mirror of
https://github.com/logos-co/logos-rln-modules.git
synced 2026-08-27 13:01:15 +00:00
Arseniy KlempnerandClaude Fable 5
734c92c4d6
Replace the WAKU-RLN-KEYSTORE-format encrypted store with a from-scratch sealed store: one file per trust class (Argon2id -> HKDF sub-keys -> XChaCha20-Poly1305-sealed credentials with identity-binding AAD and an O(1) verifier; per-membership MAC'd allocation counters under a root MAC that fails closed on any structural tamper; an unauthenticated, registry-healed cache). Persist-before-issue with waste-not-reissue, a monotone prune floor, epoch-size binding, and an exclusive dir lock keep the slot-uniqueness invariant across crash, clock rewind/spike, gap widening, and file tampering. The store lives on the module impl (no global singleton); reads run lock-free off an Arc snapshot. Old keystores are refused with guidance (no migration). Squashes the sealed-store rewrite and its audit follow-ups; granular history is preserved on refactor/keystore-sealed-store and fix/sealed-store-audit-followups. Crate 0.6.0; wire unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016nvKDUWNx1aDYoMfoWgmi9
logos-rln-modules
The Logos RLN module stack: rate-limiting-nullifier membership for Logos applications, backed by the on-chain RLN registry deployed from logos-lez-rln.
logos-lez-rln-module/—liblogos_lez_rln_module, the RLN registry provider: chain reads (roots, merkle proofs, membership state, registry bounds), the Register transaction, and the faucet funding flow. See its README.logos-rln-module/—liblogos_rln_module, the membership management module (RLN-MEMBERSHIP-MANAGEMENT spec): credential generation + keystore, registration lifecycle, proof generation and verification. Talks to the registry only through the lez-rln module's wire.logos-rln-membership-ui/— the membership UI (QML) driving the two modules from Logos Basecamp.
Prerequisites
- Nix with flakes enabled — the only hard requirement; every build
(modules,
.lgxbundles, UI tests, codegen) runs through the flakes. First builds compile zerokit and the Qt module glue, so the Logos attic cache helps a lot; CI gets it vialogos-co/setup-nix-cache-action, which needs theATTIC_TOKEN_CI/ATTIC_TOKEN_PUBLICrepo secrets. - git + network on first build — the staging scripts clone the pinned
logos-rust-sdk(cached under~/.cache/logos-rln-modules/), and cargo fetchesrln-layoutsfrom the pinned logos-lez-rln rev. - Rust (stable) — only for bare-cargo dev loops (
cargo testin a module'srust-lib/) after staging; the nix builds bring their own pinned toolchain. - Chain-facing testing lives in [logos-rln-e2e] — the module-stack e2e
(
registerscenario) and the harness that drives the lez module's live-registry tests against a local sequencer or testnet. The gated cargo tests themselves stay in this repo (logos-lez-rln-module/rust-lib/src/testnet_tests.rs,LEZ_RLN_TESTNET_TESTS=1) and, when run directly, read deployment descriptors from a logos-lez-rln checkout viaLEZ_RLN_CHECKOUT(default../logos-lez-rln). - Platforms — darwin-arm64, linux-amd64, linux-arm64 (the variant set the release workflow publishes).
Build
Each module is its own flake; the root flake aggregates the two Rust modules:
nix build .#logos-lez-rln-module-lgx
nix build .#logos-rln-module-lgx
nix run .#inspect-rln-module # or .#inspect-lez-rln-module
The Rust modules build from gitignored staged sources — refresh with
logos-lez-rln-module/stage-sources.sh and
nix run ./logos-rln-module#generate (both clone-and-go; see each
module's README). Release bundles + package catalog: tools/publish.sh.
License
Dual-licensed under MIT or Apache 2.0, at your option.