ElastOS Weekly Shipping Report — Week of May 22 – May 29, 2026

[SashaMIT]

Elacity Labs — Weekly Team Update for the World Computer Initiative (WCI)
May 22 – May 29, 2026

The week PC2 shipped its security release and Runtime put a real OS on a Mac. Last week's report (#17) closed the Capsule-Readiness Audit and drove the Phase 2 type-safety refactor through main. This week both repositories crossed from hardening into shipping: PC2 cut and tagged v1.3.0 — its most concentrated security cycle of the year — and Elastos Runtime tagged v0.3.0 (the authority-surface release) and immediately ran a CVE-hygiene cycle on top of it, while the Mac VZ virtualization backend reached a real Ubuntu login prompt and a real ElastOS WASM capsule running on Apple Silicon.

On PC2, the v1.3.0 security-audit hardening release closed a high-severity RPC-spoof vector, a skill-install IDOR, wired live session revocation, and made capability-URL signing default-on — all behind a clean auto-update so live nodes upgrade in place. A WASM-contained decrypt runtime landed with end-to-end CEK containment and a server-owned secure-view session, removing the last hand-configured supernode hop from dDRM playback via a zero-config Lit-Action RPC auto-route. The Monetisation Agent S1 (first Creator-Studio slice) shipped dormant behind a kill-switch — present in the codebase, off by default, with the third-party AI chat and Creator wizard untouched. In parallel, the team contributed the Elastos Node Manager as a two-PR set: a generic service-type-app supervisor for pc2-node, and the ENM app itself — a full Council/BPoS validator node (mainchain + sidechains + oracles + arbiter) operable from the PC2 desktop.

On Runtime, v0.3.0 declared capsule authority surfaces, promoted Wallet to a typed authority, locked Browser into a runtime-mediated capsule, and shipped a passkey-first Home/System UX with passkey recovery + root protection — then a v0.3.1 CVE-hygiene cycle drove the advisory count down hard (wasmtime + axum-server bumps, RSA/rustls cleanup). The Mac VZ backend advanced through real-kernel multi-VM boots to a tmpfs-overlay Ubuntu reaching login: on Mac, interactive console attach, a real ElastOS WASM capsule on Mac, and a cargo-fuzz harness for the Carrier-bridge framing parser.

---

Table of Contents

1. The Big Picture — From Hardening to Shipping
2. PC2 — v1.3.0 Security-Audit Hardening Release (tagged)
3. PC2 — dDRM Hardening: WASM-Contained Decrypt + Server-Owned Secure-View + RPC Auto-Route
4. PC2 — Monetisation Agent S1 (Dormant Landing)
5. PC2 — Elastos Node Manager (two-PR set — in review)
6. PC2 — Raspberry Pi OS CI Gate + Install-UX + Strategy Docs
7. Runtime — v0.3.0 Authority-Surface Release (tagged)
8. Runtime — v0.3.1 Security / Dependency-Hygiene Release
9. Runtime — Mac VZ Virtualization Backend (real OS on Apple Silicon)
10. Other Repositories This Week
11. Convergence Lens — The Runtime Model + First External Capsule
12. Looking Ahead
13. Summary Statistics
14. Data-Quality & Off-Repo Notes
15. Key Links This Week

---

1. The Big Picture — From Hardening to Shipping

Two releases anchored the week. PC2's v1.3.0 is a security release first: an audit closed real access-control gaps (RPC spoof, IDOR, revocation, signed capability URLs) and the dDRM decrypt path was moved into a WASM-contained runtime with end-to-end key containment. Runtime's v0.3.0 is a capability-model release: capsules now declare explicit authority surfaces and the trust boundaries between Wallet, Browser, and the gateway are enforced in code, immediately followed by a CVE-hygiene sweep so the new surface ships clean. Underneath both, the Mac VZ work proved the runtime can boot a real guest OS and run a real ElastOS capsule on consumer Apple-Silicon hardware — the substrate the whole "World Computer on your machine" thesis depends on.

2. PC2 — v1.3.0 Security-Audit Hardening Release (tagged)

Merged release/2026-05-28-ddrm-hardening → main (37 commits) and tagged v1.3.0 on 2026-05-29, coupled with ElastOS Launcher v1.2.9. CI green on the 4-platform smoke matrix + secret-scan (gitleaks). Auto-update is live — nodes on the 1.2.7.x line detect and self-upgrade in place (git fast-forward + rebuild + restart, no operator action).

Security audit closed (2026-05-29):

• H1 — RPC spoofing (high severity): the Lit-Action on-chain access check no longer trusts client-supplied Host / X-Forwarded-Host headers; it routes through an operator-pinned proxy or a health-tracked server-side RPC pool, closing a path that could forge ownership claims.
• Skill-install IDOR: installing a decrypted skill is now bound to the authenticated secure-view session owner; a mismatched buyerAddress is rejected (403).
• Live session revocation: revoked delegation tokens stop working immediately; admin CEK flush clears the WASM handle cache.
• Capability URLs signed by default: /file links require a server-side HMAC signature (FILE_URL_SIGNING_REQUIRED default-on) — invisible to users (the node signs/verifies automatically, no wallet prompt), with a FILE_URL_SIGNING_ALLOW_LEGACY=true escape hatch for genuinely old cached links.
• Log redaction: kid is no longer logged by the wallet bridge (source and shipped bundle aligned).

This release also folds in the previously-untagged v1.2.8.0 operator-observability work (Health & Support app + local-only telemetry) and the Release-Engineering V1280 CI/Docker hardening, both rolled forward onto the release branch. Top landings: bef5c3b2e (security-audit hardening), 0340618ce (1.3.0 bump), a0a910158 (gitleaks CI license wiring).

3. PC2 — dDRM Hardening: WASM-Contained Decrypt + Server-Owned Secure-View + RPC Auto-Route

• WASM-contained decrypt runtime (ddrm-decrypt crate, e80a5579f) — end-to-end CEK containment; the content key is never observable on the host process. The decryption keypair is generated and held inside the WASM sandbox per session, so the CEK never leaves the box; a new, optimised decrypt Lit Action with added security checks accompanies it.
• Server-owned secure-view session (0ae8bcae4) — P-256 keypair owned by the server, wallet-signed delegation, opaque bearer token.
• Zero-config resilient Lit-Action RPC (b69dba650) — access checks auto-route through the node's own rotating, health-tracked /api/rpc/base proxy when reachable, with a loopback/LAN guard and health-aware public fallback. Removes the last hand-configured supernode hop and fixes intermittent "purchase access tokens" errors on owned content.
• Legacy playback rescue — server-side override of PSSH-baked RPC values (32f578277) lets videos minted with an exhausted hardcoded RPC play again without re-minting; legacy decrypt-CID remap ordering fix (02050c6fe) restores non-media assets (3D/GLB, EPUB, PDF, image).
• RPC pool resilience (01f034a9c) — centralized health tracker sidelines unhealthy upstreams (5xx/429/408/transport) for a cooldown; default Base RPC list expanded 3 → 6.
• 3D model viewer (4e3d79d39) — camera near/far clip planes now adapt to model bounding-box size, fixing the "wall" that hid large models on zoom-out.

4. PC2 — Monetisation Agent S1 (Dormant Landing)

The conversational Monetisation Agent (Creator-Studio S1 — dialogue + intent capture + Creator hand-off) shipped dormant behind MONETISATION_AGENT_ENABLED (0675de2a2). Defense-in-depth: the flag is enforced at the tool-advertisement chokepoint in AIChatService and re-checked at dispatch in ToolExecutor, so the agent's tools are stripped no matter where they originate. Third-party AI chat (all providers) and the existing Creator wizard are unaffected — they are a separate path. The agent is present in-tree, off by default, to be promoted to default-on in a later release once validated.

5. PC2 — Elastos Node Manager (two-PR set — in review)

The team opened a two-part contribution that brings full Elastos node operation onto the PC2 desktop:

• #18 — service-type app support (+1,388/−17, 10 files, open). Teaches pc2-node to run and supervise a long-running backend service, not just static web apps. New generic "service" app type + AppProcessManager.ts (spawn, health-poll, exponential-backoff auto-restart, quarantine-after-3-crashes with persisted count, clean SIGTERM) + a non-interactive CI bundler. Nothing is hardcoded to ENM — any app can declare "service".
• #19 — the Elastos Node Manager app (+82,483/−0, 149 files, open; depends on Necessary PC2 changes for the Node Manager (service-type app support) #18). A self-contained service-type app that installs, runs, and self-heals a full Elastos Council / BPoS validator node — mainchain + ESC/EID/PG sidechains + the three oracles + the arbiter — from the PC2 desktop, with health monitoring and guided self-healing. Ships an enm-server/ Express sidecar (/api/enm + self-heal engine), the operator UI app, and a bundle workflow.

Both are open and awaiting review — a substantial expansion of what a PC2 node can host.

6. PC2 — Raspberry Pi OS CI Gate + Install-UX + Strategy Docs

• Experimental Raspberry Pi OS distro-coverage CI gate went up with its first green run (68448e6d8, d7afbde0b), plus a gate that runs the actual install-arm.sh (b733e6729) and strengthened Pi acceptance (full artifact + boot smoke, a712cef5f).
• Install UX — one-prompt sudo for the Pi installer (78cd3ef58), particle-auth dist/submodule cleanup (7c73388bb, f08c72e8a), user-facing one-liner Quick Start in the README (4e87307ec).
• Strategy / infra docs — the Public Cloud PC2 plan + R13 risk landed (6409452d2) along with a 2026-05-25 cert + DNS audit (17407736f), crystallising the try.pc2.net try-before-download operator roadmap.

7. Runtime — v0.3.0 Authority-Surface Release (tagged)

Tagged v0.3.0 on 2026-05-27 (commit 8acb72d) — the release where capsules stopped being processes and became authorities. The authority-surface PR set landed on main (17 in-window commits on main) and declared the capability model in code:

• Capsule authority surfaces declared (11c59a5) — capsules now publish the explicit authorities they require.
• Wallet promoted to a typed authority (db603a5).
• Browser locked into a runtime-mediated capsule + adapter (c38f383) — no direct host access.
• Typed chain provider core (6ee5965) + content-availability and protected-content providers (a12df39).
• Gateway split enforcing provider boundaries (a871671) — the gateway now polices which capsule may reach which provider.
• Passkey-first Home / System UX with passkey recovery + root protection (d2a3448).

The release process itself was tightened along the way: branch from main, publish coherent slices, review them one by one, then merge — turning a large working branch into reviewable history.

8. Runtime — v0.3.1 Security / Dependency-Hygiene Release

Immediately after v0.3.0, a focused security / dependency-hygiene release was merged to main as v0.3.1. It drove the advisory count down hard: wasmtime 17 → 36 and a FIFO carrier transport swap took one sweep from 21 → 3 vulnerabilities (cecded4), with axum-server bumps, rustls cleanup, and removal of the direct RSA WebAuthn dependency (da21e67, 132c8df) — CI stayed green throughout. Remaining items were deliberately tracked as future work rather than hidden release debt: a bincode 2.x migration, an iroh / Hickory carrier upgrade, an rsa Marvin-advisory review, and the Mac VZ platform work. (Formally, v0.3.1 is merged but not yet cut as a git tag / GitHub Release — that is the one remaining step; only v0.3.0 carries a tag today.)

9. Runtime — Mac VZ Virtualization Backend (real OS on Apple Silicon)

The biggest single body of work this week by commit volume: the Mac VZ virtualization backend on sash/local-test (79 in-window commits), then reconciled against v0.3.0 on sash/local-test-v030 (33 commits). The build progressed from elastos-vz crate scaffold through real-kernel multi-VM boots, a tmpfs-overlay Ubuntu reaching login: on Apple Silicon, interactive console attach, and a real ElastOS WASM capsule running on Mac — plus a cargo-fuzz harness for the Carrier-bridge framing parser. The reconcile cycle ported the conflict-free Mac VZ pieces onto v0.3.0 and made carrier_bridge.rs principal-aware (ded1333 day-2, 7fe2a35 day-4), and carried its own CVE sweep. Tracked in open PR #3 (Mac VZ branch refresh against v0.3.0, draft / review-ready). Archive tags cut: archive/local-test-pre-v030-rebase, archive/runtime-cve-hygiene-v020-base. The integration review recommends keeping native macOS Virtualization.framework support out of v0.3.1 and treating it as a v0.3.2 candidate — gated on a current-main rebase, a Darwin socket-path fix, Mac-hardware smoke, and hunk-level review.

10. Other Repositories This Week

Two threads ran across the supporting repos this week: a coordinated dDRM / WASM push (decrypt Lit Action CID rotation + WASI/WASM distribution across media-player, lit-keystore-moleculer, and ffmpeg-installer), and install-parity + web hardening (the single-password launcher and the elacitylabs.com refresh). All-branch scan (work landed on non-default branches in two repos):

Repo	Commits (window)	What shipped
media-player	14	Busiest repo. New image-viewer (shadow DOM + themed CSS-variable surface + theme registry), dDRM WASI static-lib distribution (ELACITY-2224), decrypt-action CID update, CI/CD revamp (per-module deploy tags). Released 0.12.2 (2026-05-27).
document-portal	4	Published user-facing legal package v1.0 (#1 merged 2026-05-27), aligned install guides with the notarized launcher (fixed dead links), documented Blockchain/RPC + dDRM playback settings.
ElacityLabsWeb (elacitylabs.com)	20 (branch wip/homepage-narrative-refresh)	Site hardening + refresh: rate-limited auth routes, URL-scheme allowlisting in BlockRenderer, helmet + trust-proxy + sensitive-log redaction, admin-only blog endpoints gated; design-system foundation tokens + icon migration (lucide → iconoir); large dependency cleanup (removed 86 unused npm deps, 38 unused shadcn components, 34 retired migration scripts); published the Feb–May 2026 article batch (10 posts) + scheduling scripts.
lit-keystore-moleculer	2	Decrypt Lit Action updated; delegation made action-agnostic (CID refresh) — keeps the keystore in sync with the new decrypt action.
elastos-launcher	3 (branch fix/install-parity-ffmpeg-cmake)	v1.2.8 + v1.2.9 released 2026-05-28 — the Mac launcher coupled to PC2 v1.3.0. v1.2.9 consolidates all macOS prerequisites into a single password prompt (5de167e) and installs ffmpeg + cmake during network setup (579d539) for install parity with PC2.
ffmpeg-installer	1	Enabled a WASI target build — supports the broader WASM/dDRM push.

No activity in window: elacity-web, drm-contracts (each has older open PRs, but neither was updated this week).

11. Convergence Lens — The Runtime Model + First External Capsule

The two codebases are converging on the same capability model from opposite ends. Runtime's v0.3.0 declares authority surfaces (Wallet as a typed authority, Browser as a runtime-mediated capsule, gateway-enforced provider boundaries); PC2's v1.3.0 enforces the analogous boundaries in a shipping product (wallet-scoped capability URLs, server-owned secure-view sessions, host-process CEK containment). PC2's dDRM trust model — "the operator can always extract their own keys; we document that honestly rather than ship DRM theatre" — is the same trust-boundary thinking Runtime encodes in its capsule authority surfaces. The Node Manager is a third convergence point: a PC2 app that operates Elastos L1 infrastructure, stitching the desktop layer to the chain layer.

The Runtime model, stated plainly. The capability model now has a clear division of roles: Home launches capsules, Wallet owns user-facing authority, Inbox handles approvals, System handles policy / recovery / diagnostics, Runtime enforces capabilities, and Carrier / provider paths mediate all external effects. Apps never receive raw wallet, chain, node, IPFS, network, provider, or identity authority — they request capabilities and the runtime brokers them.

First external capsule — a social app on the Runtime-aligned path. This week the convergence model got its first real external app: a third-party social capsule (Hey) was migrated onto the Runtime path. The initial slice launches from Home, uses app-scoped storage, and uses Runtime identity projection instead of the upstream app's broad-storage / shared-identity / raw-provider assumptions. Runtime gained the supporting contracts — app-scoped storage routes, media publish through the content provider, identity / discovery routes, typed social-event envelope validation, and social event publish/receive — plus a Carrier-backed social provider: signed social events are admitted by Runtime, published through Carrier, received for followed DIDs, and materialized into a verified remote-feed projection. Follow, remote-post materialization, comments, reactions, reposts, deletes, and basic mute / block / report now run through this path. Newer upstream chat / messenger code is intentionally not imported yet — it still assumes app-owned passkeys, shared identity, broad storage, and app-held signing — and will migrate as a separate capsule once boundary-aligned. This is the template for PC2 convergence: move one boundary at a time — user-facing capsules first, provider contracts where protected data or authority is involved.

12. Looking Ahead

Headline goal — convergence in June. Bring PC2's core patterns into the runtime as capsules — the file system, a unified settings surface, the AI-chat service, and the Elacity marketplace + dDRM — so that updating into the runtime feels like the PC2 experience, now with the name service, file directory, DRM markets, and capability tokens underneath. The target is Elacity running inside the runtime in June.

Convergence sequencing — one boundary at a time (user-facing capsules first, provider contracts where protected data or authority is involved):

1. File Manager / Library / WebSpace — manage files, open content, and publish/share through Runtime provider contracts.
2. AI Chat — brought over as a provider-backed capsule using Runtime capability calls instead of PC2 monolith assumptions.
3. dDRM + Elacity Marketplace — staged behind protected-content provider contracts: rights checks, key release, decrypt/render, content availability, Wallet/Inbox approval, and audit.

The first external capsule — a social app (Hey) — is already on this path (see §11); its messenger/chat pieces follow as a separate capsule once boundary-aligned.

PC2:

• Community beta of v1.3.0 + Launcher v1.2.9 (Mac): test the notarized launcher on clean machines (no Xcode/Homebrew) — first run asks once for a password, installs prerequisites, then PC2 — then announce.
• Review + land the Elastos Node Manager set (Necessary PC2 changes for the Node Manager (service-type app support) #18 → Elastos Node Manager app (service-type app — requires #18) #19).
• Decide on Monetisation Agent promotion (dormant → default-on) after validation; Public Cloud PC2 (try.pc2.net) pending sign-off.
• Extend the Elacity marketplace with refreshed branding + additional asset types as they come online.

Runtime:

• Cut the formal v0.3.1 tag/release, then push Mac VZ toward v0.3.2 — gated on a current-main rebase, a Darwin socket-path fix, Mac-hardware smoke, and hunk-level review — alongside multi-VM orchestration + capsule lifecycle; prepare the external security-review packet.
• Hold the boundary discipline v0.3.0 established: keep the trusted core small and delegate passkey, networking, IPFS, and crypto to the runtime + carrier rather than baking them into individual capsules. Fundamental, performance- and security-critical providers stay Rust-native (smaller attack surface, better performance); everything else loads on demand as a capsule. A capsule template repository with guidelines is planned so third parties can build to the boundaries without learning the whole runtime.

Cross-cutting direction:

• dDRM roadmap: get Lit Protocol working and ported first, then build a parallel, protocol-abstracted key-delivery layer (apps shouldn't need to care which protocol or solution is underneath); gate DRM decrypt execution to KVM / TEE-class hosting for sensitive content; a later iteration to quantum-proof the key-delivery service.
• Content portability: port PC2's multi-format dDRM playback (3D, PDF, ePub, image) to the Elacity platform via a session-based backend that cuts repeat round-trips and can deploy serverlessly.
• Virtualization positioning: the Mac VZ backend is an adaptability layer (run any language in an isolated container, ease porting existing apps) that complements — rather than replaces — Rust-native capsules for the fundamentals. Kernel-level (KVM/TEE) isolation matters most for multi-tenant or sensitive-data capsules; for single-user local use it is not yet on the critical path.
• Wallet-agnostic by design: built-in runtime wallets at the base, with connectors (e.g. WalletConnect / Universal X) as optional convenience adapters — a transaction is a transaction and a balance is a balance regardless of the wallet behind it.
• Security cadence: a dedicated security-audit pass across smart contracts + platform is scheduled using the latest frontier models; v1.3.0 already cleared an automated pre-release audit.
• Future monetisation: explore packaging a user's own node analytics into signable, opt-in data capsules as a personal-data income stream, plus monetisation paths for larger assets, apps, games, and agents.

13. Summary Statistics

Window: 2026-05-22 10:45 UTC (since report #17) → 2026-05-29 23:59 UTC (7 days)

Repository	Commits	Insertions	Deletions	Files
Elacity/pc2.net	37	15,195	2,619	121
Elacity/elastos-runtime	132	223,722	22,002	634
Combined	169	238,917	24,621	755

Stats source: git log aggregated and deduped by SHA. PC2 is scoped to commits landed on origin/main (Elacity's fork) in the window — the vendored Puter upstream/* remote is excluded. Unlike #17, this window has no large vendored-dependency deletion to distort the deletions column. Runtime stats aggregated across all remote branches in window, deduped by SHA.

PC2 active branches in window: main (37), release/2026-05-28-ddrm-hardening (36, merged), feat/ddrm-zero-cek-exposure (16), chore/2026-05-25-roadmap-and-pi-ci (14).
PC2 contributors in window: Elacity team (37 commits across 2 engineers).

Releases / tags in window:

• PC2: v1.3.0 (2026-05-29) — first PC2 tag since v1.2.7.14.
• Runtime: v0.3.0 (2026-05-27) + archive tags archive/local-test-pre-v030-rebase, archive/runtime-cve-hygiene-v020-base. v0.3.1 is not yet tagged (CVE-hygiene commits only).

Runtime active branches in window: sash/local-test (79, Mac VZ), sash/local-test-v030 (33, reconcile + CVE), main (17, v0.3.0 + 0.3.1 merges), review/0.3.0 (12).
Runtime contributors in window: Elacity team (132 commits across 2 engineers).
Secondary-repo activity (all-branch): ElacityLabsWeb (20, wip/homepage-narrative-refresh), media-player (14), document-portal (4), elastos-launcher (3, fix/install-parity-ffmpeg-cmake), lit-keystore-moleculer (2), ffmpeg-installer (1).

14. Data-Quality & Off-Repo Notes

• Window boundary is anchored to report ElastOS Weekly Shipping Report — Week of May 15 – May 22, 2026 #17's publish time (2026-05-22 10:45 UTC) so there is no overlap with ElastOS Weekly Shipping Report — Week of May 15 – May 22, 2026 #17's "May 15 – 22" coverage; the shared boundary date (May 22) carries only post-ElastOS Weekly Shipping Report — Week of May 15 – May 22, 2026 #17 commits.
• Coverage: every Elacity org repo with a push in the window was scanned across all branches (not just the default branch) — this surfaced the launcher's fix/install-parity-ffmpeg-cmake work and ElacityLabsWeb's wip/homepage-narrative-refresh (both off-default). ElacityLabsWeb's ~14.2M-line deletion count is a vendored-dependency / retired-components cleanup and is excluded from the headline stats to avoid distortion (hand-written churn ≈ 7.9K insertions).
• PC2 scope deliberately excludes the upstream/* Puter remote — those are upstream-Puter (third-party) contributions, not Elacity work. Counting them would have inflated the table with ~240K lines of unrelated churn.
• Off-repo context — forward-looking direction from the weekly team sync is folded into §12 (Looking Ahead). Travel, partner calls, and ecosystem conversations not otherwise visible in git are out of scope for this report.

15. Key Links This Week

• Previous report — ElastOS Weekly Shipping Report — Week of May 15 – May 22, 2026 (#17)
• PC2 v1.3.0 release — https://github.com/Elacity/pc2.net/releases/tag/v1.3.0
• ElastOS Launcher v1.2.9 — https://github.com/Elacity/elastos-launcher/releases/tag/v1.2.9
• Runtime v0.3.0 — https://github.com/Elacity/elastos-runtime/releases/tag/v0.3.0
• Node Manager PRs — #18 service-type support · #19 ENM app
• PC2 install — Mac / Linux / VPS — curl -fsSL https://raw.githubusercontent.com/Elacity/pc2.net/main/scripts/start-local.sh | bash
• PC2 install — Raspberry Pi / NVIDIA Jetson (ARM) — curl -sSL https://raw.githubusercontent.com/Elacity/pc2.net/main/scripts/install-arm.sh | bash
• Network Map — map.ela.city · Portal — portal.ela.city · Elacity Labs — elacitylabs.com