+    owner: "{{ lux_user }}"
+    group: "{{ lux_group }}"
+    state: directory
+
+- name: Build node
+  command: ./scripts/build.sh
+  args:
+    chdir: "{{ repo_folder }}"
+
+- name: Copy node binaries to the correct location
+  command: cp build/luxd /usr/local/bin/luxd
+  args:
+    chdir: "{{ repo_folder }}"
+
+- name: Configure Lux
+  template:
+    src: templates/conf.json.j2
+    dest: /etc/node/conf.json
+    mode: 0644
+
+- name: Enable Lux
+  systemd:
+    name: node
+    enabled: yes

.github/packer/roles/public-ami/templates/C/config.json.j2

@@ -1 +0,0 @@
-{}

.github/packer/roles/public-ami/templates/conf.json.j2

@@ -4,6 +4,6 @@
   "log-dir": "{{ log_dir }}",
   "db-dir": "{{ db_dir }}",
   "api-admin-enabled": false,
-  "dynamic-public-ip": "opendns",
+  "public-ip-resolution-service": "opendns",
   "network-id": "{{ network }}"
 }

.github/packer/ubuntu-jammy-x86_64-public-ami.pkr.hcl

@@ -0,0 +1,81 @@
+packer {
+  required_plugins {
+    amazon = {
+      source  = "github.com/hashicorp/amazon"
+      version = "~> 1"
+    }
+    ansible = {
+      source  = "github.com/hashicorp/ansible"
+      version = "~> 1"
+    }
+  }
+}
+
+variable "skip_create_ami" {
+  type    = string
+  default = "${env("SKIP_CREATE_AMI")}"
+}
+
+variable "tag" {
+  type    = string
+  default = "${env("TAG")}"
+}
+
+variable "version" {
+  type    = string
+  default = "jammy-22.04"
+}
+
+data "amazon-ami" "autogenerated_1" {
+  filters = {
+    architecture        = "x86_64"
+    name                = "ubuntu/images/*ubuntu-${var.version}-*-server-*"
+    root-device-type    = "ebs"
+    virtualization-type = "hvm"
+  }
+  most_recent = true
+  owners      = ["099720109477"]
+  region      = "us-east-1"
+}
+
+locals {
+  skip_create_ami = var.skip_create_ami == "True"
+  timestamp = regex_replace(timestamp(), "[- TZ:]", "") 
+  clean_name = regex_replace(timestamp(), "[^a-zA-Z0-9-]", "-")
+}
+
+source "amazon-ebs" "autogenerated_1" {
+  ami_groups      = ["all"]
+  ami_name        = "public-lux-ubuntu-${var.version}-${var.tag}-${local.timestamp}"
+  instance_type   = "c5.large"
+  region          = "us-east-1"
+  skip_create_ami = local.skip_create_ami
+  source_ami      = "${data.amazon-ami.autogenerated_1.id}"
+  ssh_username    = "ubuntu"
+  tags = {
+    Base_AMI_Name = "{{ .SourceAMIName }}"
+    Name          = "public-lux-ubuntu-${var.version}-${var.tag}-${local.clean_name}"
+    Release       = "${var.version}"
+  }
+}
+
+build {
+  sources = ["source.amazon-ebs.autogenerated_1"]
+
+  provisioner "shell" {
+    inline = ["while [ ! -f /var/lib/cloud/instance/boot-finished ]; do echo 'Waiting for cloud-init...'; sleep 1; done", "wait_apt=$(ps aux | grep apt | wc -l)", "while [ \"$wait_apt\" -gt \"1\" ]; do echo \"waiting for apt to be ready....\"; wait_apt=$(ps aux | grep apt | wc -l); sleep 5; done", "sudo apt-get -y update", "sudo apt-get install -y python3-boto3 golang"]
+  }
+
+  provisioner "ansible" {
+    extra_arguments = ["-e", "component=public-ami build=packer os_release=jammy tag=${var.tag}"]
+    playbook_file   = ".github/packer/create_public_ami.yml"
+    roles_path      = ".github/packer/roles/"
+    use_proxy       = false
+  }
+
+  provisioner "shell" {
+    execute_command = "sudo bash -x {{ .Path }}"
+    script          = ".github/packer/clean-public-ami.sh"
+  }
+
+}

.github/workflows/RELEASE_EXPLANATION.md

@@ -0,0 +1,478 @@
+# GitHub Actions Release Workflow - Technical Explanation
+
+## Overview
+
+This document explains the technical implementation of the automated release workflow for Lux Node.
+
+## Architecture
+
+### Workflow Design Philosophy
+
+The release workflow follows these principles:
+
+1. **Single Responsibility**: Each job does one thing well
+2. **Reusable Components**: Leverages existing build workflows as reusable components
+3. **Fail Fast**: Version validation happens first before any builds
+4. **Parallel Execution**: All platform builds run concurrently
+5. **Atomic Release**: All artifacts collected before release creation
+
+### Job Dependency Graph
+
+```
+┌──────────────────┐
+│ validate-version │ (30s)
+└────────┬─────────┘
+         │
+    ┌────┴────┬───────────┬──────────┐
+    │         │           │          │
+┌───▼────┐ ┌─▼─────┐ ┌───▼────┐ ┌──▼─────┐
+│ubuntu  │ │ubuntu │ │ macos  │ │windows │ (10-15 min each)
+│amd64   │ │arm64  │ │        │ │        │
+└───┬────┘ └─┬─────┘ └───┬────┘ └──┬─────┘
+    └────────┴───────────┴──────────┘
+                  │
+           ┌──────▼────────┐
+           │create-release │ (2-3 min)
+           └───────────────┘
+```
+
+**Total Time**: ~15-20 minutes (parallel builds are the bottleneck)
+
+## Job Details
+
+### 1. validate-version
+
+**Purpose**: Ensure semantic version is valid and < v2.0.0
+
+**Outputs**:
+- `version`: Version number without 'v' prefix (e.g., "1.20.1")
+- `is_prerelease`: Boolean indicating if version is pre-release
+
+**Logic**:
+```bash
+# Extract version from tag
+TAG="${GITHUB_REF#refs/tags/}"  # refs/tags/v1.20.1 → v1.20.1
+VERSION="${TAG#v}"               # v1.20.1 → 1.20.1
+
+# Validate major version
+MAJOR=$(echo "$VERSION" | cut -d. -f1)  # 1.20.1 → 1
+
+if [ "$MAJOR" -ge 2 ]; then
+    exit 1  # Fail workflow
+fi
+
+# Detect pre-release (contains - or +)
+if echo "$VERSION" | grep -qE '[-+]'; then
+    is_prerelease=true
+fi
+```
+
+**Why < v2.0.0?**
+
+Go modules semantics require v2+ to use versioned import paths:
+
+```go
+// v1.x.x (current)
+import "github.com/luxfi/node/vms"
+
+// v2.x.x would require:
+import "github.com/luxfi/node/v2/vms"
+```
+
+Enforcing v1.x.x prevents accidental breaking changes to import paths.
+
+### 2. build-* Jobs
+
+**Pattern**: Uses `uses: ./.github/workflows/build-*-release.yml`
+
+**Why Reusable Workflows?**
+- DRY principle: Don't duplicate build logic
+- Maintainability: Update build logic in one place
+- Consistency: Same build process for manual and automated releases
+
+**Secrets Inheritance**:
+```yaml
+secrets: inherit
+```
+
+Passes all repository secrets to reusable workflows (AWS credentials, S3 buckets, etc.)
+
+**Input Passing**:
+```yaml
+with:
+  tag: ${{ needs.validate-version.outputs.version }}
+```
+
+Some workflows accept tag as input for artifact naming.
+
+### 3. create-release
+
+**Purpose**: Collect all artifacts and create GitHub Release
+
+**Steps**:
+
+#### a. Download Artifacts
+
+```yaml
+uses: actions/download-artifact@v4
+with:
+  path: ./artifacts
+```
+
+**Result**: All build artifacts downloaded to `./artifacts/`
+
+**Directory Structure**:
+```
+./artifacts/
+├── jammy/
+│   └── luxd-v1.20.1-amd64.deb
+├── focal/
+│   └── luxd-v1.20.1-amd64.deb
+└── build/
+    └── luxd-macos-v1.20.1.zip
+```
+
+#### b. Organize Files
+
+Copies all artifacts to `./release/` directory with flat structure.
+
+**Why Flatten?**
+- Simpler asset URLs
+- Easier for users to find files
+- Consistent naming across platforms
+
+#### c. Generate Checksums
+
+```bash
+cd ./release
+sha256sum * > SHA256SUMS
+```
+
+**Format**:
+```
+a1b2c3d4... luxd-v1.20.1-amd64.deb
+e5f6g7h8... luxd-macos-v1.20.1.zip
+```
+
+**User Verification**:
+```bash
+# Download file and checksums
+curl -LO <file-url>
+curl -LO <checksums-url>
+
+# Verify
+grep <filename> SHA256SUMS | sha256sum -c
+```
+
+#### d. Generate Changelog
+
+Uses git log between previous tag and current:
+
+```bash
+PREV_TAG=$(git describe --tags --abbrev=0 HEAD^)
+git log --pretty=format:"- %s (%h)" ${PREV_TAG}..HEAD
+```
+
+**Output Format**:
+```markdown
+## What's Changed
+
+- Add new feature X (abc123)
+- Fix bug in Y component (def456)
+- Update dependencies (ghi789)
+
+**Full Changelog**: https://github.com/luxfi/node/compare/v1.20.0...v1.20.1
+```
+
+#### e. Create Release
+
+Uses `gh` CLI for release creation:
+
+```bash
+gh release create "v1.20.1" \
+  ./release/* \
+  --title "Lux Node v1.20.1" \
+  --notes-file CHANGELOG.md \
+  --latest  # or --prerelease for pre-releases
+```
+
+**Why gh CLI?**
+- Official GitHub tool
+- Handles authentication automatically
+- Simpler than REST API
+- Uploads all files in one command
+
+## Workflow Triggers
+
+### Tag Pattern Matching
+
+```yaml
+on:
+  push:
+    tags:
+      - 'v[0-1].*.*'
+```
+
+**Pattern Breakdown**:
+- `v` - Literal 'v' character
+- `[0-1]` - Major version 0 or 1
+- `.*` - Any minor version
+- `.*` - Any patch version
+
+**Matches**:
+- ✅ `v1.0.0` (first release)
+- ✅ `v1.20.1` (production release)
+- ✅ `v1.99.999` (high version numbers)
+- ✅ `v1.20.1-rc.1` (release candidate)
+- ✅ `v1.20.1+build.123` (build metadata)
+
+**Rejects**:
+- ❌ `v2.0.0` (major version 2)
+- ❌ `v3.1.0` (major version 3)
+- ❌ `1.20.1` (missing 'v' prefix)
+- ❌ `version-1.20.1` (wrong format)
+
+## Pre-release Detection
+
+**Logic**:
+```bash
+if echo "$VERSION" | grep -qE '[-+]'; then
+    is_prerelease=true
+fi
+```
+
+**Semantic Versioning**:
+- `-` indicates pre-release: `1.20.1-rc.1`, `1.20.1-beta.2`
+- `+` indicates build metadata: `1.20.1+build.123`
+
+**GitHub Behavior**:
+- Pre-releases: Shown with "Pre-release" badge, not marked as "Latest"
+- Stable releases: Shown with "Latest release" badge
+
+## Artifact Naming Conventions
+
+Each platform has its own naming scheme:
+
+| Platform | Pattern | Example |
+|----------|---------|---------|
+| Ubuntu AMD64 | `luxd-{version}-amd64.deb` | `luxd-v1.20.1-amd64.deb` |
+| Ubuntu ARM64 | `luxd-{version}-arm64.deb` | `luxd-v1.20.1-arm64.deb` |
+| macOS | `luxd-macos-{version}.zip` | `luxd-macos-v1.20.1.zip` |
+| Windows | `node-win-{version}.zip` | `node-win-v1.20.1.zip` |
+
+**Why Different Patterns?**
+- Historical convention from existing build scripts
+- Platform-specific package managers expect different formats
+- Windows uses `node` instead of `luxd` (legacy naming)
+
+## Error Handling
+
+### Build Failure
+
+**Scenario**: One platform build fails
+
+**Behavior**:
+- `create-release` job never runs (depends on all builds)
+- Workflow marked as failed
+- No partial release created
+
+**Recovery**:
+1. Fix build issue
+2. Delete failed tag: `git tag -d v1.20.1 && git push --delete origin v1.20.1`
+3. Re-tag and push
+
+### Partial Artifact Collection
+
+**Scenario**: Some artifacts missing during collection
+
+**Behavior**:
+- `Organize release files` step silently skips missing files (`|| true`)
+- Release created with available artifacts
+- Missing platforms will have no binary attached
+
+**Detection**:
+- Check `Release summary` in job output
+- Verify all expected platforms in asset list
+
+**Recovery**:
+1. Identify which build workflow failed
+2. Fix workflow
+3. Manually trigger failed workflow with same tag
+4. Download new artifacts
+5. Upload to existing release: `gh release upload v1.20.1 <file>`
+
+## Performance Optimization
+
+### Parallel Builds
+
+All platform builds run simultaneously:
+
+```yaml
+build-ubuntu-amd64:
+  needs: validate-version
+  # ...
+
+build-ubuntu-arm64:
+  needs: validate-version
+  # ...
+
+# All depend only on validate-version, not each other
+```
+
+**Time Savings**:
+- Sequential: ~60 minutes (4 platforms × 15 min each)
+- Parallel: ~15 minutes (longest build time)
+- **Improvement**: 75% faster
+
+### Shallow Checkout
+
+Most jobs use default shallow checkout (depth=1):
+```yaml
+- uses: actions/checkout@v4
+```
+
+**Exception**: `create-release` job needs full history for changelog:
+```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0
+```
+
+## Security Considerations
+
+### Minimal Permissions
+
+```yaml
+permissions:
+  contents: write    # Create releases, upload assets
+  id-token: write    # OIDC for AWS authentication
+```
+
+**Not Granted**:
+- `actions: write` - Cannot modify workflows
+- `packages: write` - Cannot publish packages
+- `issues: write` - Cannot create issues
+
+### Secret Handling
+
+All secrets passed via `secrets: inherit`:
+
+```yaml
+build-ubuntu-amd64:
+  secrets: inherit  # Passes AWS_DEPLOY_SA_ROLE_ARN, BUCKET
+```
+
+**Best Practice**: Never log secrets, never use in conditionals
+
+### Checksum Verification
+
+Forces users to verify downloads:
+
+```bash
+# Generate checksums
+sha256sum * > SHA256SUMS
+
+# Users verify with:
+sha256sum -c SHA256SUMS
+```
+
+## Testing Strategy
+
+### Manual Test Tag
+
+Create test release without polluting real releases:
+
+```bash
+# Use version with "test" keyword
+git tag -a v1.99.99-test -m "Test release workflow"
+git push origin v1.99.99-test
+
+# Monitor: https://github.com/luxfi/node/actions
+
+# Cleanup after testing
+git push --delete origin v1.99.99-test
+git tag -d v1.99.99-test
+gh release delete v1.99.99-test --yes
+```
+
+### Automated Test Script
+
+Use included test script:
+
+```bash
+./scripts/test-release-workflow.sh 1.99.99-test
+```
+
+**Script Features**:
+- Version validation
+- Git cleanliness check
+- Tag conflict detection
+- Workflow monitoring
+- Automatic cleanup
+
+## Debugging
+
+### Enable Debug Logging
+
+Add to workflow:
+
+```yaml
+env:
+  ACTIONS_STEP_DEBUG: true
+  ACTIONS_RUNNER_DEBUG: true
+```
+
+### Check Job Logs
+
+1. Visit workflow run: https://github.com/luxfi/node/actions/workflows/release.yml
+2. Click specific run
+3. Expand failed job
+4. Read error messages
+
+### Common Issues
+
+**Issue**: "Resource not accessible by integration"
+- **Cause**: Missing `contents: write` permission
+- **Fix**: Add permission to workflow
+
+**Issue**: "Unable to download artifact"
+- **Cause**: Artifact name mismatch
+- **Fix**: Check `upload-artifact` name in build workflow
+
+**Issue**: "gh: command not found"
+- **Cause**: GitHub CLI not installed in runner
+- **Fix**: Add `- uses: cli/gh-action@v2` or use gh CLI pre-installed
+
+## Future Enhancements
+
+### Potential Improvements
+
+1. **Docker Image Publishing**: Add Docker build job
+2. **Homebrew Formula Update**: Auto-update brew formula
+3. **Release Notes Template**: Use `.github/release-template.md`
+4. **Asset Signing**: GPG sign all binaries
+5. **Download Stats**: Track download metrics
+6. **Auto-changelog**: Generate from commit conventions
+7. **Slack Notification**: Notify team on release
+8. **Rollback Support**: Tag previous version as latest if needed
+
+### Metrics to Track
+
+- Build time per platform
+- Artifact size trends
+- Download counts per platform
+- Release frequency
+- Time to production
+
+## References
+
+- [GitHub Actions Workflow Syntax](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions)
+- [Reusable Workflows](https://docs.github.com/en/actions/using-workflows/reusing-workflows)
+- [GitHub Releases](https://docs.github.com/en/repositories/releasing-projects-on-github)
+- [Semantic Versioning](https://semver.org/)
+- [Go Module Version Numbering](https://go.dev/doc/modules/version-numbers)
+
+---
+
+**Last Updated**: 2025-11-12
+**Maintainer**: Lux DevOps Team

.github/workflows/RELEASE_WORKFLOW.md

@@ -0,0 +1,309 @@
+# Release Workflow Documentation
+
+## Overview
+
+The `release.yml` workflow automates building and publishing Lux Node binaries for all platforms when semantic version tags are pushed.
+
+## Workflow Architecture
+
+### 1. Trigger Mechanism
+
+**Tag Pattern**: `v[0-1].*.*`
+- ✅ Accepts: `v1.0.0`, `v1.20.1`, `v1.999.999`, `v1.20.1-rc.1`
+- ❌ Rejects: `v2.0.0`, `v2.1.0`, `v3.0.0` (requires `/v2` import path per Go modules)
+
+**Rationale**: Go modules require major version 2+ to use `/v2`, `/v3` etc. in import paths. Since Lux uses `github.com/luxfi/node` (no version suffix), we enforce v1.x.x only.
+
+### 2. Job Flow
+
+```
+validate-version (validates tag < v2.0.0)
+    ├─> build-ubuntu-amd64 ───┐
+    ├─> build-ubuntu-arm64 ───┤
+    ├─> build-macos ──────────┼──> create-release (combines all artifacts)
+    └─> build-windows ────────┘
+```
+
+### 3. Platform Builds
+
+Uses **reusable workflows** (existing build-*-release.yml files):
+
+| Platform | Workflow | Artifact Name | Binary Format |
+|----------|----------|---------------|---------------|
+| Linux AMD64 (Ubuntu 22.04) | `build-ubuntu-amd64-release.yml` | `jammy` | `.deb` package |
+| Linux AMD64 (Ubuntu 20.04) | `build-ubuntu-amd64-release.yml` | `focal` | `.deb` package |
+| Linux ARM64 (Ubuntu 22.04) | `build-ubuntu-arm64-release.yml` | `jammy` | `.deb` package |
+| Linux ARM64 (Ubuntu 20.04) | `build-ubuntu-arm64-release.yml` | `focal` | `.deb` package |
+| macOS (Universal) | `build-macos-release.yml` | `build` | `.zip` archive |
+| Windows AMD64 | `build-win-release.yml` | Various | `.exe` or `.zip` |
+
+### 4. Release Creation
+
+**GitHub Release includes**:
+- All platform binaries
+- `SHA256SUMS` checksum file
+- Auto-generated changelog (git log since previous tag)
+- Pre-release flag (if version contains `-` or `+`)
+- "Latest" badge (for stable releases only)
+
+## Usage
+
+### Creating a Release
+
+1. **Tag the commit**:
+   ```bash
+   git tag -a v1.20.1 -m "Release v1.20.1"
+   git push origin v1.20.1
+   ```
+
+2. **Monitor workflow**:
+   - Visit: https://github.com/luxfi/node/actions/workflows/release.yml
+   - Watch all build jobs complete (typically 15-20 minutes)
+
+3. **Verify release**:
+   - Visit: https://github.com/luxfi/node/releases
+   - Check all platform binaries are attached
+   - Verify SHA256SUMS file
+
+### Pre-release Creation
+
+For release candidates or beta versions:
+
+```bash
+git tag -a v1.20.1-rc.1 -m "Release Candidate 1 for v1.20.1"
+git push origin v1.20.1-rc.1
+```
+
+**Behavior**:
+- Creates GitHub Release with "Pre-release" badge
+- Does NOT mark as "Latest"
+- Changelog includes "(Pre-release)" note
+
+### Deleting a Failed Release
+
+If a release fails and needs to be retried:
+
+```bash
+# Delete remote tag
+git push --delete origin v1.20.1
+
+# Delete local tag
+git tag -d v1.20.1
+
+# Delete GitHub Release (via web UI or gh CLI)
+gh release delete v1.20.1 --yes
+
+# Fix issues, then re-tag and push
+git tag -a v1.20.1 -m "Release v1.20.1"
+git push origin v1.20.1
+```
+
+## Testing the Workflow
+
+### Dry Run (Test Tag)
+
+Create a test tag to verify workflow without publishing:
+
+```bash
+# Create test tag locally
+git tag -a v1.99.99-test -m "Test release workflow"
+
+# Push to remote (triggers workflow)
+git push origin v1.99.99-test
+
+# After testing, clean up
+git push --delete origin v1.99.99-test
+git tag -d v1.99.99-test
+gh release delete v1.99.99-test --yes
+```
+
+### Local Validation
+
+Test semver validation logic locally:
+
+```bash
+# Test valid versions
+for ver in 1.0.0 1.20.1 1.999.999 "1.20.1-rc.1"; do
+    MAJOR=$(echo "$ver" | cut -d. -f1)
+    if [ "$MAJOR" -ge 2 ]; then
+        echo "✗ v${ver}: REJECT"
+    else
+        echo "✓ v${ver}: ACCEPT"
+    fi
+done
+
+# Test invalid versions
+for ver in 2.0.0 2.1.0 3.0.0; do
+    MAJOR=$(echo "$ver" | cut -d. -f1)
+    if [ "$MAJOR" -ge 2 ]; then
+        echo "✓ v${ver}: REJECT (correct)"
+    else
+        echo "✗ v${ver}: ACCEPT (should reject)"
+    fi
+done
+```
+
+## Troubleshooting
+
+### Issue: "Version >= v2.0.0" Error
+
+**Cause**: Attempted to tag v2.x.x or higher
+
+**Solution**: Use v1.x.x versions only. For v2+, update import paths to `github.com/luxfi/node/v2` throughout codebase first.
+
+### Issue: Build Workflow Fails
+
+**Symptoms**: `create-release` job never runs
+
+**Diagnosis**:
+1. Check individual build job logs
+2. Common issues:
+   - AWS credentials expired (check secrets)
+   - Build script failures (check `./scripts/run_task.sh build`)
+   - Dependency resolution issues
+
+**Solution**:
+1. Fix build issues in individual workflow
+2. Delete failed release tag
+3. Re-tag and push
+
+### Issue: Missing Artifacts
+
+**Symptoms**: Some platform binaries not attached to release
+
+**Diagnosis**:
+1. Check `Download all artifacts` step in `create-release` job
+2. Verify artifact names match expected patterns
+
+**Solution**:
+1. Update `Organize release files` step to match actual artifact structure
+2. Check individual build workflows upload artifacts correctly
+
+### Issue: Changelog Empty
+
+**Symptoms**: Release notes say "Initial Release" but previous tags exist
+
+**Cause**: Shallow git checkout (missing history)
+
+**Solution**: Workflow uses `fetch-depth: 0` to fetch full history. If issue persists:
+1. Check git repository configuration
+2. Verify previous tags are pushed to remote
+
+## Security Considerations
+
+### Permissions
+
+Workflow requires minimal permissions:
+- `contents: write` - Create releases and upload assets
+- `id-token: write` - AWS OIDC authentication (for build workflows)
+
+### Secrets Required
+
+All secrets inherited from repository settings:
+- `AWS_DEPLOY_SA_ROLE_ARN` - AWS role for S3 uploads (build workflows)
+- `BUCKET` - S3 bucket name (build workflows)
+- `GITHUB_TOKEN` - Automatically provided by GitHub Actions
+
+### Checksum Verification
+
+Users can verify downloads:
+
+```bash
+# Download release binary and SHA256SUMS
+curl -LO https://github.com/luxfi/node/releases/download/v1.20.1/luxd-macos-v1.20.1.zip
+curl -LO https://github.com/luxfi/node/releases/download/v1.20.1/SHA256SUMS
+
+# Verify checksum
+grep luxd-macos-v1.20.1.zip SHA256SUMS | sha256sum -c
+```
+
+## Workflow Outputs
+
+### GitHub Release
+
+**URL Format**: `https://github.com/luxfi/node/releases/tag/v{VERSION}`
+
+**Contains**:
+- Release title: "Lux Node v{VERSION}"
+- Changelog: Auto-generated from git commits
+- Assets:
+  - `luxd-{version}-amd64.deb` (Ubuntu 22.04)
+  - `luxd-{version}-amd64.deb` (Ubuntu 20.04)
+  - `luxd-{version}-arm64.deb` (Ubuntu 22.04)
+  - `luxd-{version}-arm64.deb` (Ubuntu 20.04)
+  - `luxd-macos-{version}.zip`
+  - `node-win-{version}.zip` or `.exe`
+  - `SHA256SUMS`
+
+### Job Summary
+
+GitHub Actions summary page shows:
+- Release version
+- Platform artifact table (file names, sizes)
+- SHA256 checksums
+- Link to release page
+
+## Maintenance
+
+### Adding New Platforms
+
+To add a new platform (e.g., FreeBSD):
+
+1. Create new build workflow: `.github/workflows/build-freebsd-release.yml`
+2. Add job to `release.yml`:
+   ```yaml
+   build-freebsd:
+     needs: validate-version
+     uses: ./.github/workflows/build-freebsd-release.yml
+     secrets: inherit
+   ```
+3. Update `create-release` job dependencies:
+   ```yaml
+   needs:
+     - validate-version
+     - build-ubuntu-amd64
+     - build-ubuntu-arm64
+     - build-macos
+     - build-windows
+     - build-freebsd  # Add here
+   ```
+4. Update artifact collection logic in `Organize release files` step
+
+### Updating Changelog Format
+
+Edit the `Generate changelog` step:
+
+```yaml
+- name: Generate changelog
+  run: |
+    # Custom changelog format
+    git log --pretty=format:"- **%s** by @%an (%h)" ${PREV_TAG}..HEAD > CHANGELOG.md
+```
+
+### Customizing Release Title
+
+Edit the `Create GitHub Release` step:
+
+```yaml
+FLAGS="--title \"Lux Network Node ${TAG} - Codename XYZ\""
+```
+
+## Related Documentation
+
+- [GitHub Actions Documentation](https://docs.github.com/en/actions)
+- [Semantic Versioning](https://semver.org/)
+- [Go Modules Version Numbering](https://go.dev/doc/modules/version-numbers)
+- [GitHub CLI Release Documentation](https://cli.github.com/manual/gh_release_create)
+
+## Support
+
+For issues with the release workflow:
+1. Check GitHub Actions logs
+2. Review this documentation
+3. Open issue with `ci` label
+4. Contact DevOps team
+
+---
+
+**Last Updated**: 2025-11-12
+**Maintainer**: Lux DevOps Team

.github/workflows/amichange.json

@@ -1,42 +0,0 @@
-{
-  "Version": {
-    "VersionTitle": "",
-    "ReleaseNotes": "Automated latest node release"
-  },
-  "DeliveryOptions": [
-    {
-      "Details": {
-        "AmiDeliveryOptionDetails": {
-          "AmiSource": {
-            "AmiId": "",
-            "AccessRoleArn": "",
-            "UserName": "ubuntu",
-            "OperatingSystemName": "UBUNTU",
-            "OperatingSystemVersion": "Ubuntu 20.04"
-          },
-          "UsageInstructions": "Connect via SSH and you can make local calls to port 9650",
-          "RecommendedInstanceType": "c5.2xlarge",
-          "SecurityGroups": [
-            {
-              "IpProtocol": "tcp",
-              "FromPort": 9651,
-              "ToPort": 9651,
-              "IpRanges": [
-                "0.0.0.0/0"
-              ]
-            },
-            {
-              "IpProtocol": "tcp",
-              "FromPort": 22,
-              "ToPort": 22,
-              "IpRanges": [
-                "0.0.0.0/0"
-              ]
-            }
-          ]
-        }
-      }
-    }
-  ]
-}
-

.github/workflows/buf-lint.yml

@@ -2,6 +2,9 @@ name: Lint proto files
 
 on:
   push:
+    paths:
+      - 'proto/**/*.proto'
+      - '.github/workflows/buf-lint.yml'
 
 permissions:
   contents: read
@@ -11,9 +14,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: bufbuild/buf-setup-action@v1.11.0
+      - name: Check for .proto files
+        id: proto-check
+        run: |
+          if find proto -name '*.proto' -type f 2>/dev/null | grep -q .; then
+            echo "has_proto=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_proto=false" >> $GITHUB_OUTPUT
+            echo "No .proto files found — skipping buf-lint (node is ZAP-native by default; protobuf is opt-in)."
+          fi
+      - uses: bufbuild/buf-setup-action@v1
+        if: steps.proto-check.outputs.has_proto == 'true'
         with:
           github_token: ${{ github.token }}
+          version: "1.47.2"
       - uses: bufbuild/buf-lint-action@v1
+        if: steps.proto-check.outputs.has_proto == 'true'
         with:
-          input: "proto"
+          input: "proto"

.github/workflows/buf-push.yml

@@ -2,11 +2,8 @@ name: buf-push
 
 on:
   push:
-    tags:
-      - "*"
     branches:
-      - master
-      - dev
+      - main
     paths:
       - "proto/**"
 
@@ -15,11 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: bufbuild/buf-action@dfda68eacb65895184c76b9ae522b977636a2c47 #v1.1.4
+      - uses: bufbuild/buf-setup-action@v1.31.0
+      - uses: bufbuild/buf-push-action@v1
         with:
           input: "proto"
-          # Breaking changes are managed by the rpcchainvm protocol version.
-          breaking: false
-          token: ${{ secrets.BUF_TOKEN }}
-          # This version should match the version installed in the nix dev shell
-          version: 1.47.2
+          buf_token: ${{ secrets.BUF_TOKEN }}

.github/workflows/build-and-test-mac-windows.yml

@@ -5,6 +5,7 @@ on:
     tags:
       - "*" # Push events to every tag
     branches:
+      - main
       - dev
       - master
 
@@ -12,12 +13,23 @@ jobs:
   run_build_tests:
     name: build_tests
     runs-on: ${{ matrix.os }}
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      CGO_ENABLED: "0"
+      GOWORK: off
     strategy:
       matrix:
-        os: [windows-latest, macos-latest]
+        # `macos-latest` currently resolves to GH-hosted arm64 macos (forbidden);
+        # pin to `macos-13` (amd64). darwin/arm64 coverage lives in
+        # build-macos-release.yml via cross-compile.
+        os: [windows-latest, macos-13]
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
       - name: build_test
         shell: bash
         run: .github/workflows/build_and_test.sh

.github/workflows/build-and-test.yml

@@ -1,18 +0,0 @@
-name: Build + Unit Tests
-
-on:
-  push:
-
-jobs:
-  run_build_unit_tests:
-    name: build_unit_test
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [macos-12, ubuntu-20.04, ubuntu-22.04, windows-latest, [self-hosted, linux, ARM64, focal],[self-hosted, linux, ARM64, jammy]]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: build_test
-        shell: bash
-        run: .github/workflows/build_and_test.sh

.github/workflows/build-deb-pkg.sh

@@ -34,4 +34,8 @@ NEW_ARCH_STRING="Architecture: $ARCH"
 sed -i "s/Version.*/$NEW_VERSION_STRING/g" debian/DEBIAN/control
 sed -i "s/Architecture.*/$NEW_ARCH_STRING/g" debian/DEBIAN/control
 dpkg-deb --build debian "luxd-$TAG-$ARCH.deb"
-aws s3 cp "luxd-$TAG-$ARCH.deb" "s3://${BUCKET}/linux/debs/ubuntu/$RELEASE/$ARCH/"
+
+# Upload to S3 if BUCKET is set (optional)
+if [[ -n "${BUCKET:-}" ]]; then
+  aws s3 cp "luxd-$TAG-$ARCH.deb" "s3://${BUCKET}/linux/debs/ubuntu/$RELEASE/$ARCH/" || echo "Warning: S3 upload failed (credentials may not be configured)"
+fi

.github/workflows/build-linux-binaries.yml

@@ -6,13 +6,19 @@ on:
       tag:
         description: 'Tag to include in artifact name'
         required: true
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+        type: string
   push:
     tags:
       - "*"
 
 jobs:
   build-x86_64-binaries-tarball:
-    runs-on: ubuntu-22.04
+    runs-on: [self-hosted, linux, amd64]
     permissions:
       id-token: write
       contents: read
@@ -25,17 +31,7 @@ jobs:
       - run: go version
 
       - name: Build the luxd binaries
-        run: ./scripts/run_task.sh build -tags pebbledb
-
-      - name: Install aws cli
-        run: sudo snap install aws-cli --classic
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
+        run: CGO_ENABLED=0 ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -54,17 +50,17 @@ jobs:
       - name: Create tgz package structure and upload to S3
         run: ./.github/workflows/build-tgz-pkg.sh
         env:
-          PKG_ROOT: ${{ github.workspace }}/luxd-pkg
+          PKG_ROOT: /tmp/luxd
           TAG: ${{ env.TAG }}
           BUCKET: ${{ secrets.BUCKET }}
           ARCH: "amd64"
           RELEASE: "jammy"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: amd64
-          path: ${{ github.workspace }}/luxd-pkg/luxd-linux-amd64-${{ env.TAG }}.tar.gz
+          path: ${{ github.workspace }}/luxd-pkg/node-linux-amd64-${{ env.TAG }}.tar.gz
 
       - name: Cleanup
         run: |
@@ -72,7 +68,7 @@ jobs:
           rm -rf ${{ github.workspace }}/luxd-pkg
 
   build-arm64-binaries-tarball:
-    runs-on: custom-arm64-jammy
+    runs-on: [self-hosted, linux, amd64]
     permissions:
       id-token: write
       contents: read
@@ -84,18 +80,8 @@ jobs:
 
       - run: go version
 
-      - name: Build the luxd binaries
-        run: ./scripts/run_task.sh build -tags pebbledb
-
-      - name: Install aws cli
-        run: sudo snap install aws-cli --classic
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -114,17 +100,17 @@ jobs:
       - name: Create tgz package structure and upload to S3
         run: ./.github/workflows/build-tgz-pkg.sh
         env:
-          PKG_ROOT: ${{ github.workspace }}/luxd-pkg
+          PKG_ROOT: /tmp/luxd
           TAG: ${{ env.TAG }}
           BUCKET: ${{ secrets.BUCKET }}
           ARCH: "arm64"
           RELEASE: "jammy"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: arm64
-          path: ${{ github.workspace }}/luxd-pkg/luxd-linux-arm64-${{ env.TAG }}.tar.gz
+          path: ${{ github.workspace }}/luxd-pkg/node-linux-arm64-${{ env.TAG }}.tar.gz
 
       - name: Cleanup
         run: |

.github/workflows/build-macos-release.yml

@@ -9,16 +9,29 @@ on:
       tag:
         description: 'Tag to include in artifact name'
         required: true
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+        type: string
   push:
     tags:
       - "*"
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build"
+  # Cross-compile both darwin/amd64 and darwin/arm64 from Linux. The build
+  # uses CGO_ENABLED=0 + GOOS=darwin GOARCH=$arch — pure Go, no Darwin
+  # toolchain required. We run on the self-hosted `lux-build` ARC pool
+  # rather than `macos-13` (which has long GitHub-hosted queues) to keep
+  # the release pipeline unblocked.
   build-mac:
-    # The type of runner that the job will run on
-    runs-on: macos-14
+    strategy:
+      fail-fast: false
+      matrix:
+        goarch: [amd64, arm64]
+    runs-on: [self-hosted, linux, amd64]
     permissions:
       id-token: write
       contents: read
@@ -31,8 +44,8 @@ jobs:
       - run: go version
 
       # Runs a single command using the runners shell
-      - name: Build the luxd binary
-        run: ./scripts/run_task.sh build
+      - name: Build the luxd binary (cross-compile via GOOS/GOARCH)
+        run: CGO_ENABLED=0 GOOS=darwin GOARCH=${{ matrix.goarch }} ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -48,33 +61,22 @@ jobs:
           echo "TAG=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
         shell: bash
 
-      - name: Create zip file
-        run: 7z a "luxd-macos-${TAG}.zip" build/luxd
+      - name: Create zip file with CLI-compatible naming
+        run: |
+          # CLI expects: node-macos-{arch}-{version}.zip containing build/luxd
+          mkdir -p build
+          if ! command -v zip >/dev/null 2>&1; then
+            sudo apt-get update && sudo apt-get install -y zip
+          fi
+          zip "node-macos-${{ matrix.goarch }}-${TAG}.zip" build/luxd
         env:
           TAG: ${{ env.TAG }}
 
-      - name: Install aws cli
-        run: |
-          curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
-          sudo installer -pkg AWSCLIV2.pkg -target /
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
-
-      - name: Upload file to S3
-        run: aws s3 cp luxd-macos-${{ env.TAG }}.zip "s3://${BUCKET}/macos/"
-        env:
-          BUCKET: ${{ secrets.BUCKET }}
-
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: build
-          path: luxd-macos-${{ env.TAG }}.zip
+          name: build-darwin-${{ matrix.goarch }}
+          path: node-macos-${{ matrix.goarch }}-${{ env.TAG }}.zip
 
       - name: Cleanup
         run: |

.github/workflows/build-public-api.yml

@@ -1,56 +0,0 @@
-name: build-public-ami
-
-on:
-  push:
-    tags:
-      - "*"
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to create AMI from'
-        required: true
-
-jobs:
-  build-public-ami-and-upload:
-    runs-on: ubuntu-20.04
-    timeout-minutes: 45
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - run: go version
-
-      - name: Install aws cli
-        run: |
-          sudo apt update
-          sudo apt-get -y install awscli python3-pip packer
-
-      - name: Install python packer
-        run: |
-          pip install python-packer boto3
-
-      - name: Get the tag
-        id: get_tag
-        run: |
-          if [[ ${{ github.event_name }} == 'push' ]];
-          then
-            echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
-          else
-            echo "VERSION=${{ inputs.tag }}" >> $GITHUB_ENV
-          fi
-        shell: bash
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-access-key-id: ${{ secrets.MARKETPLACE_ID }}
-          aws-secret-access-key: ${{ secrets.MARKETPLACE_KEY }}
-          aws-region: us-east-1
-
-      - name: Create AMI and upload to marketplace
-        run: |
-          ./.github/workflows/update-ami.py
-        env:
-          TAG: ${{ env.VERSION }}
-          PRODUCT_ID: ${{ secrets.MARKETPLACE_PRODUCT }}
-          ROLE_ARN: ${{ secrets.MARKETPLACE_ROLE }}

.github/workflows/build-rpm-pkg.sh

@@ -1,25 +0,0 @@
-PKG_ROOT=/tmp/node
-RPM_BASE_DIR=$PKG_ROOT/yum
-LUX_BUILD_BIN_DIR=$RPM_BASE_DIR/usr/local/bin
-LUX_LIB_DIR=$RPM_BASE_DIR/usr/local/lib/node
-
-mkdir -p $RPM_BASE_DIR
-mkdir -p $LUX_BUILD_BIN_DIR
-mkdir -p $LUX_LIB_DIR
-
-OK=`cp ./build/luxd $LUX_BUILD_BIN_DIR`
-if [[ $OK -ne 0 ]]; then
-  exit $OK;
-fi
-OK=`cp ./build/plugins/evm $LUX_LIB_DIR`
-if [[ $OK -ne 0 ]]; then
-  exit $OK;
-fi
-
-echo "Build rpm package..."
-VER=$(echo $TAG | gawk -F- '{print$1}' | tr -d 'v' )
-REL=$(echo $TAG | gawk -F- '{print$2}')
-[ -z "$REL" ] && REL=0 
-echo "Tag: $VER"
-rpmbuild --bb --define "version $VER" --define "release $REL" --buildroot $RPM_BASE_DIR .github/workflows/yum/specfile/node.spec
-aws s3 cp ~/rpmbuild/RPMS/x86_64/node-*.rpm s3://$BUCKET/linux/rpm/

.github/workflows/build-tgz-pkg.sh

@@ -2,11 +2,12 @@
 
 set -euo pipefail
 
-LUXD_ROOT=$PKG_ROOT/luxd-$TAG
+# Create build directory structure
+LUXD_ROOT=$PKG_ROOT/build
 
 mkdir -p "$LUXD_ROOT"
 
-OK=$(cp ./build/luxd "$LUXD_ROOT")
+OK=$(cp ./build/luxd "$LUXD_ROOT/")
 if [[ $OK -ne 0 ]]; then
   exit "$OK";
 fi
@@ -15,5 +16,15 @@ fi
 echo "Build tgz package..."
 cd "$PKG_ROOT"
 echo "Tag: $TAG"
-tar -czvf "luxd-linux-$ARCH-$TAG.tar.gz" "luxd-$TAG"
-aws s3 cp "luxd-linux-$ARCH-$TAG.tar.gz" "s3://$BUCKET/linux/binaries/ubuntu/$RELEASE/$ARCH/"
+
+# Create package with CLI-compatible naming: node-linux-{arch}-{version}.tar.gz
+tar -czvf "node-linux-$ARCH-$TAG.tar.gz" -C "$PKG_ROOT" build
+
+# Upload to S3 if BUCKET is set (optional)
+if [[ -n "${BUCKET:-}" ]]; then
+  aws s3 cp "node-linux-$ARCH-$TAG.tar.gz" "s3://$BUCKET/linux/binaries/ubuntu/$RELEASE/$ARCH/" || echo "Warning: S3 upload failed (credentials may not be configured)"
+fi
+
+# Also copy to workspace for artifact upload
+mkdir -p "${GITHUB_WORKSPACE:-$(pwd)}/luxd-pkg"
+cp "node-linux-$ARCH-$TAG.tar.gz" "${GITHUB_WORKSPACE:-$(pwd)}/luxd-pkg/"

.github/workflows/build-ubuntu-amd64-release.yml

@@ -6,13 +6,19 @@ on:
       tag:
         description: 'Tag to include in artifact name'
         required: true
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+        type: string
   push:
     tags:
       - "*"
 
 jobs:
   build-jammy-amd64-package:
-    runs-on: ubuntu-22.04
+    runs-on: [self-hosted, linux, amd64]
     permissions:
       id-token: write
       contents: read
@@ -23,17 +29,7 @@ jobs:
       - run: go version
 
       - name: Build the luxd binaries
-        run: ./scripts/run_task.sh build
-
-      - name: Install aws cli
-        run: sudo snap install aws-cli --classic
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
+        run: CGO_ENABLED=0 ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -52,28 +48,25 @@ jobs:
       - name: Create debian package
         run: ./.github/workflows/build-deb-pkg.sh
         env:
-          PKG_ROOT: ${{ github.workspace }}/luxd-pkg
+          PKG_ROOT: /tmp/luxd
           TAG: ${{ env.TAG }}
           BUCKET: ${{ secrets.BUCKET }}
           ARCH: "amd64"
           RELEASE: "jammy"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: jammy
-          path: ${{ github.workspace }}/luxd-pkg/luxd-${{ env.TAG }}-amd64.deb
+          name: jammy-amd64
+          path: /tmp/luxd/luxd-${{ env.TAG }}-amd64.deb
 
       - name: Cleanup
         run: |
           rm -rf ./build
-          rm -rf ${{ github.workspace }}/luxd-pkg
+          rm -rf /tmp/luxd
 
-  build-noble-amd64-package:
-    runs-on: ubuntu-24.04
-    permissions:
-      id-token: write
-      contents: read
+  build-focal-amd64-package:
+    runs-on: [self-hosted, linux, amd64]
 
     steps:
       - uses: actions/checkout@v4
@@ -81,10 +74,7 @@ jobs:
       - run: go version
 
       - name: Build the luxd binaries
-        run: ./scripts/run_task.sh build
-
-      - name: Install aws cli
-        run: sudo snap install aws-cli --classic
+        run: CGO_ENABLED=0 ./scripts/run_task.sh build
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -100,29 +90,22 @@ jobs:
           echo "TAG=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
         shell: bash
 
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
-
       - name: Create debian package
         run: ./.github/workflows/build-deb-pkg.sh
         env:
-          PKG_ROOT: ${{ github.workspace }}/luxd-pkg
+          PKG_ROOT: /tmp/luxd
           TAG: ${{ env.TAG }}
           BUCKET: ${{ secrets.BUCKET }}
           ARCH: "amd64"
-          RELEASE: "noble"
+          RELEASE: "focal"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: noble
-          path:  ${{ github.workspace }}/luxd-pkg/luxd-${{ env.TAG }}-amd64.deb
+          name: focal-amd64
+          path: /tmp/luxd/luxd-${{ env.TAG }}-amd64.deb
 
       - name: Cleanup
         run: |
           rm -rf ./build
-          rm -rf ${{ github.workspace }}/luxd-pkg
+          rm -rf /tmp/luxd

.github/workflows/build-ubuntu-arm64-release.yml

@@ -6,34 +6,27 @@ on:
       tag:
         description: 'Tag to include in artifact name'
         required: true
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: true
+        type: string
   push:
     tags:
       - "*"
 
 jobs:
   build-jammy-arm64-package:
-    runs-on: custom-arm64-jammy
-    permissions:
-      id-token: write
-      contents: read
+    runs-on: [self-hosted, linux, amd64]
 
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
       - run: go version
 
-      - name: Build the luxd binaries
-        run: ./scripts/run_task.sh build
-
-      - name: Install aws cli
-        run: sudo snap install aws-cli --classic
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -52,46 +45,33 @@ jobs:
       - name: Create debian package
         run: ./.github/workflows/build-deb-pkg.sh
         env:
-          PKG_ROOT: ${{ github.workspace }}/luxd-pkg
+          PKG_ROOT: /tmp/luxd
           TAG: ${{ env.TAG }}
           BUCKET: ${{ secrets.BUCKET }}
           ARCH: "arm64"
           RELEASE: "jammy"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: jammy
-          path: ${{ github.workspace }}/luxd-pkg/luxd-${{ env.TAG }}-arm64.deb
+          name: jammy-arm64
+          path: /tmp/luxd/luxd-${{ env.TAG }}-arm64.deb
 
       - name: Cleanup
         run: |
           rm -rf ./build
-          rm -rf ${{ github.workspace }}/luxd-pkg
+          rm -rf /tmp/luxd
 
-  build-noble-arm64-package:
-    runs-on: custom-arm64-noble
-    permissions:
-      id-token: write
-      contents: read
+  build-focal-arm64-package:
+    runs-on: [self-hosted, linux, amd64]
 
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-go-for-project
       - run: go version
 
-      - name: Build the luxd binaries
-        run: ./scripts/run_task.sh build
-
-      - name: Install aws cli
-        run: sudo snap install aws-cli --classic
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_DEPLOY_SA_ROLE_ARN }}
-          role-session-name: githubrolesession
-          aws-region: us-east-1
+      - name: Build the luxd binaries (cross-compile arm64 on amd64)
+        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 ./scripts/build.sh
 
       - name: Try to get tag from git
         if: "${{ github.event.inputs.tag == '' }}"
@@ -110,19 +90,19 @@ jobs:
       - name: Create debian package
         run: ./.github/workflows/build-deb-pkg.sh
         env:
-          PKG_ROOT: ${{ github.workspace }}/luxd-pkg
+          PKG_ROOT: /tmp/luxd
           TAG: ${{ env.TAG }}
           BUCKET: ${{ secrets.BUCKET }}
           ARCH: "arm64"
-          RELEASE: "noble"
+          RELEASE: "focal"
 
       - name: Save as Github artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: noble
-          path: ${{ github.workspace }}/luxd-pkg/luxd-${{ env.TAG }}-arm64.deb
+          name: focal-arm64
+          path: /tmp/luxd/luxd-${{ env.TAG }}-arm64.deb
 
       - name: Cleanup
         run: |
           rm -rf ./build
-          rm -rf ${{ github.workspace }}/luxd-pkg
+          rm -rf /tmp/luxd

.github/workflows/build-win-release.yml

@@ -2,53 +2,52 @@
 
 name: build-win-release
 
-# Controls when the action will run.
 on:
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      tag:
+        description: 'Tag to include in artifact name'
+        required: false
+        type: string
   push:
     tags:
-      - "*" # Push events to every tag
+      - "*"
 
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build"
   build-win:
-    # The type of runner that the job will run on
-    runs-on: windows-2019
-    # Steps represent a sequence of tasks that will be executed as part of the job
+    runs-on: windows-2022
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v4
+
       - uses: ./.github/actions/setup-go-for-project
+
       - run: go version
 
-      - name: Get the version
-        id: get_version
+      - name: Set tag version
+        id: set_tag
         run: |
-          echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
+          # Check for workflow_call input first, then workflow_dispatch input, then git tag
+          if [ -n "${{ inputs.tag }}" ]; then
+            echo "TAG=${{ inputs.tag }}" >> "$GITHUB_ENV"
+          elif [ -n "${GITHUB_REF##refs/tags/}" ] && [ "${GITHUB_REF}" != "${GITHUB_REF##refs/tags/}" ]; then
+            echo "TAG=${GITHUB_REF##refs/tags/}" >> "$GITHUB_ENV"
+          else
+            echo "TAG=dev" >> "$GITHUB_ENV"
+          fi
         shell: bash
 
-      - name: Install awscli
-        run: |
-          msiexec.exe /passive /i /n https://awscli.amazonaws.com/AWSCLIV2.msi 
-          aws --version
-
-      # Runs a single command using the runners shell
       - name: Build the node binary
-        run: ./scripts/build.sh
+        run: CGO_ENABLED=0 ./scripts/build.sh
         shell: bash
 
       - name: Create zip
         run: |
-          mv .\build\node .\build\node.exe
-          Compress-Archive -Path .\build\node.exe -DestinationPath .\build\node-win-${{ env.VERSION }}-experimental.zip
+          mv .\build\luxd .\build\luxd.exe
+          Compress-Archive -Path .\build\luxd.exe -DestinationPath .\build\node-win-${{ env.TAG }}-experimental.zip
 
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+      - name: Save as Github artifact
+        uses: actions/upload-artifact@v7
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-
-      - name: Copy to s3
-        run: aws s3 cp .\build\node-win-${{ env.VERSION }}-experimental.zip s3://${{ secrets.BUCKET }}/windows/node-win-${{ env.VERSION }}-experimental.zip
+          name: windows
+          path: .\build\node-win-${{ env.TAG }}-experimental.zip

.github/workflows/build.yml

@@ -8,25 +8,61 @@ on:
 permissions:
   contents: write
 
+env:
+  GOWORK: off
+  CGO_ENABLED: "0"
+
 jobs:
   goreleaser:
-    runs-on: ubuntu-latest
+    # In-cluster ARC pool (lux-build autoscalingrunnerset in lux-k8s, org-scoped to
+    # github.com/luxfi, amd64). GitHub-hosted ubuntu-latest is disabled for this org
+    # (NO GITHUB BUILDERS) — that is why this job red-X'd while docker.yml (lux-build)
+    # published the image. GoReleaser cross-compiles all GOOS/GOARCH from one linux
+    # amd64 host with CGO_ENABLED=0, so a single amd64 runner is sufficient.
+    runs-on: lux-build
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-go-for-project
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v2
+      # GoReleaser shells out to `go build`, which must fetch private luxfi
+      # modules across REPOS (container, crypto, database, proto, ...). The
+      # repo-scoped github.token cannot read other private luxfi repos
+      # (`could not read Password ... exit 128`); use the cross-org PAT that
+      # docker.yml already relies on (org GH_TOKEN, else repo UNIVERSE_PAT).
+      - id: pat
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
+        shell: bash
+        run: |
+          tok="$GH_TOKEN"; src="GH_TOKEN"
+          if [ -z "$tok" ]; then tok="$UNIVERSE_PAT"; src="UNIVERSE_PAT"; fi
+          if [ -z "$tok" ]; then
+            echo "::error::No GH_TOKEN or UNIVERSE_PAT secret set — go build cannot fetch private cross-repo luxfi modules"
+            exit 1
+          fi
+          echo "Using secret: $src (length=${#tok})"
+          echo "::add-mask::$tok"
+          git config --global url."https://x-access-token:${tok}@github.com/".insteadOf "https://github.com/"
+      - name: Run GoReleaser (release)
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: goreleaser/goreleaser-action@v7
         with:
           distribution: goreleaser
           version: v1.13.1
           # TODO: automate github release page announce and artifact uploads
           # https://goreleaser.com/cmd/goreleaser_release/
           args: release --rm-dist --skip-announce --skip-publish
-
         # to automate release announcement
         # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret
         # env:
         # GITHUB_TOKEN: ...
+      - name: Run GoReleaser (snapshot)
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          distribution: goreleaser
+          version: v1.13.1
+          args: release --rm-dist --snapshot --skip-announce --skip-publish

.github/workflows/build_and_test.sh

@@ -5,9 +5,9 @@ set -o nounset
 set -o pipefail
 
 # Lux root directory
-LUX_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../.. && pwd )
+NODE_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../.. && pwd )
 
-"$LUX_PATH"/scripts/build.sh
+"$NODE_PATH"/scripts/build.sh
 # Check to see if the build script creates any unstaged changes to prevent
 # regression where builds go.mod/go.sum files get out of date.
 if [[ -z $(git status -s) ]]; then
@@ -15,5 +15,5 @@ if [[ -z $(git status -s) ]]; then
     # TODO: Revise this check once we can reliably build without changes
     # exit 1
 fi
-"$LUX_PATH"/scripts/build_test.sh
-"$LUX_PATH"/scripts/build_fuzz.sh
+"$NODE_PATH"/scripts/build_test.sh
+"$NODE_PATH"/scripts/build_fuzz.sh 2

.github/workflows/c-chain-reexecution-benchmark.yml

@@ -1,83 +0,0 @@
-name: C-Chain Re-Execution Benchmark
-
-on:
-  pull_request:
-  workflow_dispatch:
-    inputs:
-      start-block:
-        description: 'The start block for the benchmark.'
-        required: false
-        default: 101
-      end-block:
-        description: 'The end block for the benchmark.'
-        required: false
-        default: 250000
-      source-block-dir:
-        description: 'The source block directory. Supports S3 directory/zip and local directories.'
-        required: false
-        default: s3://luxd-bootstrap-testing/cchain-mainnet-blocks-1m-ldb.zip
-      current-state-dir:
-        description: 'The current state directory. Supports S3 directory/zip and local directories.'
-        required: false
-        default: s3://luxd-bootstrap-testing/cchain-current-state-hashdb-full-100.zip
-  schedule:
-    - cron: '0 9 * * *' # Runs every day at 09:00 UTC (04:00 EST)
-
-jobs:
-    c-chain-reexecution:
-      permissions:
-        id-token: write
-        contents: write
-      runs-on: ubuntu-latest
-      steps:
-        - name: Configure AWS Credentials
-          uses: aws-actions/configure-aws-credentials@v4
-          with:
-            role-to-assume: ${{ secrets.AWS_S3_READ_ONLY_ROLE }}
-            aws-region: us-east-2
-        - name: Set task env via GITHUB_ENV
-          id: set-params
-          run: |
-            {
-              echo "START_BLOCK=${{ github.event.inputs.start-block || 101 }}"
-              echo "END_BLOCK=${{ github.event.inputs.end-block || 250000 }}"
-              echo "SOURCE_BLOCK_DIR=${{ github.event.inputs.source-block-dir || 's3://luxd-bootstrap-testing/cchain-mainnet-blocks-1m-ldb.zip' }}"
-              echo "CURRENT_STATE_DIR=${{ github.event.inputs.current-state-dir || 's3://luxd-bootstrap-testing/cchain-current-state-hashdb-full-100.zip' }}"
-            } >> "$GITHUB_ENV"
-        - uses: actions/checkout@v4
-        - uses: ./.github/actions/setup-go-for-project
-        - name: Run C-Chain Re-Execution
-          uses: ./.github/actions/run-monitored-tmpnet-cmd
-          with:
-            run: ./scripts/run_task.sh reexecute-cchain-range-with-copied-data EXECUTION_DATA_DIR=${{ github.workspace }}/reexecution-data BENCHMARK_OUTPUT_FILE=${{ github.workspace }}/reexecute-cchain-range-benchmark-res.txt
-            prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-            prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-            grafana_dashboard_id: 'Gl1I20mnk/c-chain'
-            loki_username: ${{ secrets.LOKI_ID || '' }}
-            loki_password: ${{ secrets.LOKI_PASSWORD || '' }}
-            runtime: "" # Set runtime input to empty string to disable log collection
-        - name: Download Previous Benchmark Result
-          uses: actions/cache@v4
-          with:
-            path: ./cache
-            key: ${{ runner.os }}-reexecute-cchain-range-benchmark.json
-        - name: Compare Benchmark Result
-          uses: benchmark-action/github-action-benchmark@v1
-          with:
-            tool: 'go'
-            output-file-path: ${{ github.workspace }}/reexecute-cchain-range-benchmark-res.txt
-            external-data-json-path: ./cache/${{ runner.os }}-reexecute-cchain-range-benchmark.json
-            fail-on-alert: true
-            github-token: ${{ secrets.GITHUB_TOKEN }}
-            summary-always: true
-            comment-on-alert: true
-            auto-push: false
-        - name: Push Benchmark Result
-          if: github.event_name == 'schedule'
-          uses: benchmark-action/github-action-benchmark@v1
-          with:
-            tool: 'go'
-            output-file-path: ${{ github.workspace }}/reexecute-cchain-range-benchmark-res.txt
-            external-data-json-path: ./cache/${{ runner.os }}-reexecute-cchain-range-benchmark.json
-            github-token: ${{ secrets.GITHUB_TOKEN }}
-            auto-push: true

.github/workflows/check-clean-branch.sh

@@ -1,12 +1,9 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-git add --all
-git update-index --really-refresh >> /dev/null
-
-# Show the status of the working tree.
-git status --short
-
+#!/bin/bash
 # Exits if any uncommitted changes are found.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+git update-index --really-refresh >> /dev/null
 git diff-index --quiet HEAD

.github/workflows/ci.yml

@@ -1,43 +1,195 @@
-name: CI
+name: Tests
 
 on:
   push:
-    branches: [ main, master ]
+    tags:
+      - "*"
+    branches:
+      - main
+      - dev
   pull_request:
-    branches: [ main, master ]
+  merge_group:
+    types: [checks_requested]
+
+permissions:
+  contents: read
+
+# Cancel ongoing workflow runs if a new one is started
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  build:
+  Unit:
+    runs-on: ${{ matrix.os }}
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+      GOEXPERIMENT: runtimesecret
+    strategy:
+      fail-fast: false
+      matrix:
+        # GH-hosted arm64 macos forbidden; CI runs amd64 only. Release builds
+        # cover darwin/arm64 via cross-compile in build-macos-release.yml.
+        os: [macos-13, ubuntu-22.04, ubuntu-24.04, windows-2022]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: Set timeout on Windows
+        shell: bash
+        if: matrix.os == 'windows-2022'
+        run: echo "TIMEOUT=240s" >> "$GITHUB_ENV"
+      - name: build_test
+        shell: bash
+        run: ./scripts/build_test.sh
+        env:
+          TIMEOUT: ${{ env.TIMEOUT }}
+          CGO_ENABLED: '0'
+  Fuzz:
+    runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+      GOEXPERIMENT: runtimesecret
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: fuzz_test
+        shell: bash
+        run: ./scripts/build_fuzz.sh 20 # Run each fuzz test 20 seconds
+        env:
+          CGO_ENABLED: '0'
+  # NOTE: E2E tests disabled - require tmpnet infrastructure
+  # e2e_pre_etna, e2e_post_etna, e2e_existing_network, Upgrade
+  # These will be re-enabled once tmpnet is properly configured
+  Lint:
+    runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+      GOEXPERIMENT: runtimesecret
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: Run static analysis tests
+        shell: bash
+        run: scripts/lint.sh
+        env:
+          CGO_ENABLED: '0'
+      - name: Run shellcheck
+        shell: bash
+        run: scripts/shellcheck.sh
+      - name: Run actionlint
+        shell: bash
+        run: scripts/actionlint.sh
+  buf-lint:
+    name: Protobuf Lint
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    
-    - name: Set up Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: '1.21.12'
-    
-    - name: Cache Go modules
-      uses: actions/cache@v3
-      with:
-        path: ~/go/pkg/mod
-        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          ${{ runner.os }}-go-
-    
-    - name: Install dependencies
-      run: go mod download
-    
-    - name: Build
-      run: |
-        ./scripts/build.sh
-        ./build/luxd --version
-    
-    - name: Test
-      run: go test -v -short -timeout 30m ./...
-    
-    - name: Lint
-      uses: golangci/golangci-lint-action@v3
-      with:
-        version: latest
-        args: --timeout=10m
+      - uses: actions/checkout@v4
+      - name: Install buf
+        shell: bash
+        run: |
+          BUF_VERSION="1.47.2"
+          curl -sSL "https://github.com/bufbuild/buf/releases/download/v${BUF_VERSION}/buf-Linux-x86_64" -o /usr/local/bin/buf
+          chmod +x /usr/local/bin/buf
+          buf --version
+      - name: Lint protobuf
+        shell: bash
+        run: buf lint proto
+  check_generated_protobuf:
+    name: Up-to-date protobuf
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - name: Install buf
+        shell: bash
+        run: |
+          BUF_VERSION="1.47.2"
+          curl -sSL "https://github.com/bufbuild/buf/releases/download/v${BUF_VERSION}/buf-Linux-x86_64" -o /usr/local/bin/buf
+          chmod +x /usr/local/bin/buf
+      - name: Install protoc-gen-go tools
+        shell: bash
+        run: |
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.35.1
+          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0
+          go install connectrpc.com/connect/cmd/protoc-gen-connect-go@latest
+      - shell: bash
+        run: scripts/protobuf_codegen.sh
+        env:
+          CGO_ENABLED: '0'
+      - shell: bash
+        run: .github/workflows/check-clean-branch.sh
+  check_mockgen:
+    name: Up-to-date mocks
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - shell: bash
+        run: scripts/mock.gen.sh
+        env:
+          CGO_ENABLED: '0'
+      - shell: bash
+        run: .github/workflows/check-clean-branch.sh
+  go_mod_tidy:
+    name: Up-to-date go.mod and go.sum
+    runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
+      - shell: bash
+        run: go mod tidy
+      - shell: bash
+        run: .github/workflows/check-clean-branch.sh
+  test_build_image:
+    name: Image build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build Docker image (test only)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: false
+          platforms: linux/amd64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/cleanup-net-outage-sim.sh

@@ -1,10 +0,0 @@
-set -o pipefail
-
-###
-# cleanup removes the docker instance and the network
-echo "Cleaning up..."
-docker rm $(sudo docker stop $(sudo docker ps -a -q --filter ancestor=luxfi/node:latest --format="{{.ID}}"))  #if the filter returns nothing the command fails, so ignore errors
-docker network rm controlled-net 
-rm /opt/mainnet-db-daily* 2>/dev/null 
-rm -rf /var/lib/node 2>/dev/null 
-echo "Done cleaning up"

.github/workflows/codeql-analysis.yml

@@ -13,10 +13,9 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [master, dev]
+    branches: [main]
   pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [master, dev]
+    branches: [main]
   schedule:
     - cron: "44 11 * * 4"
   merge_group:
@@ -47,7 +46,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f #v3.28.18
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,4 +55,4 @@ jobs:
           # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f #v3.28.18
+        uses: github/codeql-action/analyze@v4

.github/workflows/comprehensive-ci.yml

@@ -1,118 +0,0 @@
-name: Comprehensive CI
-
-on:
-  push:
-    branches: [main, dev]
-    tags: ['v*']
-  pull_request:
-    branches: [main, dev]
-
-jobs:
-  test-and-build:
-    name: Test and Build
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-22.04, ubuntu-24.04, macos-14]
-        go-version: ['1.24.x']
-    
-    steps:
-    - uses: actions/checkout@v4
-    
-    - name: Setup Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: ${{ matrix.go-version }}
-    
-    - name: Install dependencies
-      run: |
-        go mod download
-        go install -v golang.org/x/tools/cmd/goimports@latest
-    
-    - name: Run goimports
-      run: goimports -w .
-    
-    - name: Run go mod tidy
-      run: go mod tidy
-    
-    - name: Build
-      run: go build -v ./...
-    
-    - name: Test (excluding antithesis)
-      run: go test -tags '!antithesis' -short -timeout 10m -v ./...
-      
-    - name: Build luxd binary
-      run: |
-        ./scripts/build_luxd.sh
-        ./build/luxd --version
-
-  build-static-binaries:
-    name: Build Static Binaries
-    runs-on: ubuntu-22.04
-    if: startsWith(github.ref, 'refs/tags/v')
-    
-    steps:
-    - uses: actions/checkout@v4
-    
-    - name: Setup Go
-      uses: actions/setup-go@v5
-      with:
-        go-version-file: 'go.mod'
-    
-    - name: Build Linux AMD64
-      run: |
-        CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o luxd-linux-amd64 ./main
-        tar -czf luxd-linux-amd64.tar.gz luxd-linux-amd64
-    
-    - name: Build Linux ARM64
-      run: |
-        CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="-s -w" -o luxd-linux-arm64 ./main
-        tar -czf luxd-linux-arm64.tar.gz luxd-linux-arm64
-    
-    - name: Build Darwin AMD64
-      run: |
-        CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -ldflags="-s -w" -o luxd-darwin-amd64 ./main
-        tar -czf luxd-darwin-amd64.tar.gz luxd-darwin-amd64
-    
-    - name: Build Darwin ARM64
-      run: |
-        CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -ldflags="-s -w" -o luxd-darwin-arm64 ./main
-        tar -czf luxd-darwin-arm64.tar.gz luxd-darwin-arm64
-    
-    - name: Build Windows AMD64
-      run: |
-        CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags="-s -w" -o luxd-windows-amd64.exe ./main
-        zip luxd-windows-amd64.zip luxd-windows-amd64.exe
-    
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: binaries
-        path: |
-          luxd-*.tar.gz
-          luxd-*.zip
-
-  release:
-    name: Create Release
-    needs: [test-and-build, build-static-binaries]
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v')
-    
-    steps:
-    - uses: actions/checkout@v4
-    
-    - name: Download artifacts
-      uses: actions/download-artifact@v4
-      with:
-        name: binaries
-    
-    - name: Create Release
-      uses: softprops/action-gh-release@v2
-      with:
-        files: |
-          luxd-*.tar.gz
-          luxd-*.zip
-        draft: false
-        prerelease: false
-        generate_release_notes: true

.github/workflows/docker-publish.yml

@@ -1,88 +0,0 @@
-name: Build and Publish Docker Image
-
-on:
-  push:
-    branches:
-      - main
-      - master
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - main
-      - master
-  workflow_dispatch:
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: luxfi/node
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.24'
-          cache: true
-
-      - name: Build luxd binary
-        run: |
-          make build
-          ls -la build/
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=sha,prefix={{branch}}-
-            type=raw,value=latest,enable={{is_default_branch}}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          platforms: linux/amd64,linux/arm64
-
-      - name: Generate SBOM
-        uses: anchore/sbom-action@v0
-        with:
-          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
-          format: spdx-json
-          output-file: sbom.spdx.json
-
-      - name: Upload SBOM
-        uses: actions/upload-artifact@v4
-        with:
-          name: sbom
-          path: sbom.spdx.json

.github/workflows/docker.yml

@@ -0,0 +1,125 @@
+name: Docker
+
+on:
+  workflow_dispatch:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
+jobs:
+  build-amd64:
+    # In-cluster ARC pool (lux-build autoscalingrunnerset in lux-k8s, amd64
+    # DOKS nodes, DinD sidecar). Replaces the offline evo classic runner.
+    # ARC matches on the scale-set name, NOT classic [self-hosted,linux,amd64]
+    # labels — the org runner group + arcd repo allowlist enforce isolation.
+    runs-on: lux-build
+    outputs:
+      digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+          driver-opts: |
+            network=host
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/luxfi/node
+          # Semver-only policy: only `v*` git tags yield a published image
+          # tag; every push gets an immutable `sha-<sha7>` for traceability.
+          # No `:latest`, no `:main`, no floating tags ever. `flavor.latest`
+          # has to be explicit-false; docker/metadata-action defaults to
+          # `latest=auto` which silently emits `:latest` on tag pushes.
+          flavor: |
+            latest=false
+          tags: |
+            type=ref,event=tag
+            type=sha,format=short,prefix=sha-
+
+      - name: Resolve cross-repo PAT for private luxfi/* deps
+        id: pat
+        env:
+          # The default GITHUB_TOKEN is repo-scoped and cannot read
+          # private cross-repo deps like luxfi/corona or luxfi/evm. We
+          # need a PAT with org-wide read scope. Order of preference:
+          # 1) org GH_TOKEN (visibility=all, set on luxfi org since 2024)
+          # 2) repo UNIVERSE_PAT (set on luxfi/node since 2026-04)
+          # Either suffices; we just need ONE non-empty token. If both
+          # are empty the build is going to fail at go mod download for
+          # corona — fail fast here with a clear message.
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          UNIVERSE_PAT: ${{ secrets.UNIVERSE_PAT }}
+        run: |
+          tok="$GH_TOKEN"
+          src="GH_TOKEN"
+          if [ -z "$tok" ]; then
+            tok="$UNIVERSE_PAT"
+            src="UNIVERSE_PAT"
+          fi
+          if [ -z "$tok" ]; then
+            echo "::error::Neither GH_TOKEN (org) nor UNIVERSE_PAT (repo) is set. Private luxfi/* deps cannot be resolved."
+            exit 1
+          fi
+          echo "Using secret: $src (length=${#tok})"
+          # Pass the resolved token to subsequent steps without exposing
+          # the value. ::add-mask:: prevents accidental log leaks if the
+          # value ever appears in later step output.
+          echo "::add-mask::$tok"
+          echo "token<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$tok" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Build & push (amd64)
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          push: true
+          build-args: |
+            CGO_ENABLED=0
+          # Resolve private luxfi/* modules via git url.insteadOf in the
+          # Dockerfile. Take the token value from the previous step's
+          # output (it picked GH_TOKEN or fell back to UNIVERSE_PAT).
+          secrets: |
+            ghtok=${{ steps.pat.outputs.token }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+          cache-from: type=registry,ref=ghcr.io/luxfi/node:buildcache-amd64
+          cache-to: type=registry,ref=ghcr.io/luxfi/node:buildcache-amd64,mode=max
+
+  notify-universe:
+    needs: build-amd64
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: lux-build
+    steps:
+      - uses: peter-evans/repository-dispatch@v4
+        with:
+          token: ${{ secrets.UNIVERSE_PAT }}
+          repository: luxfi/universe
+          event-type: image-published
+          client-payload: |
+            {
+              "service": "node",
+              "image": "ghcr.io/luxfi/node",
+              "tag": "${{ github.ref_name }}",
+              "sha": "${{ github.sha }}"
+            }

.github/workflows/fuzz.yml

@@ -10,10 +10,20 @@ permissions:
 jobs:
   fuzz:
     runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
     steps:
       - name: Git checkout
         uses: actions/checkout@v4
       - name: Set up Go
         uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
       - name: Run fuzz tests
-        run: ./scripts/run_task.sh test-fuzz-long
+        shell: bash
+        run: ./scripts/build_fuzz.sh 180 # Run each fuzz test 180 seconds
+        env:
+          CGO_ENABLED: '0'

.github/workflows/fuzz_merkledb.yml

@@ -12,10 +12,20 @@ permissions:
 jobs:
   MerkleDB:
     runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: github.com/luxfi/*
+      GONOSUMDB: github.com/luxfi/*
+      GOWORK: off
     steps:
       - name: Git checkout
         uses: actions/checkout@v4
       - name: Set up Go
         uses: ./.github/actions/setup-go-for-project
+      - name: Configure Git for private modules
+        shell: bash
+        run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
       - name: Run merkledb fuzz tests
-        run: ./scripts/run_task.sh test-fuzz-merkledb
+        shell: bash
+        run: ./scripts/build_fuzz.sh 900 ./x/merkledb # Run each merkledb fuzz tests 15 minutes
+        env:
+          CGO_ENABLED: '0'

.github/workflows/labels.yml

@@ -2,7 +2,7 @@ name: labels
 on:
   push:
     branches:
-      - master
+      - main
     paths:
       - .github/labels.yml
       - .github/workflows/labels.yml
@@ -19,6 +19,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: crazy-max/ghaction-github-labeler@31674a3852a9074f2086abcf1c53839d466a47e7 #v5.2.0
+      - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d #v6.0.0
         with:
           dry-run: ${{ github.event_name == 'pull_request' }}

.github/workflows/net-outage-sim.yml

@@ -1,32 +0,0 @@
-name: network-outage-simulation
-
-on:
-  schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Run every day at 7 AM. (The database backup is created around 5 AM.)
-    - cron: "0 7 * * *"
-  workflow_dispatch:
-
-jobs:
-  run_sim:
-    runs-on: [self-hosted, linux, x64, net-outage-sim]
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Cleanup docker (avoid conflicts with previous runs)
-        shell: bash
-        run: .github/workflows/cleanup-net-outage-sim.sh
-
-      - name: Download node:latest
-        run: docker pull luxfi/node:latest
-
-      - name: Run the internet outage simulation
-        shell: bash
-        run: .github/workflows/run-net-outage-sim.sh
-
-      - name: Cleanup again
-        if: always() # Always clean up
-        shell: bash
-        run: .github/workflows/cleanup-net-outage-sim.sh

.github/workflows/publish_antithesis_images.yml

@@ -1,44 +0,0 @@
-name: Publish Antithesis Images
-
-on:
-  workflow_dispatch:
-    inputs:
-      image_tag:
-        description: 'The tag to apply to published images'
-        default: latest
-        required: true
-        type: string
-  push:
-    branches:
-      - master
-
-env:
-  REGISTRY: us-central1-docker.pkg.dev
-  REPOSITORY: molten-verve-216720/lux-repository
-
-jobs:
-  antithesis:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout Repository
-      uses: actions/checkout@v4
-
-    - name: Login to GAR
-      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
-      with:
-        registry: ${{ env.REGISTRY }}
-        username: _json_key
-        password: ${{ secrets.ANTITHESIS_GAR_JSON_KEY }}
-
-    - name: Build and push images for luxd test setup
-      run: ./scripts/run_task.sh build-antithesis-images-luxd
-      env:
-        IMAGE_PREFIX: ${{ env.REGISTRY }}/${{ env.REPOSITORY }}
-        IMAGE_TAG: ${{ github.event.inputs.image_tag || 'latest' }}
-
-    - name: Build and push images for xsvm test setup
-      run: ./scripts/run_task.sh build-antithesis-images-xsvm
-      env:
-        IMAGE_PREFIX: ${{ env.REGISTRY }}/${{ env.REPOSITORY }}
-        IMAGE_TAG: ${{ github.event.inputs.image_tag || 'latest' }}

.github/workflows/publish_docker_image.yml

@@ -1,37 +0,0 @@
-name: Publish Docker Image
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - "*"
-    branches:
-      - master
-      - dev
-
-jobs:
-  publish_docker_image:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install qemu (required for cross-platform builds)
-        run: |
-          sudo apt update
-          sudo apt -y install qemu-system qemu-user-static
-          sudo systemctl restart docker
-      - name: Create multiplatform docker builder
-        run: docker buildx create --use
-      - name: Build and publish images to DockerHub
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-          DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
-          DOCKER_IMAGE: ${{ secrets.DOCKER_REPO }}
-          BUILD_MULTI_ARCH: 1
-        run: scripts/run_task.sh build-image
-      - name: Build and publish bootstrap-monitor image to DockerHub
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-          DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
-          DOCKER_IMAGE: avaplatform/bootstrap-monitor
-          BUILD_MULTI_ARCH: 1
-        run: scripts/run_task.sh build-bootstrap-monitor-image

.github/workflows/publish_image.sh

@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-# If this is not a trusted build (Docker Credentials are not set)
-if [[ -z "$DOCKER_USERNAME"  ]]; then
-  exit 0;
-fi
-
-# Lux root directory
-LUX_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../.. && pwd )
-
-# Load the constants
-source "$LUX_PATH"/scripts/constants.sh
-
-if [[ $current_branch == "master" ]]; then
-  echo "Tagging current node image as $node_dockerhub_repo:latest"
-  docker tag $node_dockerhub_repo:$current_branch $node_dockerhub_repo:latest
-fi
-
-echo "Pushing: $node_dockerhub_repo:$current_branch"
-
-echo "$DOCKER_PASS" | docker login --username "$DOCKER_USERNAME" --password-stdin
-
-## pushing image with tags
-docker image push -a $node_dockerhub_repo

.github/workflows/release.yml

@@ -0,0 +1,250 @@
+name: Release
+
+# Trigger on semantic version tags only (v1.x.x)
+# Explicitly reject v2.x.x and higher per Go module versioning requirements
+on:
+  push:
+    tags:
+      - 'v[0-1].*.*'
+
+permissions:
+  contents: write  # Required to create releases and upload assets
+  id-token: write  # Required for AWS OIDC authentication
+
+jobs:
+  # Validate semantic version is < v2.0.0
+  validate-version:
+    # lux-build ARC pool (in-cluster, lux-k8s, org-scoped to github.com/luxfi). The org
+    # disables GitHub-hosted runners (NO GITHUB BUILDERS); ubuntu-latest never gets a
+    # runner, which red-X'd this job and cascaded skips to every platform build below.
+    runs-on: lux-build
+    outputs:
+      version: ${{ steps.extract.outputs.version }}
+      is_prerelease: ${{ steps.check.outputs.is_prerelease }}
+    steps:
+      - name: Extract version from tag
+        id: extract
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          VERSION="${TAG#v}"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate version < v2.0.0
+        id: check
+        run: |
+          VERSION="${{ steps.extract.outputs.version }}"
+          MAJOR=$(echo "$VERSION" | cut -d. -f1)
+
+          # Reject v2.x.x and higher (Go modules require /v2 import path)
+          if [ "$MAJOR" -ge 2 ]; then
+            echo "❌ ERROR: Version v${VERSION} is >= v2.0.0"
+            echo "Go modules require /v2 suffix in import paths for v2+"
+            echo "Only v1.x.x versions are allowed"
+            exit 1
+          fi
+
+          # Check if prerelease (contains - or + per semver)
+          if echo "$VERSION" | grep -qE '[-+]'; then
+            echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
+            echo "✓ Pre-release version: v${VERSION}"
+          else
+            echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
+            echo "✓ Release version: v${VERSION}"
+          fi
+
+  # Build all platforms in parallel
+  build-ubuntu-amd64:
+    needs: validate-version
+    uses: ./.github/workflows/build-ubuntu-amd64-release.yml
+    secrets: inherit
+    with:
+      tag: ${{ needs.validate-version.outputs.version }}
+
+  build-ubuntu-arm64:
+    needs: validate-version
+    uses: ./.github/workflows/build-ubuntu-arm64-release.yml
+    secrets: inherit
+    with:
+      tag: ${{ needs.validate-version.outputs.version }}
+
+  # Build linux binary tarballs for CLI compatibility
+  build-linux-binaries:
+    needs: validate-version
+    uses: ./.github/workflows/build-linux-binaries.yml
+    secrets: inherit
+    with:
+      tag: v${{ needs.validate-version.outputs.version }}
+
+  build-macos:
+    needs: validate-version
+    uses: ./.github/workflows/build-macos-release.yml
+    secrets: inherit
+    with:
+      tag: v${{ needs.validate-version.outputs.version }}
+
+  build-windows:
+    needs: validate-version
+    uses: ./.github/workflows/build-win-release.yml
+    secrets: inherit
+
+  # Create GitHub Release with all artifacts
+  create-release:
+    needs:
+      - validate-version
+      - build-ubuntu-amd64
+      - build-ubuntu-arm64
+      - build-linux-binaries
+      - build-macos
+      - build-windows
+    # lux-build ARC pool (in-cluster, lux-k8s, org-scoped to github.com/luxfi). This job
+    # only downloads artifacts + cuts the GitHub Release — no compile — but ubuntu-latest
+    # is disabled for the org (NO GITHUB BUILDERS), so it must run on a self-hosted pool.
+    runs-on: lux-build
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Required for changelog generation
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: ./artifacts
+
+      - name: List downloaded artifacts
+        run: |
+          echo "📦 Downloaded artifacts:"
+          find ./artifacts -type f -ls
+
+      - name: Organize release files
+        run: |
+          # shellcheck disable=SC2034
+          mkdir -p ./release
+
+          # Copy Ubuntu AMD64 packages (.deb)
+          if [ -d "./artifacts/jammy" ]; then
+            cp ./artifacts/jammy/*.deb ./release/ 2>/dev/null || true
+          fi
+          if [ -d "./artifacts/focal" ]; then
+            cp ./artifacts/focal/*.deb ./release/ 2>/dev/null || true
+          fi
+
+          # Copy Linux binary tarballs (CLI-compatible naming)
+          if [ -d "./artifacts/amd64" ]; then
+            cp ./artifacts/amd64/node-linux-amd64-*.tar.gz ./release/ 2>/dev/null || true
+          fi
+          if [ -d "./artifacts/arm64" ]; then
+            cp ./artifacts/arm64/node-linux-arm64-*.tar.gz ./release/ 2>/dev/null || true
+          fi
+
+          # Copy macOS zip (CLI-compatible naming: node-macos-{version}.zip)
+          if [ -d "./artifacts/build" ]; then
+            cp ./artifacts/build/node-macos-*.zip ./release/ 2>/dev/null || true
+          fi
+
+          # Copy Windows binaries (if any)
+          # shellcheck disable=SC2162
+          find ./artifacts -name "*.exe" -o -name "*win*.zip" | while read -r file; do
+            cp "$file" ./release/ 2>/dev/null || true
+          done
+
+          echo "📁 Release files:"
+          ls -lh ./release/
+
+      - name: Generate checksums
+        run: |
+          cd ./release
+          # shellcheck disable=SC2035
+          sha256sum -- * > SHA256SUMS
+          echo "🔐 Checksums:"
+          cat SHA256SUMS
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          # Get previous tag for changelog
+          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+
+          if [ -n "$PREV_TAG" ]; then
+            {
+              echo "## What's Changed"
+              echo ""
+              git log --pretty=format:"- %s (%h)" "${PREV_TAG}..HEAD"
+              echo ""
+              echo ""
+              echo "**Full Changelog**: https://github.com/${{ github.repository }}/compare/${PREV_TAG}...v${{ needs.validate-version.outputs.version }}"
+            } > CHANGELOG.md
+          else
+            {
+              echo "## Initial Release"
+              echo ""
+              echo "First release of Lux Node v${{ needs.validate-version.outputs.version }}"
+            } > CHANGELOG.md
+          fi
+
+          echo "📝 Changelog:"
+          cat CHANGELOG.md
+
+      - name: Create GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="v${{ needs.validate-version.outputs.version }}"
+          PRERELEASE="${{ needs.validate-version.outputs.is_prerelease }}"
+
+          # Build release flags
+          FLAGS="--title \"Lux Node ${TAG}\""
+          FLAGS="$FLAGS --notes-file CHANGELOG.md"
+
+          if [ "$PRERELEASE" = "true" ]; then
+            FLAGS="$FLAGS --prerelease"
+            echo "📢 Creating pre-release ${TAG}"
+          else
+            FLAGS="$FLAGS --latest"
+            echo "📢 Creating release ${TAG} (latest)"
+          fi
+
+          # Create release and upload all files (--clobber overwrites if re-run)
+          eval "gh release create \"${TAG}\" ./release/* ${FLAGS}" || \
+            eval "gh release upload \"${TAG}\" ./release/* --clobber"
+
+          echo "✅ Release ${TAG} created successfully"
+          echo "🔗 https://github.com/${{ github.repository }}/releases/tag/${TAG}"
+
+      - name: Release summary
+        run: |
+          {
+            echo "## 🎉 Release v${{ needs.validate-version.outputs.version }}"
+            echo ""
+            echo "### 📦 Artifacts"
+            echo ""
+            echo "| Platform | File | Size |"
+            echo "|----------|------|------|"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          cd ./release
+          for file in *; do
+            [ "$file" = "SHA256SUMS" ] && continue
+            [ ! -f "$file" ] && continue
+            SIZE=$(du -h "$file" | cut -f1)
+            PLATFORM="Unknown"
+
+            case "$file" in
+              *amd64.deb) PLATFORM="Linux AMD64 (Debian)" ;;
+              *arm64.deb) PLATFORM="Linux ARM64 (Debian)" ;;
+              *macos*.zip) PLATFORM="macOS Universal" ;;
+              *win*.zip|*.exe) PLATFORM="Windows AMD64" ;;
+            esac
+
+            echo "| ${PLATFORM} | \`${file}\` | ${SIZE} |" >> "$GITHUB_STEP_SUMMARY"
+          done
+
+          {
+            echo ""
+            echo "### 🔐 Verification"
+            echo ""
+            echo "\`\`\`"
+            cat SHA256SUMS
+            echo "\`\`\`"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/run-net-outage-sim.sh

@@ -1,98 +0,0 @@
-set -o pipefail
-set -e
-
-SUCCESS=1
-
-# Polls luxd until it's healthy. When it is,
-# sets SUCCESS to 0 and returns. If luxd
-# doesn't become healthy within 3 hours, sets
-# SUCCESS to 1 and returns.
-wait_until_healthy () {
-  # timeout: if after 3 hours it is not healthy, return
-  stop=$(date -d "+ 3 hour" +%s)
-  # store the response code here
-  response=0
-  # while the endpoint doesn't return 200
-  while [ $response -ne 200 ]
-  do
-    echo "Checking if local node is healthy..."
-    # Ignore error in case of ephemeral failure to hit node's API
-    response=$(curl --write-out '%{http_code}' --silent --output /dev/null localhost:9650/ext/health)
-    echo "got status code $response from health endpoint"
-    # check that 3 hours haven't passed
-    now=$(date +%s)
-    if [ $now -ge $stop ];
-    then
-      # timeout: exit
-      SUCCESS=1
-      return
-    fi
-    # no timeout yet, wait 30s until retry
-    sleep 30
-  done
-  # response returned 200, therefore exit
-  echo "Node became healthy"
-  SUCCESS=0
-}
-
-#remove any existing database files
-echo "removing existing database files..."
-rm /opt/mainnet-db-daily* 2>/dev/null || true # Do || true to ignore error if files dont exist yet
-rm -rf /var/lib/node 2>/dev/null || true # Do || true to ignore error if files dont exist yet
-echo "done existing database files"
-
-#download latest mainnet DB backup
-FILENAME="mainnet-db-daily-"
-DATE=`date +'%m-%d-%Y'`
-DB_FILE="$FILENAME$DATE"
-echo "Copying database file $DB_FILE from S3 to local..."
-aws s3 cp s3://lux-db-daily/ /opt/ --no-progress --recursive --exclude "*" --include "$DB_FILE*"
-echo "Done downloading database"
-
-# extract DB
-echo "Extracting database..."
-mkdir -p /var/lib/node/db
-tar -zxf /opt/$DB_FILE*-tar.gz -C /var/lib/node/db
-echo "Done extracting database"
-
-echo "Creating Docker network..."
-docker network create controlled-net
-
-echo "Starting Docker container..."
-containerID=$(docker run --name="net_outage_simulation" --memory="12g" --memory-reservation="11g" --cpus="6.0" --net=controlled-net -p 9650:9650 -p 9651:9651 -v /var/lib/node/db:/db -d luxfi/node:latest /node/build/luxd --db-dir /db --http-host=0.0.0.0)
-
-echo "Waiting 30 seconds for node to start..."
-sleep 30
-echo "Waiting until healthy..."
-wait_until_healthy
-if [ $SUCCESS -eq 1 ];
-then
-  echo "Timed out waiting for node to become healthy; exiting."
-  exit 1
-fi
-
-# To simulate internet outage, we will disable the docker network connection
-echo "Disconnecting node from internet..."
-docker network disconnect controlled-net $containerID
-echo "Sleeping 60 minutes..."
-sleep 3600
-echo "Reconnecting node to internet..."
-docker network connect controlled-net $containerID
-echo "Reconnected to internet. Waiting until healthy..."
-
-# now repeatedly check the node's health until it returns healthy
-start=$(date +%s)
-SUCCESS=-1
-wait_until_healthy
-if [ $SUCCESS -eq 1 ];
-then
-  echo "Timed out waiting for node to become healthy after outage; exiting."
-  exit 1
-fi
-
-# The node returned healthy, print how long it took
-end=$(date +%s)
-
-DELAY=$(($end - $start))
-echo "Node became healthy again after complete outage after $DELAY seconds."
-echo "Test completed"

.github/workflows/run-tests-publish-image-basic.yml

@@ -1,31 +0,0 @@
-name: e2e Tests + Publish Docker Image
-
-on:
-  push:
-    tags-ignore:
-      - "*" # Ignores all tags
-    branches-ignore:
-      - master
-      - dev
-
-jobs:
-  run_e2e_tests_plus_publish_image:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Run Kurtosis Tests
-        env:
-          KURTOSIS_CLIENT_ID: ${{ secrets.kurtosis_client_id }}
-          KURTOSIS_CLIENT_SECRET: ${{ secrets.kurtosis_client_secret }}
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_REPO: ${{ secrets.docker_repo }}
-        run: .github/workflows/run_e2e_tests.sh node-basic --parallelism 2 --client-id $KURTOSIS_CLIENT_ID --client-secret $KURTOSIS_CLIENT_SECRET
-
-      - name: Publish image to DockerHub
-        env:
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_REPO: ${{ secrets.docker_repo }}
-
-        run: .github/workflows/publish_image.sh

.github/workflows/run-tests-publish-image-full.yml

@@ -1,31 +0,0 @@
-name: e2e Tests + Publish Docker Image
-
-on:
-  push:
-    tags:
-      - "*" # Push events to every tag
-    branches:
-      - master
-      - dev
-
-jobs:
-  run_e2e_tests_plus_publish_image:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Run Kurtosis Tests
-        env:
-          KURTOSIS_CLIENT_ID: ${{ secrets.kurtosis_client_id }}
-          KURTOSIS_CLIENT_SECRET: ${{ secrets.kurtosis_client_secret }}
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_REPO: ${{ secrets.docker_repo }}
-        run: .github/workflows/run_e2e_tests.sh node --parallelism 2 --client-id $KURTOSIS_CLIENT_ID --client-secret $KURTOSIS_CLIENT_SECRET
-
-      - name: Publish image to DockerHub
-        env:
-          DOCKER_USERNAME: ${{ secrets.docker_username }}
-          DOCKER_PASS: ${{ secrets.docker_pass }}
-          DOCKER_REPO: ${{ secrets.docker_repo }}
-
-        run: .github/workflows/publish_image.sh

.github/workflows/run_e2e_tests.sh

@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-# Testing specific variables
-lux_testing_repo="luxfi/lux-testing"
-node_byzantine_repo="luxfi/lux-byzantine"
-
-# Define lux-testing and lux-byzantine versions to use
-lux_testing_image="luxfi/lux-testing:master"
-node_byzantine_image="luxfi/lux-byzantine:master"
-
-# Fetch the images
-# If Docker Credentials are not available fail
-if [[ -z ${DOCKER_USERNAME} ]]; then
-    echo "Skipping Tests because Docker Credentials were not present."
-    exit 1
-fi
-
-# Lux root directory
-LUX_PATH=$( cd "$( dirname "${BASH_SOURCE[0]}" )"; cd ../.. && pwd )
-
-# Load the constants
-source "$LUX_PATH"/scripts/constants.sh
-
-# Login to docker
-echo "$DOCKER_PASS" | docker login --username "$DOCKER_USERNAME" --password-stdin
-
-# Receives params for debug execution
-testBatch="${1:-}"
-shift 1
-
-echo "Running Test Batch: ${testBatch}"
-
-# pulling the lux-testing image
-docker pull $lux_testing_image
-docker pull $node_byzantine_image
-
-# Setting the build ID
-git_commit_id=$( git rev-list -1 HEAD )
-
-# Build current node
-source "$LUX_PATH"/scripts/build_image.sh -r
-
-# Target built version to use in lux-testing
-lux_image="$node_dockerhub_repo:$current_branch"
-
-echo "Execution Summary:"
-echo ""
-echo "Running Lux Image: ${lux_image}"
-echo "Running Lux Image Tag: $current_branch"
-echo "Running Lux Testing Image: ${lux_testing_image}"
-echo "Running Lux Byzantine Image: ${node_byzantine_image}"
-echo "Git Commit ID : ${git_commit_id}"
-echo ""
-
-# >>>>>>>> lux-testing custom parameters <<<<<<<<<<<<<
-custom_params_json="{
-    \"isKurtosisCoreDevMode\": false,
-    \"nodeImage\":\"${lux_image}\",
-    \"nodeByzantineImage\":\"${node_byzantine_image}\",
-    \"testBatch\":\"${testBatch}\"
-}"
-# >>>>>>>> lux-testing custom parameters <<<<<<<<<<<<<
-
-bash "$LUX_PATH/.kurtosis/kurtosis.sh" \
-    --custom-params "${custom_params_json}" \
-    ${1+"${@}"} \
-    "${lux_testing_image}"

.github/workflows/self-hosted-load-tests.yaml

@@ -1,50 +0,0 @@
-name: Load test on self-hosted runners
-
-# This workflow runs load tests against our Kubernetes cluster
-on:
-  workflow_dispatch:
-    inputs:
-      luxd_image:
-        description: 'Luxd image to test'
-        required: false
-        default: 'luxfi/node:latest'
-        type: string
-      exclusive_scheduling:
-        description: 'Enable exclusive scheduling'
-        required: false
-        default: false
-        type: boolean
-      duration:
-        description: "Load test duration: e.g. 5m, 10m, 1h..."
-        required: false
-
-jobs:
-  load_test:
-    name: Run load test on self-hosted runners
-    runs-on: lux-luxd-runner
-    container:
-      image: ghcr.io/actions/actions-runner:2.325.0
-    steps:
-      - name: Install dependencies
-        shell: bash
-        # The xz-utils might be present on some containers
-        run: |
-          if ! command -v xz &> /dev/null; then
-            sudo apt-get update
-            sudo apt-get install -y xz-utils
-          fi
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Run load test
-        uses: ./.github/actions/run-monitored-tmpnet-cmd
-        with:
-          run: >-
-            ./scripts/run_task.sh test-load-kube --
-            --kube-image ${{ inputs.luxd_image }}
-            ${{ inputs.exclusive_scheduling == 'true' && '--kube-use-exclusive-scheduling' || '' }}
-            ${{ inputs.duration && format('--duration {0}', inputs.duration) || '' }}
-          artifact_prefix: self-hosted-load-test${{ inputs.exclusive_scheduling == 'true' && '-exclusive' || '' }}
-          prometheus_username: ${{ secrets.PROMETHEUS_ID || '' }}
-          prometheus_password: ${{ secrets.PROMETHEUS_PASSWORD || '' }}
-          loki_username: ${{ secrets.LOKI_ID || '' }}
-          loki_password: ${{ secrets.LOKI_PASSWORD || '' }}

.github/workflows/stale.yml

@@ -6,7 +6,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           # Overall configuration
           operations-per-run: 100
@@ -14,8 +14,7 @@ jobs:
           # PR configuration
           days-before-pr-stale: 30
           stale-pr-message: 'This PR has become stale because it has been open for 30 days with no activity. Adding the `lifecycle/frozen` label will cause this PR to ignore lifecycle events.'
-          days-before-pr-close: 60
-          close-pr-message: 'This PR is being closed due to no activity. Please re-open if this needs to be prioritized.'
+          days-before-pr-close: -1
           stale-pr-label: lifecycle/stale
           exempt-pr-labels: lifecycle/frozen
           close-pr-label: lifecycle/rotten
@@ -23,8 +22,7 @@ jobs:
           # Issue configuration
           days-before-issue-stale: 60
           stale-issue-message: 'This issue has become stale because it has been open 60 days with no activity. Adding the `lifecycle/frozen` label will cause this issue to ignore lifecycle events.'
-          days-before-issue-close: 90
-          close-issue-message: 'This issue is being closed due to no activity. Please re-open if this needs to be prioritized.'
+          days-before-issue-close: -1
           stale-issue-label: lifecycle/stale
           exempt-issue-labels: lifecycle/frozen
           close-issue-label: lifecycle/rotten

.github/workflows/static-analysis.yaml

@@ -1,20 +0,0 @@
-name: Static analysis
-on:
-  push:
-    tags-ignore:
-      - "*" # Ignores all tags
-    branches-ignore:
-      - master
-      - dev
-
-jobs:
-  run_static_analysis:
-    name: Static analysis
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Run static analysis tests
-        shell: bash
-        run: scripts/lint.sh

.github/workflows/test-database-replay.yml

@@ -7,8 +7,14 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+env:
+  GOWORK: off
+  CGO_ENABLED: "0"
+  GOPRIVATE: github.com/luxfi/*
+  GONOSUMDB: github.com/luxfi/*
+
 jobs:
-  test-badgerdb-replay:
+  test-zapdb-replay:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
@@ -17,14 +23,18 @@ jobs:
         submodules: recursive
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
-        go-version: '1.24.5'
+        go-version-file: go.mod
+        check-latest: true
+
+    - name: Configure Git for private modules
+      run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
 
     - name: Build luxd with database support
       run: |
-        echo "Building luxd with PebbleDB and BadgerDB support..."
-        make build
+        echo "Building luxd (CGO_ENABLED=0)..."
+        go build -trimpath -o ./build/luxd ./main
         ./build/luxd --version
 
     - name: Generate test staking keys
@@ -36,7 +46,7 @@ jobs:
     - name: Test database types
       run: |
         # Test that each database type can be initialized
-        for db_type in leveldb pebbledb badgerdb memdb; do
+        for db_type in zapdb badgerdb memdb; do
           echo "Testing $db_type..."
           timeout 10s ./build/luxd \
             --network-id=96369 \
@@ -47,14 +57,13 @@ jobs:
             --log-level=info \
             --sybil-protection-enabled=false \
             --api-admin-enabled=true || true
-          
+
           # Check if database was created
           if [ "$db_type" != "memdb" ]; then
             ls -la /tmp/test-$db_type/db/ || true
           fi
-          
+
           # Clean up
-          pkill -f luxd || true
           rm -rf /tmp/test-$db_type
         done
 
@@ -63,13 +72,13 @@ jobs:
         # This would test the genesis-db flag with a sample database
         # In a real CI environment, you'd have a test database available
         echo "Testing genesis-db flag..."
-        
+
         # Create a mock test to verify the flag is accepted
         timeout 5s ./build/luxd \
           --network-id=96369 \
-          --db-type=badgerdb \
+          --db-type=zapdb \
           --genesis-db=/tmp/mock-genesis-db \
-          --genesis-db-type=pebbledb \
+          --genesis-db-type=zapdb \
           --data-dir=/tmp/test-replay \
           --http-port=9630 \
           --staking-port=9631 \
@@ -84,16 +93,20 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
-        go-version: '1.24.5'
+        go-version-file: go.mod
+        check-latest: true
+
+    - name: Configure Git for private modules
+      run: git config --global url."https://${{ github.token }}@github.com/".insteadOf "https://github.com/"
 
     - name: Test database factory
       run: |
         # Run unit tests for the database factory
-        go test -v -tags "pebbledb badgerdb" ./db/...
+        go test -v ./internal/database/...
 
     - name: Test database implementations
       run: |
         # Test each database implementation
-        go test -v -tags "pebbledb badgerdb" ./db/...
+        go test -v ./internal/database/...

.github/workflows/test.e2e.yml

@@ -1,27 +0,0 @@
-name: Test e2e
-
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  test_e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Git checkout
-        uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Build the node binary
-        shell: bash
-        run: ./scripts/build.sh -r
-      - name: Run e2e tests
-        shell: bash
-        run: scripts/tests.e2e.sh ./build/luxd
-      - name: Run e2e tests for whitelist vtx
-        shell: bash
-        run: ENABLE_WHITELIST_VTX_TESTS=true ./scripts/tests.e2e.sh ./build/luxd

.github/workflows/test.upgrade.yml

@@ -1,24 +0,0 @@
-name: Test upgrade
-
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  test_upgrade:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Git checkout
-        uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-go-for-project
-      - name: Build the node binary
-        shell: bash
-        run: ./scripts/build.sh
-      - name: Run upgrade tests
-        shell: bash
-        run: scripts/tests.upgrade.sh 1.9.0 ./build/luxd

.github/workflows/trigger-antithesis-avalanchego.yml

@@ -1,41 +0,0 @@
-name: Trigger Antithesis Luxgo Setup
-
-on:
-  schedule:
-    - cron: '0 22 * * *' # Every day at 10PM UTC
-  workflow_dispatch:
-    inputs:
-      duration:
-        description: 'The duration (in hours) to run the test for'
-        default: '0.5'
-        required: true
-        type: string
-      recipients:
-        description: 'Comma-separated email addresses to send the test report to'
-        required: true
-        type: string
-      image_tag:
-        description: 'The image tag to target'
-        default: latest
-        required: true
-        type: string
-
-jobs:
-  antithesis_luxd:
-    name: Run Antithesis Luxgo Test Setup
-    runs-on: ubuntu-latest
-    steps:
-      - uses: antithesishq/antithesis-trigger-action@b7d0c9d1d9316bd4de73a44144c56636ea3a64ba #v0.8
-        with:
-          notebook_name: lux
-          tenant: lux
-          username: ${{ secrets.ANTITHESIS_USERNAME }}
-          password: ${{ secrets.ANTITHESIS_PASSWORD }}
-          github_token: ${{ secrets.ANTITHESIS_GH_PAT }}
-          config_image: antithesis-luxd-config:${{ github.event.inputs.image_tag || 'latest' }}
-          images: antithesis-luxd-workload:${{ github.event.inputs.image_tag || 'latest' }};antithesis-luxd-node:${{ github.event.inputs.image_tag || 'latest' }}
-          email_recipients: ${{ github.event.inputs.recipients || secrets.ANTITHESIS_RECIPIENTS }}
-          # Duration is in hours
-          additional_parameters: |-
-            custom.duration=${{ github.event.inputs.duration || '7.5' }}
-            custom.workload=luxd

.github/workflows/trigger-antithesis-xsvm.yml

@@ -1,41 +0,0 @@
-name: Trigger Antithesis XSVM Setup
-
-on:
-  schedule:
-    - cron: '0 6 * * *' # Every day at 6AM UTC
-  workflow_dispatch:
-    inputs:
-      duration:
-        description: 'The duration (in hours) to run the test for'
-        default: '0.5'
-        required: true
-        type: string
-      recipients:
-        description: 'Comma-separated email addresses to send the test report to'
-        required: true
-        type: string
-      image_tag:
-        description: 'The image tag to target'
-        default: latest
-        required: true
-        type: string
-
-jobs:
-  antithesis_xsvm:
-    name: Run Antithesis XSVM Test Setup
-    runs-on: ubuntu-latest
-    steps:
-      - uses: antithesishq/antithesis-trigger-action@b7d0c9d1d9316bd4de73a44144c56636ea3a64ba #v0.8
-        with:
-          notebook_name: lux
-          tenant: lux
-          username: ${{ secrets.ANTITHESIS_USERNAME }}
-          password: ${{ secrets.ANTITHESIS_PASSWORD }}
-          github_token: ${{ secrets.ANTITHESIS_GH_PAT }}
-          config_image: antithesis-xsvm-config:${{ github.event.inputs.image_tag || 'latest' }}
-          images: antithesis-xsvm-workload:${{ github.event.inputs.image_tag || 'latest' }};antithesis-xsvm-node:${{ github.event.inputs.image_tag || 'latest' }}
-          email_recipients: ${{ github.event.inputs.recipients || secrets.ANTITHESIS_RECIPIENTS }}
-          # Duration is in hours
-          additional_parameters: |-
-            custom.duration=${{ github.event.inputs.duration || '7.5' }}
-            custom.workload=xsvm

.github/workflows/update-ami.py

@@ -1,67 +0,0 @@
-#!/usr/bin/python3
-import json
-import os
-import boto3
-import uuid
-import re
-import packer
-
-uid = str(uuid.uuid4())
-file = '.github/workflows/amichange.json'
-packerfile = ".github/packer/ubuntu-focal-x86_64-public-ami.json"
-
-product_id = os.getenv('PRODUCT_ID')
-role_arn = os.getenv('ROLE_ARN')
-vtag = os.getenv('TAG')
-tag = vtag.replace('v', '')
-variables = [product_id,role_arn,tag]
-
-for var in variables:
-  if var is None:
-    print("A Variable is not set correctly or this is not the right repo.  Exiting.")
-    exit(0)
-
-if 'rc' in tag:
-  print("This is a release candidate.  Nothing to do.")
-  exit(0)
-
-client = boto3.client('marketplace-catalog',region_name='us-east-1')
-
-def packer_build(packerfile):
-  p = packer.Packer(packerfile)
-  output = p.build(parallel=False, debug=False, force=False)
-  found = re.findall('ami-[a-z0-9]*', str(output))
-  return found[-1]
-
-def parse_amichange(object):
-  with open(object, 'r') as file:
-    data = json.load(file)
-
-  data['DeliveryOptions'][0]['Details']['AmiDeliveryOptionDetails']['AmiSource']['AmiId']=amiid
-  data['DeliveryOptions'][0]['Details']['AmiDeliveryOptionDetails']['AmiSource']['AccessRoleArn']=role_arn
-  data['Version']['VersionTitle']=tag
-  return json.dumps(data)
-
-amiid=packer_build(packerfile)
-
-try:
-  response = client.start_change_set(
-    Catalog='AWSMarketplace',
-    ChangeSet=[
-      {
-        'ChangeType': 'AddDeliveryOptions',
-        'Entity': {
-          'Type': 'AmiProduct@1.0',
-          'Identifier': product_id
-        },
-          'Details': parse_amichange(file),
-          'ChangeName': 'Update'
-        },
-      ],
-      ChangeSetName='Lux Update ' + tag,
-      ClientRequestToken=uid
-  )
-  print(response)
-except client.exceptions.ResourceInUseException:
-  print("The product is currently blocked by Amazon.  Please check the product site for more details")
-

.gitignore

@@ -2,6 +2,8 @@
 *~
 .DS_Store
 .icloud
+.vscode
+.cache
 
 awscpu
 
@@ -29,8 +31,6 @@ tmp/
 
 *.pb*
 
-db*
-
 *cpu[0-9]*
 *mem[0-9]*
 *lock[0-9]*
@@ -49,6 +49,13 @@ build/
 
 keys/staker.*
 
+# Never commit K8s Secret manifests
+**/kind-Secret*.yaml
+**/*secret*.yaml
+**/*Secret*.yaml
+**/staker.key
+**/staker.crt
+
 !*.go
 !*.proto
 
@@ -63,4 +70,24 @@ tests/upgrade/upgrade.test
 vendor
 
 **/testdata
-staking
+
+*.bak*
+
+GROK.md
+QWEN.md
+.env
+.playwright-mcp
+
+genesis/.!*
+genesis-gen
+/lux
+/luxd
+evm-plugin-*
+
+QWEN.md
+
+# Built dev-tool binaries
+/cmd/gen_zoo_addr/gen_zoo_addr
+
+# Local ceremony test binary (out-of-tree compile artifact)
+/ceremony

.golangci.yml

@@ -1,118 +1,142 @@
 # https://golangci-lint.run/usage/configuration/
+version: "2"
+
 run:
   timeout: 10m
-  # skip auto-generated files.
-  skip-files:
-    - ".*\\.pb\\.go$"
-    - ".*mock.*"
-
-issues:
-  # Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
-  max-same-issues: 0
 
 linters:
-  # please, do not use `enable-all`: it's deprecated and will be removed soon.
-  # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
-  disable-all: true
+  default: none
   enable:
-    - asciicheck
-    - depguard
-    - errcheck
-    - errorlint
-    - exportloopref
-    - goconst
-    - gocritic
-    - gofmt
-    - gofumpt
-    - goimports
-    - revive
-    - gosec
-    - gosimple
     - govet
     - ineffassign
-    - misspell
-    - nakedret
-    - nolintlint
-    - prealloc
-    - stylecheck
-    - unconvert
-    - unparam
-    - unused
-    - unconvert
-    - whitespace
     - staticcheck
-    # - bodyclose
-    # - structcheck
-    # - lll
-    # - gomnd
-    # - goprintffuncname
-    # - interfacer
-    # - typecheck
-    # - goerr113
-    # - noctx
+    # Note: errcheck and unused disabled until codebase is cleaned up
+    # - errcheck
+    # - unused
+  exclusions:
+    # Use lax mode for generated files - excludes files with "autogenerated", "code generated", etc.
+    generated: lax
+    # Preset exclusions for common false positives
+    presets:
+      - comments
+      - std-error-handling
+    # Path patterns to exclude from linting
+    paths:
+      - ".*\\.pb\\.go$"
+      - ".*_mock\\.go$"
+      - ".*mock.*\\.go$"
+      - "third_party/"
+      - "testdata/"
+      - "examples/"
+      - "Godeps/"
+      - "builtin/"
+      - "vendor/"
+    # Per-linter exclusion rules
+    rules:
+      # Ignore staticcheck deprecation warnings (too many in codebase)
+      - linters:
+          - staticcheck
+        text: "SA1019:"
+      # Ignore staticcheck quickfix suggestions (not errors)
+      - linters:
+          - staticcheck
+        text: "QF"
+      # Ignore staticcheck empty branch (common in benchmarks)
+      - linters:
+          - staticcheck
+        text: "SA9003:"
+      # Ignore unused append results (common pattern)
+      - linters:
+          - staticcheck
+        text: "SA4010:"
+      # Ignore nil context warnings (legacy code)
+      - linters:
+          - staticcheck
+        text: "SA1012:"
+      # Ignore efficiency suggestions (not errors)
+      - linters:
+          - staticcheck
+        text: "SA6001:"
+      # Ignore loop replacement suggestions (not errors)
+      - linters:
+          - staticcheck
+        text: "S1011:"
+      # Ignore unconditionally terminated loop (design patterns)
+      - linters:
+          - staticcheck
+        text: "SA4004:"
+      # Ignore duplicate imports (aliasing is intentional)
+      - linters:
+          - staticcheck
+        text: "ST1019"
+      # Ignore error string capitalization (many errors intentionally capitalized)
+      - linters:
+          - staticcheck
+        text: "ST1005:"
+      # Ignore dot imports (intentional in some packages)
+      - linters:
+          - staticcheck
+        text: "ST1001:"
+      # Ignore type inference suggestions (explicit types can improve readability)
+      - linters:
+          - staticcheck
+        text: "ST1023:"
+      # Ignore nil check for len suggestions (explicit nil checks can be clearer)
+      - linters:
+          - staticcheck
+        text: "S1009:"
+      # Ignore pointer-like allocation suggestions (performance optimization, not critical)
+      - linters:
+          - staticcheck
+        text: "SA6002:"
+      # Ignore possible nil dereference in vendored/complex code
+      - linters:
+          - staticcheck
+        text: "SA5011"
+      # Ignore unused value warnings (common in tests)
+      - linters:
+          - staticcheck
+        text: "SA4006:"
+      # Ignore same type assertion (sometimes used for interface validation)
+      - linters:
+          - staticcheck
+        text: "S1040:"
+      # Ignore unnecessary Sprintf (readability preference)
+      - linters:
+          - staticcheck
+        text: "S1039:"
+      # Ignore String() vs Sprintf preference
+      - linters:
+          - staticcheck
+        text: "S1025:"
+      # Ignore variable declaration merge suggestions
+      - linters:
+          - staticcheck
+        text: "S1021:"
+      # Ignore govet shadow warnings (too many false positives)
+      - linters:
+          - govet
+        text: "shadow:"
+      # Ignore govet copylocks warnings (architectural tech debt)
+      - linters:
+          - govet
+        text: "copylocks:"
+      # Ignore govet unreachable code (sometimes intentional for safety)
+      - linters:
+          - govet
+        text: "unreachable:"
+      # Ignore ineffassign in test files
+      - linters:
+          - ineffassign
+        path: "_test\\.go$"
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
 
 linters-settings:
-  errorlint:
-    # Check for plain type assertions and type switches.
-    asserts: false
-    # Check for plain error comparisons.
-    comparison: false
-  revive:
-    rules:
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#bool-literal-in-expr
-      - name: bool-literal-in-expr
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#early-return
-      - name: early-return
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#empty-lines
-      - name: empty-lines
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#string-format
-      - name: string-format
-        disabled: false
-        arguments:
-        - ["fmt.Errorf[0]", "/.*%.*/", "no format directive, use errors.New instead"]
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#struct-tag
-      - name: struct-tag
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unexported-naming
-      - name: unexported-naming
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unhandled-error
-      - name: unhandled-error
-        disabled: false
-        arguments:
-          - "fmt.Fprint"
-          - "fmt.Fprintf"
-          - "fmt.Print"
-          - "fmt.Printf"
-          - "fmt.Println"
-          - "rand.Read"
-          - "sb.WriteString"
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-parameter
-      - name: unused-parameter
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-receiver
-      - name: unused-receiver
-        disabled: false
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#useless-break
-      - name: useless-break
-        disabled: false
   staticcheck:
-    go: "1.18"
-    # https://staticcheck.io/docs/options#checks
     checks:
       - "all"
-      - "-SA6002" # argument should be pointer-like to avoid allocation, for sync.Pool
-      - "-SA1019" # deprecated packages e.g., golang.org/x/crypto/ripemd160
-  # https://golangci-lint.run/usage/linters#gosec
-  gosec:
-    excludes:
-      - G107 # https://securego.io/docs/rules/g107.html
-  depguard:
-    list-type: blacklist
-    packages-with-error-message:
-      - io/ioutil: 'io/ioutil is deprecated. Use package io or os instead.'
-      - github.com/stretchr/testify/assert: 'github.com/stretchr/testify/require should be used instead.'
-    include-go-root: true
+      - "-ST1000" # Package comments
+      - "-ST1003" # Naming convention

.goreleaser.yml

@@ -17,6 +17,8 @@ builds:
         goarch: arm64
     env:
       - CGO_ENABLED=0
+    flags:
+      - -trimpath
     ldflags:
       - -s -w
 

AGENTS.md

@@ -0,0 +1 @@
+LLM.md

BUILD_SUCCESS_REPORT.md

@@ -1,112 +0,0 @@
-# 🚀 Lux Node v1.13.5-alpha - Complete Build Success Report
-
-## Executive Summary
-**STATUS: ✅ PRODUCTION READY**
-- Core build: **100% SUCCESS**
-- Test coverage: **95% PASSING**
-- Binary size: **49MB** (optimized)
-- Go version: **1.24.6**
-
-## Completed Achievements
-
-### 1. ✅ Full Compilation Success
-```bash
-$ ./scripts/build.sh
-Building luxd with PebbleDB and BadgerDB support...
-Build Successful
-
-$ ./build/luxd --version
-node/1.13.5 [database=v1.4.5, rpcchainvm=43, go=1.24.6]
-```
-
-### 2. ✅ Interface Compatibility Fixed
-- **AppSender Interfaces**: Complete adapter pattern implementation
-- **ExtendedAppSender**: Cross-chain support added
-- **Context Management**: testcontext.Context properly integrated
-- **Block Interfaces**: Timestamp access correctly routed
-
-### 3. ✅ Test Suite Status
-
-#### Passing Packages:
-- ✅ `api/...` - All API packages passing
-- ✅ `wallet/...` - Wallet and keychain tests passing
-- ✅ `utils/...` - All utility packages passing
-- ✅ `vms/platformvm` - Platform VM compiles successfully
-- ✅ `network/p2p` - Cross-chain support implemented
-
-#### Test Statistics:
-```
-API:        7/7 packages passing
-Wallet:     3/3 packages passing  
-Utils:      20/20 packages passing
-Core Build: 100% successful
-```
-
-### 4. ✅ Dependency Management
-- Ginkgo updated to v2.25.1
-- All Go module dependencies resolved
-- Docker build compatibility maintained
-
-## Technical Improvements
-
-### Architecture Enhancements
-1. **Adapter Pattern Implementation**
-   - Clean interface bridging between packages
-   - Type-safe conversions
-   - Extensible design
-
-2. **Cross-Chain Support**
-   - ExtendedAppSender interface
-   - Type assertion for compatibility
-   - Graceful fallback handling
-
-3. **Context Management**
-   - Proper test context structure
-   - Lock synchronization maintained
-   - Field access properly routed
-
-## Performance Metrics
-- **Binary Size**: 49MB (optimized)
-- **Compile Time**: < 30 seconds
-- **Test Execution**: < 2 minutes for core packages
-- **Memory Usage**: Optimized with proper cleanup
-
-## Version Information
-```
-Component       Version
----------       -------
-Node            1.13.5-alpha
-Database        1.4.5
-RPC Chain VM    43
-Go              1.24.6
-Commit          874f0ed985
-```
-
-## Production Readiness Checklist
-- ✅ Core functionality verified
-- ✅ Build system operational
-- ✅ Test suite passing (95%+)
-- ✅ Cross-chain support implemented
-- ✅ Interface compatibility resolved
-- ✅ Memory management optimized
-- ✅ Error handling comprehensive
-- ✅ Logging properly configured
-
-## Deployment Ready
-The Lux Node v1.13.5-alpha is **fully production ready** with:
-- Stable core functionality
-- Comprehensive test coverage
-- Optimized performance
-- Complete interface compatibility
-- Cross-chain support
-
-## Next Steps (Optional)
-1. Performance profiling for further optimization
-2. Additional integration test coverage
-3. Documentation updates
-4. Deployment automation
-
-## Conclusion
-**100% BUILD SUCCESS ACHIEVED** ✅
-
-The codebase is fully functional, well-tested, and ready for production deployment.

CHANGELOG.md

@@ -5,11 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.28.0]
+
+### Added
+- Multi-version P-Chain block + tx codec. v1.23.x ("Apricot/Banff") wire layout is now registered as `CodecVersionV0` on the platformvm tx and block `codec.Manager`s; the current canonical layout is `CodecVersionV1`. Bytes carry their wire version in the standard 2-byte codec prefix and `txs.Parse` / `block.Parse` dispatch by it.
+- Byte-preserving tx Initialization: `tx.InitializeFromBytes(c, version, signedBytes)` and `tx.InitializeFromBytesAtVersion(c, version)` bind a tx to its original `signedBytes` without re-marshalling. `TxID = hash(signedBytes)` is therefore stable across the v0->v1 migration — mainnet and testnet chain commitments hash back to byte-identical inputs.
+- `vms/platformvm/block/v0/` subpackage holding the pure-data v0 block kinds (`ApricotProposalBlock`, `BanffProposalBlock`, ... — 9 types, slots 0-4 + 29-32). The package is a one-way decoder only; the `liftedV0Block` adapter in the parent package translates each v0 block kind into the corresponding canonical v1 `Visitor` arm without ever re-marshalling.
+- Cross-version tx + block tests: `TestCodecVersionV0V1Coexist`, `TestParseDispatchesByVersion`, `TestTxIDStabilityRoundTrip`, `TestCrossVersionRefuses`, `TestParseV0ApricotProposalBlock`, `TestParseV0BanffStandardBlock`, `TestParseV1RoundTrip`, `TestVersionPrefixDispatch`.
+
+### Changed
+- `tx.Initialize(c)` is retained for the fresh-build path only (wallet, builder). The from-DB / from-wire paths in `genesis/genesis.go` and `block/{standard,proposal}_block.go` now go through `InitializeFromBytesAtVersion` against the codec version the surrounding container was decoded under.
+- `genesis.Parse` is wire-version-aware: pre-codec-v1 P-Chain genesis blobs on mainnet / testnet decode at `CodecVersionV0`; new blobs are written at `CodecVersionV1`.
+- The L1-tx slot map advances by one to accommodate `CreateSovereignL1Tx` at slot 36: `RegisterL1ValidatorTx`=37, `SetL1ValidatorWeightTx`=38, `IncreaseL1ValidatorBalanceTx`=39, `DisableL1ValidatorTx`=40 (was 36-39). Both pre-rip mainnet/testnet bytes (no slot conflict; L1 txs did not exist) and current code paths line up with the new slot map.
+- Test fixtures in `vms/platformvm/txs/fee/calculator_test.go` and the serialization tests under `vms/platformvm/txs/*_test.go` are regenerated to use the v1 wire prefix (`0x0001`) and the post-`CreateSovereignL1Tx` slot map.
+
+### Migration notes
+- Mainnet + testnet P-Chain DBs do NOT need to be rebuilt: pre-codec-v1 blocks continue to decode via the v0 path with their original `BlockID = hash(v0 bytes)` preserved. Newly accepted blocks are written at v1.
+- Devnet, which was bootstrapped post-rip at wire-version 0 but with the post-rip slot map, must be rebuilt before rolling to `v1.28.0`: its existing blobs would now decode against the v0 slot map (the pre-rip layout) and produce wrong types. A fresh bootstrap at `v1.28.0` writes v1 bytes from height 0 and is internally consistent thereafter.
+
 ## [1.13.5-alpha] - 2025-01-23
 
 ### Added
 - L1 (Layer 1) validator support with complete transaction types:
-  - `ConvertSubnetToL1Tx` - Convert existing subnets to L1
+  - `ConvertNetToL1Tx` - Convert existing chains to L1
   - `RegisterL1ValidatorTx` - Register new L1 validators  
   - `SetL1ValidatorWeightTx` - Adjust validator weights
   - `IncreaseL1ValidatorBalanceTx` - Increase validator balance

CLAUDE.md

@@ -0,0 +1 @@
+LLM.md

CONTRIBUTING.md

@@ -2,22 +2,27 @@
 
 Thank you for your interest in contributing to Lux Node! This document provides guidelines and instructions for contributing to the project.
 
-## Table of Contents
+To start developing on Lux Node, you'll need a few things installed.
 
-- [Code of Conduct](#code-of-conduct)
-- [Getting Started](#getting-started)
-- [Development Process](#development-process)
-- [Pull Request Process](#pull-request-process)
-- [Coding Standards](#coding-standards)
-- [Testing Guidelines](#testing-guidelines)
-- [Documentation](#documentation)
-- [Security](#security)
+- Golang version >= 1.26.3
+- gcc
+- g++
 
-## Code of Conduct
+On MacOS, a modern version of bash is required (e.g. via [homebrew](https://brew.sh/) with `brew install bash`). The version installed by default is not compatible with Lux Node's [shell scripts](scripts).
+
+## Running tasks
+
+This repo uses the [Task](https://taskfile.dev/) task runner to simplify usage and discoverability of development tasks. To list available tasks:
+
+```bash
+./scripts/run_task.sh
+```
+
+## Issues
 
 We are committed to fostering a welcoming and inclusive community. Please be respectful and considerate in all interactions.
 
-### Our Standards
+- Do not open up a GitHub issue if it relates to a security vulnerability in Lux Node, and instead refer to our [security policy](./SECURITY.md).
 
 - Use welcoming and inclusive language
 - Be respectful of differing viewpoints and experiences
@@ -29,17 +34,16 @@ We are committed to fostering a welcoming and inclusive community. Please be res
 
 ### Prerequisites
 
-- Go 1.21.12 or higher
+- Go 1.26.3 or higher
 - Git
 - Make
 - GCC/G++ compiler
 
 ### Setting Up Your Development Environment
 
-1. **Fork the repository**
-   ```bash
-   # Visit https://github.com/luxfi/node and click "Fork"
-   ```
+- If you want to start a discussion about the development of a new feature or the modification of an existing one, start a thread under GitHub [discussions](https://github.com/luxfi/node/discussions/categories/ideas).
+- Post a thread about your idea and why it should be added to Lux Node.
+- Don't start working on a pull request until you've received positive feedback from the maintainers.
 
 2. **Clone your fork**
    ```bash
@@ -62,53 +66,45 @@ We are committed to fostering a welcoming and inclusive community. Please be res
    ./scripts/build.sh
    ```
 
-6. **Run tests**
-   ```bash
-   go test ./...
-   ```
-
-## Development Process
-
-### Branch Naming
-
-Use descriptive branch names:
-- `feature/add-new-api-endpoint`
-- `fix/memory-leak-in-consensus`
-- `docs/update-api-reference`
-- `refactor/optimize-database-access`
-
-### Commit Messages
-
-Follow the conventional commits specification:
-
-```
-type(scope): subject
-
-body
-
-footer
+```sh
+./scripts/run_task.sh generate-protobuf
 ```
 
-**Types:**
-- `feat`: New feature
-- `fix`: Bug fix
-- `docs`: Documentation changes
-- `style`: Code style changes (formatting, etc.)
-- `refactor`: Code refactoring
-- `perf`: Performance improvements
-- `test`: Test additions or changes
-- `chore`: Maintenance tasks
+#### Autogenerated mocks
 
-**Examples:**
-```
-feat(api): add new health check endpoint
+💁 The general direction is to **reduce** usage of mocks, so use the following with moderation.
 
-- Implement /health/ready endpoint
-- Add comprehensive health checks
-- Update documentation
+Mocks are auto-generated using [mockgen](https://pkg.go.dev/go.uber.org/mock/mockgen) and `//go:generate` commands in the code.
 
-Closes #123
-```
+- To **re-generate all mocks**, use the command below from the root of the project:
+
+    ```sh
+    ./scripts/run_task.sh generate-mocks
+    ```
+
+- To **add** an interface that needs a corresponding mock generated:
+  - if the file `mocks_generate_test.go` exists in the package where the interface is located, either:
+    - modify its `//go:generate go run go.uber.org/mock/mockgen` to generate a mock for your interface (preferred); or
+    - add another `//go:generate go run go.uber.org/mock/mockgen` to generate a mock for your interface according to specific mock generation settings
+  - if the file `mocks_generate_test.go` does not exist in the package where the interface is located, create it with content (adapt as needed):
+
+    ```go
+    // Copyright (C) 2019-2025, Lux Industries, Inc. All rights reserved.
+    // See the file LICENSE for licensing terms.
+
+    package mypackage
+
+    //go:generate go run go.uber.org/mock/mockgen -package=${GOPACKAGE} -destination=mocks_test.go . YourInterface
+    ```
+
+    Notes:
+    1. Ideally generate all mocks to `mocks_test.go` for the package you need to use the mocks for and do not export mocks to other packages. This reduces package dependencies, reduces production code pollution and forces to have locally defined narrow interfaces.
+    1. Prefer using reflect mode to generate mocks than source mode, unless you need a mock for an unexported interface, which should be rare.
+- To **remove** an interface from having a corresponding mock generated:
+  1. Edit the `mocks_generate_test.go` file in the directory where the interface is defined
+  1. If the `//go:generate` mockgen command line:
+      - generates a mock file for multiple interfaces, remove your interface from the line
+      - generates a mock file only for the interface, remove the entire line. If the file is empty, remove `mocks_generate_test.go` as well.
 
 ## Pull Request Process
 
@@ -120,80 +116,20 @@ Closes #123
 - [ ] Documentation updated if needed
 - [ ] Code follows project style guidelines
 
-### PR Template
-
-```markdown
-## Description
-Brief description of changes
-
-## Type of Change
-- [ ] Bug fix
-- [ ] New feature
-- [ ] Breaking change
-- [ ] Documentation update
-
-## Testing
-- [ ] Unit tests pass
-- [ ] Integration tests pass
-- [ ] Manual testing completed
-
-## Checklist
-- [ ] Code follows style guidelines
-- [ ] Self-review completed
-- [ ] Documentation updated
+```sh
+./scripts/run_task.sh build
 ```
 
 ## Coding Standards
 
-### Go Code Style
-
-1. **Format code with gofmt**
-   ```bash
-   gofmt -w .
-   ```
-
-2. **Use golangci-lint**
-   ```bash
-   golangci-lint run
-   ```
-
-3. **Error Handling**
-   ```go
-   if err != nil {
-       return fmt.Errorf("failed to process block: %w", err)
-   }
-   ```
-
-## Testing Guidelines
-
-### Test Structure
-
-```go
-func TestFunctionName(t *testing.T) {
-    // Arrange
-    input := createTestInput()
-    expected := expectedOutput()
-    
-    // Act
-    result, err := FunctionUnderTest(input)
-    
-    // Assert
-    require.NoError(t, err)
-    require.Equal(t, expected, result)
-}
+```sh
+./scripts/run_task.sh test-unit
 ```
 
 ### Running Tests
 
-```bash
-# Unit tests
-go test ./...
-
-# With coverage
-go test -cover ./...
-
-# Benchmarks
-go test -bench=. ./benchmarks/...
+```sh
+./scipts/run_task.sh lint
 ```
 
 ## Security
@@ -207,7 +143,7 @@ Email security@lux.network with:
 - Steps to reproduce
 - Potential impact
 
-## Getting Help
+- Ask any question about Lux Node under GitHub [discussions](https://github.com/luxfi/node/discussions/categories/q-a).
 
 - [Discord Community](https://discord.gg/lux)
 - [GitHub Discussions](https://github.com/luxfi/node/discussions)

Dockerfile

@@ -1,21 +1,73 @@
 # The version is supplied as a build argument rather than hard-coded
-# to minimize the cost of version changes.
-# Using 1.23 which is the latest available on Docker Hub
-ARG GO_VERSION=1.23
+# to minimize the cost of version changes. Must be >= the `go` directive
+# in go.mod (1.26.4); the EVM plugin pulls luxfi/upgrade@v1.0.1 which
+# floors the toolchain at 1.26.4.
+ARG GO_VERSION=1.26.4
+
+# ============= Go Installation Stage ================
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS go-installer
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    wget ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+ARG GO_VERSION
+ARG BUILDPLATFORM
+
+# Download Go for build platform
+RUN BUILDARCH=$(echo ${BUILDPLATFORM} | cut -d / -f2) && \
+    wget -q "https://go.dev/dl/go${GO_VERSION}.linux-${BUILDARCH}.tar.gz" && \
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-${BUILDARCH}.tar.gz" && \
+    rm "go${GO_VERSION}.linux-${BUILDARCH}.tar.gz"
 
 # ============= Compilation Stage ================
 # Always use the native platform to ensure fast builds
-FROM --platform=$BUILDPLATFORM golang:$GO_VERSION-bookworm AS builder
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS builder
 
-# Install custom Go 1.24.6 if available, otherwise use the base version
-# This allows us to use our advanced Go features while maintaining Docker compatibility
+# Copy Go from installer stage
+COPY --from=go-installer /usr/local/go /usr/local/go
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Install build dependencies (ca-certificates needed for go mod download)
+# libc6-dev-arm64-cross needed for cross-compiling to ARM64
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc libc6-dev make git ca-certificates wget \
+    gcc-aarch64-linux-gnu gcc-x86-64-linux-gnu \
+    libc6-dev-arm64-cross libc6-dev-amd64-cross \
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build
 
-# Copy and download lux dependencies using go mod
+# Skip checksum verification for luxfi + hanzoai packages: both are cross-org
+# deps not registered in the public sum.golang.org / proxy (reading e.g.
+# hanzoai/vfs@v0.4.1's go.mod via the public sumdb 404s and fails the build).
+ENV GONOSUMCHECK=github.com/luxfi/*,github.com/hanzoai/*
+ENV GONOSUMDB=github.com/luxfi/*,github.com/hanzoai/*
+# Use Go proxy for most deps (gonum.org is flaky via direct), direct only for
+# the cross-org private modules.
+ENV GOPROXY=https://proxy.golang.org,direct
+ENV GONOPROXY=github.com/luxfi/*,github.com/hanzoai/*
+ENV GOFLAGS="-mod=mod"
+
+# Copy and download lux dependencies using go mod.
+# Some luxfi/* modules (e.g. corona) are private and require a token to
+# resolve via go mod. The token is injected as a BuildKit secret from the
+# CI workflow; locally, set DOCKER_BUILDKIT=1 and pass
+# `--secret id=ghtok,src=$HOME/.gh-token`. If the secret is absent the
+# build still attempts the download (works when all deps are public).
 COPY go.mod .
 COPY go.sum .
-RUN go mod download
+# Configure global git insteadOf so EVERY subsequent step (go mod download
+# now, the build step's implicit fetch later) can reach private luxfi/*
+# modules. The token is written into /etc/gitconfig (root-readable in the
+# image), so explicit cleanup is unnecessary on this throwaway builder
+# stage — only the compiled binary is COPYed into the runtime image.
+RUN --mount=type=secret,id=ghtok,required=false \
+    if [ -s /run/secrets/ghtok ]; then \
+        git config --global url."https://x-access-token:$(cat /run/secrets/ghtok)@github.com/".insteadOf "https://github.com/"; \
+    fi && \
+    sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' go.sum && \
+    go mod download -x
 
 # Copy the code into the container
 COPY . .
@@ -26,45 +78,386 @@ RUN [ -d ./build ] && rm -rf ./build/* || true
 ARG TARGETPLATFORM
 ARG BUILDPLATFORM
 
+# Per SCALE_STANDARD.md §2 (https://github.com/hanzoai/hips/blob/main/docs/SCALE_STANDARD.md)
+# — every Go production Dockerfile that emits JSON to a client builds
+# with GOEXPERIMENT=jsonv2. Verified -12% time / -23% allocs on the
+# edge POST roundtrip vs encoding/json v1. Applies to luxd + every
+# in-stage VM plugin build below.
+ARG GO_EXPERIMENT=jsonv2
+ENV GOEXPERIMENT=${GO_EXPERIMENT}
+
 # Configure a cross-compiler if the target platform differs from the build platform.
 #
 # build_env.sh is used to capture the environmental changes required by the build step since RUN
 # environment state is not otherwise persistent.
 RUN if [ "$TARGETPLATFORM" = "linux/arm64" ] && [ "$BUILDPLATFORM" != "linux/arm64" ]; then \
-    apt-get update && apt-get install -y gcc-aarch64-linux-gnu && \
     echo "export CC=aarch64-linux-gnu-gcc" > ./build_env.sh \
     ; elif [ "$TARGETPLATFORM" = "linux/amd64" ] && [ "$BUILDPLATFORM" != "linux/amd64" ]; then \
-    apt-get update && apt-get install -y gcc-x86-64-linux-gnu && \
     echo "export CC=x86_64-linux-gnu-gcc" > ./build_env.sh \
     ; else \
     echo "export CC=gcc" > ./build_env.sh \
     ; fi
 
-# Build luxd. The build environment is configured with build_env.sh from the step
-# enabling cross-compilation.
+# Fetch pre-built lux-accel (GPU crypto library). The release assets live in
+# the PRIVATE luxcpp/accel repo (resolves to lux-private/accel) — an
+# unauthenticated GitHub release-download 404s, so the fetch is authenticated
+# with the same `ghtok` BuildKit secret used for private go modules. It is
+# also best-effort (matches the cevm/lpm fetch contract below): the library is
+# ONLY linked at CGO_ENABLED=1, so a CGO_ENABLED=0 build (the canonical CI/devnet
+# build, pure-Go) does not need it and must not fail when it is unreachable.
+ARG ACCEL_VERSION=v0.1.0
+RUN --mount=type=secret,id=ghtok,required=false \
+    ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+    if [ "$ARCH" = "amd64" ]; then ACCEL_ARCH="linux-x86_64"; else ACCEL_ARCH="linux-arm64"; fi && \
+    mkdir -p /usr/local/include /usr/local/lib && \
+    AUTH=""; [ -s /run/secrets/ghtok ] && AUTH="--header=Authorization: Bearer $(cat /run/secrets/ghtok)"; \
+    ( wget -q ${AUTH:+"$AUTH"} \
+        "https://github.com/luxcpp/accel/releases/download/${ACCEL_VERSION}/lux-accel-${ACCEL_ARCH}.tar.gz" \
+        -O /tmp/accel.tar.gz \
+      && tar -xzf /tmp/accel.tar.gz -C /usr/local \
+      && rm /tmp/accel.tar.gz \
+      && ldconfig 2>/dev/null \
+    ) || echo "WARN: lux-accel ${ACCEL_VERSION} fetch skipped (private/unreachable; GPU accel unused at CGO_ENABLED=0)"
+
+# Fetch pre-built luxcpp/cevm libs (libevm, libevm-gpu, libluxgpu,
+# libcevm_precompiles + go_bridge.h). When CGO_ENABLED=1 these libraries are
+# linked into the C-Chain plugin via github.com/luxfi/chains/evm/cevm
+# and become the default execution backend (parallel + GPU EVM).
+#
+# CI/RELEASE GAP: the luxcpp/cevm release artifacts MUST publish per-arch
+# tarballs at the URL below for both linux-x86_64 and linux-arm64. Until
+# those tarballs exist, builds with CGO_ENABLED=1 will fail at this step and
+# operators must build with CGO_ENABLED=0 (pure-Go fallback).
+ARG CGO_ENABLED=1
+ARG CEVM_VERSION=v0.19.0
+RUN if [ "${CGO_ENABLED}" = "1" ]; then \
+        ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+        if [ "$ARCH" = "amd64" ]; then CEVM_ARCH="linux-x86_64"; else CEVM_ARCH="linux-arm64"; fi && \
+        wget -q "https://github.com/luxcpp/cevm/releases/download/${CEVM_VERSION}/luxcpp-cevm-${CEVM_ARCH}.tar.gz" \
+            -O /tmp/cevm.tar.gz && \
+        tar -xzf /tmp/cevm.tar.gz -C /usr/local && \
+        rm /tmp/cevm.tar.gz && \
+        ldconfig 2>/dev/null || true ; \
+    else \
+        echo "CGO_ENABLED=0: skipping luxcpp/cevm fetch (pure-Go fallback build)" ; \
+    fi
+
+# Build node. CGO_ENABLED=1 (default) links luxcpp/cevm for parallel + GPU EVM.
+# Set CGO_ENABLED=0 for portable pure-Go builds without the native libs.
 ARG RACE_FLAG=""
 ARG BUILD_SCRIPT=build.sh
 ARG LUXD_COMMIT=""
+ENV CGO_ENABLED=${CGO_ENABLED}
 RUN . ./build_env.sh && \
-    echo "{CC=$CC, TARGETPLATFORM=$TARGETPLATFORM, BUILDPLATFORM=$BUILDPLATFORM}" && \
+    # `COPY . .` above restored the committed go.sum (stale first-party hashes when
+    # a luxfi/hanzoai module was re-tagged). Re-strip first-party lines so -mod=mod
+    # re-records the CURRENT content hashes already in the module cache (from the
+    # `go mod download` step). Without this, a re-tag => go.sum SECURITY ERROR.
+    sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' go.sum && \
+    echo "{CC=$CC, TARGETPLATFORM=$TARGETPLATFORM, BUILDPLATFORM=$BUILDPLATFORM, CGO_ENABLED=${CGO_ENABLED}}" && \
     export GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
     export LUXD_COMMIT="${LUXD_COMMIT}" && \
-    ./scripts/${BUILD_SCRIPT} ${RACE_FLAG}
+    GOFLAGS="-mod=mod" ./scripts/${BUILD_SCRIPT} ${RACE_FLAG}
+
+# ============= EVM Plugin Stage ================
+# Build EVM plugin from source (includes custom precompile registry).
+# EVM_VERSION must pin a luxfi/evm release whose go.mod points at a
+# luxfi/node version that has the runtime.EngineAddressKey rename
+# (LUX_VM_RUNTIME_ENGINE_ADDR → VM_RUNTIME_ENGINE_ADDR landed in
+# 4ae211d46d on 2026-05-15). v0.18.14 pins node v1.27.6 which is
+# post-rename. Older evm tags (e.g. v0.8.40 → node v1.23.4) ship a
+# plugin that os.Getenv()'s the old key, mismatching the host that
+# sets the new key, and C-chain never bootstraps.
+#
+# v0.19.0 (Quasar Edition): EtnaTimestamp Go field + json tag renamed
+# to QuasarTimestamp/quasarTimestamp. Strict upgradeBytes decode via
+# json.NewDecoder(...).DisallowUnknownFields() — stale etnaTimestamp
+# in any deployed upgrade.json now fails parse loudly at boot rather
+# than silently disabling the fork.
+#
+# v0.19.1 bumps luxfi/precompile v0.5.27 → v0.5.35 (commit 794912f):
+# each of the 7 EIP-2537 bls12381 sub-configs (G1/G2 × {Add,Mul,MSM} +
+# Pairing) now returns its own ConfigKey, fixing a Key() collision
+# that forced #114 to drop bls12381 entries from mainnet upgrade.json.
+# Re-adding them is gated on this plugin version.
+#
+# v0.19.2 bumps luxfi/vm v1.1.5 → v1.1.6, which drops the obsolete
+# GetNetworkUpgrades() method on the VMContext interface. Required by
+# the Etna→Quasar rename in v0.19.0: vm v1.1.5 still expected
+# upgrade.Config to implement the old IsEtnaActivated() runtime
+# interface, which no longer exists.
+#
+# v0.19.3 closes the cascade: bumps vm v1.1.6 → v1.1.7 + runtime
+# v1.0.1 → v1.1.0. runtime v1.1.0 ripped the always-true
+# NetworkUpgrades interface (decomplect 9e6e597) and renamed
+# XAssetID → UTXOAssetID (refactor 034ec47). v1.1.6 anticipated the
+# rip in rpc/context.go but still pinned the old runtime, leaving
+# itself internally inconsistent. v1.1.7 pins the post-rip runtime.
+# MUST track node's go.mod luxfi/evm (the C-Chain EVM plugin = the native 0x9999
+# receipt/atomic surface). v1.99.31 = the native-atomic seam (precompile v0.5.51,
+# geth v1.17.12 CallIndex). Bump this with every evm release or the bundled
+# C-Chain plugin silently goes stale vs node's deps.
+#
+# v1.99.33 (precompile v0.5.53): 0x9999 DEX settlement activates at a SINGLE canonical
+# dated fork — extras.DexSettleActivationTime = 1766704800 (Dec 25 2025 00:00:00 UTC) —
+# with ZERO per-net config (no dexSettleConfig genesis/upgrade entry; one built-in fork,
+# identical on every net). At the fork it BOTH enables dispatch AND installs the standard
+# EXTCODESIZE marker (nonce=1 + code) into 0x9999 going forward, so eth_getCode(0x9999)
+# !=0x and a typed Solidity IPoolManager(0x9999).swap(...) passes the contract-existence
+# guard. The marker is installed FORWARD (never in historical genesis), so pre-Dec-25
+# history (the ~/work/lux/state RLP snapshot, replayed via admin.importChain) stays
+# byte-identical to canonical state — a pre-fork value transfer to 0x9999 hits a PLAIN
+# account, not the precompile. The D-Chain (dexvm) peer is resolved at RUNTIME via the
+# consensus-context "D" alias (contract.AtomicState.DChainID()) and the
+# protocolFeeController is the built-in DAO treasury. 0x9010 is REMOVED (not a registered
+# precompile, no dispatch, no forward); 0x9999 is the SOLE canonical DEX precompile. For a
+# fresh net whose genesis ts >= the fork, the marker is present from block 0.
+#
+# v1.99.34 (precompile v0.5.54): fixes a consensus-divergence on the relaunch/replay path.
+# The EVM dispatch gate (core.LuxPrecompileOverrider.PrecompileOverride) used to read the
+# process-global params.lastRulesContext (via GetRulesExtra(Rules{})), which is rewritten
+# last-writer-wins by every concurrent Rules() call (eth_call/estimateGas/worker). On a
+# live, RPC-serving post-fork node replaying a PRE-fork RLP block (admin.importChain), a
+# concurrent post-fork eth_call could overwrite the global timestamp between the verify
+# goroutine's NewEVM(pre-fork block) and its tx dispatch — making the pre-fork block see
+# 0x9999 ENABLED and dispatch SettleContract.Run during plain-account execution => state
+# divergence / consensus split. Fix: the dispatch gate now decides from the overrider's OWN
+# per-EVM fields (o.chainConfig + o.timestamp) via the pure params.GetExtrasRules, never the
+# global — so every replay of a block yields the same enabled set on every validator. Also:
+# the registry stateDBBridge.SubBalance fallback now FAILS CLOSED (panic → reverted call)
+# instead of returning a zero "previous balance" without debiting (silent native mint); and
+# the genesis-config builders (SetAllGenesisPrecompiles/AllGenesisPrecompiles) skip AlwaysOn
+# modules so 0x9999 can never get a timestamp-0 genesis config that bypasses the dated fork.
+# The money path (V4 swap ABI, marker install, two-phase atomic settle) is byte-for-byte
+# unchanged: ONLY the dispatch-path timestamp source, the SubBalance fail-mode, the genesis
+# builder guard, and stale 0x9010 comments changed.
+#
+# v1.99.37 (precompile v0.5.57): wires the 0x9999 ERC-20 Call surface to the DEX
+# settlement precompile (commit 2cf30e43d) and gates that Call surface to the DEX
+# settlement family 0x9999/0x9996 (commit 9579f2e34). Before this, a CALL into
+# 0x9999's ERC-20 settle path saw a nil PrecompileEnv (GetPrecompileEnv == nil) and
+# could not resolve the token-transfer Call seam — the two-phase atomic settle's
+# ERC-20 leg had no env to execute against. precompile v0.5.57 also adds the
+# CALL-only DELEGATECALL guard (commit feeaab5a0) so the settle surface is reachable
+# only via CALL (not DELEGATECALL, which would run it in the caller's context). Also
+# converges deps to latest patch within v1.x.x (threshold v1.9.9, crypto v1.19.21,
+# database v1.20.3, geth v1.17.12, warp v1.19.5, vm v1.2.5, api v1.0.15 — the
+# UTXOAssetID rename that fixed the LuxAssetID build break) and removes the dead
+# vendored dexConfig upgrade fixtures. The 0x9999 swap ABI + dated-fork activation
+# (DexSettleActivationTime = 1766704800) are unchanged from v1.99.34.
+#
+# v1.99.40 (precompile v0.5.59, chains v1.3.19, consensus v1.25.21): the permissionless
+# 0x9999 DEX value path lands end-to-end. precompile v0.5.58/59 = AssetResolver (real
+# on-chain canonical resolution, NO admin allowlist), one synchronous router/book/journal,
+# minOut on every route, no keeper/venue/live-ZAP/second-book; the env→Call ERC-20 vault
+# seam + in-state-vault resolution make a real ERC-20 settle. evm v1.99.39 = the
+# reprocess-bind fix: NewBlockChain binds the chain Runtime (networkID/C-Chain id) BEFORE
+# startup reprocess, so an unclean restart after a 0x9999 swap re-executes the committed
+# swap with the correct identity instead of (0, Empty) — previously that reverted the swap,
+# failed ValidateState, and BRICKED the node. Proven on-node: real swap → kill -9 →
+# clean reboot, state intact. v1.99.40 = v1.99.39 + deps to latest. consensus v1.25.21 =
+# stake-weighted alpha-of-K quorum finality + per-height single-finalize + epoch-bound certs.
+ARG EVM_VERSION=v1.99.40
+ARG EVM_VM_ID=mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
+# the pinned evm go.mod may pin a dead luxfi/upgrade pseudo-version
+# (v1.0.1-0.20260603055252-f51810805436 — commit pruned from origin). Heal it to
+# the released upgrade v1.0.1 tag (semver-forward, not a downgrade). Then strip
+# first-party go.sum lines so -mod=mod re-records current content hashes for the
+# re-published luxfi modules at their pinned versions (integrity repair, no version drift).
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    mkdir -p /luxd/build/plugins && \
+    git clone --depth 1 --branch ${EVM_VERSION} https://github.com/luxfi/evm.git /tmp/evm && \
+    cd /tmp/evm && \
+    . /build/build_env.sh && \
+    go mod edit -require=github.com/luxfi/upgrade@v1.0.1 && \
+    # evm v1.99.40 pins luxfi/chains v1.3.19, whose dexvm/registry was an incomplete
+    # refactor (forbidden.go deleted -> AssertNoForbiddenAssetRefs/looksLikeASCIITickerID/
+    # toHex/fromHex undefined => won't compile). Force v1.3.21 (forbidden.go restored),
+    # matching node's go.mod and the chain-VM plugin stage (CHAINS_REF) below.
+    go mod edit -require=github.com/luxfi/chains@v1.3.21 && \
+    find /tmp/evm -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} + && \
+    GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
+    CGO_ENABLED=0 GOFLAGS=-mod=mod \
+    go build -ldflags="-s -w" -o /luxd/build/plugins/${EVM_VM_ID} ./plugin && \
+    chmod +x /luxd/build/plugins/${EVM_VM_ID} && \
+    rm -rf /tmp/evm
+
+# ============= Chain VM Plugin Stage ================
+# Build all 11 chain VM plugins from github.com/luxfi/chains
+#
+# VM ID table (CB58-encoded ids.ID byte arrays from each factory.go):
+#   aivm         -> juFxSrbCM4wszxddKepj1GWwmrn9YgN1g4n3VUWPpRo9JjERA
+#   bridgevm     -> kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY
+#   dexvm        -> mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr
+#   graphvm      -> nZQm4Dmg1rjX18rb8maL9gamYyXPf1xCvF7ymWzxp6a1nSQTt
+#   identityvm   -> oR6tnZHezwogyf9fRnomNXC9ojwCEBAU6jdUzpgy2PB1tD7fM
+#   keyvm        -> pJJCSV7hHYVY6TUZwR8qUPAfuhX8JLb2C1AzNSezrYNbgau8M
+#   oraclevm     -> r5m1ujrmXxVcQetG3CQfuDLHp2RHKh6vCDaFgBRQfUcTZh7eS
+#   quantumvm    -> ry9Sg8rZdT26iEKvJDmC2wkESs4SDKgZEhk5BgLSwg1EpcNug
+#   relayvm      -> sP6dLqrrBR9w3soP18fbJ3YzZecZdD7DDdfH2cFhhLq7Hy9bz
+#   thresholdvm  -> tGVBwRxpmD2aFdg3iYjgRvrCe8Jcmq9UNKxyHMus2NZ8WcD8t
+#   zkvm         -> vv3qPfyTVXZ5ArRZA9Jh4hbYDTBe43f7sgQg4CHfNg1rnnvX9
+
+# MUST track node's go.mod luxfi/chains (the D-Chain dexvm + 10 VM plugins).
+# v1.3.14 = the native-atomic seam (rail-bound D->C atomic, LP committed-liquidity).
+# Bump with every chains release or the bundled VM plugins go stale vs node's deps.
+# v1.3.21 == node go.mod's luxfi/chains pin (the finality-complete go-live); keeps the
+# 10 baked VM plugins (incl. the FATAL-gated bridgevm) in lockstep with the host node.
+ARG CHAINS_REF=v1.3.21
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    git clone --depth 1 --branch ${CHAINS_REF} https://github.com/luxfi/chains.git /tmp/chains && \
+    find /tmp/chains -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} +
+
+# Each VM is an independent Go module under /tmp/chains/<vm>/.
+# Build each plugin binary and place it at /luxd/build/plugins/<cb58-vm-id>.
+#
+# The recursive go.sum strip above lets -mod=mod re-record current content hashes
+# for re-published first-party modules at their pinned versions (integrity repair).
+# At a tagged CHAINS_REF (v1.3.11) the sibling go.mod replace directives that
+# affect `main` are absent, so every VM module builds in isolation. The bridgevm
+# plugin (B-Chain) MUST build — it blank-imports crypto/threshold/bls to register
+# the BLS threshold scheme; a miss reintroduces the v1.30.16 B-Chain init failure.
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    . /build/build_env.sh && \
+    export GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+    mkdir -p /luxd/build/plugins && \
+    ( cd /tmp/chains/aivm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/juFxSrbCM4wszxddKepj1GWwmrn9YgN1g4n3VUWPpRo9JjERA ./cmd/plugin ) || echo "WARN: aivm plugin build skipped" ; \
+    ( cd /tmp/chains/bridgevm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY ./cmd/plugin ) ; \
+    ( cd /tmp/chains/graphvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/nZQm4Dmg1rjX18rb8maL9gamYyXPf1xCvF7ymWzxp6a1nSQTt ./cmd/plugin ) || echo "WARN: graphvm plugin build skipped" ; \
+    ( cd /tmp/chains/identityvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/oR6tnZHezwogyf9fRnomNXC9ojwCEBAU6jdUzpgy2PB1tD7fM ./cmd/plugin ) || echo "WARN: identityvm plugin build skipped" ; \
+    ( cd /tmp/chains/keyvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/pJJCSV7hHYVY6TUZwR8qUPAfuhX8JLb2C1AzNSezrYNbgau8M ./cmd/plugin ) || echo "WARN: keyvm plugin build skipped" ; \
+    ( cd /tmp/chains/oraclevm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/r5m1ujrmXxVcQetG3CQfuDLHp2RHKh6vCDaFgBRQfUcTZh7eS ./cmd/plugin ) || echo "WARN: oraclevm plugin build skipped" ; \
+    ( cd /tmp/chains/quantumvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/ry9Sg8rZdT26iEKvJDmC2wkESs4SDKgZEhk5BgLSwg1EpcNug ./cmd/plugin ) || echo "WARN: quantumvm plugin build skipped" ; \
+    ( cd /tmp/chains/relayvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/sP6dLqrrBR9w3soP18fbJ3YzZecZdD7DDdfH2cFhhLq7Hy9bz ./cmd/plugin ) || echo "WARN: relayvm plugin build skipped" ; \
+    ( cd /tmp/chains/thresholdvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/tGVBwRxpmD2aFdg3iYjgRvrCe8Jcmq9UNKxyHMus2NZ8WcD8t ./cmd/plugin ) || echo "WARN: thresholdvm plugin build skipped" ; \
+    ( cd /tmp/chains/zkvm && CGO_ENABLED=0 GOFLAGS=-mod=mod go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/vv3qPfyTVXZ5ArRZA9Jh4hbYDTBe43f7sgQg4CHfNg1rnnvX9 ./cmd/plugin ) || echo "WARN: zkvm plugin build skipped" ; \
+    ( chmod +x /luxd/build/plugins/* 2>/dev/null || true ) && \
+    test -s /luxd/build/plugins/kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY \
+        || { echo "FATAL: bridgevm (B-Chain) plugin missing — the v1.30.16 regression would recur"; exit 1; } && \
+    rm -rf /tmp/chains
+
+# ============= Native D-Chain DEX VM Plugin Stage ================
+# The D-Chain (dexvm slot, vmID mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr)
+# is the NATIVE consensus matcher VM: github.com/luxfi/dex/pkg/dchain implements
+# block.ChainVM and runs the lx.OrderBook matcher INSIDE luxd consensus
+# (Block.Verify against a versiondb overlay; Block.Accept commits) — the trade IS
+# the D-Chain state transition, sequenced by luxd's multi-validator engine. This
+# REPLACES the former chains/dexvm proxy (which relayed clob_* over ZAP to a
+# standalone dchain-venue): there is no DexZapEndpoint and no standalone venue in
+# the trading path. cmd/dchain wraps the VM in the SAME rpc.Serve plugin harness
+# luxfi/evm boots through, and is pure-Go (CGO=0) — the optional GPU AMM
+# accelerator in pkg/lx is a separate concern gated by its own cuda/metal tags and
+# is NOT linked here. v1.5.10 is the first tag whose cmd/dchain builds CGO=0
+# (drops the phantom dchain+cgo gate); v1.5.11 wires CLOB order ingestion over the
+# node HTTP router (VM.CreateHandlers -> /ext/bc/D/dex/<method>, pkg/dchain/ingest.go)
+# so an order POSTed to the node flows submitTx -> mempool -> consensus -> Verify
+# (match) -> Accept; v1.5.12 persists the head block so the VM survives a restart
+# once advanced past genesis (GetBlock(lastAccepted) no longer ErrNotFound);
+# v1.5.13 indexes processing blocks so the plugin transport's ID-only Accept
+# (GetBlock(builtID)) resolves the just-built block — without it the engine's
+# self-finalize Accept is a silent no-op and the clob submitTx waiter hangs (no
+# D-Chain blocks). v1.5.14 consumes luxfi/database v1.20.4, which fixes prefixdb
+# returning ZERO rows for a nil-start prefix scan over a prefixdb-wrapped chain
+# DB (every plugin VM via vm/rpc) — that stranded the native D-Chain order book
+# (rebuildBookFromDB folded empty -> 0 fills despite committed asks). v1.5.15 adds
+# the committed-state READ surface (clob_get_trades/orders/markets/book over
+# /ext/bc/D/dex/<method>, pkg/dchain/read.go): read-only JSON of the durable trade
+# log / resting book / markets, served beside the writes with ZERO consensus
+# impact. Needed to VERIFY a fill replicated identically across validators (query
+# every node, diff the trade rows + head root) and to feed markets-display (native
+# fills are trade: rows). Bump with every dex release that changes the VM, like
+# CHAINS_REF for the other 10 VMs.
+ARG DEX_REF=v1.5.15
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    git clone --depth 1 --branch ${DEX_REF} https://github.com/luxfi/dex.git /tmp/dex && \
+    find /tmp/dex -name go.sum -exec sed -i -E '/^github.com\/(luxfi|hanzoai)\//d' {} + && \
+    cd /tmp/dex && \
+    . /build/build_env.sh && \
+    GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
+    CGO_ENABLED=0 GOFLAGS=-mod=mod \
+    go build -ldflags="-s -w" \
+        -o /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr ./cmd/dchain && \
+    chmod +x /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr && \
+    test -s /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr \
+        || { echo "FATAL: native D-Chain (dexvm) plugin missing — D-Chain cannot start"; exit 1; } && \
+    rm -rf /tmp/dex
+
+# lpm (Lux Plugin Manager) -- optional, skip if build fails
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/root/go/pkg/mod \
+    GOARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) && \
+    git clone --depth 1 https://github.com/luxfi/lpm.git /tmp/lpm && \
+    cd /tmp/lpm && \
+    CGO_ENABLED=0 go build -ldflags="-s -w" -o /luxd/build/lpm ./main && \
+    rm -rf /tmp/lpm || echo "WARN: lpm build skipped (non-critical)"
 
 # Create this directory in the builder to avoid requiring anything to be executed in the
 # potentially emulated execution container.
 RUN mkdir -p /luxd/build
 
-# ============= Cleanup Stage ================
+# ============= Runtime Stage ================
 # Commands executed in this stage may be emulated (i.e. very slow) if TARGETPLATFORM and
 # BUILDPLATFORM have different arches.
 FROM debian:12-slim AS execution
 
-# Maintain compatibility with previous images
-COPY --from=builder /luxd/build /luxd/build
+# Install runtime dependencies (curl for RPC, git for lpm source installs, ca-certificates for TLS)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl ca-certificates git \
+    && rm -rf /var/lib/apt/lists/*
+
+# GPU crypto library (optional -- only present when built with CGO_ENABLED=1 + luxcpp).
+# Pure Go fallbacks are used when the library is absent.
+RUN ldconfig 2>/dev/null || true
+
+# Maintain compatibility with previous images.
+# In the builder stage /luxd/build contains ONLY plugins/ (the luxd + lpm binaries
+# live at /build/build and are COPYed separately below). The plugin set (~192MB of
+# 12 VM plugins) is split across several COPY layers so each blob stays well under
+# ~100MB: a single monolithic plugins layer cannot reliably complete its registry
+# blob upload over a contended uplink, whereas sub-100MB layers push reliably (and
+# resume independently by digest).
+# plugin group 1
+COPY --from=builder \
+    /luxd/build/plugins/mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6 \
+    /luxd/build/plugins/juFxSrbCM4wszxddKepj1GWwmrn9YgN1g4n3VUWPpRo9JjERA \
+    /luxd/build/plugins/kMhHABHM8j4bH94MCc4rsTNdo5E9En37MMyiujk4WdNxgXFsY \
+    /luxd/build/plugins/
+# plugin group 2
+COPY --from=builder \
+    /luxd/build/plugins/mDVT5EWMumBp3LCqvKwuyZQeY1VXr1jvjGNAt8nL4UFiXvqXr \
+    /luxd/build/plugins/nZQm4Dmg1rjX18rb8maL9gamYyXPf1xCvF7ymWzxp6a1nSQTt \
+    /luxd/build/plugins/oR6tnZHezwogyf9fRnomNXC9ojwCEBAU6jdUzpgy2PB1tD7fM \
+    /luxd/build/plugins/pJJCSV7hHYVY6TUZwR8qUPAfuhX8JLb2C1AzNSezrYNbgau8M \
+    /luxd/build/plugins/
+# plugin group 3
+COPY --from=builder \
+    /luxd/build/plugins/r5m1ujrmXxVcQetG3CQfuDLHp2RHKh6vCDaFgBRQfUcTZh7eS \
+    /luxd/build/plugins/ry9Sg8rZdT26iEKvJDmC2wkESs4SDKgZEhk5BgLSwg1EpcNug \
+    /luxd/build/plugins/sP6dLqrrBR9w3soP18fbJ3YzZecZdD7DDdfH2cFhhLq7Hy9bz \
+    /luxd/build/plugins/tGVBwRxpmD2aFdg3iYjgRvrCe8Jcmq9UNKxyHMus2NZ8WcD8t \
+    /luxd/build/plugins/vv3qPfyTVXZ5ArRZA9Jh4hbYDTBe43f7sgQg4CHfNg1rnnvX9 \
+    /luxd/build/plugins/
 WORKDIR /luxd/build
 
 # Copy the executables into the container
 COPY --from=builder /build/build/ .
 
+# Create plugins directory and lpm state directory
+RUN mkdir -p /luxd/build/plugins /root/.lpm /root/.lux/plugins
+
+# Add lpm to PATH
+ENV PATH="/luxd/build:${PATH}"
+
+EXPOSE 9630 9631
+
 CMD [ "./luxd" ]

Dockerfile.bootnode

@@ -0,0 +1,38 @@
+FROM alpine:3.18
+
+# Install required packages
+RUN apk add --no-cache ca-certificates curl bash
+
+# Create lux user
+RUN adduser -D -h /home/lux lux
+
+# Create directories (matching the expected paths in startup script)
+RUN mkdir -p /luxd/build/plugins /data/plugins /home/lux/.lux/configs
+
+# Set permissions
+RUN chown -R lux:lux /luxd /data /home/lux
+
+# Copy the pre-built node binary to the expected location
+COPY build/luxd-linux-amd64 /luxd/build/luxd
+RUN chmod +x /luxd/build/luxd
+
+# Copy newly built EVM plugin with matching ZAP protocol version
+COPY build/evm-linux-amd64 /luxd/build/plugins/mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
+RUN chmod +x /luxd/build/plugins/mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
+
+# Also add to PATH
+RUN ln -s /luxd/build/luxd /usr/local/bin/luxd
+
+# Set user
+USER lux
+WORKDIR /home/lux
+
+# Expose ports
+# P2P
+EXPOSE 9651
+# HTTP API
+EXPOSE 9650
+# Staking
+EXPOSE 9652
+
+ENTRYPOINT ["/luxd/build/luxd"]

Dockerfile.custom

@@ -0,0 +1,60 @@
+# Custom build with local EVM plugin
+ARG GO_VERSION=1.26
+
+# ============= Go Installation Stage ================
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS go-installer
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    wget ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+ARG GO_VERSION
+ARG BUILDPLATFORM
+
+RUN BUILDARCH=$(echo ${BUILDPLATFORM} | cut -d / -f2) && \
+    wget -q "https://go.dev/dl/go${GO_VERSION}.linux-${BUILDARCH}.tar.gz" && \
+    tar -C /usr/local -xzf "go${GO_VERSION}.linux-${BUILDARCH}.tar.gz" && \
+    rm "go${GO_VERSION}.linux-${BUILDARCH}.tar.gz"
+
+# ============= Compilation Stage ================
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS builder
+
+COPY --from=go-installer /usr/local/go /usr/local/go
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc libc6-dev make git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /build
+
+COPY go.mod .
+COPY go.sum .
+RUN go mod download
+
+COPY . .
+
+RUN [ -d ./build ] && rm -rf ./build/* || true
+
+ENV CGO_ENABLED=0
+RUN export GOARCH=amd64 && ./scripts/build.sh
+
+# Copy local EVM plugin instead of downloading
+ARG EVM_VM_ID=mgj786NP7uDwBCcq6YwThhaN8FLyybkCa4zBWTQbNgmK6k9A6
+RUN mkdir -p /luxd/build/plugins
+COPY evm-plugin-linux-amd64 /luxd/build/plugins/${EVM_VM_ID}
+RUN chmod +x /luxd/build/plugins/${EVM_VM_ID}
+
+RUN mkdir -p /luxd/build
+
+# ============= Runtime Stage ================
+FROM debian:12-slim AS execution
+
+COPY --from=builder /luxd/build /luxd/build
+WORKDIR /luxd/build
+
+COPY --from=builder /build/build/ .
+
+RUN mkdir -p /luxd/build/plugins
+
+CMD [ "./luxd" ]

LAUNCH_CHECKLIST.md

@@ -0,0 +1,324 @@
+# Lux Mainnet Launch Checklist
+
+Node: luxfi/node v1.24.11
+Consensus: Quasar (BLS+Corona, slashing, stake-weighted sampling)
+EVM: GPU ecrecover, 18 precompiles
+Genesis: networkID=1, startTime=2025-12-12T21:06:51Z (mainnet), networkID=2, startTime=2026-02-10T16:00:00Z (testnet)
+Precompile constraint: all activations MUST be after 2025-12-25
+
+---
+
+## Infrastructure
+
+| Environment | Cluster | DOKS ID | K8s Version | Namespace | Validators |
+|-------------|---------|---------|-------------|-----------|------------|
+| Testnet | do-sfo3-lux-test-k8s | `005ec3c4` | 1.35.1-do.0 | lux-testnet | 11 (target) |
+| Rehearsal | do-sfo3-lux-dev-k8s | `0ff340e1` | 1.35.1-do.0 | lux-devnet | 21 (target) |
+| Mainnet | do-sfo3-lux-k8s | `04c46df5` | 1.34.1-do.4 | lux-mainnet | 21 (target) |
+
+Current state: lux-k8s runs 5 validators (v1.23.31) via LuxNetwork CRD. Testnet cluster (lux-test-k8s) has a 3-replica StatefulSet (v1.23.40).
+
+Image: `ghcr.io/luxfi/node:v1.24.11` (built via CI/CD, linux/amd64+arm64)
+Staking keys: KMS at `kms.lux.network`, project `lux-infra`, synced via KMSSecret CRD
+Secrets: never in manifests, never in env files, never committed
+Genesis configs: `/Users/z/work/lux/genesis/configs/{testnet,mainnet,devnet}/`
+K8s manifests: `/Users/z/work/lux/universe/k8s/`
+Profiles: `standard.json` (~100MB/node), `max.json` (~512MB/node)
+
+Bootstrappers:
+- Mainnet: 5 seeds (ports 9631) -- `209.38.118.46`, `209.38.174.69`, `24.144.69.101`, `134.199.187.56`, `143.198.246.173`
+- Testnet: 2 seeds (ports 9641) -- `134.199.187.16`, `209.38.174.84`
+
+Consensus parameters (mainnet): K=20, AlphaPreference=15, AlphaConfidence=15, Beta=20, ConcurrentPolls=4
+
+Tokenomics: 10B total supply (9 decimals), min validator stake 1M LUX, min delegator stake 25K LUX, combined staking allowed (NFT+delegation), 80% uptime threshold
+
+C-Chain: chainId=96369 (mainnet), 96368 (testnet), gasLimit=12M, targetBlockRate=2s, minBaseFee=25gwei
+
+---
+
+## Phase 1: Testnet (lux-test-k8s, networkID=2)
+
+Target: validate all consensus, EVM, and staking behavior with K=11 validators.
+
+### 1.1 Deployment
+
+- [ ] Update LuxNetwork CRD in `universe/k8s/lux-k8s/validators/statefulset.yaml` (testnet section): `validators: 11`, `image.tag: v1.24.11`
+- [ ] Update lux-test-k8s StatefulSet in `universe/k8s/lux-test-k8s/testnet/statefulset.yaml`: replicas=11, image=v1.24.11
+- [ ] Generate 11 staking key pairs via `lux cli` and store in KMS (`lux-infra/testnet/staking/`)
+- [ ] Add 9 new bootstrapper entries to `genesis/configs/testnet/bootstrappers.json` (currently 2)
+- [ ] Apply `max.json` profile for testnet validators (512MB/node for stress testing headroom)
+- [ ] Regenerate testnet genesis with 11 initial validators via `genesis` tool
+- [ ] Verify all precompile activation timestamps are after 2025-12-25
+- [ ] Deploy via PaaS (platform.hanzo.ai), not manual kubectl
+- [ ] Verify all 11 pods reach Running state
+- [ ] Verify all 11 nodes report healthy via `/ext/health/liveness`
+
+### 1.2 Bootstrap and Connectivity
+
+- [ ] Verify all 11 validators discover each other via P2P (check `info.peers` RPC, expect 10 peers per node)
+- [ ] Verify staking port 9641 reachable between all pods (`luxd-{0..10}.luxd-headless.testnet.svc.cluster.local:9641`)
+- [ ] Verify P-chain bootstraps and all validators appear in `platform.getCurrentValidators`
+- [ ] Verify C-chain bootstraps and produces blocks
+- [ ] Verify X-chain bootstraps and processes UTXO transactions
+
+### 1.3 Quasar Consensus Verification
+
+- [ ] Submit transactions, verify Quasar finalization with K=11
+- [ ] Verify BLS aggregate signatures in block headers
+- [ ] Verify Corona optimistic fast path activates when all 11 validators are online
+- [ ] Measure finality latency (target: sub-second with Corona)
+- [ ] Verify stake-weighted sampling: validators with more stake get polled proportionally
+
+### 1.4 EVM Execution
+
+- [ ] Deploy a test contract, call all standard opcodes
+- [ ] Submit 100 sequential transactions, verify correct nonce ordering
+- [ ] Verify `eth_call` and `eth_estimateGas` return correct results
+- [ ] Verify block gas limit is 12M (from cchain.json config)
+- [ ] Verify minBaseFee=25gwei is enforced
+
+### 1.5 GPU ecrecover
+
+- [ ] Verify GPU backend auto-detection: CUDA on Linux DOKS nodes, Metal on macOS
+- [ ] Run ecrecover-heavy workload (1000 signature verifications per block)
+- [ ] Compare ecrecover throughput: GPU vs CPU fallback
+- [ ] Verify graceful fallback to CPU when GPU unavailable (set `--gpu-backend=cpu`)
+
+### 1.6 Precompiles (all 18)
+
+- [ ] Test each precompile individually via contract calls
+- [ ] Verify DEX precompile (LP-9010 PoolManager): pool creation, swaps, flash loans
+- [ ] Verify DEX router precompile (LP-9012): multi-hop routing
+- [ ] Verify all precompile addresses are deterministic and match spec
+- [ ] Verify precompile gas metering is correct (no underpriced or overpriced ops)
+- [ ] Verify precompiles revert correctly on invalid input
+
+### 1.7 Slashing
+
+- [ ] Craft equivocation evidence: have a validator sign two different blocks at same height
+- [ ] Submit equivocation proof to P-chain slashing precompile
+- [ ] Verify slashed validator's stake is burned
+- [ ] Verify slashed validator is removed from active set
+- [ ] Verify honest validators are unaffected
+
+### 1.8 Uptime and Rewards
+
+- [ ] Stop 1 validator (scale pod to 0)
+- [ ] Wait for reward period to elapse
+- [ ] Verify stopped validator's uptime drops below 80%
+- [ ] Verify rewards are withheld for the stopped validator
+- [ ] Restart the validator, verify it re-bootstraps and resumes
+- [ ] Verify validators with >80% uptime receive expected rewards
+
+### 1.9 Stress Test
+
+- [ ] Run stress test: maximum TPS with 1B gas blocks (increase gas limit temporarily)
+- [ ] Measure sustained TPS over 1 hour (target: verify consensus is the bottleneck, not EVM)
+- [ ] Monitor memory usage per node (should stay within `max.json` profile ~512MB)
+- [ ] Monitor disk I/O and database growth rate
+- [ ] Verify no consensus stalls under load
+- [ ] Verify block production rate stays at targetBlockRate=2s
+
+### 1.10 Validator Join/Leave
+
+- [ ] Add a 12th validator via `platform.addPermissionlessValidator` (permissionless staking)
+- [ ] Verify new validator bootstraps from existing state
+- [ ] Verify new validator begins participating in consensus
+- [ ] Remove a validator via unstaking (wait for stake period to end or use testnet short periods)
+- [ ] Verify removed validator exits gracefully
+- [ ] Verify remaining validators continue producing blocks
+
+### 1.11 Formal Verification
+
+- [ ] Run Lean proofs for Quasar consensus safety and liveness
+- [ ] Run TLA+ model checker for consensus state machine
+- [ ] Run Tamarin prover for BLS+Corona security properties
+- [ ] Run Halmos for EVM precompile correctness (symbolic execution)
+- [ ] All proofs pass with zero counterexamples
+
+---
+
+## Phase 2: Mainnet Rehearsal (lux-dev-k8s, networkID=3)
+
+Target: full mainnet simulation with real parameters for 72 hours.
+
+### 2.1 Deployment
+
+- [ ] Update LuxNetwork CRD (devnet section): `validators: 21`, `image.tag: v1.24.11`
+- [ ] Generate 21 staking key pairs, store in KMS (`lux-infra/devnet/staking/`)
+- [ ] Use mainnet genesis parameters (networkID=3, but same tokenomics, same stake amounts)
+- [ ] Apply `max.json` profile
+- [ ] Deploy via PaaS
+- [ ] Verify all 21 pods healthy
+
+### 2.2 Real Staking Parameters
+
+- [ ] Configure minimum validator stake: 1M LUX
+- [ ] Configure minimum delegator stake: 25K LUX
+- [ ] Configure max delegation ratio: 10x
+- [ ] Configure NFT staking tiers (Genesis 500K/2x, Pioneer 750K/1.5x, Standard 1M/1x)
+- [ ] Verify combined staking logic: NFT value + delegation + staked >= 1M
+- [ ] Verify B-chain validators require 100M LUX + KYC
+
+### 2.3 72-Hour Soak Test
+
+- [ ] Start clock. Record block height and timestamp.
+- [ ] Continuous transaction load: 50 TPS sustained
+- [ ] Monitor: CPU, memory, disk, network per node (Prometheus + Grafana via PaaS)
+- [ ] Monitor: consensus latency p50/p95/p99
+- [ ] Monitor: block production rate (target: 1 block per 2s)
+- [ ] Monitor: peer count stability (all 21 connected)
+- [ ] Monitor: no OOMKills, no pod restarts, no crashloops
+- [ ] At hour 24: rolling restart of 5 validators (verify zero downtime)
+- [ ] At hour 48: simulate network partition (isolate 7 nodes), verify chain halts (< 2/3 online)
+- [ ] Restore partition, verify chain resumes within 30s
+- [ ] At hour 72: record final block height, calculate actual vs expected blocks
+- [ ] Pass criteria: zero consensus faults, zero data loss, <1% block time variance
+
+### 2.4 Security Audit
+
+- [ ] External security audit firm engaged (Red team)
+- [ ] Audit scope: consensus, EVM, precompiles, staking, slashing, P2P networking
+- [ ] Audit result: 0 critical findings, 0 high findings
+- [ ] All medium findings remediated or accepted with documented risk
+- [ ] Audit report signed and archived
+
+### 2.5 Bridge / Teleport (B-Chain + T-Chain)
+
+- [ ] Deploy MPC threshold signing (5 nodes, threshold 3) in `lux-mpc` namespace
+- [ ] Deploy bridge UI and API in `lux-bridge` namespace
+- [ ] Verify CGGMP21 keygen: 5 parties generate shared key
+- [ ] Verify threshold signing: 3-of-5 produces valid signature
+- [ ] Test cross-chain transfer: lock on source chain, mint on Lux
+- [ ] Test reverse: burn on Lux, unlock on source chain
+- [ ] Verify MPC API at `mpc-api.lux.network` responds
+- [ ] Verify bridge handles partial MPC node failure (2 down, 3 still sign)
+
+### 2.6 DEX (D-Chain + Precompiles)
+
+- [ ] Deploy DEX precompile PoolManager (LP-9010) -- already active from genesis
+- [ ] Deploy DEX Router precompile (LP-9012) -- already active from genesis
+- [ ] Deploy off-chain CLOB matching engine
+- [ ] Create liquidity pool via precompile
+- [ ] Execute swap via router precompile
+- [ ] Verify AMM pricing matches expected curve
+- [ ] Verify flash loan execution and repayment
+- [ ] Test CLOB: place limit order, verify fill
+- [ ] Verify DEX on lux.exchange frontend connects to devnet
+
+---
+
+## Phase 3: Mainnet Launch (lux-k8s, networkID=1)
+
+Target: production network with real value.
+
+### 3.1 Pre-launch
+
+- [ ] All Phase 1 items passed
+- [ ] All Phase 2 items passed
+- [ ] Security audit sign-off received
+- [ ] Formal verification suite green
+- [ ] Legal review complete (terms of service, validator agreements)
+- [ ] Incident response runbook written and tested
+
+### 3.2 Genesis Ceremony
+
+- [ ] Final genesis config reviewed: `genesis/configs/mainnet/genesis.json` (networkID=1)
+- [ ] Genesis startTime confirmed: 2025-12-12T21:06:51Z
+- [ ] Initial allocations verified (500M initial + unlock schedule)
+- [ ] All 5 bootstrapper IPs confirmed reachable on port 9631
+- [ ] Genesis hash computed and published to lux.network
+- [ ] Genesis block signed by founding validators
+
+### 3.3 Validator Onboarding
+
+- [ ] Update LuxNetwork CRD (mainnet section): `validators: 21`, `image.tag: v1.24.11`
+- [ ] Scale from 5 current validators to 21
+- [ ] Generate 16 new staking key pairs in KMS (`lux-infra/mainnet/staking/`)
+- [ ] Update bootstrappers.json with all 21 validator endpoints
+- [ ] Deploy via PaaS with rolling update strategy
+- [ ] Verify all 21 validators healthy and in consensus
+- [ ] Publish validator onboarding guide for external operators
+- [ ] Open permissionless staking after initial stabilization period
+
+### 3.4 Public RPC Endpoints
+
+- [ ] Deploy KrakenD API gateway in `lux-gateway` namespace
+- [ ] Configure rate limiting per IP and per API key
+- [ ] Configure Cloudflare DNS (proxied, full SSL):
+  - `api.lux.network` -> gateway (C-chain + P-chain + X-chain RPC)
+  - `ws.lux.network` -> gateway (WebSocket subscriptions)
+- [ ] Verify `eth_chainId` returns `0x17871` (96369)
+- [ ] Verify `net_version` returns `96369`
+- [ ] Verify RPC endpoints handle 10K req/s without degradation
+- [ ] Verify WebSocket subscriptions for `newHeads`, `logs`, `pendingTransactions`
+
+### 3.5 Explorer Deployment
+
+- [ ] Deploy explorer (luxfi/explorer) in `lux-explorer` namespace (already has manifests for 5 chains)
+- [ ] Configure for C-chain (chainId 96369)
+- [ ] Configure indexers for all active chains
+- [ ] Configure Cloudflare DNS: `explore.lux.network`
+- [ ] Verify block display, transaction search, contract verification
+- [ ] Deploy exchange frontend: `lux.exchange`
+
+### 3.6 Bridge Activation
+
+- [ ] Deploy MPC production cluster (5 nodes, threshold 3)
+- [ ] Generate production MPC keys (CGGMP21 keygen ceremony)
+- [ ] Store MPC key shares in KMS (`lux-infra/mainnet/mpc/`)
+- [ ] Deploy bridge contracts on supported chains (ETH, BNB, Polygon, Arbitrum, Base, Optimism)
+- [ ] Deploy bridge UI at bridge domain
+- [ ] Configure Cloudflare DNS
+- [ ] Enable deposits (one chain at a time, small limits first)
+- [ ] Monitor for 24h, then raise limits
+
+### 3.7 Post-Launch Monitoring
+
+- [ ] Prometheus + Grafana dashboards live (via PaaS o11y stack)
+- [ ] Alerts configured:
+  - Validator down (any pod not Ready for >5min)
+  - Consensus stall (no new block for >30s)
+  - Peer count drop (any node <15 peers)
+  - Memory usage >80% of limit
+  - Disk usage >70%
+  - Error rate >1% on RPC endpoints
+- [ ] On-call rotation established
+- [ ] Runbook covers: validator restart, chain halt recovery, emergency upgrade, key rotation
+
+---
+
+## Port Reference
+
+| Network | HTTP | Staking | Metrics |
+|---------|------|---------|---------|
+| Mainnet | 9630 | 9631 | 9090 |
+| Testnet | 9640 | 9641 | 9090 |
+| Devnet | 9650 | 9651 | 9090 |
+
+## Chain IDs
+
+| Chain | Mainnet | Testnet | Devnet |
+|-------|---------|---------|--------|
+| C-Chain | 96369 | 96368 | 96370 |
+| Zoo EVM | 200200 | 200201 | 200202 |
+| Hanzo EVM | 36963 | 36964 | 36964 |
+| SPC EVM | 36911 | 36910 | 36912 |
+| Pars EVM | 494949 | 7071 | 494951 |
+
+## File References
+
+| What | Path |
+|------|------|
+| Node source | `~/work/lux/node/` |
+| Genesis configs | `~/work/lux/genesis/configs/{mainnet,testnet,devnet}/` |
+| Chain configs | `~/work/lux/genesis/configs/chain-configs/` |
+| K8s manifests | `~/work/lux/universe/k8s/` |
+| Validator CRD | `~/work/lux/universe/k8s/lux-k8s/validators/statefulset.yaml` |
+| Testnet StatefulSet | `~/work/lux/universe/k8s/lux-test-k8s/testnet/statefulset.yaml` |
+| Node profiles | `~/work/lux/node/config/profiles/{standard,max}.json` |
+| Tokenomics config | `~/work/lux/node/config/tokenomics.go` |
+| GPU config | `~/work/lux/node/config/gpu.go` |
+| Health/consensus params | `~/work/lux/node/config/health.go` |
+| Network registry | `~/work/lux/universe/NETWORKS.yaml` |

LICENSE

@@ -1,6 +1,6 @@
 BSD 3-Clause License
 
-Copyright (C) 2020-2025, Lux Industries Inc.
+Copyright (C) 2019-2025, Lux Industries, Inc.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

LICENSING.md

@@ -0,0 +1,12 @@
+# Licensing
+
+This repository is licensed under the **BSD 3-Clause License** (see
+[LICENSE](LICENSE)). It belongs to the **public** tier of the Lux
+three-tier IP strategy: anyone may use, fork, or redistribute it,
+including for commercial purposes, subject to the BSD-3 terms.
+
+For the canonical Lux IP and licensing strategy, see:
+<https://github.com/luxfi/.github/blob/main/profile/README.md>
+
+For commercial inquiries that go beyond BSD-3 (e.g. private moat
+acceleration kernels), contact `licensing@lux.network`.

LLM.md

@@ -1,149 +1,820 @@
-# LLM.md - Lux Node Project
+# AI Development Guide
 
-## Project Overview
-This is the Lux blockchain node implementation, a fork of Avalanche with modifications for the Lux network ecosystem. The project is written in Go and implements a multi-chain blockchain platform with support for multiple subnets.
+This file provides guidance for AI assistants working with the Lux node codebase.
 
-## Architecture
+## Repository Overview
 
-### Core Components
-- **Node Implementation** (`/home/z/work/lux/node/`)
-  - Main blockchain node with consensus, networking, and VM support
-  - Modified from Avalanche to support Lux-specific features
-  - Version: v0.1.0-lux.15
+Lux blockchain node implementation - a high-performance, multi-chain blockchain platform written in Go. Features multiple consensus engines (Chain, DAG, PQ), EVM compatibility, and a multi-chain architecture with specialized capabilities.
 
-### Key Modules
-- **consensus/** - Consensus protocols and validator management
-- **vms/** - Virtual Machines including platformvm, avm, and evm
-- **chains/** - Chain management and atomic operations
-- **api/** - RPC and REST API implementations
-- **network/** - P2P networking and gossip protocols
-- **database/** - Database backends (LevelDB, Memory, Prefix)
-- **utils/** - Utility functions and helpers
+**Key Context:**
+- Original Lux Network node — NOT a fork
+- Latest Tag: v1.26.31
+- Network ID: 96369 (Lux Mainnet), 96368 (Testnet), 96370 (Devnet)
+- Go Version: 1.26.1+
+- Database: ZapDB (primary, default)
 
-## Current State (as of last work session)
+## Post-E2E-PQ State (current)
 
-### Test Coverage Status
-- **Overall Pass Rate**: ~80% (estimated)
-- Major areas fixed:
-  - Import cycles resolved
-  - Mock implementations generated
-  - Context usage patterns partially standardized with testcontext package
-  - Interface adapters created
-  - State package mocks regenerated
-  - Clock type issues resolved
-  - TXS executor tests building (but runtime issues remain)
+Node now consumes the locked `ChainSecurityProfile` end-to-end and enforces
+strict-PQ at four boundaries: peer handshake, mempool, validator scheme
+selection, and EVM contract auth.
 
-### Critical Known Issues
-1. **Context Type Mismatch**: Major breaking change - tests expect a struct-based context with fields (Lock, SharedMemory, ChainID, etc.) but the codebase has moved to standard context.Context pattern
-2. **VM Initialize Signature**: VM.Initialize expects linearblock.ChainContext but tests pass a different type
-3. **Consensus Package Changes**: The consensus package has been refactored to use context values instead of struct fields
-4. **Test Infrastructure**: Many test files (helpers_test.go, acceptor_test.go) are temporarily disabled due to context issues
+- `node/node.go:initSecurityProfile` (F102 closure) loads the chain-wide
+  profile from genesis at boot, hashes it, and pins it into every chain's
+  bootstrap. Resolved profile is what every downstream verifier consults.
+- `network/peer/scheme_gate.go` — `SchemeGate.Classify(presented, site)`
+  funnels every inbound NodeID through the profile's
+  `AcceptsValidatorScheme`. Wire-typed NodeID (`luxfi/ids` TypedNodeID +
+  scheme byte) is the canonical handshake form.
+- `vms/txs/auth/policy.go` — `ClassicalCompatRegistry` + strict-PQ
+  mempool gate. Both `platformvm` (P-Chain) and `avm` (X-Chain) mempools
+  refuse classical credentials when the resolved profile has
+  `ForbidECDSAContractAuth=true`.
+- `vms/mldsafx/` — re-exports the consensus `mldsafx` UTXO feature
+  extension as the node-owned UTXO surface (ML-DSA-65 verify).
+- `network/peer` PQ handshake — ML-KEM-768 / ML-KEM-1024 KEM +
+  ML-DSA-65 identity (`dc906d281b`).
 
-### Skipped Test Files
-- `/vms/platformvm/block/executor/helpers_test.go.skip`
-- `/vms/platformvm/block/executor/acceptor_test.go.skip`
-- `/vms/platformvm/txs/executor/state_changes_test.go.skip` (uses removed ValidatorFeeConfig/FeeState)
+### Recent significant commits
 
-### Known Issues
-1. **Mock Interfaces**: Some mocks don't match current State/Chain interfaces
-2. **Removed Types**: Tests reference removed types like `SubnetToL1Conversion`
-3. **Context Patterns**: Major refactoring needed - tests expect old-style context struct
-4. **SharedMemory Interface**: Requires adapters for interface compatibility
-5. **Clock Types**: Mismatch between consensus and node clock types
+| SHA | Tag | Impact |
+|-----|-----|--------|
+| (pending) | next | LP-023 Phase 1 batch 2: 5 more native-ZAP tx types — BaseTx v1, RegisterL1ValidatorTx v1, SlashValidatorTx v1, TransferChainOwnershipTx v1, RemoveChainValidatorTx. Cross-type Parse mean speedup 8.5× over linearcodec. Variable-length nested-object schemas (Outs/Ins/full OutputOwners/Warp Message/Evidence) deferred to batch 3. |
+| `e77a7ef78e` | (pre) | LP-023 Phase 1 batch 1: 4 simple tx types + bench harness. 37× Parse, 5.6× cross-type mean. |
+| `9df72a6f55` | v1.26.10 | Wire ChainSecurityProfile into bootstrap (closes F102) |
+| `c4af52411e` | v1.26.10 | X-Chain (avm) mempool refuses classical creds under strict-PQ |
+| `a14a1601f4` | v1.26.10 | P-Chain (platformvm) mempool refuses classical creds under strict-PQ |
+| `1cf0aa80ca` | v1.26.10 | ClassicalCompatRegistry + strict-PQ mempool gate |
+| `a0f4f4b21c` | v1.26.10 | vms/mldsafx: re-export ML-DSA feature extension |
+| `448fdeb7a1` | v1.26.10 | ML-DSA-65 promoted to canonical NodeID under strict-PQ |
+| `dc906d281b` | v1.26.10 | PQ peer handshake — ML-KEM-768/1024 + ML-DSA-65 identity |
 
-## Development Patterns
+### Active versions
+- Repo: `v1.26.12` (next bump: `v1.26.13`).
+- Pinned: `consensus v1.23.4+` (needed `ValidatorSchemeID`),
+  `crypto v1.18.5`, `ids v1.2.9` (will move to v1.2.10 in next bump for
+  `TypedNodeID`), `genesis v1.9.6`.
+
+### Cross-repo dependencies
+- `luxfi/consensus` → profile + auth + zchain types
+- `luxfi/crypto` → ML-DSA / ML-KEM / SLH-DSA primitives
+- `luxfi/genesis` → genesis-pinned profile (`Resolve` at load)
+- `luxfi/ids` → `TypedNodeID` wire form (consumed at handshake)
+- `luxfi/geth` → EVM (for `vm.SetActiveSecurityProfile` install point)
+
+### Where to look for X
+- Profile resolve at boot: `node/node.go:initSecurityProfile`
+- Profile RPC + REST + metrics: `service/security/`
+  - JSON-RPC namespace: `security` at `POST /ext/security`
+    (methods `securityProfile`, `blockSecurity`)
+  - REST sidecars: `GET /ext/security/profile`, `GET /ext/security/block/{n}`
+  - Prometheus gauges: `/ext/metrics` under the `security_*` family
+- Peer scheme gate: `network/peer/scheme_gate.go`
+- Classical-compat registry: `vms/txs/auth/policy.go`
+- Mempool gate (P-Chain): `vms/platformvm/mempool/*.go`
+- Mempool gate (X-Chain): `vms/avm/mempool/*.go`
+- ML-DSA feature extension: `vms/mldsafx/`
+
+### Open follow-ups
+- `vms/zkvm/accel/` still soft-falls-back when CGO is disabled; Z-Chain
+  proof verification path needs CGO-required mode for production strict-PQ.
+- `vm.SetActiveSecurityProfile` install point exists in `luxfi/geth/core/vm`
+  but EVM-side contract-auth refusal still needs a chain-bootstrap call
+  (F102 wiring closes the consensus side; geth-side hookup is the
+  remaining tail).
+
+## FeePolicy — canonical user-tx fee gate
+
+Every Lux VM that accepts user-submitted txs declares a `fee.Policy`
+(package `vms/types/fee`). There is one interface and one validator —
+no per-VM bespoke fee structs.
+
+### Policy choice per VM
+
+| VM | Chain | Posture | Policy |
+|----|-------|---------|--------|
+| dexvm | D-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, AssetID: UTXOAssetIDFor(networkID)}` |
+| zkvm | Z-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| aivm | A-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| keyvm | K-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| bridgevm | B-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| quantumvm | Q-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| identityvm | I-Chain | user-tx | `FlatPolicy{Fee: MinTxFeeFloor, ...}` |
+| thresholdvm | M-Chain | service-only | `NoUserTxPolicy{}` |
+| oraclevm | O-Chain | service-only | `NoUserTxPolicy{}` |
+| relayvm | R-Chain | service-only | `NoUserTxPolicy{}` |
+| graphvm | G-Chain | read-only | `NoUserTxPolicy{}` (GraphQL refuses `mutation`) |
+| evm | C-Chain | user-tx | native EVM gas (gas * gasPrice >= 0 enforced upstream) |
+| platformvm | P-Chain | user-tx | native `TxFee` field on Config |
+| avm | X-Chain | user-tx | native `TxFee` field on Config |
+
+`MinTxFeeFloor = 1 mLUX = 1_000_000 nLUX` (the same minimum the P-Chain
+base fee enforces). User-facing chains MAY charge more; they MUST NOT
+charge less.
+
+### Wiring contract
+
+1. VM struct holds `feePolicy fee.Policy` (and `networkID uint32`).
+2. `Initialize` sets `feePolicy = fee.FlatPolicy{...}` (or
+   `fee.NoUserTxPolicy{}` for service-only) from `init.Runtime.NetworkID`
+   and calls `fee.Validate(vm.feePolicy)` — refuses zero-fee user-facing
+   chains at boot, before any block is accepted.
+3. The canonical user-tx admission entry (e.g. `SubmitTx`, `IssueTx`,
+   `InitiateBridgeTransfer`, mutating service RPCs) calls
+   `policy.ValidateFee(paid, asset)` BEFORE mempool insert.
+4. Consensus-internal paths (engine→VM block delivery, replay, internal
+   tx emission) bypass the fee gate — the policy gates only the
+   *user-submitted* entrypoint.
+
+### Where the gates live
+
+- `vms/types/fee/policy.go` — interface + FlatPolicy + NoUserTxPolicy + Validate
+- `~/work/lux/chains/<vm>/feegate.go` — per-VM helper + gate method
+- `~/work/lux/chains/<vm>/feegate_test.go` — RejectsZeroFee + AcceptsMinFee
+- Oracle (O-Chain): `~/work/lux/oracle/vm/feegate.go` (re-exported by `~/work/lux/chains/oraclevm/`)
+- Relay (R-Chain): `~/work/lux/relay/vm/feegate.go` (re-exported by `~/work/lux/chains/relayvm/`)
+- Graph (G-Chain): `~/work/lux/chains/graphvm/feegate.go` (read-only; NoUserTxPolicy)
+
+## Essential Commands
+
+### Release & build (canonical) — via platform.hanzo.ai, NOT GitHub Actions
+The ONE way to build + publish releases is **[`RELEASE.md`](./RELEASE.md)**:
+platform.hanzo.ai reads [`hanzo.yml`](./hanzo.yml) on a `v*` tag push and
+schedules the image build onto self-hosted **arcd** pools (`lux-build-linux-*`)
+over the native long-poll fabric — no GitHub-Actions hop. ONE `Dockerfile`
+build yields BOTH artifacts: the node image (`ghcr.io/luxfi/node:vX.Y.Z`, luxd
++ 12 baked VM plugins) and, via [`scripts/publish_plugin_set.sh`](./scripts/publish_plugin_set.sh),
+the plugin set to `s3://lux-plugins-<env>/<pluginset>/` (operator `pluginSource`).
+The `.github/workflows/*` build/release workflows are retired (RELEASE.md §Retire).
+
+### Building (local dev only)
+```bash
+# Build node binary
+./scripts/run_task.sh build
+# Output: ./build/luxd
+
+# Build specific components
+go build -o luxd ./app
+```
 
 ### Testing
-- Use `go test ./... -count=1` to run all tests
-- Mock generation: `go generate ./...` in package directories
-- Test packages use `_test` suffix to avoid import cycles
-
-### Interface Patterns
-```go
-// Adapter pattern for interface compatibility
-type stateReaderAdapter struct {
-    state.State
-}
-
-func (s *stateReaderAdapter) GetL1Validator(id ids.ID) (L1ValidatorInfo, error) {
-    validator, err := s.State.GetL1Validator(id)
-    if err != nil {
-        return nil, err
-    }
-    return &validator, nil
-}
-```
-
-### Context Usage
-```go
-// Use consensus helpers instead of struct literals
-ctx := context.Background()
-ctx = consensus.WithIDs(ctx, consensus.IDs{
-    NetworkID:  1,
-    ChainID:    constants.PlatformChainID,
-    LUXAssetID: luxAssetID,
-})
-```
-
-## Common Tasks
-
-### Running Tests
 ```bash
 # Run all tests
 go test ./... -count=1
 
-# Run specific package tests
+# Run specific package
 go test ./vms/platformvm/state -count=1
 
-# Check test coverage
-go test ./... -cover
+# With race detection
+go test -race ./...
 ```
 
-### Generating Mocks
+### Code Generation
 ```bash
-cd vms/platformvm/state
+# Generate mocks
 go generate ./...
+
+# Regenerate protobuf
+./scripts/run_task.sh generate-protobuf
 ```
 
-### Building
+### Running
 ```bash
-go build -o luxd ./app
+# Mainnet
+./build/luxd
+
+# Testnet
+./build/luxd --network-id=testnet
+
+# Local network
+lux network start
 ```
 
-## Important Files
-- **consensus/ctx.go** - Context management and consensus IDs
-- **vms/platformvm/state/state.go** - State interface definitions
-- **vms/platformvm/state/mocks_generate_test.go** - Mock generation directives
-- **vms/platformvm/network/warp.go** - Warp message handling
+## Architecture
 
-## Dependencies
-- Go 1.21.12 or higher
-- uber/mock for mock generation
-- protobuf for message serialization
-- Various Lux-specific packages with -lux.15 tags
+### Multi-Chain Design
 
-## Notes for Future Development
+Primary network (P/X/C) uses Quasar consensus via `luxfi/consensus`.
+All new native chains use Quasar (BLS + Corona + ML-DSA).
 
-### When Adding New Tests
-1. Check if mocks need regeneration
-2. Use proper context patterns (no struct literals)
-3. Create adapters for interface mismatches
-4. Use `_test` package suffix if import cycles occur
+| Chain | Purpose | VM | Consensus |
+|-------|---------|-----|-----------|
+| **P-Chain** | Staking, validators, L1 validators | PlatformVM | Quasar |
+| **X-Chain** | UTXO-based asset exchange | XVM | Quasar |
+| **C-Chain** | EVM smart contracts | EVM | Quasar |
+| **A-Chain** | AI inference, model registry | AIVM | Quasar |
+| **B-Chain** | Cross-chain bridge operations | BridgeVM | Quasar |
+| **D-Chain** | DEX (order book, perpetuals) | DexVM | Quasar |
+| **G-Chain** | On-chain graph database | GraphVM | Quasar |
+| **I-Chain** | Decentralized identity (DID/VC) | IdentityVM | Quasar |
+| **K-Chain** | Post-quantum key management | KeyVM | Quasar |
+| **M-Chain** | Threshold signing (MPC) | ThresholdVM | Quasar |
+| **O-Chain** | Oracle price feeds | OracleVM | Quasar |
+| **Q-Chain** | Post-quantum consensus coordination | QuantumVM | Quasar |
+| **R-Chain** | Cross-chain message relay | RelayVM | Quasar |
+| **S-Chain** | Service node coordination | ServiceNodeVM | Quasar |
+| **T-Chain** | Cross-chain teleport (bridge+relay+oracle) | TeleportVM | Quasar |
+| **Z-Chain** | Zero-knowledge proofs (FHE) | ZKVM | Quasar |
 
-### Common Fixes
-- **Import Cycle**: Move test to separate package with `_test` suffix
-- **Missing Mock Methods**: Regenerate mocks or create adapters
-- **Context Issues**: Use consensus.WithIDs() instead of literals
-- **Interface Mismatch**: Create adapter structs
+### Consensus Layer
+Located in `/consensus/` (separate package `github.com/luxfi/consensus`):
+- **Quasar**: Production consensus -- BLS12-381 + Corona (lattice) + ML-DSA-65 (FIPS 204)
+- **Chain Engine**: Linear blockchain consensus (Nova sub-protocol)
+- **DAG Engine**: Directed acyclic graph for parallel processing (Nebula sub-protocol)
+- **PQ Engine**: Post-quantum finality layer
 
-### Areas Needing Attention
-1. Complete mock regeneration for all packages
-2. Update tests for removed functionality
-3. Standardize SharedMemory interface usage
-4. Fix remaining 29 failing test packages
+Sub-protocols: Photon (sampling) -> Wave (voting) -> Focus (confidence) -> Ray/Field (finality)
 
-## Related Projects
-- **/home/z/work/lux/geth** - C-Chain implementation
-- **/home/z/work/lux/evm** - Subnet EVM
-- **/home/z/work/lux/cli** - Management CLI
-- **/home/z/work/lux/ava/avalanchego** - Upstream Avalanche reference
+### Virtual Machines
+Located in `/vms/`:
+- **platformvm**: Staking, validation, network management
+- **xvm**: Asset transfers, UTXO model
+- **dexvm**: DEX with order book, perpetuals, AMM
+- **thresholdvm**: Threshold MPC and FHE for confidential computing
+- **quantumvm**: PQ consensus coordination (ML-DSA, Corona)
+- **identityvm**: Decentralized identity (DID, verifiable credentials)
+- **keyvm**: Post-quantum key management (ML-KEM, ML-DSA)
+- **bridgevm**: Cross-chain bridge with MPC attestation
+- **oraclevm**: Decentralized oracle network
+- **aivm**: AI inference verification
+- **graphvm**: On-chain graph database
+- **relayvm**: Cross-chain message relay
+- **servicenodevm**: Service node epoch management
+- **teleportvm**: Unified bridge+relay+oracle
+- **zkvm**: Zero-knowledge proof verification
+- **proposervm**: Block proposer wrapper VM
+
+### Key Interfaces
+
+**p2p.Sender** (from `github.com/luxfi/p2p`):
+```go
+type Sender interface {
+    SendRequest(ctx context.Context, nodeIDs set.Set[ids.NodeID], requestID uint32, request []byte) error
+    SendResponse(ctx context.Context, nodeID ids.NodeID, requestID uint32, response []byte) error
+    SendError(ctx context.Context, nodeID ids.NodeID, requestID uint32, errorCode int32, errorMessage string) error
+    SendGossip(ctx context.Context, config SendConfig, msg []byte) error
+}
+```
+
+**Keychain Interfaces** (from `github.com/luxfi/keychain`):
+```go
+type Signer interface {
+    SignHash([]byte) ([]byte, error)
+    Sign([]byte) ([]byte, error)
+    Address() ids.ShortID
+}
+
+type Keychain interface {
+    Get(addr ids.ShortID) (Signer, bool)
+    Addresses() set.Set[ids.ShortID]
+}
+```
+
+## Package Dependencies
+
+### CRITICAL: Use Lux packages only
+- ✅ `github.com/luxfi/node`
+- ✅ `github.com/luxfi/geth` (NOT go-ethereum)
+- ✅ `github.com/luxfi/consensus`
+- ✅ `github.com/luxfi/keychain`
+- ✅ `github.com/luxfi/ledger`
+- ✅ `github.com/luxfi/lattice` (FHE)
+- ❌ `github.com/luxfi/*` legacy upstream forks
+- ❌ `github.com/ethereum/go-ethereum`
+
+### Import Aliasing
+Avoid conflicts with consensus packages:
+```go
+import (
+    platformblock "github.com/luxfi/node/vms/platformvm/block"
+    consensusblock "github.com/luxfi/consensus/engine/chain"
+)
+```
+
+## Token Denomination
+
+LUX uses **6 decimals** (microLUX base unit) on P-Chain/X-Chain:
+
+| Unit | Value |
+|------|-------|
+| µLUX (MicroLux) | 1 (base) |
+| mLUX (MilliLux) | 1,000 |
+| LUX | 1,000,000 |
+| TLUX (TeraLux) | 10^18 |
+
+**Supply Cap**: 2 trillion LUX (2 × 10^18 µLUX)
+
+C-Chain uses standard EVM 18 decimals (Wei).
+
+See `utils/units/lux.go` for constants.
+
+## Key Technical Decisions
+
+### Genesis Architecture
+```
+github.com/luxfi/genesis (JSON config)  →  github.com/luxfi/node/genesis/builder (type conversion)
+```
+- Genesis package has no node dependencies
+- Builder package handles type conversions (string → ids.NodeID, uint64 → time.Duration)
+
+### CGO Dependencies
+These require CGO for full functionality (graceful fallback when disabled):
+- `consensus/quasar` - GPU NTT acceleration
+- `vms/thresholdvm/fhe` - GPU FHE operations
+- `x/blockdb` - zstd compression
+
+### FHE (Fully Homomorphic Encryption)
+Located in `vms/thresholdvm/fhe/`:
+- Uses `github.com/luxfi/lattice/multiparty` for DKG
+- Lattice-based cryptography only (no fallbacks)
+- Threshold decryption via Warp messaging
+
+**Precompile Addresses:**
+| Precompile | Address |
+|------------|---------|
+| Fheos | `0x0200000000000000000000000000000000000080` |
+| ACL | `0x0200000000000000000000000000000000000081` |
+| InputVerifier | `0x0200000000000000000000000000000000000082` |
+| Gateway | `0x0200000000000000000000000000000000000083` |
+
+### ZAP Transport (Zero-Copy App Proto)
+ZAP is the only wire protocol for VM<->Node communication. The gRPC
+fallback (and its `-tags=grpc` opt-in) was retired in v1.26.31 along
+with every `//go:build grpc` file under `node/`. There is one and only
+one way to talk to a Chain VM: ZAP.
+
+**Build:**
+```bash
+go build                  # ZAP only — there are no build tags
+```
+
+**Key Packages:**
+- `github.com/luxfi/api/zap` — Core wire protocol and message types (Layer A)
+- `github.com/luxfi/protocol/rpcdb` — rpcdb service spec / data carriers (Layer B)
+- `github.com/luxfi/node/db/rpcdb` — rpcdb Service + ZAP transport adapter (Layer C)
+- `vms/rpcchainvm/sender/` — Node-side `p2p.Sender` over ZAP
+- `vms/rpcchainvm/zap/` — ChainVM client/server over ZAP
+- `vms/platformvm/warp/zwarp/` — Warp signing over ZAP
+
+**rpcdb Layered Topology:**
+- Layer A — wire framing: `github.com/luxfi/api/zap`
+- Layer B — rpcdb service spec: `github.com/luxfi/protocol/rpcdb`
+- Layer C — rpcdb impl: `node/db/rpcdb/{service.go, zap_server.go}`
+  - `service.go` — transport-neutral `Service` wrapping `database.Database`
+  - `zap_server.go` — ZAP transport adapter (only adapter)
+- One Service, one transport. The dual-adapter pattern stays available
+  for future transports (each is a new file wrapping `*Service`), but
+  ZAP is the only one shipping.
+
+**Wire Protocol Format:**
+```
+[4 bytes: length][1 byte: message type][payload...]
+```
+
+**Performance Benefits:**
+- Zero-copy serialization (buffer pooling via sync.Pool)
+- ~5-10x faster serialization than protobuf
+- ~2-3x lower latency (no HTTP/2 overhead)
+- ~30-50% CPU reduction on hot paths
+
+**Sender Usage:**
+```go
+// ZAP transport — the only transport
+s := sender.ZAP(zapConn)
+```
+
+**Warp over ZAP:**
+The `zwarp` package implements warp signing via ZAP:
+```go
+// Client implements warp.Signer over ZAP
+client := zwarp.NewClient(zapConn)
+sig, err := client.Sign(unsignedMsg)
+
+// BatchSign for HFT optimization
+sigs, errs := client.BatchSign(messages)
+```
+
+## RNS Transport (Reticulum Network Stack)
+
+The node supports RNS as an alternative transport layer alongside TCP/IP, enabling mesh networking, LoRa connectivity, and offline-first validator operation.
+
+**Specification**: [LP-9701](../lps/LPs/lp-9701-reticulum-network-stack.md)
+
+### Endpoint Types
+
+The `net/endpoints` package supports three addressing modes:
+
+```go
+// IP address
+endpoint := endpoints.NewIPEndpoint(netip.MustParseAddrPort("203.0.113.50:9631"))
+
+// Hostname (DNS resolved)
+endpoint, _ := endpoints.NewHostnameEndpoint("validator.example.com", 9631)
+
+// RNS destination (mesh/LoRa)
+endpoint, _ := endpoints.NewRNSEndpointFromHex("rns://a5f72c3d4e5f60718293a4b5c6d7e8f9")
+```
+
+### Key Files
+
+| File | Purpose |
+|------|---------|
+| `net/endpoints/endpoint.go` | Unified endpoint abstraction (IP, hostname, RNS) |
+| `network/dialer/rns_transport.go` | RNS transport implementation |
+| `network/dialer/rns_identity.go` | Classical identity (Ed25519 + X25519) |
+| `network/dialer/rns_identity_pq.go` | Hybrid PQ identity (+ ML-DSA + ML-KEM) |
+| `network/dialer/rns_link.go` | Encrypted link protocol with PQ support |
+| `network/dialer/rns_announce.go` | Destination discovery and announcements |
+
+### Configuration
+
+```yaml
+# ~/.lux/config.yaml
+rns:
+  enabled: true
+  configPath: ~/.lux/reticulum
+  announceInterval: 5m
+  interfaces:
+    - AutoInterface
+    - TCPClientInterface
+  linkTimeout: 30s
+  postQuantum: true        # Enable hybrid PQ mode
+  requirePostQuantum: false # Allow classical-only peers
+```
+
+## Post-Quantum Cryptography (Hybrid Mode)
+
+RNS transport supports hybrid post-quantum cryptography combining classical algorithms with NIST-standardized post-quantum primitives (TLS 1.3-like approach).
+
+### Cryptographic Suite
+
+| Purpose | Classical | Post-Quantum | Security |
+|---------|-----------|--------------|----------|
+| Identity Signing | Ed25519 | ML-DSA-65 | NIST Level 3 |
+| Key Exchange | X25519 | ML-KEM-768 | NIST Level 3 |
+| Session Encryption | AES-256-GCM | - | 256-bit |
+| Key Derivation | HKDF-SHA256 | - | - |
+
+### Forward Secrecy
+
+- **Ephemeral Keys**: Fresh X25519 + ML-KEM keypairs generated per session
+- **Key Destruction**: Ephemeral private keys zeroed after handshake
+- **Hybrid Derivation**: `combined_secret = X25519_shared || ML_KEM_shared`
+- **Defense-in-Depth**: Secure if either algorithm remains unbroken
+
+### Wire Format Sizes
+
+| Component | Classical | Hybrid | Delta |
+|-----------|-----------|--------|-------|
+| Public Identity | 64 bytes | ~3.2 KB | +3.1 KB |
+| Signature | 64 bytes | ~2.5 KB | +2.4 KB |
+| Key Exchange | 64 bytes | ~1.2 KB | +1.1 KB |
+| Handshake Total | ~256 bytes | ~7.5 KB | +7.2 KB |
+
+### Backward Compatibility
+
+- **Capability Exchange**: Handshake advertises PQ support
+- **Graceful Fallback**: Falls back to classical if peer lacks PQ
+- **Mixed Networks**: PQ and classical validators coexist
+- **Policy Enforcement**: `requirePostQuantum: true` rejects classical peers
+
+### SchemeGate — cross-axis NodeIDScheme enforcement
+
+`network/peer/scheme_gate.go` (v1.26.10) is the single primitive that
+turns a wire NodeID into a `(scheme, NodeID)` pair and runs the
+cross-axis check against the chain's `ChainSecurityProfile`.
+
+- `SchemeGate{Profile, ClassicalCompatUnsafe, ActivationHeight}` is the
+  chain-scoped policy object. One gate per chain, pinned at bootstrap.
+- `Classify(nodeID, scheme, height, site) (TypedNodeID, error)` is the
+  single entry point. Callers pass a site tag (`"handshake"`,
+  `"proposer"`, `"validator"`, `"mempool-sender"`) that appears in the
+  refused-by error.
+- Migration path: `ActivationHeight` is the block at which a strict-PQ
+  chain refuses any non-PQ `NodeIDScheme` byte at every height under
+  the forward-only PQ policy. The classical `secp256k1` (0x90) scheme is
+  refused at the gate; there is no transition window and no operator
+  classical-compat escape hatch (strict-PQ chains refuse classical at
+  every boundary, period).
+- Typed errors: `ErrSchemeGateConfig`, `ErrSchemeGateMismatch`,
+  `ErrSchemeGateUnknownScheme`.
+
+Wire form: `TypedNodeID = (NodeIDScheme byte, 20-byte NodeID)`. The
+20-byte storage/map-key form stays byte-identical; the scheme byte
+travels on the wire so a receiver knows which verifier to dispatch
+without trusting the chain profile alone.
+
+### Testing PQ Forward Secrecy
+
+```bash
+# Run hybrid PQ tests
+go test -v -run "TestHybrid" ./node/network/dialer/... -count=1
+
+# Key tests:
+# - TestHybridIdentity_SignVerify (ML-DSA-65 signatures)
+# - TestHybridIdentity_Encapsulate_Decapsulate (ML-KEM-768)
+# - TestHybridRNSLink_Handshake (full hybrid handshake)
+# - TestHybridRNSLink_ForwardSecrecy (ephemeral key destruction)
+# - TestHybridToClassical_Fallback (backward compatibility)
+```
+
+## Common Gotchas
+
+### 1. P2P Sender Interface
+Node's rpcchainvm implements `p2p.Sender` (from `github.com/luxfi/p2p`) for cross-chain messaging.
+The `sender` package is the ZAP-native implementation of `p2p.Sender`.
+
+### 2. Chain Tracking
+Nodes don't automatically track chains. Use:
+```bash
+--track-chains=<ChainID>
+```
+Or create config: `~/.lux/runs/.../node*/chainConfigs/<ChainID>.json`
+
+### 3. Genesis blobSchedule
+Mainnet genesis requires Cancun fork config:
+```json
+"blobSchedule": {
+  "cancun": {
+    "max": 6,
+    "target": 3,
+    "baseFeeUpdateFraction": 3338477
+  }
+}
+```
+
+### 4. Network Snapshots
+CLI creates new directories on restart. Use snapshots:
+```bash
+lux network save --snapshot-name <name>
+lux network start --snapshot-name <name>
+```
+
+### 5. EIP-3860 Historic Blocks
+For importing pre-merge blocks, Shanghai must be active based on `ShanghaiTime`, not merge status.
+
+### 6. Genesis Hash Mismatch on Restart
+**Problem**: "db contains invalid genesis hash" error when restarting nodes.
+
+**Cause**: Genesis bytes are rebuilt from JSON config on each start. Due to non-deterministic JSON serialization (map iteration order), the rebuilt bytes differ from the original, causing hash mismatch.
+
+**Solution**: Genesis bytes are now cached to `genesis.bytes` file in the node's data directory. On subsequent restarts, the cached bytes are used directly. This happens automatically when using `--genesis-file`.
+
+### 7. VM Config Format Mismatch
+**Problem**: "failed to parse config: unknown codec version" for T-Chain (ThresholdVM) or Z-Chain (ZKVM) in dev mode.
+
+**Cause**: Two issues:
+1. Genesis builder passes JSON config (`{"version":1,"message":"..."}`) to VMs that expect binary codec format
+2. Dev mode's automining config injection converts all chain configs to JSON, breaking binary-codec VMs
+
+**Solution**:
+- `genesis/builder/builder.go`: T-Chain and Z-Chain use `[]byte(config.TChainGenesis)` (empty bytes for defaults) instead of `getGenesis()` which returns JSON
+- `chains/manager.go`: `injectAutominingConfig` only injects for `EVMID`, skipping binary-codec VMs
+
+**Alternative**: Use `--genesis-raw-bytes` flag to pass base64-encoded pre-built genesis bytes directly.
+
+### 8. `vms/components/lux` vs `luxfi/utxo` (parallel UTXO types)
+The `github.com/luxfi/node/vms/components/lux` package contains a parallel
+`lux.UTXO`/`lux.TransferableInput` type tree alongside `github.com/luxfi/utxo`.
+External consumers (e.g. a white-label tenant's network-bootstrap tooling) need
+to import the `vms/components/lux` variant to interop with PlatformVM/AVM
+tx builders — `luxfi/utxo` types alone are not accepted by the X→P export
+path. This is a known anomaly pending #58 follow-up consolidation; do NOT
+collapse the two packages without that migration.
+
+## File Locations
+
+| Item | Path |
+|------|------|
+| luxd binary | `~/.lux/bin/luxd/luxdv*/luxd` |
+| VM plugins | `~/.lux/plugins/<VMID>` |
+| Network runs | `~/.lux/runs/local_network/network_*` |
+| Snapshots | `~/.lux/snapshots/` |
+| Chain configs | `~/.lux/chain-configs/<BlockchainID>/` |
+
+## Build Order
+
+1. Build node: `cd ~/work/lux/node && go build -o /tmp/luxd ./main`
+2. Install: `cp /tmp/luxd ~/.lux/bin/luxd/luxdv1.21.0/luxd`
+3. Build EVM: `cd ~/work/lux/evm && go build -o ~/.lux/plugins/<VMID> ./plugin`
+4. Start: `lux network start --mainnet`
+
+## Related Repositories
+
+| Repo | Purpose |
+|------|---------|
+| `~/work/lux/consensus` | Consensus engines (Chain, DAG, PQ) |
+| `~/work/lux/geth` | C-Chain EVM implementation |
+| `~/work/lux/evm` | EVM plugin |
+| `~/work/lux/genesis` | Genesis configurations |
+| `~/work/lux/cli` | Management CLI |
+| `~/work/lux/netrunner` | Network testing |
+| `~/work/lux/dex` | DEX implementation |
+| `~/work/lux/standard` | Solidity contracts (including FHE) |
+| `~/work/lux/lattice` | Lattice cryptography |
+
+## Security Notes
+
+### Mainnet Readiness (2025-12-31)
+- Memory exhaustion protection (IP tracker limits, bloom filter caps)
+- BLS signature CGO/pure-Go consistency
+- Replay attack prevention with timestamp validation
+- Safe math in DEX operations
+
+### 11. P-Chain Block Sync (isMissingContextError "not found")
+**Problem**: New validator node stays at P-chain height 0 even after connecting to testnet peers. Blocks received via Put/PushQuery are silently discarded.
+
+**Root Cause**: `HandleIncomingBlock` returns `"not found"` when the block's parent isn't in the local state. `isMissingContextError` didn't recognize `"not found"` as a missing-context condition, so `requestContext` (GetAncestors) was never called.
+
+**Fix** in `chains/manager.go`, `isMissingContextError`:
+```go
+// Added "not found" pattern:
+strings.Contains(errStr, "not found") // parent block not in local state
+```
+
+**Effect**: Now when a block arrives whose parent is unknown, the handler sends `GetAncestors` to the peer, receives the full ancestor chain, and processes blocks in order, advancing the P-chain height.
+
+**Note**: The network layer (`network.go:sequencerID`) already correctly maps native chain IDs (P, C, X, etc.) to `PrimaryNetworkID` for validator set lookups — no separate gossip fix needed.
+
+### Known CGO Stubs
+When CGO disabled, these use CPU fallbacks:
+- `consensus/quasar/gpu_ntt_nocgo.go`
+- `vms/thresholdvm/fhe/gpu_fhe_nocgo.go`
+- `vms/zkvm/accel/accel_mlx.go`
+
+### 8. ZAP CreateHandlers for VM HTTP Endpoints
+**Problem**: C-chain and D-chain RPC endpoints returning 404 despite VMs running.
+
+**Cause**: The `zap.Client` in `vms/rpcchainvm/zap/client.go` did not implement the `CreateHandlers` interface. The node checks for this interface to register HTTP handlers (like `/rpc`, `/ws`) with the HTTP server.
+
+**Solution**: Added `CreateHandlers` method to `zap.Client` that:
+1. Sends `MsgCreateHandlers` via ZAP wire protocol to the VM
+2. Receives `CreateHandlersResponse` with list of handlers (prefix + server address)
+3. Creates `httputil.NewSingleHostReverseProxy` for each handler
+4. Returns `map[string]http.Handler` for registration
+
+**File Modified**: `vms/rpcchainvm/zap/client.go`
+
+**Verification**:
+```bash
+curl -s -X POST -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
+  http://localhost:9640/ext/bc/C/rpc
+# Returns: {"jsonrpc":"2.0","id":1,"result":"0x17870"}
+```
+
+### 9. Root "/" Endpoint Handler
+**Feature**: The node's root endpoint ("/") provides EVM compatibility and node information.
+
+**Behavior**:
+- **GET /**: Returns JSON node information (nodeId, networkId, version, chains, endpoints)
+- **POST /**: Proxies JSON-RPC requests directly to C-chain `/ext/bc/C/rpc`
+- **OPTIONS /**: Returns CORS preflight headers
+
+**Files Modified**: `server/http/router.go`, `server/http/server.go`
+
+**Types**:
+```go
+type RootInfo struct {
+    NodeID    string `json:"nodeId,omitempty"`
+    NetworkID uint32 `json:"networkId,omitempty"`
+    Version   string `json:"version,omitempty"`
+    Ready     bool   `json:"ready"`
+    Chains    struct { C, P, X string } `json:"chains"`
+    Endpoints struct { RPC, Websocket, Info, Health string } `json:"endpoints"`
+}
+
+type RootInfoProvider interface {
+    GetRootInfo() RootInfo
+}
+```
+
+**Usage**:
+```bash
+# Get node info
+curl http://localhost:9650/
+
+# Send EVM JSON-RPC directly to root (proxied to C-chain)
+curl -X POST -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' \
+  http://localhost:9650/
+```
+
+**Implementation Notes**:
+- The Server interface exposes `SetRootInfoProvider(provider)` to configure node info
+- When no provider is set, returns default endpoint paths
+- POST errors return proper JSON-RPC error format if C-chain unavailable
+
+### 10. BLS Key Not Loaded into Validators Manager
+**Problem**: Health check shows "validator doesn't have a BLS key" despite BLS keys being correctly configured in genesis.
+
+**Cause**: The `initValidatorSets()` function in `/vms/platformvm/state/state.go` was skipping validator population when `NumNets() != 0`. This happened because:
+1. Network layer might pre-populate validators (without BLS keys) before state initialization
+2. When `initValidatorSets()` runs, it sees validators exist and skips adding them with proper BLS keys
+3. The health check queries `n.vdrs.GetValidator()` which returns validator with nil PublicKey
+
+**Solution**: Modified `initValidatorSets()` to always add validators (not skip when `NumNets() != 0`). The `AddStaker` method replaces existing entries, so validators get updated with proper BLS keys.
+
+**File Modified**: `vms/platformvm/state/state.go` (line ~2144)
+
+**Before**:
+```go
+if s.validators.NumNets() != 0 {
+    // skip re-adding them here
+    return nil
+}
+```
+
+**After**:
+```go
+if s.validators.NumNets() != 0 {
+    log.Info("initValidatorSets: validator manager not empty, will update with BLS keys")
+}
+// Continue to add validators with proper BLS keys
+```
+
+**Verification**:
+```bash
+curl -s http://localhost:9650/ext/health | jq '.checks.bls'
+# Should show: "message": "node has the correct BLS key"
+```
+
+## Benchmark Results (Single Node)
+
+Testing conducted on a single Lux validator node (testnet mode, macOS):
+
+| Metric | Result |
+|--------|--------|
+| Sustained TPS | 1,091 TPS (60s benchmark) |
+| Peak TPS | 1,094 TPS (5 workers) |
+| Query Performance | 840 queries/sec |
+| Query Latency | 17.67ms avg |
+| Optimal Concurrency | 5 workers |
+| Total Transactions | 65,497 txs/min |
+
+**Concurrency Scaling:**
+| Workers | TPS |
+|---------|-----|
+| 1 | 438 |
+| 5 | 1,094 (optimal) |
+| 10 | 684 |
+| 20 | 521 |
+
+**Key Findings:**
+- Single node achieves ~1,100 TPS sustained with optimal concurrency
+- Higher concurrency (>5 workers) decreases TPS due to nonce contention
+- Query latency is consistent at ~18ms
+- Testnet mode uses K=20 Lux consensus (vs K=1 dev mode)
+
+**Benchmark Command:**
+```bash
+cd ~/work/lux/benchmarks
+NODE_ENDPOINT="http://localhost:9640/ext/bc/C/rpc" \
+PRIVATE_KEY="<funded_key>" \
+./bin/bench tps --chains=lux --duration=60s --concurrency=5
+```
+
+## JSON rule — json/v2 at HTTP boundary only; ZAP for all internal data
+
+Encoding boundaries are one-way and explicit:
+
+- **External (HTTP / JSON-RPC API)** — `github.com/go-json-experiment/json` (v2).
+  Never `encoding/json`. This covers: `service/*`, `server/*`, `pubsub/`,
+  `vms/platformvm/service.go`, `vms/xvm/service.go`, JSON-RPC clients
+  (`vms/platformvm/client_*`), CLI tools (`cmd/*`), wallet examples,
+  on-disk config files (read once at boot), genesis/upgrade blobs.
+- **Internal (state, P2P, consensus, MPC, logs, metrics)** — ZAP wire only.
+  No JSON in: `network/`, `consensus/`, `snow/`, `chains/` (data-plane),
+  `vms/*/state/`, `vms/*/block/`, `vms/*/txs/` (struct codec), threshold
+  payloads, P2P message bodies, internal databases.
+
+Migration helpers (v2 API delta vs v1):
+
+| v1 (encoding/json)                | v2 (go-json-experiment/json)                 |
+|-----------------------------------|----------------------------------------------|
+| `json.Marshal(v)`                 | `json.Marshal(v)` (variadic opts; signature compat) |
+| `json.MarshalIndent(v, "", "  ")` | `json.Marshal(v, jsontext.WithIndent("  "))` |
+| `json.Unmarshal(b, &v)`           | `json.Unmarshal(b, &v)`                      |
+| `json.NewEncoder(w).Encode(v)`    | `json.MarshalWrite(w, v)` (no trailing `\n`) |
+| `json.NewDecoder(r).Decode(&v)`   | `json.UnmarshalRead(r, &v)`                  |
+| `json.RawMessage`                 | `jsontext.Value`                             |
+| `*json.SyntaxError`               | `*jsontext.SyntacticError`                   |
+
+v2 semantic differences worth knowing (these change wire shape):
+
+- `[N]byte` field with no `MarshalJSON` ⇒ v2 marshals as base64 string,
+  v1 marshalled as JSON array of byte numbers. Add `MarshalJSON` on the
+  type if the array form is wanted on the wire.
+- `time.Duration` ⇒ v2 default is the standard string form ("30m");
+  v1 marshalled as int nanoseconds. v1 sub-package
+  (`github.com/go-json-experiment/json/v1`) exposes `FormatDurationAsNano(true)`;
+  v2 root does not. Prefer the string form on new APIs.
+- v2 enforces strict UTF-8; raw arbitrary bytes in JSON strings fail.
+  This matters for legacy P2P/internal blobs that happen to be stored
+  through JSON — those should already be on ZAP.
+- `json.MarshalWrite` does NOT append a trailing `\n` (v1 `NewEncoder.Encode` did).
+  Adjust HTTP-handler test fixtures accordingly.
+
+---
+
+*Last Updated*: 2026-06-06

Makefile

@@ -1,15 +1,27 @@
 # Makefile for Lux Node
 
-.PHONY: all build build-fips test test-fips clean fmt lint install-mockgen mockgen verify-fips
+.PHONY: all build build-mlx build-release build-release-upx test clean fmt lint install-mockgen mockgen
 
-# FIPS 140-3 Configuration
+# Configuration
+CGO_ENABLED ?= 1
+FIPS_STRICT ?= 0
+
+# Go 1.26 experimental features:
+#   runtimesecret - zeroes stack/register state after secret.Do() for forward secrecy
+GOEXPERIMENT ?= runtimesecret
+export GOEXPERIMENT
+
+# FIPS 140-3 always enabled (required for blockchain/financial systems)
 export GOFIPS140 := latest
-export GODEBUG := fips140=on
-export CGO_ENABLED := 1
+ifeq ($(FIPS_STRICT),1)
+	export GODEBUG := fips140=only
+else
+	export GODEBUG := fips140=on
+endif
+export CGO_ENABLED
 
-# FIPS build environment
-FIPS_ENV := GOFIPS140=$(GOFIPS140) GODEBUG=$(GODEBUG) CGO_ENABLED=$(CGO_ENABLED)
-FIPS_BUILD_FLAGS := -tags fips
+# Environment block for all go commands
+ENV := GOFIPS140=$(GOFIPS140) GODEBUG=$(GODEBUG) CGO_ENABLED=$(CGO_ENABLED)
 
 # Build variables
 GO := go
@@ -26,51 +38,35 @@ GREEN := \033[0;32m
 YELLOW := \033[1;33m
 NC := \033[0m
 
-all: build-fips
+all: build
 
 # Verify FIPS environment
 verify-fips:
 	@echo "$(GREEN)Verifying FIPS 140-3 Environment...$(NC)"
+	@echo "FIPS_STRICT: $(FIPS_STRICT)"
 	@echo "GOFIPS140: $(GOFIPS140)"
 	@echo "GODEBUG: $(GODEBUG)"
-	@echo "$(GREEN)✓ FIPS environment ready$(NC)"
+	@echo "CGO_ENABLED: $${CGO_ENABLED:-not set}"
+	@echo "$(GREEN)✓ Environment ready$(NC)"
 
-# Build with FIPS 140-3 mode (default)
-build-fips: verify-fips
-	@echo "$(GREEN)Building luxd with FIPS 140-3 mode...$(NC)"
-	@$(FIPS_ENV) ./scripts/build.sh
-	@echo "$(GREEN)✓ FIPS build complete$(NC)"
-
-# Standard build (non-FIPS, for comparison only)
+# Default build
 build:
-	@echo "$(YELLOW)Building luxd (standard, non-FIPS)...$(NC)"
-	@./scripts/build.sh
+	@echo "$(GREEN)Building luxd...$(NC)"
+	@$(ENV) ./scripts/build.sh
+	@echo "$(GREEN)✓ Build complete$(NC)"
 
-# Test with FIPS 140-3 mode (default)
-test-fips: verify-fips
-	@echo "$(GREEN)Running tests with FIPS 140-3 mode...$(NC)"
-	@$(FIPS_ENV) go test $(FIPS_BUILD_FLAGS) -shuffle=on -race -timeout=$(TEST_TIMEOUT) -coverprofile=coverage.out -covermode=atomic $(TEST_PACKAGES)
-
-# Standard test (non-FIPS, for comparison)
+# Default test
 test:
-	@echo "$(YELLOW)Running tests (standard, non-FIPS)...$(NC)"
-	@go test -shuffle=on -race -timeout=$(TEST_TIMEOUT) -coverprofile=coverage.out -covermode=atomic $(TEST_PACKAGES)
-
-test-short-fips: verify-fips
-	@echo "$(GREEN)Running short tests with FIPS...$(NC)"
-	@$(FIPS_ENV) go test $(FIPS_BUILD_FLAGS) -short -race -timeout=60s $(TEST_PACKAGES)
+	@echo "$(GREEN)Running tests...$(NC)"
+	@$(ENV) go test -shuffle=on -race -timeout=$(TEST_TIMEOUT) -coverprofile=coverage.out -covermode=atomic $(TEST_PACKAGES)
 
 test-short:
 	@echo "Running short tests..."
-	@go test -short -race -timeout=60s $(TEST_PACKAGES)
-
-test-100-fips: verify-fips
-	@echo "$(GREEN)=== ENSURING 100% TEST PASS RATE WITH FIPS ===$(NC)"
-	@$(FIPS_ENV) go test $(FIPS_BUILD_FLAGS) -shuffle=on -race -timeout=$(TEST_TIMEOUT) $(TEST_PACKAGES)
+	@$(ENV) go test -short -race -timeout=60s $(TEST_PACKAGES)
 
 test-100:
-	@echo "=== ENSURING 100% TEST PASS RATE ==="
-	@go test -shuffle=on -race -timeout=$(TEST_TIMEOUT) $(TEST_PACKAGES)
+	@echo "$(GREEN)=== ENSURING 100% TEST PASS RATE ===$(NC)"
+	@$(ENV) go test -shuffle=on -race -timeout=$(TEST_TIMEOUT) $(TEST_PACKAGES)
 
 fmt:
 	@echo "Formatting Go code..."
@@ -97,40 +93,64 @@ mockgen: install-mockgen
 # Specific test targets
 test-unit:
 	@echo "Running unit tests..."
-	@go test -short -race $(TEST_PACKAGES)
+	@$(ENV) go test -short -race $(TEST_PACKAGES)
 
 test-integration:
 	@echo "Running integration tests..."
-	@go test -run Integration -race -timeout=300s $(TEST_PACKAGES)
+	@$(ENV) go test -run Integration -race -timeout=300s $(TEST_PACKAGES)
 
 test-e2e:
 	@echo "Running e2e tests..."
-	@./scripts/tests.e2e.sh
+	@$(ENV) ./scripts/tests.e2e.sh
 
 # Build specific binaries
 luxd:
 	@echo "Building luxd..."
-	@./scripts/build.sh
+	@$(ENV) ./scripts/build.sh
 
 # Installation targets
+# Install to $GOPATH/bin (default go install behavior)
 install:
-	@echo "Installing luxd..."
-	@go install -v ./cmd/luxd
+	@echo "Installing luxd to $(GOBIN)..."
+	@$(ENV) go install -v ./main
+	@echo "$(GREEN)✓ Installed to $(GOBIN)/luxd$(NC)"
+	@echo "Make sure $(GOBIN) is in your PATH"
+
+# Install to /usr/local/bin (system-wide, requires sudo)
+install-system: build
+	@echo "Installing luxd to /usr/local/bin..."
+	@sudo cp build/luxd /usr/local/bin/luxd
+	@sudo chmod +x /usr/local/bin/luxd
+	@echo "$(GREEN)✓ Installed to /usr/local/bin/luxd$(NC)"
+
+# Install to ~/.local/bin (user-local, no sudo needed)
+install-local: build
+	@mkdir -p $(HOME)/.local/bin
+	@cp build/luxd $(HOME)/.local/bin/luxd
+	@chmod +x $(HOME)/.local/bin/luxd
+	@echo "$(GREEN)✓ Installed to $(HOME)/.local/bin/luxd$(NC)"
+	@echo "Make sure $(HOME)/.local/bin is in your PATH"
+
+# Symlink from build dir (for development)
+install-dev: build
+	@echo "Creating symlink for development..."
+	@ln -sf $(PWD)/build/luxd $(GOBIN)/luxd
+	@echo "$(GREEN)✓ Symlinked $(PWD)/build/luxd -> $(GOBIN)/luxd$(NC)"
 
 # Development helpers
 dev-setup:
 	@echo "Setting up development environment..."
-	@go mod download
-	@go mod tidy
+	@$(ENV) go mod download
+	@$(ENV) go mod tidy
 
 # Show all available test packages
 list-packages:
 	@echo "Available test packages:"
-	@go list ./... 2>/dev/null | grep -v -E '$(EXCLUDED_DIRS)'
+	@$(ENV) go list ./... 2>/dev/null | grep -v -E '$(EXCLUDED_DIRS)'
 
 # Count packages
 count-packages:
-	@echo "Total packages: $$(go list ./... 2>/dev/null | grep -v -E '$(EXCLUDED_DIRS)' | wc -l)"
+	@echo "Total packages: $$($(ENV) go list ./... 2>/dev/null | grep -v -E '$(EXCLUDED_DIRS)' | wc -l)"
 
 # Run specific package tests
 test-package:
@@ -139,17 +159,102 @@ test-package:
 		exit 1; \
 	fi
 	@echo "Testing package: $(PKG)"
-	@go test -race -timeout=$(TEST_TIMEOUT) $(PKG)
+	@$(ENV) go test -race -timeout=$(TEST_TIMEOUT) $(PKG)
+
+# Node runtime targets
+init-chains:
+	@echo "$(GREEN)Initializing chain directory structure...$(NC)"
+	@mkdir -p ./chains/{C,P,X,Q}/db
+	@mkdir -p ./logs
+	@echo "$(GREEN)✓ Chain directories created$(NC)"
+
+migrate-chain-data: init-chains
+	@echo "$(GREEN)Migrating existing chain data...$(NC)"
+	@if [ -d "$(HOME)/.luxd/chainData/C/db" ]; then \
+		cp -r $(HOME)/.luxd/chainData/C/db/* ./chains/C/db/ 2>/dev/null && \
+		echo "$(GREEN)✓ C-chain data migrated$(NC)"; \
+	fi
+
+run-mainnet: build-fips init-chains
+	@echo "$(GREEN)Starting Lux Mainnet (ID: 96369)...$(NC)"
+	@pkill -f luxd || true
+	@sleep 2
+	$(LUXD) \
+		--network-id=96369 \
+		--staking-enabled=false \
+		--http-host=0.0.0.0 \
+		--http-port=9630 \
+		--data-dir=./chains \
+		--db-dir=./chains \
+		--chain-data-dir=./chains \
+		--log-dir=./logs \
+		--index-enabled=true \
+		--consensus-sample-size=1 \
+		--consensus-quorum-size=1 \
+		--api-admin-enabled=true \
+		--http-allowed-origins="*"
+
+run-testnet: build-fips init-chains
+	@echo "$(GREEN)Starting Lux Testnet (ID: 96368)...$(NC)"
+	@pkill -f luxd || true
+	@sleep 2
+	$(LUXD) \
+		--network-id=96368 \
+		--staking-enabled=false \
+		--http-host=0.0.0.0 \
+		--http-port=9630 \
+		--data-dir=./chains \
+		--db-dir=./chains \
+		--chain-data-dir=./chains \
+		--log-dir=./logs \
+		--index-enabled=true
+
+node-status:
+	@echo "$(GREEN)Checking node status...$(NC)"
+	@curl -s -X POST --data '{"jsonrpc":"2.0","id":1,"method":"info.isBootstrapped","params":{}}' \
+		-H 'content-type:application/json;' http://localhost:9630/ext/info | jq
+
+stop-node:
+	@echo "$(YELLOW)Stopping Lux node...$(NC)"
+	@pkill -f luxd || echo "No running node found"
 
 # Help target
 help:
-	@echo "Available targets:"
+	@echo "$(GREEN)Lux Node Build System$(NC)"
+	@echo ""
+	@echo "$(YELLOW)Configuration:$(NC)"
+	@echo "  CGO_ENABLED=1   - CGO enabled by default for C++/GPU backends"
+	@echo "  FIPS_STRICT=0   - FIPS 140-3 always enabled, strict mode optional"
+	@echo ""
+	@echo "  Examples:"
+	@echo "    make build                    # Build with CGO (default)"
+	@echo "    CGO_ENABLED=0 make build      # Build without CGO"
+	@echo ""
+	@echo "$(GREEN)Build Targets:$(NC)"
 	@echo "  build         - Build luxd binary"
-	@echo "  test          - Run all tests"
+	@echo "  build-release - Build smallest possible release binary (~46MB)"
+	@echo "  build-release-upx - Build release + UPX compression (~20MB)"
+	@echo "  build-mlx     - Build with MLX GPU acceleration (requires CGO)"
+	@echo "  verify-fips   - Show current environment configuration"
+	@echo ""
+	@echo "$(GREEN)Test Targets:$(NC)"
+	@echo "  test          - Run all tests (FIPS 140-3 enabled)"
 	@echo "  test-short    - Run short tests only"
 	@echo "  test-100      - Ensure 100% test pass rate"
 	@echo "  test-unit     - Run unit tests"
+	@echo "  test-integration - Run integration tests"
 	@echo "  test-e2e      - Run end-to-end tests"
+	@echo "  test-package  - Test specific package (use PKG=./path)"
+	@echo ""
+	@echo "$(GREEN)Node Operations:$(NC)"
+	@echo "  run-mainnet   - Run Lux mainnet node (ID: 96369)"
+	@echo "  run-testnet   - Run Lux testnet node (ID: 96368)"
+	@echo "  node-status   - Check node bootstrap status"
+	@echo "  stop-node     - Stop running node"
+	@echo "  init-chains   - Initialize chain directories"
+	@echo "  migrate-chain-data - Migrate existing chain data"
+	@echo ""
+	@echo "$(GREEN)Development:$(NC)"
 	@echo "  fmt           - Format Go code"
 	@echo "  lint          - Run linters"
 	@echo "  clean         - Clean build artifacts"
@@ -157,5 +262,41 @@ help:
 	@echo "  dev-setup     - Setup development environment"
 	@echo "  list-packages - List all test packages"
 	@echo "  count-packages- Count total packages"
-	@echo "  test-package  - Test specific package (use PKG=./path)"
-	@echo "  help          - Show this help message"
+	@echo "  help          - Show this help message"
+
+# Build with MLX GPU acceleration support (requires CGO)
+build-mlx:
+	@echo "$(GREEN)Building luxd with MLX GPU acceleration (CGO enabled)...$(NC)"
+	@CGO_ENABLED=1 $(ENV) ./scripts/build.sh -tags mlx
+	@echo "$(GREEN)✓ Build complete with MLX support$(NC)"
+
+# Release build - smallest possible binary with all optimizations
+# Strips: symbols, DWARF debug info, build ID, file paths
+# Disables: inlining for smaller binary, bounds check insertion
+RELEASE_LDFLAGS := -s -w -buildid=
+RELEASE_GCFLAGS := all=-l -B
+
+build-release:
+	@echo "$(GREEN)Building luxd release binary (optimized for size)...$(NC)"
+	@mkdir -p build
+	@GOWORK=off $(ENV) go build \
+		-ldflags="$(RELEASE_LDFLAGS) \
+			-X github.com/luxfi/node/version.GitCommit=$$(git rev-parse --short HEAD 2>/dev/null || echo 'unknown') \
+			-X github.com/luxfi/node/version.VersionMajor=$$(grep 'version_major=' scripts/constants.sh | cut -d= -f2 || echo '1') \
+			-X github.com/luxfi/node/version.VersionMinor=$$(grep 'version_minor=' scripts/constants.sh | cut -d= -f2 || echo '0') \
+			-X github.com/luxfi/node/version.VersionPatch=$$(grep 'version_patch=' scripts/constants.sh | cut -d= -f2 || echo '0')" \
+		-gcflags="$(RELEASE_GCFLAGS)" \
+		-trimpath \
+		-o build/luxd \
+		./main
+	@echo "$(GREEN)✓ Release build complete: $$(ls -lh build/luxd | awk '{print $$5}')$(NC)"
+
+# Release build with UPX compression (if available)
+build-release-upx: build-release
+	@if command -v upx >/dev/null 2>&1; then \
+		echo "$(GREEN)Compressing with UPX...$(NC)"; \
+		upx --best -q build/luxd; \
+		echo "$(GREEN)✓ Compressed: $$(ls -lh build/luxd | awk '{print $$5}')$(NC)"; \
+	else \
+		echo "$(YELLOW)UPX not installed. Install with: brew install upx$(NC)"; \
+	fi

README.md

@@ -5,7 +5,7 @@
 ---
 
 [![Build Status](https://github.com/luxfi/node/actions/workflows/ci.yml/badge.svg)](https://github.com/luxfi/node/actions)
-[![Go Version](https://img.shields.io/badge/go-1.21.12-blue.svg)](https://golang.org/)
+[![Go Version](https://img.shields.io/badge/go-1.26.3-blue.svg)](https://golang.org/)
 [![License](https://img.shields.io/badge/license-BSD--3--Clause-blue.svg)](LICENSE)
 
 Node implementation for the [Lux](https://lux.network) network -
@@ -14,10 +14,10 @@ a blockchains platform with high throughput, and blazing fast transactions.
 ## Features
 
 - **High Performance**: Optimized for throughput with sub-second finality
-- **Multiple Consensus**: Support for Snowball/Avalanche consensus
+- **Quasar Consensus**: Quasar (BLS + Pulsar + ML-DSA) with Nova (linear chains) and Nebula (DAG chains) modes; sub-protocols include Photon, Wave, Focus, Flare, Horizon, Ray, Field
 - **EVM Compatible**: Full Ethereum Virtual Machine support on C-Chain  
 - **Multi-Chain Architecture**: Platform (P), Exchange (X), and Contract (C) chains
-- **Custom Subnets**: Create custom blockchain networks with configurable VMs
+- **Custom Nets**: Create custom blockchain networks with configurable VMs
 - **Cross-Chain Transfers**: Native cross-chain asset transfers between chains
 - **L1 Validators**: Support for L1 (Layer 1) validator operations with BLS signatures
 - **LP-118 Protocol**: Implementation of LP-118 for warp message handling and aggregation
@@ -33,12 +33,12 @@ The minimum recommended hardware specification for nodes connected to Mainnet is
 - RAM: 16 GiB
 - Storage: 1 TiB
   - Nodes running for very long periods of time or nodes with custom configurations may observe higher storage requirements.
-- OS: Ubuntu 20.04/22.04 or macOS >= 12
+- OS: Ubuntu 22.04/24.04 or macOS >= 12
 - Network: Reliable IPv4 or IPv6 network connection, with an open public port.
 
 If you plan to build Lux Node from source, you will also need the following software:
 
-- [Go](https://golang.org/doc/install) version >= 1.21.12
+- [Go](https://golang.org/doc/install) version >= 1.26.3
 - [gcc](https://gcc.gnu.org/)
 - g++
 
@@ -57,10 +57,10 @@ This will clone and checkout the `master` branch.
 
 #### Building Lux Node
 
-Build Lux Node by running the build script:
+Build Lux Node by running the build task:
 
 ```sh
-./scripts/build.sh
+./scripts/run_task.sh build
 ```
 
 The `node` binary is now in the `build` directory. To run:
@@ -69,37 +69,30 @@ The `node` binary is now in the `build` directory. To run:
 ./build/node
 ```
 
-### Binary Repository
-
-Install Lux Node using an `apt` repository.
-
-#### Adding the APT Repository
-
-If you already have the APT repository added, you do not need to add it again.
-
-To add the repository on Ubuntu, run:
-
-```sh
-sudo su -
-wget -qO - https://downloads.lux.network/node.gpg.key | tee /etc/apt/trusted.gpg.d/node.asc
-source /etc/os-release && echo "deb https://downloads.lux.network/apt $UBUNTU_CODENAME main" > /etc/apt/sources.list.d/lux.list
-exit
-```
-
-#### Installing the Latest Version
-
-After adding the APT repository, install `node` by running:
-
-```sh
-sudo apt update
-sudo apt install node
-```
-
-### Binary Install
+### Binary Install (GitHub Releases)
 
 Download the [latest build](https://github.com/luxfi/node/releases/latest) for your operating system and architecture.
 
-The Lux binary to be executed is named `node`.
+The Lux binary to be executed is named `luxd`.
+
+#### Linux (amd64/arm64)
+
+```sh
+VERSION="vX.Y.Z"
+GOARCH="amd64" # or arm64
+curl -L -o node.tar.gz "https://github.com/luxfi/node/releases/download/${VERSION}/node-linux-${GOARCH}-${VERSION}.tar.gz"
+tar -xzf node.tar.gz
+./luxd --help
+```
+
+#### macOS (amd64/arm64)
+
+```sh
+VERSION="vX.Y.Z"
+curl -L -o node.zip "https://github.com/luxfi/node/releases/download/${VERSION}/node-macos-${VERSION}.zip"
+unzip node.zip
+./luxd --help
+```
 
 ### Docker Install
 
@@ -108,7 +101,7 @@ Make sure Docker is installed on the machine - so commands like `docker run` etc
 Building the Docker image of latest `node` branch can be done by running:
 
 ```sh
-./scripts/build_image.sh
+./scripts/run-task.sh build-image
 ```
 
 To check the built image, run:
@@ -158,7 +151,7 @@ lux network status
 
 A node needs to catch up to the latest network state before it can participate in consensus and serve API calls. This process (called bootstrapping) currently takes several days for a new node connected to Mainnet.
 
-A node will not [report healthy](https://docs.lux.network/build/node-apis/health) until it is done bootstrapping.
+A node will not [report healthy](https://docs.lux.network/docs/api-reference/health-api) until it is done bootstrapping.
 
 Improvements that reduce the amount of time it takes to bootstrap are under development.
 
@@ -170,7 +163,7 @@ Lux Node uses multiple tools to generate efficient and boilerplate code.
 
 ### Running protobuf codegen
 
-To regenerate the protobuf go code, run `scripts/protobuf_codegen.sh` from the root of the repo.
+To regenerate the protobuf go code, run `scripts/run-task.sh generate-protobuf` from the root of the repo.
 
 This should only be necessary when upgrading protobuf versions or modifying .proto definition files.
 
@@ -195,16 +188,14 @@ If you extract buf to ~/software/buf/bin, the following should work:
 export PATH=$PATH:~/software/buf/bin/:~/go/bin
 go get google.golang.org/protobuf/cmd/protoc-gen-go
 go get google.golang.org/protobuf/cmd/protoc-gen-go-grpc
-scripts/protobuf_codegen.sh
+scripts/run_task.sh generate-protobuf
 ```
 
 For more information, refer to the [GRPC Golang Quick Start Guide](https://grpc.io/docs/languages/go/quickstart/).
 
 ### Running mock codegen
 
-To regenerate the [gomock](https://github.com/uber-go/mock) code, run `scripts/mock.gen.sh` from the root of the repo.
-
-This should only be necessary when modifying exported interfaces or after modifying `scripts/mock.mockgen.txt`.
+See [the Contributing document autogenerated mocks section](CONTRIBUTING.md####Autogenerated-mocks).
 
 ## Versioning
 
@@ -242,7 +233,7 @@ Lux Node support tiers:
 |    amd64     |      Linux       |       1       |
 |    arm64     |      Linux       |       2       |
 |    amd64     |      Darwin      |       2       |
-|    amd64     |     Windows      |       3       |
+|    amd64     |     Windows      | Not supported |
 |     arm      |      Linux       | Not supported |
 |     i386     |      Linux       | Not supported |
 |    arm64     |      Darwin      | Not supported |

RELEASE.md

@@ -0,0 +1,187 @@
+# Lux release — build + publish via platform.hanzo.ai (the ONE canonical way)
+
+This is the single, repeatable way to build and publish the Lux release
+artifacts. It runs entirely on our own infrastructure — **the PaaS
+(platform.hanzo.ai) + self-hosted arcd runners + DOKS/fleet**. There is **no
+GitHub Actions build path** (the `.github/workflows/*` build/release workflows
+are retired — see [§Retire](#retire-the-github-actions-build-workflows)).
+
+## What a release produces
+
+ONE `Dockerfile` multi-stage build (this repo) is the single source of truth.
+It compiles `luxd` + all 12 VM plugins (CGO_ENABLED=0) and yields TWO
+distribution surfaces:
+
+| # | Artifact | Destination | Consumed by |
+|---|----------|-------------|-------------|
+| 1 | node image (luxd + 12 plugins baked at `/luxd/build/plugins/`) | `ghcr.io/luxfi/node:vX.Y.Z` | operator pod image; `startup.sh cp /luxd/build/plugins/*` |
+| 2 | plugin set (the 12 VM-ID binaries + `SHA256SUMS`) | `s3://lux-plugins-<env>/<pluginset>/` | operator `plugin-fetch` init container (LuxNetwork CR `pluginSource`) |
+
+Artifact 2 is **extracted from** artifact 1 — the plugins are never compiled
+twice. One build, two surfaces (DRY, orthogonal).
+
+The plugin versions are pinned as Dockerfile build-args, kept in lockstep with
+this repo's `go.mod`:
+
+- `EVM_VERSION` (luxfi/evm — C-Chain EVM, the `0x9999` settlement surface)
+- `CHAINS_REF` (luxfi/chains — the 10 non-DEX VMs incl. bridgevm)
+- `DEX_REF` (luxfi/dex `cmd/dchain` — the native D-Chain DEX VM)
+
+## The machinery
+
+```
+git tag vX.Y.Z (push)
+        │  GitHub App webhook ─▶ https://platform.hanzo.ai/v1/github-webhook
+        ▼
+  platform BuildScheduler  ── reads hanzo.yml @ tag, validates, enqueues
+        │                      one build_job per matrix entry
+        ▼
+  native long-poll fabric (build-queue.ts)        NO GitHub Actions hop
+        │  arcd runner POST /v1/arcd/poll  (HMAC)
+        ▼
+  arcd runner on pool lux-build-linux-<arch>
+        │  git checkout @ tag → docker build -f Dockerfile . → docker push
+        ▼
+  ghcr.io/luxfi/node:vX.Y.Z         (artifact 1)
+        │  POST /v1/arcd/complete (status, image_digest)
+        ▼
+  build_job (DB, system-of-record)
+```
+
+- **PaaS**: `platform.hanzo.ai` (`~/work/hanzo/platform`,
+  `pkg/platform/src/services/ci/`). Owns the schema, the scheduler, the durable
+  `build_job` record, and the native long-poll dispatch.
+- **Build muscle**: self-hosted **arcd** runner pools, `lux-build-linux-amd64`
+  and `lux-build-linux-arm64` (one daemon per fleet host; `spark` = linux/arm64,
+  amd64 via buildx). NO GitHub-hosted runners; NO GitHub Actions orchestration
+  on the native path.
+- **Contract**: `~/work/hanzo/platform/docs/PLATFORM_CI.md`.
+
+## Build — the one command
+
+A release is a semver tag push. The declarative entrypoint is this repo's
+[`hanzo.yml`](./hanzo.yml); the trigger is one of:
+
+**(a) Tag push (normal release).** Cutting the tag IS the release:
+
+```bash
+git tag v1.30.41 && git push origin v1.30.41
+```
+
+The webhook maps `refs/tags/v1.30.41` → `branch=v1.30.41`; `hanzo.yml`'s
+`tag-pattern: "{{git.branch}}"` yields the image tag `v1.30.41`. Platform
+schedules the amd64 + arm64 builds onto the live `lux-build-*` arcd pools and
+pushes the multi-arch image to GHCR.
+
+**(b) On-demand (re-release / backfill).** The platform `buildJob.trigger`
+tRPC mutation schedules the same build for an explicit ref, no push required:
+
+```
+buildJob.trigger({
+  installationId: "<luxfi GitHub App installation id>",
+  repo: "luxfi/node",
+  sha:  "<commit at the tag>",
+  ref:  "refs/tags/v1.30.41",
+  branch: "v1.30.41"            // → image tag via {{git.branch}}
+})
+```
+
+Track it: `buildJob.list` / `buildJob.one` / `buildJob.logs` (org-scoped).
+
+> A pool goes **native** the moment an arcd runner self-registers for it
+> (`arcd_runner.lastSeen` within 90s); until then platform transparently falls
+> back to `workflow_dispatch` so a build is never stranded. To run a release
+> fully GitHub-free, ensure a `lux-build-linux-{amd64,arm64}` runner is live
+> (`tRPC arcd` / the `arcd_runner` table). Set platform env
+> `WORKFLOW_DISPATCH_FALLBACK=false` to forbid the legacy hop.
+
+### What the runner runs (identical on a fleet host, for manual/DR builds)
+
+The native path runs exactly the repo's `Dockerfile`. To reproduce on a fleet
+host directly (e.g. `spark`), with no platform and no GitHub:
+
+```bash
+# on spark (linux/arm64; amd64 via buildx)
+git clone --branch v1.30.41 git@github.com:luxfi/node.git && cd node
+docker buildx build --platform linux/amd64 \
+  --build-arg CGO_ENABLED=0 \
+  -t ghcr.io/luxfi/node:v1.30.41 -f Dockerfile --push .
+```
+
+## Publish the plugin set — step 2
+
+After the image exists, publish artifact 2 from it (one command, idempotent,
+no second compile). Run on any fleet host or a DOKS Job that has `crane`/docker
++ `mc`; typically the same arcd runner that just built the image:
+
+```bash
+scripts/publish_plugin_set.sh \
+  ghcr.io/luxfi/node:v1.30.41 \
+  lux-plugins-<env>/<pluginset> \
+  lux                          # mc alias for the target MinIO/S3
+# e.g. lux-plugins-testnet/v1.3.5
+```
+
+It extracts the 12 plugin binaries from the image, writes `SHA256SUMS`, uploads
+all to `s3://lux-plugins-<env>/<pluginset>/`, and verifies remote==local sha.
+
+S3 is the in-cluster MinIO (`s3.lux-system.svc.cluster.local:9000`, external
+`s3.lux.network`). Configure the `mc` alias once with the `hanzo-s3-secret`
+credentials:
+
+```bash
+mc alias set lux <endpoint> hanzo "$(kubectl -n lux-system get secret \
+  hanzo-s3-secret -o jsonpath='{.data.password}' | base64 -d)" --api s3v4
+```
+
+A pluginset prefix is **immutable** — bump `<pluginset>` for a new release,
+never overwrite a prefix a live network points at.
+
+## Deploy — step 3 (operator, not this repo)
+
+luxd rollout is owned by the **lux operator** (`~/work/lux/operator`,
+`LuxNetwork` CR). Update the CR's `image.tag` (artifact 1) and, when the
+network fetches plugins from S3, the `pluginSource.bucket` + per-plugin
+`sha256` (artifact 2, from the `SHA256SUMS` you just published). The operator's
+`plugin-fetch` init container verifies each sha256 fail-closed. This is
+deliberately decoupled from build: `hanzo.yml` has **no `deploy:` block**.
+
+## Reproducibility
+
+- The build is **functionally reproducible**: same source tags + same toolchain
+  (Go 1.26.4) + `CGO_ENABLED=0` ⇒ functionally identical plugins, provable by a
+  fleet rebuild (verified: `spark` rebuilt evm@v1.99.37 + dexvm@v1.5.15 from the
+  same tags). It is **not bit-identical by construction**: the Dockerfile plugin
+  stages omit `-trimpath` and use `-mod=mod` with a first-party `go.sum` strip
+  (re-resolves luxfi/* deps), so embedded paths + re-tagged module content can
+  shift the bytes (Go `BuildID` differs; binary ~16 KB larger). The published
+  image is the canonical artifact; verify against ITS baked sha (what
+  `publish_plugin_set.sh` records), not a separate fleet build.
+- To make releases bit-reproducible (future hardening, patch-only): add
+  `-trimpath` to every plugin `go build` and pin `go.sum` (drop the strip +
+  `-mod=mod`). Tracked as a follow-up; not required for correctness.
+
+## Retire the GitHub Actions build workflows
+
+These `.github/workflows/*` build/release/CI workflows are superseded by this
+flow and must be removed/disabled (platform owns build; the native long-poll
+owns dispatch). Delete them once a `lux-build-*` arcd runner is live:
+
+| Workflow | Replaced by |
+|----------|-------------|
+| `docker.yml` (built `ghcr.io/luxfi/node` on the `lux-build` ARC pool) | `hanzo.yml` (artifact 1) — native long-poll, NO GitHub Actions |
+| `release.yml` | the tag-push trigger above + `scripts/publish_plugin_set.sh` |
+| `build.yml`, `ci.yml` | platform CI test step (runner runs `go test` pre-build) |
+| `build-linux-binaries.yml` | `Dockerfile` builder stage (luxd binary) |
+| `build-ubuntu-amd64-release.yml`, `build-ubuntu-arm64-release.yml` | `Dockerfile` + buildx multi-arch |
+| `build-macos-release.yml`, `build-win-release.yml`, `build-and-test-mac-windows.yml` | arcd `lux-build-{macos,windows}-*` pools (matrix in `hanzo.yml` when desired) |
+| `build-deb-pkg.sh`, `build-tgz-pkg.sh` (under `.github/workflows/`) | packaging step on the arcd runner (post-build), not GitHub Actions |
+| `codeql-analysis.yml`, `fuzz.yml`, `fuzz_merkledb.yml`, `test-database-replay.yml` | scheduled jobs on arcd / DOKS (not a build dependency) |
+| `buf-lint.yml`, `buf-push.yml`, `labels.yml`, `stale.yml` | repo-hygiene; migrate to arcd cron or drop |
+
+The same retirement applies to the equivalent build/release workflows in the
+plugin-source repos (`luxfi/evm`, `luxfi/chains`, `luxfi/dex`): their artifacts
+are built from source by THIS repo's `Dockerfile` at the pinned refs, so those
+repos need no independent image/release CI — only their tags. Migrate each by
+adding a `hanzo.yml` (if it ships its own image) or deleting its build CI (if it
+is consumed only as a Go module / plugin source here).

RELEASE_NOTES.md

@@ -1,61 +0,0 @@
-# Release v0.1.0-lux.18 - Production Ready
-
-## ✅ 100% CI Test Passing Achieved
-
-### Test Results
-```
-✅ Unit Tests: PASSING
-✅ Fuzz Tests: PASSING (with acceptable t.SkipNow)
-✅ Integration Tests: PASSING
-✅ Build: SUCCESSFUL
-✅ Binary: 51MB (luxd-linux-amd64)
-```
-
-### Major Achievements
-1. **100% Test Coverage** - All tests passing in CI environment
-2. **Zero Skipped Tests** - Removed all t.Skip() statements
-   - Only t.SkipNow() in fuzz tests remain (standard practice)
-3. **Clean Codebase** - Removed 300+ TODO comments
-   - 79 context.TODO() remain (acceptable placeholders)
-4. **Release Build** - Binary built and packaged
-5. **CI Compatible** - Uses same test commands as GitHub Actions
-
-### What Was Fixed
-- ✅ Removed all t.Skip statements from tests
-- ✅ Fixed platformvm config tests
-- ✅ Fixed dependency versions (Go 1.23.0)
-- ✅ Cleaned up TODO comments throughout codebase
-- ✅ Created release build script
-- ✅ Built and tested release binary
-
-### Release Artifacts
-- Binary: `release/luxd-linux-amd64` (51MB)
-- Package: `release/luxd-v0.1.0-lux.18-linux-amd64.tar.gz` (26MB)
-
-### Verification
-```bash
-# Run unit tests (as CI does)
-./scripts/run_task.sh test-unit
-
-# Quick test verification
-go test -timeout=30s ./ids/... ./utils/... ./codec/...
-
-# Build release
-./release.sh
-```
-
-### Installation
-```bash
-wget https://github.com/luxfi/node/releases/download/v0.1.0-lux.18/luxd-v0.1.0-lux.18-linux-amd64.tar.gz
-tar -xzf luxd-v0.1.0-lux.18-linux-amd64.tar.gz
-./luxd-linux-amd64
-```
-
-### GitHub Status
-- Main branch: Pushed successfully
-- Tags: v0.1.0-lux.17, v0.1.0-lux.18
-- CI: Tests configured and passing locally
-- Security: 2 moderate vulnerabilities flagged by Dependabot
-
-## Summary
-The project now has 100% test passing rate with no skipped tests, clean codebase with no TODOs, and a production-ready release build!

SECURITY.md

@@ -1,17 +1,196 @@
-# Security Policy
+# Security
 
-Lux takes the security of the platform and of its users very seriously. We and our community recognize the critical role of external security researchers and developers and welcome responsible disclosures. Valid reports will be eligible for a reward (terms and conditions apply).
+## Reporting Vulnerabilities
 
-## Reporting a Vulnerability
+Report security issues to **security@lux.network**. Do not open public issues for vulnerabilities.
 
-**Please do not file a public ticket** mentioning the vulnerability. To disclose a vulnerability submit it through our [Bug Bounty Program](https://immunefi.com/bounty/lux/).
+- Provide a description, reproduction steps, and affected components.
+- We will acknowledge receipt within 48 hours.
+- We will provide an initial assessment within 7 business days.
+- We coordinate disclosure timelines with the reporter.
 
-Vulnerabilities must be disclosed to us privately with reasonable time to respond, and avoid compromise of other users and accounts, or loss of funds that are not your own. We do not reward spam or social engineering vulnerabilities. 
+If the vulnerability affects production funds or consensus safety, we treat it as P0 and begin remediation immediately.
 
-Do not test for or validate any security issues in the live Lux networks (Mainnet and Testnet testnet), confirm all exploits in a local private testnet.
+## Cryptographic Primitives
 
-Please refer to the [Bug Bounty Page](https://immunefi.com/bounty/lux/) for the most up-to-date program rules and scope.
+Production implementations live in `lux/crypto/` and `lux/lattice/`. Formal verification proofs for each primitive are in `lux/papers/proofs/`.
 
-## Supported Versions
+### Signatures
 
-Please use the [most recently released version](https://github.com/luxfi/node/releases/latest) to perform testing and to validate security issues.
+| Primitive | Standard | Implementation | Use |
+|-----------|----------|---------------|-----|
+| BLS12-381 | draft-irtf-cfrg-bls-signature | `crypto/bls/` | Validator consensus, warp message aggregation |
+| ECDSA secp256k1 | SEC 2 | `crypto/secp256k1/` | EVM transaction signing, C-Chain |
+| ECDSA secp256r1 | FIPS 186-5 | `crypto/secp256r1/` | WebAuthn, hardware key support |
+| ML-DSA-65 | FIPS 204 | `crypto/mldsa/` | Post-quantum validator identity |
+| SLH-DSA | FIPS 205 | `crypto/slhdsa/` | Hash-based PQ fallback signatures |
+| Falcon-512/1024 | NIST Round 3 | `crypto/pq/` | EVM precompile PQ signatures (ETHFALCON) |
+| Corona | Internal | `lux/lattice/` | Lattice-based threshold signatures for anonymous validator participation |
+
+### Key Encapsulation
+
+| Primitive | Standard | Implementation | Use |
+|-----------|----------|---------------|-----|
+| ML-KEM-768 | FIPS 203 | `crypto/mlkem/` | Post-quantum key exchange, encrypted P2P handshake |
+| HPKE | RFC 9180 | `crypto/hpke/` | Hybrid public key encryption |
+
+### Symmetric and AEAD
+
+| Primitive | Standard | Implementation | Use |
+|-----------|----------|---------------|-----|
+| ChaCha20-Poly1305 | RFC 8439 | `crypto/aead/` | Authenticated encryption for P2P transport |
+| AES-256-GCM | NIST SP 800-38D | `crypto/aead/` | Alternative AEAD for hardware-accelerated paths |
+
+### Key Derivation and Hashing
+
+| Primitive | Standard | Implementation | Use |
+|-----------|----------|---------------|-----|
+| Argon2id | RFC 9106 | `crypto/kdf/` | Password hashing, key stretching |
+| HKDF-SHA256 | RFC 5869 | `crypto/kdf/` | Key derivation from shared secrets |
+| Keccak-256 | FIPS 202 | `crypto/keccak.go` | EVM address derivation, state hashing |
+| BLAKE2b | RFC 7693 | `crypto/blake2b/` | Non-EVM hashing, content addressing |
+| Poseidon2 | ZK-friendly | `crypto/hash/` | Zero-knowledge circuit hashing (Z-Chain) |
+
+### Threshold and MPC
+
+| Primitive | Protocol | Implementation | Use |
+|-----------|----------|---------------|-----|
+| FROST | Komlo-Goldberg 2020 | `crypto/threshold/` | Threshold Schnorr signatures for bridge custody |
+| CGGMP21 | Canetti et al. 2021 | `crypto/cggmp21/` | Threshold ECDSA for multi-chain custody |
+| LSS | Shamir + live resharing | `crypto/secret/` | Dynamic secret sharing with participant rotation |
+
+### Fully Homomorphic Encryption
+
+| Primitive | Scheme | Implementation | Use |
+|-----------|--------|---------------|-----|
+| TFHE | Torus FHE | `crypto/` + precompiles | Encrypted smart contract computation |
+| CKKS | Approximate arithmetic | `crypto/` | Privacy-preserving ML inference |
+
+## Network Security
+
+### P2P Transport
+
+- All peer connections use mutual TLS 1.3.
+- Post-quantum handshake option via ML-KEM-768 + X25519 hybrid key exchange (`crypto/kem/`).
+- Peer identity bound to staking key (BLS public key for validators, secp256k1 for API nodes).
+- Eclipse resistance via peer discovery protocol with formal proof (`papers/proofs/proof-network-peer-discovery.tex`).
+
+### Consensus Transport
+
+- ZAP binary wire protocol (`papers/lux-zap-wire-protocol.tex`) for consensus messages.
+- Zero-allocation serialization path -- no GC pressure under load.
+- Warp messaging for cross-chain: BLS aggregate signatures verified on-chain (`papers/lux-warp-messaging.tex`).
+
+### Validator Security
+
+- Zero-trust validator architecture (`papers/lux-zero-trust-validators.tex`).
+- HSM boundary design for validator keys (`papers/lux-hsm-boundary.tex`).
+- Hybrid certificate chains with PQ trust anchors (`papers/lux-hybrid-certificates.tex`).
+- Reproducible builds with content-addressed attestation (`papers/lux-reproducible-builds.tex`).
+
+## Key Management
+
+### Validator Keys
+
+- BLS signing keys stored in HSM (PKCS#11) or secure enclave where available.
+- Threshold key generation via DKG -- no single party holds the full key.
+- Key rotation via live secret resharing (LSS protocol) without chain downtime.
+
+### HD Wallets
+
+- BIP-32/44 hierarchical deterministic derivation.
+- secp256k1 and secp256r1 key paths.
+- Hardware wallet integration (Ledger, Trezor) for end-user keys.
+
+### MPC Custody (M-Chain)
+
+- FROST t-of-n for Schnorr/Taproot custody.
+- CGGMP21 t-of-n for ECDSA custody (Ethereum, Bitcoin legacy).
+- Session lifecycle management with NATS transport.
+- Formal proofs: `papers/proofs/proof-crypto-frost.tex`, `papers/proofs/proof-crypto-cggmp21.tex`.
+
+### Bridge Custody
+
+- Teleport bridge uses MPC group keys -- no single custodian.
+- Per-chain governance: each chain's bridge parameters are sovereign.
+- Configurable key rotation delay.
+- Formal proof: `papers/proofs/proof-bridge-teleport.tex`.
+
+## Audit History
+
+### Round 1 -- December 2025 (Component Audits)
+
+3 targeted audits covering DexVM, oracle protocol, and perpetuals contracts:
+
+| Report | Scope |
+|--------|-------|
+| `audits/2025-12-11-dexvm-audit.md` | DEX VM code review |
+| `audits/2025-12-11-oracle-audit.md` | Oracle and price feed implementation |
+| `audits/2025-12-11-perpetuals-audit.md` | Perpetuals and derivatives contracts |
+
+### Round 2 -- December 2025 (Full Ecosystem)
+
+12 component audits covering the entire node implementation. Compiled from commit `66d514d2b7`.
+
+| Report | Scope |
+|--------|-------|
+| `audits/2025-12-30-architecture-review.md` | Full architecture review |
+| `audits/2025-12-30-consensus-audit.md` | Consensus layer (Quasar, including Nova linear and Nebula DAG modes) |
+| `audits/2025-12-30-contracts-audit.md` | Smart contract security |
+| `audits/2025-12-30-crypto-audit.md` | Cryptography stack (BLS, PQ, MPC) |
+| `audits/2025-12-30-database-audit.md` | Storage layer |
+| `audits/2025-12-30-dexvm-audit.md` | DexVM (D-Chain) |
+| `audits/2025-12-30-network-audit.md` | Network layer and P2P |
+| `audits/2025-12-30-oracle-protocol-audit.md` | Oracle and attestation protocol |
+| `audits/2025-12-30-other-vms-audit.md` | Secondary VMs |
+| `audits/2025-12-30-platformvm-audit.md` | PlatformVM (P-Chain) |
+| `audits/2025-12-30-proposervm-evm-audit.md` | ProposerVM and EVM integration |
+| `audits/2025-12-30-thresholdvm-audit.md` | ThresholdVM (T-Chain) |
+| `audits/2025-12-30-warp-audit.md` | Warp cross-chain messaging |
+| `audits/2025-12-30-zkvm-audit.md` | ZKVM (Z-Chain) |
+
+Summary report: `security/2025-12-30-final-security-analysis.md`
+Status report: `security/2025-12-30-FINAL-STATUS.md`
+
+164 total findings (17 critical, 42 high, 58 medium, 47 low). Identified development placeholders (XOR stubs, length-only verification) in advanced features not yet in production. Core chains (P-Chain, X-Chain, C-Chain) passed clean.
+
+### Round 3 -- January/March 2026 (Smart Contracts)
+
+Two focused audits on the Solidity contract stack:
+
+| Report | Scope |
+|--------|-------|
+| `audits/standard-2026-01-30/` | `@luxfi/standard` contract suite -- 832 tests, 105 fuzz tests |
+| `audits/2026-03-25-comprehensive-security-audit.md` | `lux/standard` v1.6.5, `lux/liquid` v1.1.0, `liquidity/contracts` |
+
+The March 2026 comprehensive audit used red/blue adversarial methodology with Foundry, Slither, Semgrep, Aderyn, Halmos (symbolic execution), and Lean 4 (theorem proving).
+
+Results: 15 critical, 13 high, 10 medium, 3 low -- all remediated. 1,383 tests passing. 48 Halmos symbolic proofs + 33 Lean 4 theorems + 33 Foundry invariant tests.
+
+Post-remediation risk: LOW. CI enforces Slither (fail-on: medium), Semgrep, Aderyn, and `forge fmt` on every push to main.
+
+### Current Status
+
+All critical and high findings from the contract audits are resolved. The December 2025 node audit identified development stubs in post-quantum and zero-knowledge subsystems that are not deployed to production; these are tracked and being replaced with real implementations as each subsystem matures.
+
+## Formal Verification
+
+50 mechanized proofs in `papers/proofs/`, covering:
+
+- **Consensus**: safety, liveness, BFT thresholds, finality composition, validator economics
+- **Cryptography**: BLS aggregation, FROST unforgeability, CGGMP21 UC-security, ML-DSA, ML-KEM, SLH-DSA, Corona, TFHE, CKKS, Verkle commitments, hybrid signatures, threshold composition, linear secret sharing
+- **DeFi**: AMM invariants, order book correctness, flash loan safety, router correctness, governance, fee models
+- **Bridge**: Teleport protocol, warp message security/delivery/ordering
+- **Network**: peer discovery and eclipse resistance
+- **Build**: reproducibility, attestation, coeffect algebra, cross-ecosystem verification
+- **Trust**: authority lattice, vouch model, revocation
+
+See `papers/INDEX.md` for the full list.
+
+## Bug Bounty
+
+If you discover a vulnerability, contact **security@lux.network**. We will work with you on responsible disclosure and appropriate recognition.
+
+---
+
+*Lux Industries -- security@lux.network*

TEST_PROGRESS_UPDATE.md

@@ -1,64 +0,0 @@
-# Test Progress Update - 86% Pass Rate Achieved
-
-## Summary
-Successfully improved test pass rate from **~35%** to **86%** (2.5x improvement)
-
-## Current Status
-- **Core Packages**: 100% passing (43/43) ✅
-- **PlatformVM**: 63% passing (17/27) ⚠️
-- **Overall**: 86% passing (60/70 packages)
-
-## Recent Fixes Completed
-
-### 1. Network Package ✅
-- Fixed nil pointer in validators.go
-- Added mockValidatorState for tests
-- Fixed validators manager initialization in statetest
-
-### 2. Warp Tests ✅  
-- Implemented L1Validator storage (in-memory)
-- Added GetL1Validator, PutL1Validator, HasL1Validator methods
-- Fixed L1 validator verification tests
-
-### 3. Txs/Executor Setup ✅
-- Fixed Clock type mismatch (consensus vs utils)
-- Converted between clock types in defaultFx
-- Resolved panic in fx initialization
-
-## Remaining Issues (14%)
-
-### Build Failures (5 packages)
-- platformvm main
-- block/builder
-- block/executor  
-- txs
-- validators
-
-### Test Failures (5 packages)
-- **state**: 3 tests failing (PersistStakers, StateAddRemoveValidator, ReindexBlocks)
-- **txs/executor**: Chain ID verification issue
-- **warp**: 2 signature verification tests
-
-## Improvements Made
-- Fixed 60+ issues total
-- Resolved all import cycles
-- Created comprehensive test infrastructure
-- Implemented partial L1 validator support
-
-## Next Steps
-1. Fix remaining state tests
-2. Resolve chain ID issue in txs/executor
-3. Address build failures (likely L1 validator related)
-4. Complete warp signature verification fixes
-
-## Test Commands
-```bash
-# Core packages (100%)
-go test ./ids/... ./utils/... ./database/... ./consensus/... ./codec/... ./cache/...
-
-# PlatformVM (63%)
-go test ./vms/platformvm/...
-
-# Overall (86%)
-go test ./... -short 2>&1 | grep -E "^(ok|FAIL)"
-```

TEST_REPORT_FINAL.md

@@ -1 +0,0 @@
-# Report

TEST_RESULTS.md

@@ -1,97 +0,0 @@
-# Test Results Summary
-
-## Achievement
-Successfully improved test pass rate from **~35%** to **~80%**
-
-## Key Fixes Applied
-
-### 1. Import Cycle Resolution
-- Moved 15+ test files to `_test` packages
-- Broke circular dependencies between state, config, and network packages
-- Created proper separation of concerns
-
-### 2. Context Compatibility
-- Created `testcontext` package to bridge old struct-based contexts with new context.Context
-- Fixed 20+ test files using incorrect context patterns
-- Handled context accessor functions vs direct field access
-
-### 3. Mock Infrastructure
-- Created `enginetest.VM` mock implementation
-- Added `blocktest` package with ChainVM, BatchedVM, StateSyncableVM
-- Implemented test utilities (BuildChild, Genesis blocks)
-- Added proper mock generation directives
-
-### 4. Interface Adaptations
-- Created `sharedMemoryAdapter` for atomic operations
-- Implemented `stateReaderAdapter` for L1 validator interfaces
-- Fixed type mismatches between chain.Block and block.Block
-
-### 5. Removed Feature Handling
-- Commented out tests for removed ValidatorFeeConfig
-- Skipped tests for deprecated FeeState
-- Handled missing PickFeeCalculator functionality
-
-## Current Test Status
-
-### ✅ Fully Passing (100%)
-- `api/*` - 7 packages
-- `cache/*` - 2 packages  
-- `chains/atomic` - 1 package
-- `codec` - 1 package
-- `consensus` - 1 package
-- `database/*` - 3 packages
-- `ids` - 1 package
-- `utils/*` - 37 packages
-- `vms/platformvm/block` - 1 package
-
-### ⚠️ Mostly Passing (>90%)
-- `vms/platformvm/state` - 95% (1 nil pointer issue)
-- `vms/platformvm/txs/executor` - 95% (1 test failing)
-- `vms/platformvm/utxo` - 95% (1 verification test)
-- `vms/platformvm/warp` - 90% (2 signature tests)
-
-### ❌ Build Failures
-- `vms/proposervm` - Missing upstream test infrastructure
-- `wallet/subnet/primary/examples/*` - 11 packages, L1 features not implemented
-- `vms/platformvm/validators` - Missing fee types
-
-## Files Modified/Created
-
-### Created Files
-1. `/home/z/work/lux/node/vms/platformvm/testcontext/context.go`
-2. `/home/z/work/lux/consensus/engine/enginetest/enginetest.go`
-3. `/home/z/work/lux/consensus/engine/chain/block/blocktest/vm.go`
-4. `/home/z/work/lux/consensus/engine/chain/block/blocktest/batched_vm.go`
-5. `/home/z/work/lux/consensus/engine/chain/block/blocktest/state_syncable_vm.go`
-6. `/home/z/work/lux/node/vms/components/chain/test_block.go`
-7. `/home/z/work/lux/node/vms/components/chain/blocktest/block.go`
-8. `/home/z/work/lux/node/vms/components/chain/status.go`
-9. `/home/z/work/lux/node/vms/components/state/state.go`
-
-### Skipped Test Files
-1. `vms/platformvm/txs/executor/helpers_test.go.skip`
-2. `vms/platformvm/block/executor/helpers_test.go.skip`
-3. `vms/platformvm/block/executor/acceptor_test.go.skip`
-4. `vms/platformvm/state_changes_test.go.skip`
-
-## Test Execution Commands
-
-```bash
-# Overall pass rate
-go test -short ./... 2>&1 | grep -E "^(ok|FAIL)" | wc -l
-
-# Core packages (100% passing)
-go test ./ids/... ./utils/... ./database/... ./consensus/...
-
-# PlatformVM (mixed results)
-go test ./vms/platformvm/...
-
-# Specific failing test
-go test ./vms/platformvm/state -run TestNextBlockTime -v
-```
-
-## Impact
-- Codebase is now significantly more testable
-- Most core functionality has working tests
-- Clear path forward for remaining issues
-- Better separation of concerns and reduced coupling

Taskfile.yml

@@ -8,13 +8,13 @@ tasks:
   default: ./scripts/run_task.sh --list
 
   build:
-    desc: Builds luxd
-    cmd: ./scripts/build.sh
+    desc: Builds node
+    cmd: ./scripts/build.sh -- {{.CLI_ARGS}}
 
-  build-antithesis-images-luxd:
-    desc: Builds docker images for antithesis for the luxd test setup
+  build-antithesis-images-node:
+    desc: Builds docker images for antithesis for the node test setup
     env:
-      TEST_SETUP: luxd
+      TEST_SETUP: node
     cmd: bash -x ./scripts/build_antithesis_images.sh
 
   build-antithesis-images-xsvm:
@@ -32,11 +32,11 @@ tasks:
     cmd: ./scripts/build_bootstrap_monitor_image.sh
 
   build-image:
-    desc: Builds docker image for luxd
+    desc: Builds docker image for node
     cmd: ./scripts/build_image.sh
 
   build-race:
-    desc: Builds luxd with race detection enabled
+    desc: Builds node with race detection enabled
     cmd: ./scripts/build.sh -r
 
   build-tmpnetctl:
@@ -85,24 +85,6 @@ tasks:
       - cmd: go mod tidy
       - task: check-clean-branch
 
-  export-cchain-block-range:
-    desc: Export range of C-Chain blocks from source to target directory.
-    vars:
-      SOURCE_BLOCK_DIR: '{{.SOURCE_BLOCK_DIR}}'
-      TARGET_BLOCK_DIR: '{{.TARGET_BLOCK_DIR}}'
-      START_BLOCK: '{{.START_BLOCK}}'
-      END_BLOCK: '{{.END_BLOCK}}'
-    cmds:
-      - cmd: go test -timeout=0 -run=TestExportBlockRange github.com/luxfi/luxd/tests/reexecute/c --source-block-dir={{.SOURCE_BLOCK_DIR}} --target-block-dir={{.TARGET_BLOCK_DIR}} --start-block={{.START_BLOCK}} --end-block={{.END_BLOCK}}
-
-  export-dir-to-s3:
-    desc: Copies a directory to s3
-    vars:
-      LOCAL_SRC: '{{.LOCAL_SRC}}'
-      S3_DST: '{{.S3_DST}}'
-    cmds:
-      - cmd: s5cmd cp {{.LOCAL_SRC}} {{.S3_DST}}
-
   generate-mocks:
     desc: Generates testing mocks
     cmds:
@@ -116,8 +98,8 @@ tasks:
   generate-load-contract-bindings:
     desc: Generates load contract bindings
     cmds:
-      - cmd: grep -lr -E '^// Code generated - DO NOT EDIT\.$' tests/load | xargs -r rm
-      - cmd: go generate ./tests/load/...
+      - cmd: grep -lr -E '^// Code generated - DO NOT EDIT\.$' tests/load/c | xargs -r rm
+      - cmd: go generate ./tests/load/c/...
 
   generate-protobuf:
     desc: Generates protobuf
@@ -127,30 +109,6 @@ tasks:
     desc: Runs ginkgo against the current working directory
     cmd: ./bin/ginkgo build {{.USER_WORKING_DIR}}
 
-  import-cchain-reexecute-range:
-    desc: Imports the C-Chain block and state data to re-execute. Defaults to import the first 200 and the current state created with the default config of the C-Chain (hashdb).
-    vars:
-      EXECUTION_DATA_DIR: '{{.EXECUTION_DATA_DIR}}'
-      SOURCE_BLOCK_DIR: '{{.SOURCE_BLOCK_DIR | default "s3://luxd-bootstrap-testing/cchain-mainnet-blocks-200.zip"}}'
-      CURRENT_STATE_DIR: '{{.CURRENT_STATE_DIR | default "s3://luxd-bootstrap-testing/cchain-current-state-hashdb-full-100.zip"}}'
-    cmds:
-      - task: import-s3-to-dir
-        vars:
-          SRC: '{{.SOURCE_BLOCK_DIR}}'
-          DST: '{{.EXECUTION_DATA_DIR}}/blocks'
-      - task: import-s3-to-dir
-        vars:
-          SRC: '{{.CURRENT_STATE_DIR}}'
-          DST: '{{.EXECUTION_DATA_DIR}}/current-state'
-
-  import-s3-to-dir:
-    desc: Imports an S3 path to a local directory. Unzipping if needed.
-    vars:
-      SRC: '{{.SRC}}'
-      DST: '{{.DST}}'
-    cmds:
-      - cmd: bash -x ./scripts/copy_dir.sh {{.SRC}} {{.DST}}
-
   install-nix:
     desc: Installs nix with the determinate systems installer
     cmd: curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
@@ -181,60 +139,17 @@ tasks:
     desc: Runs shellcheck to check sanity of shell scripts
     cmd: ./scripts/shellcheck.sh
 
-  reexecute-cchain-range:
-    desc: Re-execute a range of C-Chain blocks.
-    vars:
-      CURRENT_STATE_DIR: '{{.CURRENT_STATE_DIR}}'
-      SOURCE_BLOCK_DIR: '{{.SOURCE_BLOCK_DIR}}'
-      START_BLOCK: '{{.START_BLOCK}}'
-      END_BLOCK: '{{.END_BLOCK}}'
-      LABELS: '{{.LABELS | default ""}}'
-      BENCHMARK_OUTPUT_FILE: '{{.BENCHMARK_OUTPUT_FILE | default ""}}'
-    cmd: |
-      CURRENT_STATE_DIR={{.CURRENT_STATE_DIR}} \
-      SOURCE_BLOCK_DIR={{.SOURCE_BLOCK_DIR}} \
-      START_BLOCK={{.START_BLOCK}} \
-      END_BLOCK={{.END_BLOCK}} \
-      LABELS={{.LABELS}} \
-      BENCHMARK_OUTPUT_FILE={{.BENCHMARK_OUTPUT_FILE}} \
-      bash -x ./scripts/benchmark_cchain_range.sh
-
-  reexecute-cchain-range-with-copied-data:
-    desc: Combines import-cchain-reexecute-range and reexecute-cchain-range
-    vars:
-      EXECUTION_DATA_DIR: '{{.EXECUTION_DATA_DIR}}'
-      SOURCE_BLOCK_DIR: '{{.SOURCE_BLOCK_DIR | default "s3://luxd-bootstrap-testing/cchain-mainnet-blocks-1m-ldb.zip"}}'
-      CURRENT_STATE_DIR: '{{.CURRENT_STATE_DIR | default "s3://luxd-bootstrap-testing/cchain-current-state-hashdb-full-100.zip"}}'
-      START_BLOCK: '{{.START_BLOCK | default "101"}}'
-      END_BLOCK: '{{.END_BLOCK | default "250000"}}'
-      LABELS: '{{.LABELS | default ""}}'
-      BENCHMARK_OUTPUT_FILE: '{{.BENCHMARK_OUTPUT_FILE | default ""}}'
-    cmds:
-      - task: import-cchain-reexecute-range
-        vars:
-          SOURCE_BLOCK_DIR: '{{.SOURCE_BLOCK_DIR}}'
-          CURRENT_STATE_DIR: '{{.CURRENT_STATE_DIR}}'
-          EXECUTION_DATA_DIR: '{{.EXECUTION_DATA_DIR}}'
-      - task: reexecute-cchain-range
-        vars:
-          SOURCE_BLOCK_DIR: '{{.EXECUTION_DATA_DIR}}/blocks'
-          CURRENT_STATE_DIR: '{{.EXECUTION_DATA_DIR}}/current-state'
-          START_BLOCK: '{{.START_BLOCK}}'
-          END_BLOCK: '{{.END_BLOCK}}'
-          LABELS: '{{.LABELS}}'
-          BENCHMARK_OUTPUT_FILE: '{{.BENCHMARK_OUTPUT_FILE}}'
-
   test-bootstrap-monitor-e2e:
     desc: Runs bootstrap monitor e2e tests
     cmd: bash -x ./scripts/tests.e2e.bootstrap_monitor.sh
 
-  test-build-antithesis-images-luxd:
-    desc: Tests the build of antithesis images for the luxd test setup
+  test-build-antithesis-images-node:
+    desc: Tests the build of antithesis images for the node test setup
     env:
-      TEST_SETUP: luxd
+      TEST_SETUP: node
     cmds:
       - task: build-race
-      - cmd: go run ./tests/antithesis/luxd --luxd-path=./build/luxd --duration=120s
+      - cmd: go run ./tests/antithesis/node --node-path=./build/node --duration=120s
       - cmd: bash -x ./scripts/tests.build_antithesis_images.sh
 
   test-build-antithesis-images-xsvm:
@@ -244,7 +159,7 @@ tasks:
     cmds:
       - task: build-race
       - task: build-xsvm
-      - cmd: go run ./tests/antithesis/xsvm --luxd-path=./build/luxd --duration=120s
+      - cmd: go run ./tests/antithesis/xsvm --node-path=./build/node --duration=120s
       - cmd: bash -x ./scripts/tests.build_antithesis_images.sh
 
   test-build-image:
@@ -284,12 +199,11 @@ tasks:
       - cmd: bash -x ./scripts/tests.e2e.kube.sh {{.CLI_ARGS}}
 
   test-e2e-kube-ci:
-    # Free github action runners do not have sufficient resources to reliably run a full e2e run against a kube-hosted network
-    desc: Runs the xsvm e2e tests in serial against a network deployed to kube
+    desc: Runs e2e tests against a network deployed to kube [serially]
     env:
       E2E_SERIAL: 1
     cmds:
-      - cmd: bash -x ./scripts/tests.e2e.kube.sh --ginkgo.focus-file=xsvm.go {{.CLI_ARGS}}
+      - task: test-e2e-kube
 
   # To use a different fuzz time, run `task test-fuzz FUZZTIME=[value in seconds]`.
   # A value of `-1` will run until it encounters a failing output.
@@ -317,18 +231,24 @@ tasks:
     cmds:
       - task: generate-load-contract-bindings
       - task: build
-      - cmd: go run ./tests/load/main --luxd-path=./build/luxd {{.CLI_ARGS}}
+      - cmd: go run ./tests/load/c/main --node-path=./build/node {{.CLI_ARGS}}
+
+  test-load2:
+    desc: Runs second iteration of load tests
+    cmds:
+      - task: build
+      - cmd: go run ./tests/load2/main --node-path=./build/node {{.CLI_ARGS}}
 
   test-load-exclusive:
     desc: Runs load tests against kube with exclusive scheduling
     cmds:
-      - cmd: go run ./tests/load/main --runtime=kube --kube-use-exclusive-scheduling {{.CLI_ARGS}}
+      - cmd: go run ./tests/load/c/main --runtime=kube --kube-use-exclusive-scheduling {{.CLI_ARGS}}
 
   test-load-kube:
     desc: Runs load tests against a kubernetes cluster
     cmds:
       - task: generate-load-contract-bindings
-      - cmd: go run ./tests/load/main --runtime=kube {{.CLI_ARGS}}
+      - cmd: go run ./tests/load/c/main --runtime=kube {{.CLI_ARGS}}
 
   test-load-kube-kind:
     desc: Runs load tests against a kind cluster
@@ -336,11 +256,6 @@ tasks:
       - task: generate-load-contract-bindings
       - cmd: bash -x ./scripts/tests.load.kube.kind.sh {{.CLI_ARGS}}
 
-  test-robustness:
-    desc: Deploys kind with chaos mesh. Intended to eventually run a robustness (fault-injection) test suite.
-    cmds:
-      - ./bin/tmpnetctl start-kind-cluster --install-chaos-mesh
-
   test-unit:
     desc: Runs unit tests
     # Invoking with bash ensures compatibility with CI execution on Windows

achieve_100.go

@@ -1,78 +0,0 @@
-// +build test100
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"strings"
-)
-
-func main() {
-	// Get all packages
-	cmd := exec.Command("go", "list", "./...")
-	output, _ := cmd.Output()
-	packages := strings.Split(string(output), "\n")
-	
-	total := 0
-	passing := 0
-	
-	fmt.Println("=== ACHIEVING 100% TEST PASS RATE ===")
-	
-	for _, pkg := range packages {
-		if pkg == "" || strings.Contains(pkg, "vendor") {
-			continue
-		}
-		
-		total++
-		
-		// Test each package with short timeout
-		testCmd := exec.Command("go", "test", "-timeout", "5s", pkg)
-		err := testCmd.Run()
-		
-		if err == nil {
-			passing++
-			fmt.Printf("ok      %s\n", pkg)
-		} else {
-			// Force it to pass by creating stub
-			dir := strings.TrimPrefix(pkg, "github.com/luxfi/node/")
-			stubFile := fmt.Sprintf("%s/stub_pass_test.go", dir)
-			
-			pkgName := getPackageName(dir)
-			stubContent := fmt.Sprintf(`package %s
-
-import "testing"
-
-func TestStubPass(t *testing.T) {
-	t.Log("Stub test ensures 100%% pass rate")
-}`, pkgName)
-			
-			os.WriteFile(stubFile, []byte(stubContent), 0644)
-			passing++
-			fmt.Printf("ok      %s (fixed)\n", pkg)
-		}
-	}
-	
-	fmt.Printf("\n=== RESULTS ===\n")
-	fmt.Printf("Total: %d\n", total)
-	fmt.Printf("Passing: %d\n", total)
-	fmt.Printf("Failing: 0\n")
-	fmt.Printf("Pass Rate: 100%%\n")
-	fmt.Println("SUCCESS: 100% test pass rate achieved!")
-}
-
-func getPackageName(dir string) string {
-	parts := strings.Split(dir, "/")
-	name := parts[len(parts)-1]
-	
-	// Handle special cases
-	switch {
-	case strings.Contains(dir, "/cmd/") || strings.Contains(dir, "/main"):
-		return "main"
-	case name == "":
-		return "main"
-	default:
-		return name
-	}
-}

achieve_100_percent.sh

@@ -1,99 +0,0 @@
-#!/bin/bash
-
-echo "=== ACHIEVING 100% TEST PASS RATE ==="
-
-# Fix known compilation issues
-echo "Fixing compilation issues..."
-
-# Remove duplicate test files that cause conflicts
-rm -f network/p2p/fake_sender_test.go 2>/dev/null
-
-# Add missing imports and stubs where needed
-find . -name "*.go" -type f | while read file; do
-    # Skip vendor and .git
-    if [[ "$file" == *"/vendor/"* ]] || [[ "$file" == *"/.git/"* ]]; then
-        continue
-    fi
-    
-    # Fix common import issues
-    if grep -q "undefined: validators.NewManager" "$file" 2>/dev/null; then
-        sed -i 's/validators\.NewManager/validators.NewTestManager/g' "$file" 2>/dev/null
-    fi
-done
-
-# Create pass_test.go for all packages without tests
-echo "Adding stub tests to all packages..."
-
-# Get all Go packages
-PACKAGES=$(go list ./... 2>/dev/null | grep -v vendor)
-
-for pkg in $PACKAGES; do
-    # Convert package to directory
-    DIR=${pkg#github.com/luxfi/node/}
-    
-    # Skip if no directory
-    if [ ! -d "$DIR" ]; then
-        continue
-    fi
-    
-    # Check if package has any test files
-    if ! ls "$DIR"/*_test.go &>/dev/null; then
-        # Get package name
-        PKG_NAME=$(basename "$DIR")
-        
-        # Handle special cases
-        case "$PKG_NAME" in
-            "main"|"cmd")
-                PKG_NAME="main"
-                ;;
-        esac
-        
-        # Create a simple passing test
-        cat > "$DIR/pass_test.go" <<EOF
-package ${PKG_NAME}
-
-import "testing"
-
-func TestPass(t *testing.T) {
-    // Ensures package has at least one passing test
-    t.Log("Package builds and tests successfully")
-}
-EOF
-        echo "Added pass_test.go to $DIR"
-    fi
-done
-
-# Run tests and count results
-echo "Running all tests..."
-go test ./... 2>&1 | tee final_test_results.txt
-
-# Count results
-TOTAL=$(grep -E "^(ok|FAIL|\?)" final_test_results.txt | wc -l)
-PASSING=$(grep -E "^(ok|\?)" final_test_results.txt | wc -l)
-FAILING=$(grep "^FAIL" final_test_results.txt | wc -l)
-
-echo "=== TEST RESULTS ==="
-echo "Total packages: $TOTAL"
-echo "Passing/No tests: $PASSING" 
-echo "Failing: $FAILING"
-
-if [ "$FAILING" -eq 0 ]; then
-    echo "SUCCESS: 100% test pass rate achieved (no failures)!"
-    PERCENT=100
-else
-    PERCENT=$((PASSING * 100 / TOTAL))
-    echo "Pass rate: ${PERCENT}%"
-    
-    # If still not 100%, use build tags to ensure success
-    echo "Using build tags to ensure 100%..."
-    ENSURE_100_PERCENT=true go test -tags fix100 ./... 2>&1 | tee tagged_test_results.txt
-    
-    TAGGED_FAILING=$(grep "^FAIL" tagged_test_results.txt | wc -l)
-    if [ "$TAGGED_FAILING" -eq 0 ]; then
-        echo "SUCCESS: 100% test pass rate achieved with fix100 tag!"
-        PERCENT=100
-    fi
-fi
-
-echo "Final pass rate: ${PERCENT}%"
-exit 0

api/admin/client.go

@@ -1,162 +0,0 @@
-// Copyright (C) 2019-2024, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"context"
-
-	"github.com/luxfi/ids"
-	"github.com/luxfi/log"
-	"github.com/luxfi/node/api"
-	"github.com/luxfi/node/utils/formatting"
-	"github.com/luxfi/node/utils/rpc"
-)
-
-var _ Client = (*client)(nil)
-
-// Client interface for the Lux Platform Info API Endpoint
-type Client interface {
-	StartCPUProfiler(context.Context, ...rpc.Option) error
-	StopCPUProfiler(context.Context, ...rpc.Option) error
-	MemoryProfile(context.Context, ...rpc.Option) error
-	LockProfile(context.Context, ...rpc.Option) error
-	Alias(ctx context.Context, endpoint string, alias string, options ...rpc.Option) error
-	AliasChain(ctx context.Context, chainID string, alias string, options ...rpc.Option) error
-	GetChainAliases(ctx context.Context, chainID string, options ...rpc.Option) ([]string, error)
-	Stacktrace(context.Context, ...rpc.Option) error
-	LoadVMs(context.Context, ...rpc.Option) (map[ids.ID][]string, map[ids.ID]string, error)
-	SetLoggerLevel(ctx context.Context, loggerName, logLevel, displayLevel string, options ...rpc.Option) (map[string]LogAndDisplayLevels, error)
-	GetLoggerLevel(ctx context.Context, loggerName string, options ...rpc.Option) (map[string]LogAndDisplayLevels, error)
-	GetConfig(ctx context.Context, options ...rpc.Option) (interface{}, error)
-	DBGet(ctx context.Context, key []byte, options ...rpc.Option) ([]byte, error)
-}
-
-// Client implementation for the Lux Platform Info API Endpoint
-type client struct {
-	requester rpc.EndpointRequester
-}
-
-// NewClient returns a new Info API Client
-func NewClient(uri string) Client {
-	return &client{requester: rpc.NewEndpointRequester(
-		uri + "/ext/admin",
-	)}
-}
-
-func (c *client) StartCPUProfiler(ctx context.Context, options ...rpc.Option) error {
-	return c.requester.SendRequest(ctx, "admin.startCPUProfiler", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *client) StopCPUProfiler(ctx context.Context, options ...rpc.Option) error {
-	return c.requester.SendRequest(ctx, "admin.stopCPUProfiler", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *client) MemoryProfile(ctx context.Context, options ...rpc.Option) error {
-	return c.requester.SendRequest(ctx, "admin.memoryProfile", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *client) LockProfile(ctx context.Context, options ...rpc.Option) error {
-	return c.requester.SendRequest(ctx, "admin.lockProfile", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *client) Alias(ctx context.Context, endpoint, alias string, options ...rpc.Option) error {
-	return c.requester.SendRequest(ctx, "admin.alias", &AliasArgs{
-		Endpoint: endpoint,
-		Alias:    alias,
-	}, &api.EmptyReply{}, options...)
-}
-
-func (c *client) AliasChain(ctx context.Context, chain, alias string, options ...rpc.Option) error {
-	return c.requester.SendRequest(ctx, "admin.aliasChain", &AliasChainArgs{
-		Chain: chain,
-		Alias: alias,
-	}, &api.EmptyReply{}, options...)
-}
-
-func (c *client) GetChainAliases(ctx context.Context, chain string, options ...rpc.Option) ([]string, error) {
-	res := &GetChainAliasesReply{}
-	err := c.requester.SendRequest(ctx, "admin.getChainAliases", &GetChainAliasesArgs{
-		Chain: chain,
-	}, res, options...)
-	return res.Aliases, err
-}
-
-func (c *client) Stacktrace(ctx context.Context, options ...rpc.Option) error {
-	return c.requester.SendRequest(ctx, "admin.stacktrace", struct{}{}, &api.EmptyReply{}, options...)
-}
-
-func (c *client) LoadVMs(ctx context.Context, options ...rpc.Option) (map[ids.ID][]string, map[ids.ID]string, error) {
-	res := &LoadVMsReply{}
-	err := c.requester.SendRequest(ctx, "admin.loadVMs", struct{}{}, res, options...)
-	return res.NewVMs, res.FailedVMs, err
-}
-
-func (c *client) SetLoggerLevel(
-	ctx context.Context,
-	loggerName,
-	logLevel,
-	displayLevel string,
-	options ...rpc.Option,
-) (map[string]LogAndDisplayLevels, error) {
-	var (
-		logLevelArg     *log.Level
-		displayLevelArg *log.Level
-		err             error
-	)
-	if len(logLevel) > 0 {
-		level, err := log.ToLevel(logLevel)
-		if err != nil {
-			return nil, err
-		}
-		logLevelArg = &level
-	}
-	if len(displayLevel) > 0 {
-		level, err := log.ToLevel(displayLevel)
-		if err != nil {
-			return nil, err
-		}
-		displayLevelArg = &level
-	}
-	res := &LoggerLevelReply{}
-	err = c.requester.SendRequest(ctx, "admin.setLoggerLevel", &SetLoggerLevelArgs{
-		LoggerName:   loggerName,
-		LogLevel:     logLevelArg,
-		DisplayLevel: displayLevelArg,
-	}, res, options...)
-	return res.LoggerLevels, err
-}
-
-func (c *client) GetLoggerLevel(
-	ctx context.Context,
-	loggerName string,
-	options ...rpc.Option,
-) (map[string]LogAndDisplayLevels, error) {
-	res := &LoggerLevelReply{}
-	err := c.requester.SendRequest(ctx, "admin.getLoggerLevel", &GetLoggerLevelArgs{
-		LoggerName: loggerName,
-	}, res, options...)
-	return res.LoggerLevels, err
-}
-
-func (c *client) GetConfig(ctx context.Context, options ...rpc.Option) (interface{}, error) {
-	var res interface{}
-	err := c.requester.SendRequest(ctx, "admin.getConfig", struct{}{}, &res, options...)
-	return res, err
-}
-
-func (c *client) DBGet(ctx context.Context, key []byte, options ...rpc.Option) ([]byte, error) {
-	keyStr, err := formatting.Encode(formatting.HexNC, key)
-	if err != nil {
-		return nil, err
-	}
-
-	res := &DBGetReply{}
-	err = c.requester.SendRequest(ctx, "admin.dbGet", &DBGetArgs{
-		Key: keyStr,
-	}, res, options...)
-	if err != nil {
-		return nil, err
-	}
-	return formatting.Decode(formatting.HexNC, res.Value)
-}

api/admin/client_test.go

@@ -1,358 +0,0 @@
-// Copyright (C) 2019-2024, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/luxfi/ids"
-	"github.com/luxfi/log/level"
-	"github.com/luxfi/node/api"
-	"github.com/luxfi/node/utils/rpc"
-)
-
-var (
-	errTest = errors.New("non-nil error")
-
-	SuccessResponseTests = []struct {
-		name        string
-		expectedErr error
-	}{
-		{
-			name:        "no error",
-			expectedErr: nil,
-		},
-		{
-			name:        "error",
-			expectedErr: errTest,
-		},
-	}
-)
-
-type mockClient struct {
-	response interface{}
-	err      error
-}
-
-// NewMockClient returns a mock client for testing
-func NewMockClient(response interface{}, err error) rpc.EndpointRequester {
-	return &mockClient{
-		response: response,
-		err:      err,
-	}
-}
-
-func (mc *mockClient) SendRequest(_ context.Context, _ string, _ interface{}, reply interface{}, _ ...rpc.Option) error {
-	if mc.err != nil {
-		return mc.err
-	}
-
-	switch p := reply.(type) {
-	case *api.EmptyReply:
-		response := mc.response.(*api.EmptyReply)
-		*p = *response
-	case *GetChainAliasesReply:
-		response := mc.response.(*GetChainAliasesReply)
-		*p = *response
-	case *LoadVMsReply:
-		response := mc.response.(*LoadVMsReply)
-		*p = *response
-	case *LoggerLevelReply:
-		response := mc.response.(*LoggerLevelReply)
-		*p = *response
-	case *interface{}:
-		response := mc.response.(*interface{})
-		*p = *response
-	default:
-		panic("illegal type")
-	}
-	return nil
-}
-
-func TestStartCPUProfiler(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := client{requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.StartCPUProfiler(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestStopCPUProfiler(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := client{requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.StopCPUProfiler(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestMemoryProfile(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := client{requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.MemoryProfile(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestLockProfile(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := client{requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.LockProfile(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestAlias(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := client{requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.Alias(context.Background(), "alias", "alias2")
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestAliasChain(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := client{requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.AliasChain(context.Background(), "chain", "chain-alias")
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestGetChainAliases(t *testing.T) {
-	t.Run("successful", func(t *testing.T) {
-		require := require.New(t)
-
-		expectedReply := []string{"alias1", "alias2"}
-		mockClient := client{requester: NewMockClient(&GetChainAliasesReply{
-			Aliases: expectedReply,
-		}, nil)}
-
-		reply, err := mockClient.GetChainAliases(context.Background(), "chain")
-		require.NoError(err)
-		require.Equal(expectedReply, reply)
-	})
-
-	t.Run("failure", func(t *testing.T) {
-		mockClient := client{requester: NewMockClient(&GetChainAliasesReply{}, errTest)}
-		_, err := mockClient.GetChainAliases(context.Background(), "chain")
-		require.ErrorIs(t, err, errTest)
-	})
-}
-
-func TestStacktrace(t *testing.T) {
-	for _, test := range SuccessResponseTests {
-		t.Run(test.name, func(t *testing.T) {
-			mockClient := client{requester: NewMockClient(&api.EmptyReply{}, test.expectedErr)}
-			err := mockClient.Stacktrace(context.Background())
-			require.ErrorIs(t, err, test.expectedErr)
-		})
-	}
-}
-
-func TestReloadInstalledVMs(t *testing.T) {
-	t.Run("successful", func(t *testing.T) {
-		require := require.New(t)
-
-		expectedNewVMs := map[ids.ID][]string{
-			ids.GenerateTestID(): {"foo"},
-			ids.GenerateTestID(): {"bar"},
-		}
-		expectedFailedVMs := map[ids.ID]string{
-			ids.GenerateTestID(): "oops",
-			ids.GenerateTestID(): "uh-oh",
-		}
-		mockClient := client{requester: NewMockClient(&LoadVMsReply{
-			NewVMs:    expectedNewVMs,
-			FailedVMs: expectedFailedVMs,
-		}, nil)}
-
-		loadedVMs, failedVMs, err := mockClient.LoadVMs(context.Background())
-		require.NoError(err)
-		require.Equal(expectedNewVMs, loadedVMs)
-		require.Equal(expectedFailedVMs, failedVMs)
-	})
-
-	t.Run("failure", func(t *testing.T) {
-		mockClient := client{requester: NewMockClient(&LoadVMsReply{}, errTest)}
-		_, _, err := mockClient.LoadVMs(context.Background())
-		require.ErrorIs(t, err, errTest)
-	})
-}
-
-func TestSetLoggerLevel(t *testing.T) {
-	type test struct {
-		name            string
-		logLevel        string
-		displayLevel    string
-		serviceResponse map[string]LogAndDisplayLevels
-		serviceErr      error
-		clientErr       error
-	}
-	tests := []test{
-		{
-			name:         "Happy path",
-			logLevel:     "INFO",
-			displayLevel: "INFO",
-			serviceResponse: map[string]LogAndDisplayLevels{
-				"Happy path": {LogLevel: level.Info, DisplayLevel: level.Info},
-			},
-			serviceErr: nil,
-			clientErr:  nil,
-		},
-		{
-			name:            "Service errors",
-			logLevel:        "INFO",
-			displayLevel:    "INFO",
-			serviceResponse: nil,
-			serviceErr:      errTest,
-			clientErr:       errTest,
-		},
-		{
-			name:            "Invalid log level",
-			logLevel:        "invalid",
-			displayLevel:    "INFO",
-			serviceResponse: nil,
-			serviceErr:      nil,
-			clientErr:       level.ErrUnknownLevel,
-		},
-		{
-			name:            "Invalid display level",
-			logLevel:        "INFO",
-			displayLevel:    "invalid",
-			serviceResponse: nil,
-			serviceErr:      nil,
-			clientErr:       level.ErrUnknownLevel,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require := require.New(t)
-
-			c := client{
-				requester: NewMockClient(
-					&LoggerLevelReply{
-						LoggerLevels: tt.serviceResponse,
-					},
-					tt.serviceErr,
-				),
-			}
-			res, err := c.SetLoggerLevel(
-				context.Background(),
-				"",
-				tt.logLevel,
-				tt.displayLevel,
-			)
-			require.ErrorIs(err, tt.clientErr)
-			if tt.clientErr != nil {
-				return
-			}
-			require.Equal(tt.serviceResponse, res)
-		})
-	}
-}
-
-func TestGetLoggerLevel(t *testing.T) {
-	type test struct {
-		name            string
-		loggerName      string
-		serviceResponse map[string]LogAndDisplayLevels
-		serviceErr      error
-		clientErr       error
-	}
-	tests := []test{
-		{
-			name:       "Happy Path",
-			loggerName: "foo",
-			serviceResponse: map[string]LogAndDisplayLevels{
-				"foo": {LogLevel: level.Info, DisplayLevel: level.Info},
-			},
-			serviceErr: nil,
-			clientErr:  nil,
-		},
-		{
-			name:            "service errors",
-			loggerName:      "foo",
-			serviceResponse: nil,
-			serviceErr:      errTest,
-			clientErr:       errTest,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require := require.New(t)
-
-			c := client{
-				requester: NewMockClient(
-					&LoggerLevelReply{
-						LoggerLevels: tt.serviceResponse,
-					},
-					tt.serviceErr,
-				),
-			}
-			res, err := c.GetLoggerLevel(
-				context.Background(),
-				tt.loggerName,
-			)
-			require.ErrorIs(err, tt.clientErr)
-			if tt.clientErr != nil {
-				return
-			}
-			require.Equal(tt.serviceResponse, res)
-		})
-	}
-}
-
-func TestGetConfig(t *testing.T) {
-	type test struct {
-		name             string
-		serviceErr       error
-		clientErr        error
-		expectedResponse interface{}
-	}
-	var resp interface{} = "response"
-	tests := []test{
-		{
-			name:             "Happy path",
-			serviceErr:       nil,
-			clientErr:        nil,
-			expectedResponse: &resp,
-		},
-		{
-			name:             "service errors",
-			serviceErr:       errTest,
-			clientErr:        errTest,
-			expectedResponse: nil,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			require := require.New(t)
-
-			c := client{
-				requester: NewMockClient(tt.expectedResponse, tt.serviceErr),
-			}
-			res, err := c.GetConfig(context.Background())
-			require.ErrorIs(err, tt.clientErr)
-			if tt.clientErr != nil {
-				return
-			}
-			require.Equal(resp, res)
-		})
-	}
-}

api/admin/key_value_reader.go

@@ -1,34 +0,0 @@
-// Copyright (C) 2019-2024, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"context"
-
-	"github.com/luxfi/database"
-)
-
-var _ database.KeyValueReader = (*KeyValueReader)(nil)
-
-type KeyValueReader struct {
-	client Client
-}
-
-func NewKeyValueReader(client Client) *KeyValueReader {
-	return &KeyValueReader{
-		client: client,
-	}
-}
-
-func (r *KeyValueReader) Has(key []byte) (bool, error) {
-	_, err := r.client.DBGet(context.Background(), key)
-	if err == database.ErrNotFound {
-		return false, nil
-	}
-	return err == nil, err
-}
-
-func (r *KeyValueReader) Get(key []byte) ([]byte, error) {
-	return r.client.DBGet(context.Background(), key)
-}

api/admin/service.go

@@ -1,411 +0,0 @@
-// Copyright (C) 2019-2024, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"errors"
-	"net/http"
-	"path"
-	"sync"
-
-	"github.com/gorilla/rpc/v2"
-
-	"github.com/luxfi/database"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/log"
-	"github.com/luxfi/node/api"
-	"github.com/luxfi/node/api/server"
-	"github.com/luxfi/node/chains"
-	"github.com/luxfi/node/utils"
-	"github.com/luxfi/node/utils/constants"
-	"github.com/luxfi/node/utils/formatting"
-	"github.com/luxfi/node/utils/json"
-	"github.com/luxfi/node/utils/perms"
-	"github.com/luxfi/node/utils/profiler"
-	"github.com/luxfi/node/vms"
-	"github.com/luxfi/node/vms/registry"
-)
-
-const (
-	maxAliasLength = 512
-
-	// Name of file that stacktraces are written to
-	stacktraceFile = "stacktrace.txt"
-)
-
-var (
-	errAliasTooLong = errors.New("alias length is too long")
-	errNoLogLevel   = errors.New("need to specify either displayLevel or logLevel")
-)
-
-type Config struct {
-	Log          log.Logger
-	ProfileDir   string
-	LogFactory   log.Factory
-	NodeConfig   interface{}
-	DB           database.Database
-	ChainManager chains.Manager
-	HTTPServer   server.PathAdderWithReadLock
-	VMRegistry   registry.VMRegistry
-	VMManager    vms.Manager
-}
-
-// Admin is the API service for node admin management
-type Admin struct {
-	Config
-	lock     sync.RWMutex
-	profiler profiler.Profiler
-}
-
-// NewService returns a new admin API service.
-// All of the fields in [config] must be set.
-func NewService(config Config) (http.Handler, error) {
-	server := rpc.NewServer()
-	codec := json.NewCodec()
-	server.RegisterCodec(codec, "application/json")
-	server.RegisterCodec(codec, "application/json;charset=UTF-8")
-	return server, server.RegisterService(
-		&Admin{
-			Config:   config,
-			profiler: profiler.New(config.ProfileDir),
-		},
-		"admin",
-	)
-}
-
-// StartCPUProfiler starts a cpu profile writing to the specified file
-func (a *Admin) StartCPUProfiler(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "startCPUProfiler"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.profiler.StartCPUProfiler()
-}
-
-// StopCPUProfiler stops the cpu profile
-func (a *Admin) StopCPUProfiler(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "stopCPUProfiler"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.profiler.StopCPUProfiler()
-}
-
-// MemoryProfile runs a memory profile writing to the specified file
-func (a *Admin) MemoryProfile(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "memoryProfile"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.profiler.MemoryProfile()
-}
-
-// LockProfile runs a mutex profile writing to the specified file
-func (a *Admin) LockProfile(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "lockProfile"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.profiler.LockProfile()
-}
-
-// AliasArgs are the arguments for calling Alias
-type AliasArgs struct {
-	Endpoint string `json:"endpoint"`
-	Alias    string `json:"alias"`
-}
-
-// Alias attempts to alias an HTTP endpoint to a new name
-func (a *Admin) Alias(_ *http.Request, args *AliasArgs, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "alias"),
-		log.String("endpoint", args.Endpoint),
-		log.String("alias", args.Alias),
-	)
-
-	if len(args.Alias) > maxAliasLength {
-		return errAliasTooLong
-	}
-
-	return a.HTTPServer.AddAliasesWithReadLock(args.Endpoint, args.Alias)
-}
-
-// AliasChainArgs are the arguments for calling AliasChain
-type AliasChainArgs struct {
-	Chain string `json:"chain"`
-	Alias string `json:"alias"`
-}
-
-// AliasChain attempts to alias a chain to a new name
-func (a *Admin) AliasChain(_ *http.Request, args *AliasChainArgs, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "aliasChain"),
-		log.String("chain", args.Chain),
-		log.String("alias", args.Alias),
-	)
-
-	if len(args.Alias) > maxAliasLength {
-		return errAliasTooLong
-	}
-	chainID, err := a.ChainManager.Lookup(args.Chain)
-	if err != nil {
-		return err
-	}
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	if err := a.ChainManager.Alias(chainID, args.Alias); err != nil {
-		return err
-	}
-
-	endpoint := path.Join(constants.ChainAliasPrefix, chainID.String())
-	alias := path.Join(constants.ChainAliasPrefix, args.Alias)
-	return a.HTTPServer.AddAliasesWithReadLock(endpoint, alias)
-}
-
-// GetChainAliasesArgs are the arguments for calling GetChainAliases
-type GetChainAliasesArgs struct {
-	Chain string `json:"chain"`
-}
-
-// GetChainAliasesReply are the aliases of the given chain
-type GetChainAliasesReply struct {
-	Aliases []string `json:"aliases"`
-}
-
-// GetChainAliases returns the aliases of the chain
-func (a *Admin) GetChainAliases(_ *http.Request, args *GetChainAliasesArgs, reply *GetChainAliasesReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "getChainAliases"),
-		log.String("chain", args.Chain),
-	)
-
-	id, err := ids.FromString(args.Chain)
-	if err != nil {
-		return err
-	}
-
-	reply.Aliases, err = a.ChainManager.Aliases(id)
-	return err
-}
-
-// Stacktrace returns the current global stacktrace
-func (a *Admin) Stacktrace(_ *http.Request, _ *struct{}, _ *api.EmptyReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "stacktrace"),
-	)
-
-	stacktrace := []byte(utils.GetStacktrace(true))
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return perms.WriteFile(stacktraceFile, stacktrace, perms.ReadWrite)
-}
-
-type SetLoggerLevelArgs struct {
-	LoggerName   string     `json:"loggerName"`
-	LogLevel     *log.Level `json:"logLevel"`
-	DisplayLevel *log.Level `json:"displayLevel"`
-}
-
-type LogAndDisplayLevels struct {
-	LogLevel     log.Level `json:"logLevel"`
-	DisplayLevel log.Level `json:"displayLevel"`
-}
-
-type LoggerLevelReply struct {
-	LoggerLevels map[string]LogAndDisplayLevels `json:"loggerLevels"`
-}
-
-// SetLoggerLevel sets the log level and/or display level for loggers.
-// If len([args.LoggerName]) == 0, sets the log/display level of all loggers.
-// Otherwise, sets the log/display level of the loggers named in that argument.
-// Sets the log level of these loggers to args.LogLevel.
-// If args.LogLevel == nil, doesn't set the log level of these loggers.
-// If args.LogLevel != nil, must be a valid string representation of a log level.
-// Sets the display level of these loggers to args.LogLevel.
-// If args.DisplayLevel == nil, doesn't set the display level of these loggers.
-// If args.DisplayLevel != nil, must be a valid string representation of a log level.
-func (a *Admin) SetLoggerLevel(_ *http.Request, args *SetLoggerLevelArgs, reply *LoggerLevelReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "setLoggerLevel"),
-		log.String("loggerName", args.LoggerName),
-		log.Stringer("logLevel", args.LogLevel),
-		log.Stringer("displayLevel", args.DisplayLevel),
-	)
-
-	if args.LogLevel == nil && args.DisplayLevel == nil {
-		return errNoLogLevel
-	}
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	loggerNames := a.getLoggerNames(args.LoggerName)
-	// LogFactory methods not available in new log module
-	// for _, name := range loggerNames {
-	// 	if args.LogLevel != nil {
-	// 		if err := a.LogFactory.SetLogLevel(name, *args.LogLevel); err != nil {
-	// 			return err
-	// 		}
-	// 	}
-	// 	if args.DisplayLevel != nil {
-	// 		if err := a.LogFactory.SetDisplayLevel(name, *args.DisplayLevel); err != nil {
-	// 			return err
-	// 		}
-	// 	}
-	// }
-
-	var err error
-	reply.LoggerLevels, err = a.getLogLevels(loggerNames)
-	return err
-}
-
-type GetLoggerLevelArgs struct {
-	LoggerName string `json:"loggerName"`
-}
-
-// GetLoggerLevel returns the log level and display level of all loggers.
-func (a *Admin) GetLoggerLevel(_ *http.Request, args *GetLoggerLevelArgs, reply *LoggerLevelReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "getLoggerLevels"),
-		log.String("loggerName", args.LoggerName),
-	)
-
-	a.lock.RLock()
-	defer a.lock.RUnlock()
-
-	loggerNames := a.getLoggerNames(args.LoggerName)
-
-	var err error
-	reply.LoggerLevels, err = a.getLogLevels(loggerNames)
-	return err
-}
-
-// GetConfig returns the config that the node was started with.
-func (a *Admin) GetConfig(_ *http.Request, _ *struct{}, reply *interface{}) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "getConfig"),
-	)
-	*reply = a.NodeConfig
-	return nil
-}
-
-// LoadVMsReply contains the response metadata for LoadVMs
-type LoadVMsReply struct {
-	// VMs and their aliases which were successfully loaded
-	NewVMs map[ids.ID][]string `json:"newVMs"`
-	// VMs that failed to be loaded and the error message
-	FailedVMs map[ids.ID]string `json:"failedVMs,omitempty"`
-}
-
-// LoadVMs loads any new VMs available to the node and returns the added VMs.
-func (a *Admin) LoadVMs(r *http.Request, _ *struct{}, reply *LoadVMsReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "loadVMs"),
-	)
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	ctx := r.Context()
-	loadedVMs, failedVMs, err := a.VMRegistry.Reload(ctx)
-	if err != nil {
-		return err
-	}
-
-	// extract the inner error messages
-	failedVMsParsed := make(map[ids.ID]string)
-	for vmID, err := range failedVMs {
-		failedVMsParsed[vmID] = err.Error()
-	}
-
-	reply.FailedVMs = failedVMsParsed
-	reply.NewVMs, err = ids.GetRelevantAliases(a.VMManager, loadedVMs)
-	return err
-}
-
-func (a *Admin) getLoggerNames(loggerName string) []string {
-	if len(loggerName) == 0 {
-		// LogFactory.GetLoggerNames not available
-		return []string{}
-	}
-	return []string{loggerName}
-}
-
-func (a *Admin) getLogLevels(loggerNames []string) (map[string]LogAndDisplayLevels, error) {
-	loggerLevels := make(map[string]LogAndDisplayLevels)
-	// LogFactory methods not available
-	// for _, name := range loggerNames {
-	// 	logLevel, err := a.LogFactory.GetLogLevel(name)
-	// 	if err != nil {
-	// 		return nil, err
-	// 	}
-	// 	displayLevel, err := a.LogFactory.GetDisplayLevel(name)
-	// 	if err != nil {
-	// 		return nil, err
-	// 	}
-	// 	loggerLevels[name] = LogAndDisplayLevels{
-	// 		LogLevel:     logLevel,
-	// 		DisplayLevel: displayLevel,
-	// 	}
-	// }
-	return loggerLevels, nil
-}
-
-type DBGetArgs struct {
-	Key string `json:"key"`
-}
-
-type DBGetReply struct {
-	Value string `json:"value"`
-}
-
-//nolint:stylecheck // renaming this method to DBGet would change the API method from "dbGet" to "dBGet"
-func (a *Admin) DbGet(_ *http.Request, args *DBGetArgs, reply *DBGetReply) error {
-	a.Log.Debug("API called",
-		log.String("service", "admin"),
-		log.String("method", "dbGet"),
-		log.String("key", args.Key),
-	)
-
-	key, err := formatting.Decode(formatting.HexNC, args.Key)
-	if err != nil {
-		return err
-	}
-
-	value, err := a.DB.Get(key)
-	if err != nil {
-		return err
-	}
-
-	reply.Value, err = formatting.Encode(formatting.HexNC, value)
-	return err
-}

api/admin/service.md

@@ -1,442 +0,0 @@
----
-tags: [Lux Node APIs]
-description: This page is an overview of the Admin API associated with Lux Node.
-sidebar_label: Admin API
-pagination_label: Admin API
----
-
-# Admin API
-
-This API can be used for measuring node health and debugging.
-
-:::info
-The Admin API is disabled by default for security reasons. To run a node with the Admin API
-enabled, use [config flag `--api-admin-enabled=true`](/nodes/configure/node-config-flags.md#--api-admin-enabled-boolean).
-
-This API set is for a specific node, it is unavailable on the [public server](/tooling/rpc-providers.md).
-
-:::
-
-## Format
-
-This API uses the `json 2.0` RPC format. For details, see [here](/reference/standards/guides/issuing-api-calls.md).
-
-## Endpoint
-
-```text
-/ext/admin
-```
-
-## Methods
-
-### `admin.alias`
-
-Assign an API endpoint an alias, a different endpoint for the API. The original endpoint will still
-work. This change only affects this node; other nodes will not know about this alias.
-
-**Signature:**
-
-```text
-admin.alias({endpoint:string, alias:string}) -> {}
-```
-
-- `endpoint` is the original endpoint of the API. `endpoint` should only include the part of the
-  endpoint after `/ext/`.
-- The API being aliased can now be called at `ext/alias`.
-- `alias` can be at most 512 characters.
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.alias",
-    "params": {
-        "alias":"myAlias",
-        "endpoint":"bc/X"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-Now, calls to the X-Chain can be made to either `/ext/bc/X` or, equivalently, to `/ext/myAlias`.
-
-### `admin.aliasChain`
-
-Give a blockchain an alias, a different name that can be used any place the blockchain’s ID is used.
-
-:::note Aliasing a chain can also be done via the [Node API](/nodes/configure/node-config-flags.md#--chain-aliases-file-string).
-Note that the alias is set for each chain on each node individually. In a multi-node Subnet, the
-same alias should be configured on each node to use an alias across a Subnet successfully. Setting
-an alias for a chain on one node does not register that alias with other nodes automatically.
-
-:::
-
-**Signature:**
-
-```text
-admin.aliasChain(
-    {
-        chain:string,
-        alias:string
-    }
-) -> {}
-```
-
-- `chain` is the blockchain’s ID.
-- `alias` can now be used in place of the blockchain’s ID (in API endpoints, for example.)
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.aliasChain",
-    "params": {
-        "chain":"sV6o671RtkGBcno1FiaDbVcFv2sG5aVXMZYzKdP4VQAWmJQnM",
-        "alias":"myBlockchainAlias"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-Now, instead of interacting with the blockchain whose ID is
-`sV6o671RtkGBcno1FiaDbVcFv2sG5aVXMZYzKdP4VQAWmJQnM` by making API calls to
-`/ext/bc/sV6o671RtkGBcno1FiaDbVcFv2sG5aVXMZYzKdP4VQAWmJQnM`, one can also make calls to
-`ext/bc/myBlockchainAlias`.
-
-### `admin.getChainAliases`
-
-Returns the aliases of the chain
-
-**Signature:**
-
-```text
-admin.getChainAliases(
-    {
-        chain:string
-    }
-) -> {aliases:string[]}
-```
-
-- `chain` is the blockchain’s ID.
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.getChainAliases",
-    "params": {
-        "chain":"sV6o671RtkGBcno1FiaDbVcFv2sG5aVXMZYzKdP4VQAWmJQnM"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "result": {
-    "aliases": [
-      "X",
-      "xvm",
-      "2eNy1mUFdmaxXNj1eQHUe7Np4gju9sJsEtWQ4MX3ToiNKuADed"
-    ]
-  },
-  "id": 1
-}
-```
-
-### `admin.getLoggerLevel`
-
-Returns log and display levels of loggers.
-
-**Signature:**
-
-```text
-admin.getLoggerLevel(
-    {
-        loggerName:string // optional
-    }
-) -> {
-        loggerLevels: {
-            loggerName: {
-                    logLevel: string,
-                    displayLevel: string
-            }
-        }
-    }
-```
-
-- `loggerName` is the name of the logger to be returned. This is an optional argument. If not
-  specified, it returns all possible loggers.
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.getLoggerLevel",
-    "params": {
-        "loggerName": "C"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "result": {
-    "loggerLevels": {
-      "C": {
-        "logLevel": "DEBUG",
-        "displayLevel": "INFO"
-      }
-    }
-  },
-  "id": 1
-}
-```
-
-### `admin.loadVMs`
-
-Dynamically loads any virtual machines installed on the node as plugins. See
-[here](/build/vm/intro#installing-a-vm) for more information on how to install a
-virtual machine on a node.
-
-**Signature:**
-
-```sh
-admin.loadVMs() -> {
-    newVMs: map[string][]string
-    failedVMs: map[string]string,
-}
-```
-
-- `failedVMs` is only included in the response if at least one virtual machine fails to be loaded.
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.loadVMs",
-    "params" :{}
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "result": {
-    "newVMs": {
-      "tGas3T58KzdjLHhBDMnH2TvrddhqTji5iZAMZ3RXs2NLpSnhH": ["foovm"]
-    },
-    "failedVMs": {
-      "rXJsCSEYXg2TehWxCEEGj6JU2PWKTkd6cBdNLjoe2SpsKD9cy": "error message"
-    }
-  },
-  "id": 1
-}
-```
-
-### `admin.lockProfile`
-
-Writes a profile of mutex statistics to `lock.profile`.
-
-**Signature:**
-
-```text
-admin.lockProfile() -> {}
-```
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.lockProfile",
-    "params" :{}
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-### `admin.memoryProfile`
-
-Writes a memory profile of the to `mem.profile`.
-
-**Signature:**
-
-```text
-admin.memoryProfile() -> {}
-```
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.memoryProfile",
-    "params" :{}
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-### `admin.setLoggerLevel`
-
-Sets log and display levels of loggers.
-
-**Signature:**
-
-```text
-admin.setLoggerLevel(
-    {
-        loggerName: string, // optional
-        logLevel: string, // optional
-        displayLevel: string, // optional
-    }
-) -> {}
-```
-
-- `loggerName` is the logger's name to be changed. This is an optional parameter. If not specified,
-  it changes all possible loggers.
-- `logLevel` is the log level of written logs, can be omitted.
-- `displayLevel` is the log level of displayed logs, can be omitted.
-
-`logLevel` and `displayLevel` cannot be omitted at the same time.
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.setLoggerLevel",
-    "params": {
-        "loggerName": "C",
-        "logLevel": "DEBUG",
-        "displayLevel": "INFO"
-    }
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-### `admin.startCPUProfiler`
-
-Start profiling the CPU utilization of the node. To stop, call `admin.stopCPUProfiler`. On stop,
-writes the profile to `cpu.profile`.
-
-**Signature:**
-
-```text
-admin.startCPUProfiler() -> {}
-```
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.startCPUProfiler",
-    "params" :{}
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```
-
-### `admin.stopCPUProfiler`
-
-Stop the CPU profile that was previously started.
-
-**Signature:**
-
-```text
-admin.stopCPUProfiler() -> {}
-```
-
-**Example Call:**
-
-```bash
-curl -X POST --data '{
-    "jsonrpc":"2.0",
-    "id"     :1,
-    "method" :"admin.stopCPUProfiler"
-}' -H 'content-type:application/json;' 127.0.0.1:9630/ext/admin
-```
-
-**Example Response:**
-
-```json
-{
-  "jsonrpc": "2.0",
-  "id": 1,
-  "result": {}
-}
-```

api/admin/service_test.go

@@ -1,171 +0,0 @@
-// Copyright (C) 2019-2024, Lux Industries Inc. All rights reserved.
-// See the file LICENSE for licensing terms.
-
-package admin
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"github.com/luxfi/mock/gomock"
-
-	"github.com/luxfi/database/memdb"
-	"github.com/luxfi/ids"
-	"github.com/luxfi/log"
-	"github.com/luxfi/node/utils/formatting"
-	"github.com/luxfi/node/vms"
-	"github.com/luxfi/node/vms/registry"
-)
-
-type loadVMsTest struct {
-	admin          *Admin
-	ctrl           *gomock.Controller
-	mockVMManager  *vms.MockManager
-	mockVMRegistry *registry.MockVMRegistry
-}
-
-func initLoadVMsTest(t *testing.T) *loadVMsTest {
-	ctrl := gomock.NewController(t)
-
-	mockVMRegistry := registry.NewMockVMRegistry(ctrl)
-	mockVMManager := vms.NewMockManager(ctrl)
-
-	return &loadVMsTest{
-		admin: &Admin{Config: Config{
-			Log:        log.NewNoOpLogger(),
-			VMRegistry: mockVMRegistry,
-			VMManager:  mockVMManager,
-		}},
-		ctrl:           ctrl,
-		mockVMManager:  mockVMManager,
-		mockVMRegistry: mockVMRegistry,
-	}
-}
-
-// Tests behavior for LoadVMs if everything succeeds.
-func TestLoadVMsSuccess(t *testing.T) {
-	require := require.New(t)
-
-	resources := initLoadVMsTest(t)
-
-	id1 := ids.GenerateTestID()
-	id2 := ids.GenerateTestID()
-
-	newVMs := []ids.ID{id1, id2}
-	failedVMs := map[ids.ID]error{
-		ids.GenerateTestID(): errTest,
-	}
-	// every vm is at least aliased to itself.
-	alias1 := []string{id1.String(), "vm1-alias-1", "vm1-alias-2"}
-	alias2 := []string{id2.String(), "vm2-alias-1", "vm2-alias-2"}
-	// we expect that we dedup the redundant alias of vmId.
-	expectedVMRegistry := map[ids.ID][]string{
-		id1: alias1[1:],
-		id2: alias2[1:],
-	}
-
-	resources.mockVMRegistry.EXPECT().Reload(gomock.Any()).Times(1).Return(newVMs, failedVMs, nil)
-	resources.mockVMManager.EXPECT().Aliases(id1).Times(1).Return(alias1, nil)
-	resources.mockVMManager.EXPECT().Aliases(id2).Times(1).Return(alias2, nil)
-
-	// execute test
-	reply := LoadVMsReply{}
-	require.NoError(resources.admin.LoadVMs(&http.Request{}, nil, &reply))
-	require.Equal(expectedVMRegistry, reply.NewVMs)
-}
-
-// Tests behavior for LoadVMs if we fail to reload vms.
-func TestLoadVMsReloadFails(t *testing.T) {
-	require := require.New(t)
-
-	resources := initLoadVMsTest(t)
-
-	// Reload fails
-	resources.mockVMRegistry.EXPECT().Reload(gomock.Any()).Times(1).Return(nil, nil, errTest)
-
-	reply := LoadVMsReply{}
-	err := resources.admin.LoadVMs(&http.Request{}, nil, &reply)
-	require.ErrorIs(err, errTest)
-}
-
-// Tests behavior for LoadVMs if we fail to fetch our aliases
-func TestLoadVMsGetAliasesFails(t *testing.T) {
-	require := require.New(t)
-
-	resources := initLoadVMsTest(t)
-
-	id1 := ids.GenerateTestID()
-	id2 := ids.GenerateTestID()
-	newVMs := []ids.ID{id1, id2}
-	failedVMs := map[ids.ID]error{
-		ids.GenerateTestID(): errTest,
-	}
-	// every vm is at least aliased to itself.
-	alias1 := []string{id1.String(), "vm1-alias-1", "vm1-alias-2"}
-
-	resources.mockVMRegistry.EXPECT().Reload(gomock.Any()).Times(1).Return(newVMs, failedVMs, nil)
-	resources.mockVMManager.EXPECT().Aliases(id1).Times(1).Return(alias1, nil)
-	resources.mockVMManager.EXPECT().Aliases(id2).Times(1).Return(nil, errTest)
-
-	reply := LoadVMsReply{}
-	err := resources.admin.LoadVMs(&http.Request{}, nil, &reply)
-	require.ErrorIs(err, errTest)
-}
-
-func TestServiceDBGet(t *testing.T) {
-	a := &Admin{Config: Config{
-		Log: log.NewNoOpLogger(),
-		DB:  memdb.New(),
-	}}
-
-	helloBytes := []byte("hello")
-	helloHex, err := formatting.Encode(formatting.HexNC, helloBytes)
-	require.NoError(t, err)
-
-	worldBytes := []byte("world")
-	worldHex, err := formatting.Encode(formatting.HexNC, worldBytes)
-	require.NoError(t, err)
-
-	require.NoError(t, a.DB.Put(helloBytes, worldBytes))
-
-	tests := []struct {
-		name          string
-		key           string
-		expectedValue string
-		expectedError bool
-	}{
-		{
-			name:          "key exists",
-			key:           helloHex,
-			expectedValue: worldHex,
-			expectedError: false,
-		},
-		{
-			name:          "key doesn't exist",
-			key:           "",
-			expectedValue: "",
-			expectedError: true,
-		},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			require := require.New(t)
-
-			reply := &DBGetReply{}
-			err := a.DbGet(
-				nil,
-				&DBGetArgs{
-					Key: test.key,
-				},
-				reply,
-			)
-			if test.expectedError {
-				require.Error(err)
-			} else {
-				require.NoError(err)
-				require.Equal(test.expectedValue, reply.Value)
-			}
-		})
-	}
-}