ElastOS Weekly Shipping Report — Week of June 5 – June 11, 2026

[SashaMIT]

Elacity Labs — Weekly Team Update for the World Computer Initiative (WCI)
June 5 – June 11, 2026

The week the Runtime stopped being a shell and became a system — twice over. Two bodies of work landed in parallel, and either alone would have anchored the report. First, Runtime v0.4.0 tagged (June 9, announced June 10) — the Library / Marketplace / Archive / Spaces / Trash + WebSpaces + capsule-packaging release that gives ElastOS a real desktop: files and shared content now sit behind one provider-backed object model, the desktop projects those same objects, first-party apps become WASM capsules, and localhost://WebSpaces/* mounts networked content as governed objects — ~27 commits by Anders Alm, pointing explicitly toward the ElastOS v2 direction (more dDRM/PC2/platform logic moving into Rust + Runtime, off the Puter base). Second, the dDRM-into-Runtime convergence epic opened at full throttle — ~153 commits (123 SashaMIT + 30 Anders) on feat/ddrm-hardening-and-creator-parity, porting PC2's protected-content engine into the runtime's capability model and building, one provable layer at a time, a distributed key-management system (dKMS) that climbs from a 2-of-2 XOR split all the way to reconfigurable threshold cryptography, distributed key generation, and post-quantum (ML-DSA-65) threshold attestation. Around them, the Elacity platform integrated the new @elacity-js/ddrm-reader and fixed epub/pdf rendering (ELACITY-2224), ddrm-reader shipped UI 0.2.1–0.2.4 (incl. 24h wallet-delegation persistence), the Elacity web app cut a 4.3.0 release, and js-sdk retired a deprecated endpoint. This is the heaviest engineering week of the quarter.

Second of the #22–#24 catch-up batch (May 29 → June 19).

---

Table of Contents

1. The Big Picture — v0.4.0 Lands, dDRM Convergence Ignites
2. Runtime v0.4.0 — Library, Marketplace, WebSpaces & Capsule Packaging (tagged)
3. Runtime — Library/Explorer Completion on ElastOS Rails
4. dDRM → Runtime — Foundations & Byte-Identical PC2 Parity
5. dDRM → Runtime — Post-Quantum CEK Sealing (ML-DSA-65 Hybrid)
6. dDRM → Runtime — The Provider Spine (Phases A/B/C)
7. dDRM → Runtime — Runtime-Core Orchestration (DrmHost + Plan Runner)
8. dDRM → Runtime — The Distributed Key-Management System (dKMS)
9. dDRM → Runtime — Viewer Seam & The Runnable Vertical
10. Elacity Platform dDRM — Reader Integration + epub/pdf Fixes (ELACITY-2224)
11. Elacity Web App + js-sdk — Brand Identity, 4.3.0, getToken Fix
12. ElacityLabs.com — Narrative, Layout & Security Pass
13. PC2 — Stable at v1.3.0 (The Conformance Oracle)
14. Other Repositories This Week
15. Convergence Lens — Porting Capability, Not Copying Code
16. Looking Ahead
17. Summary Statistics
18. Data-Quality & Off-Repo Notes
19. Key Links This Week

---

1. The Big Picture — v0.4.0 Lands, dDRM Convergence Ignites

This week the Runtime crossed from "authority-surface skeleton" (v0.3.x) to "usable system" on two fronts. v0.4.0 (tagged cae83c3, June 9) delivers the parts a user touches — a Library desktop, a Marketplace, Archive/Trash/Spaces, and WebSpaces — all expressed as object providers brokered by the runtime, with first-party apps repackaged as WASM capsules. Simultaneously, the dDRM hardening & creator-parity epic moved Elacity's protected-content engine into that same model, rebuilt around capability tokens and distributed key custody and continuously validated against PC2 v1.3.0 with byte-identical conformance gates. The crown jewel is a distributed key-management system built in disciplined "Day N" milestones — 2-of-2 split → Shamir 2-of-3 over GF(256) → reconfigurable quorum → verifiable distributed key generation → post-quantum threshold attestation (QuorumReleaseProofV1). PC2 v1.3.0 stays frozen as the reference.

2. Runtime v0.4.0 — Library, Marketplace, WebSpaces & Capsule Packaging (tagged)

elastos-runtime v0.4.0 (Jun 7–9, Anders Alm, ~27 commits) turns the runtime into something you can live in. The core idea: files and shared content sit behind one provider-backed object model instead of every app inventing its own path.

• A Library for the desktop — an object-provider-backed file manager (ef281c6) with navigation, upload/download, preview/open, publish, share, status, repair, Trash, Archive handoff, Spaces, context menus, and object events; carried over provider invocation transfer rails (ea69519).
• Home and Library see the same objects — the desktop projects provider-backed Library objects directly (6df7899, 9d982f1); what the user sees and what the Runtime tracks underneath converge on one model governed by the same contracts (who can open, change, share, repair).
• First-party apps are now Runtime capsules — Library, Archive, Marketplace, Spaces, Trash and related shared-content flows move behind capsule + provider contracts instead of exposing raw host paths (3262966, 3a0fb50, 08f2479); the Marketplace capsule (18f9293) becomes where first-party apps live as the catalog grows; capsule packages are materialised before launch (6b2cf26) and first-party bundles packaged into the release (16e297e).
• WebSpaces (early) — a local mounted resolver view at localhost://WebSpaces/* (a758edc) points at content elsewhere on the network while keeping provider targets private to the resolver — networked spaces treated as mountable, governed objects.
• Provider contracts deepened — typed transfer receipts, stream sessions, content availability and protected-sharing providers (203f04c), repair flows, exact-CID fallback, quota surfaces, admission checks, and operator inspection views; the Archive capsule (66f77a9) completes the Library → Archive → Trash → Spaces lifecycle (2c7a7e3, f14ec9f, 3b4fa50, e6be95e). Release hardening: registered provider capsules (c9e158c), gateway/Library/release smoke coverage (607a197, 7d7c2d5, 7965ab4), changelog + route/lock restore (5998e5a, 4b5232e), tagged v0.4.0.

As the release note frames it, this points toward ElastOS v2: moving more dDRM, PC2 and platform logic into Rust + Runtime so ElastOS becomes fully native over time without depending on Puter as its base.

3. Runtime — Library/Explorer Completion on ElastOS Rails

The weekly Runtime report documented the Library reaching substantial completeness on ElastOS-native foundations (principal authority stays with Runtime; object/content state stays with providers; Carrier handles off-box effects; apps never receive raw host-path, IPFS/Kubo, peer, wallet, chain or cloud authority):

• PC2-familiar Explorer — sidebar/places, breadcrumbs, grid/list, sorting, create/rename, double-click open, context menus, upload/download, drag/drop move-copy, Desktop projection (localhost://Users/<principal>/Desktop through the provider layer), Trash/restore/delete, publish/share/status/repair, properties, preview/open, viewer handoff, SSE refresh, and browser Back/Forward takeover.
• WCI-aligned architecture — Library is an app capsule owning UI only; mutable local objects via library-provider with an object-scheme alias; published content via content-provider; WebSpaces as mounted provider-backed views, not ordinary folders. Carrier availability now supports signed announcement, candidate scoring, remote proof, and the first autonomous cross-peer repair/replication path; provider-to-provider invocation, transfer envelopes, repair ledgers and availability dashboards were strengthened so remote storage/repair is auditable and fail-closed.
• UX + codebase — browser-native prompt/alert/confirm replaced with in-app provider-backed flows; the Library frontend split from a monolith into focused modules; performance gains via caching, prefetching, keyed DOM reuse, chunked first paint, and reduced render churn. Deferred: broader WebSpace federation/external adapters, full remote ACL/key-release, fully native streaming/backpressure, multi-peer storage markets, the library-provider → object-provider rename.

4. dDRM → Runtime — Foundations & Byte-Identical PC2 Parity

The convergence epic (feat/ddrm-hardening-and-creator-parity) anchored itself to PC2's proven behaviour so every later layer could be checked against a known-good oracle:

• Vendored PC2 cenc-decrypt engine as a fail-closed backend (82a14ca) — decrypt with PC2's exact engine, not a re-implementation; a Branch-by-Abstraction decrypt seam (461f415) lets new rails slot in behind a flag.
• WASI-sandbox smoke harnesses proving fail-closed execution across the decrypt/rights/key/drm providers (2866d9a, 6fb838f, 94d3824), clean to wasm32-wasip1 (1813527).
• dDRM invariant ElastOS Weekly Shipping Report — Week of Feb 24-28, 2026 #1 — in-boundary CEK + KID keygen pinned (3b4dba9, ec6fd6d).
• PC2 cross-implementation conformance promoted to a standing gate (8bf242a, 8cb43b8, 787bb3a) — the port must produce a byte-identical decrypted asset to PC2; later commits prove PC2's real decrypt consumes the producer's output across multi-sample/subsample shapes (926b9ad, c63c375).
• Drift guard + 0.4.0 reconciliation with zero type drift (742f624, d1035d9); a Day-15 checkpoint recorded the foundation proven, including PQ-hybrid in WASM (3d3eb55); crosvm compiles on non-Linux hosts so v0.4.0 builds on macOS (5b167f1).

5. dDRM → Runtime — Post-Quantum CEK Sealing (ML-DSA-65 Hybrid)

The CEK-sealing path was made quantum-resistant ahead of need: PQ-hybrid CEK-seal envelope de-risked (38fa91a) and proven end-to-end pre-rail (ee5b084); real ML-DSA-65 (FIPS 204) wired into the CekSealVerifier (d6899b9) and verified through the rail entrypoint (aadb4f1); a hybrid ECDSA-P256 + ML-DSA-65 seal verifier (779c74f) holding against both classical and quantum adversaries; an adversarial negative-space + containment sweep hardened it (b1f8b7d).

6. dDRM → Runtime — The Provider Spine (Phases A/B/C)

The creator and consumer economics were rebuilt as discrete, swappable, fail-closed runtime providers:

• Key authority — pluggable multi-backend authority (ec7f765) with a reference seal engine over a shared ddrm-envelope (3225e97); key-provider::release recovers-from-escrow and re-seals to session (58808ef, Day 70).
• Rights — on-chain ownership rendered into a typed rights receipt (07e0c93), with an opt-in live wallet check (879904a, Day 57).
• Encrypt — encrypt-provider::seal runs the full production pipeline into a SealedObjectV1 (7dda28a, Day 69), content-addressing the ciphertext so payload_cid is real (e8dc4d8, Day 68).
• Chain / publish — assemble_mint becomes real EVM calldata (fce0c33, Day 62); publish-provider assembles the on-chain mint fail-closed (ad6bd13, Day 61); the producer→chain loop closes (76e0d1e, Day 63).
• Content market — reconstructs a listing from mint calldata (ea4962a, Day 64), enriches from metadata.json (676a90f, Day 65), then reconstructs from the chain's own event log (81bd466, Day 66) — marketplace state rebuilt from chain, not a trusted server.
• Orchestrator / escrow — drm-provider::open emits an executable DrmOpenPlanV1 (dba19d8, Day 67); a CEK-escrow engine runs producer → authority → decrypt on a fresh CEK (2dc9b0c, Day 59).

7. dDRM → Runtime — Runtime-Core Orchestration (DrmHost + Plan Runner)

Phase A composed the providers under one runtime-owned entrypoint, all fail-closed: a plan executor walking DrmOpenPlanV1 (015233b, Day 71); per-provider capability handles injected into the executor (c81f777, Day 72); a composition root open_drm_plan(...) (717919f, Day 73); a runtime-owned capability registry resolving a fresh handle per provider transport (c4d7195, Day 74); and the trusted DrmHost::open(content_id, viewer) owning plan-fetch + drive + event emission (bd39b18, Days 75–76), persisting via a durable CEK-free event sink (b1c4baf, Days 77–78) over a production-shaped durable store (68a535e, Days 79–80; e970279, Days 81–82).

8. dDRM → Runtime — The Distributed Key-Management System (dKMS)

The centrepiece: a distributed key-management system so no single party ever holds the CEK whole, built one provable, independently-testable, fail-closed-below-quorum layer at a time:

• Process split + delegated recovery — secret-holding node vs public-only runtime, recovery delegated across the boundary (806bb6a, Days 87–88); authenticated channel + per-recover authorization (0745c8e, Days 89–90).
• Hardened transport — long-lived connection + node-bound session required on every recover (bceea30, Days 91–92); framed Unix-domain socket + non-replayable possession-proof (ce10d4a, Days 93–94); allow-listed caller + fresh anti-replay recover (f016306, Days 95–96).
• Real 2-of-2 threshold — XOR-split the CEK 2-of-2 across two nodes, reconstructing only inside the decrypt boundary (001f09d, Days 97–98); driven through the production DrmHost (e4edaab, Days 99–100); resilient + identity-bound, failing closed under a node fault and detecting a swapped node-set (1cc75ba, Days 101–102); threshold identity welded into the transcript AAD + audit record (b392556, Days 103–104).
• Off-localhost — real TCP with an app-layer encrypted, mutually-authenticated channel from our own primitives; hostile-network edges fail closed (e9c0854, Days 105–108).
• Lifecycle — live share-wise rotation to successor nodes with proactive refresh (CEK never reassembles), operator-only authorization, live caller revocation (0c08241, Days 109–112).
• Real t-of-n — the CEK is Shamir-split 2-of-3 over GF(256) across three nodes; any two live nodes serve an open (survives a dead node), below quorum fails closed, mis-indexed/duplicated shares refused (8ce79f5, Days 113–116).
• Quorum lifecycle — share-wise rotation via coordinate-bound refresh deltas q(x_i) with q(0)=0 over GF(256); the CEK is invariant, old material dies (9322733, Days 117–120).
• Reconfigurable quorum — re-share a live 2-of-3 set into a 3-of-5 set via authenticated proactive re-sharing; threshold and membership change while the CEK never reassembles (8f86da2, Days 121–125).
• Distributed Key Generation — the CEK is born distributed: verifiable DKG across real daemons so no node — not even the provisioner — ever holds the whole key (00f3294, Days 126–130).
• Threshold attestation — the quorum proves it served you: every open emits a portable QuorumReleaseProofV1 anyone can verify offline that these t-of-n nodes authorized this content for this principal under this session (962219b, Days 131–135).

Net: the most sensitive secret in the system is never held whole, its custody is provable and reconfigurable, the proofs are quantum-resistant, and it all lives inside the runtime's containment model — even the operator's own infrastructure can no longer unilaterally recover a key.

9. dDRM → Runtime — Viewer Seam & The Runnable Vertical

The pieces were stitched into a runnable vertical: a viewer seam (B1–B4) with elacity-player + a scoped media stream (e6910f9, f3c47fc, f385874); multi-segment under the threshold + quorum split rails (50206ac), multi-MiB content via Helia-byte-compatible chunked UnixFS (1648c95, 71ca0fb), a multi-segment CENC asset decrypting under one CEK (2f313e3); a live-chain rights gate + non-media viewer + Library binding (e9dcedb), real chain-provider ownership reads behind the Home rights gate (cb60905, 6d32e27), buy-flow orchestration putting an access token in the wallet (cf62be6), and live EVM tx signing for buy via the wallet-provider — the key never leaves the capsule (edf96c2); content fetched by CID through a content capability, no raw HTTP (7b26470); plus a RUN_E2E operator runbook (eaa0792).

10. Elacity Platform dDRM — Reader Integration + epub/pdf Fixes (ELACITY-2224)

On the Elacity platform side (ELACITY-2224), the new reader was integrated and polished: fixed UI rendering for epub/pdf, integrated the new @elacity-js/ddrm-reader to the platform, refined routes from /cinema/ to / (views, channels, playlists, history), reached ~95% on layout fixes, and progressed CI/CD github-action deployment. Focus items included handling the no-access case (a looping signature prompt) and turning rich-content [Object object] errors into readable messages. In the reader repo itself, @elacity-js/ddrm-reader-ui advanced to 0.2.1 → 0.2.4, headlined by persisting wallet delegation across reloads (24h, no re-prompt) (3f2fd0b) — a frictionless-access idea the Runtime echoes the following week (#23) — plus refined UI/rendering (1d2cc79).

11. Elacity Web App + js-sdk — Brand Identity, 4.3.0, getToken Fix

elacity-web (Jun 5–8, Irzhy) advanced brand identity and cut a release: capsuleType constants + CinemaSortHorizontalFilter typing (080d2476), dynamic BottomNavigation (5be7d4e4), the ddrm-reader-ui 0.2.4 bump + refactor (fe7f945e), CI green-up (5e3d125c, db14362c), and released 4.3.0 (tag 4.3.0, Jun 8; 1ae7259e). Separately, js-sdk retired the deprecated /getToken endpoint (c8942f6, Jun 11).

12. ElacityLabs.com — Narrative, Layout & Security Pass

ElacityLabsWeb (wip/homepage-narrative-refresh, Jun 6–7, SashaMIT): a narrative/layout/security/repo-hygiene sweep (22086ad46) and a mobile & responsive layout pass with console bug fixes (b471edfb7). Staged for a later coordinated go-live.

13. PC2 — Stable at v1.3.0 (The Conformance Oracle)

PC2 (pc2.net) had no new main commits — by design. Its value this week was as the reference implementation: the runtime's dDRM port is validated against PC2 v1.3.0's exact decrypt output by the byte-identical conformance gates in §4 (8bf242a, 926b9ad). Holding PC2 stable is what makes the convergence port trustworthy.

14. Other Repositories This Week

Repo	Commits (window)	What shipped
elastos-runtime	~153	v0.4.0 Library/Marketplace/Archive/Spaces/Trash/WebSpaces + capsule-packaging cut (Anders, tagged Jun 9) + the dDRM convergence epic — vendored PC2 cenc-decrypt, byte-identical conformance gates, ML-DSA-65 hybrid seal, the provider spine, DrmHost orchestration, the dKMS ladder (2-of-2 → Shamir 2-of-3 GF(256) → reconfigurable 3-of-5 → DKG → QuorumReleaseProofV1), viewer seam + runnable E2E vertical.
elacity-web	6	Brand-identity features, ddrm-reader-ui 0.2.4, CI green-up; released 4.3.0.
ddrm-reader (private)	4	UI 0.2.1–0.2.4: 24h wallet-delegation persistence (no re-prompt), refined UI/rendering.
ElacityLabsWeb	2	Narrative/layout/security/hygiene + mobile-responsive + console cleanup.
elastos (website)	1	About page: ElastOS delivery-roadmap chart + people carousel + DAO stats.
js-sdk (private)	1	Retired deprecated /getToken endpoint.
CRC-Accountant (portal)	1	Added Elastos DAO Nodes as a partner — tx HeyPuter#33 label, logo, tooltip, note.
pc2.net	0	Stable at v1.3.0 — conformance oracle.

Audited, no in-window activity: v3-drm-protocol, media-player, lit-keystore-moleculer.

15. Convergence Lens — Porting Capability, Not Copying Code

The runtime didn't copy PC2's dDRM code — it re-expressed PC2's capabilities in a stricter trust model and proved equivalence. PC2 brokers decryption through a WASM-contained runtime with end-to-end CEK containment; the new runtime brokers it through capability tokens, distributed key custody, and quantum-resistant attestation, with a standing gate asserting byte-identical output to PC2 v1.3.0. That's the convergence pattern stated last week (Strangler-Fig + Anti-Corruption-Layer + characterization gates): PC2 as proven oracle, runtime as hardened destination, equivalence enforced by tests. v0.4.0 does the same for the shell — File Explorer, Library, Marketplace and app-distribution re-expressed as object providers and capsules — and the public release note names the destination directly: ElastOS v2, fully native on Rust + Runtime. The capability model's sharpest expression is the dKMS: even operator infrastructure can no longer unilaterally recover a content key — it takes a live, attestable quorum.

16. Looking Ahead

• dDRM live end-to-end — wire the dKMS quorum into a real consumer "open" over Carrier and the creator mint into a real on-chain mint (lands next week — ElastOS Weekly Shipping Report — Week of June 5 – June 11, 2026 #23).
• Latency & friction — warm the key-provider/quorum against cold start; bring PC2's secure-view session (and the reader's 24h delegation idea) into the runtime so re-opens skip the wallet prompt; show live staged progress.
• Web go-live — converge the website rebuild + Elacity brand refresh + base-network release.
• Reconcile — fold the convergence epic toward a tagged runtime cut once the live path is soaked.
• Mac — get Runtime running properly on Mac for a normal install-and-test desktop experience; continue Linux↔Mac Carrier testing.
• PC2 — hold v1.3.0 as the conformance oracle.

17. Summary Statistics

Window: 2026-06-05 → 2026-06-11

Repository	Commits	Insertions	Deletions
elastos-runtime (epic + v0.4.0)	~153	~167,997*	~12,512*
elacity-web	6	251	106
ddrm-reader (private)	4	1,114	30
ElacityLabsWeb	2	1,221	1,352
elastos (website)	1	3,442	929
js-sdk (private)	1	225	2
CRC-Accountant (portal)	1	118	4
pc2.net	0	0	0
Combined (audited)	~168	~174,368	~14,935

*Runtime line counts include vendored dependencies + generated artifacts pulled into the convergence branch (the PC2 cenc-decrypt engine, ABIs, golden vectors, fixtures); raw totals overstate hand-written change. Commit counts are the truer effort signal.

• Runtime active branches: feat/ddrm-hardening-and-creator-parity (~153), main/0.4.0 (v0.4.0 cut). Contributors: SashaMIT (~123, dDRM epic), Anders Alm (~30, v0.4.0 + provider rails + Library).
• elacity-web: feature/brand-identity-2026 + release/base-network (6, Irzhy). ddrm-reader: main (4, Irzhy). ElacityLabsWeb: wip/homepage-narrative-refresh (2, SashaMIT).
• Releases / tags in window: Runtime v0.4.0 (2026-06-09); elacity-web 4.3.0 (2026-06-08); ddrm-reader UI 0.2.1–0.2.4.

18. Data-Quality & Off-Repo Notes

• Catch-up batch. Second of three reports (ElastOS Weekly Shipping Report — Week of June 12 – June 19, 2026 #21–ElastOS Weekly Shipping Report — Week of June 5 – June 11, 2026 #23) covering May 29 → June 16.
• "Day N" milestones refer to the dDRM convergence project's internal day counter (heavily AI-assisted; multiple "days" land per calendar day), not calendar days.
• Line-count caveat: runtime totals inflated by vendored/generated content — see footnote; commit counts + milestone narrative are the truer signal.
• Authorship (runtime epic): ~123 SashaMIT + ~30 Anders Alm in-window on the convergence branch; v0.4.0 authored by Anders Alm.
• Private repos ddrm-reader + js-sdk audited via authenticated read-only clones (serialised, no bulk ops). v3-drm-protocol, media-player, lit-keystore-moleculer: no in-window commits.
• Author-date windowing used for web/reader repos (branches consolidated later in the period).
• PC2 scope excludes the vendored upstream/* Puter remote.

19. Key Links This Week

• Runtime v0.4.0 — https://github.com/Elacity/elastos-runtime/releases/tag/v0.4.0
• Convergence branch — feat/ddrm-hardening-and-creator-parity (elastos-runtime)
• PC2 v1.3.0 (conformance reference) — https://github.com/Elacity/pc2.net/releases/tag/v1.3.0
• Previous report — Week of May 29 – June 4, 2026 (#22)
• Network Map — map.ela.city · Portal — portal.ela.city · Elacity Labs — elacitylabs.com