ElastOS Weekly Shipping Report — Week of June 19 – June 26, 2026

[SashaMIT]

Elacity Labs — Weekly Team Update for the World Computer Initiative (WCI)
June 19 – June 26, 2026

The week the dDRM stack grew its market — and the platform around it got a security sweep. Three arcs ran in parallel and they were all the same thing: turning a hardened dDRM stack into something a buyer can pay for, a node operator can run, and an auditor can trust. In Runtime, an AI-pair-programmed deep-audit branch merged into the dDRM hardening line (PR #7) — closing 7 of 8 pre-audit findings, landing single-copy CENC decrypt, library directory-list caching, per-capsule WASM memory limits, and operator-terminable runaway capsules — and then a brand-new feat/marketplace-runtime branch went from empty to a working buy/trade backend on real Base contracts in three days (buy/trade only; mint and in-app playback explicitly out of scope). In PC2, the Elastos Node Manager landed as an installable service-type app and was hardened, gated, multi-arch packaged, and proxied. Across the platform, a coordinated security-remediation sweep closed findings in the marketplace frontend, the on-chain DRM protocol, the key-transfer service, and the transcode service; Hyper matured post-quantum E2E calls and passed an independent multi-round audit; and a self-hosted, two-region public RPC stack went live as a byte-compatible, faster, $0-managed-cloud replacement for api.elastos.io.

Marketplace Phase 1+2 alive on real Base · ENM service-app install rails merged + hardened · dDRM pre-audit pass: 7/8 closed · WASM capsules now operator-terminable · forensic variant pipeline wired into the live gateway · platform security sweep across 4 repos · Hyper PQ A/V calls + audit closure · public RPC stack live (FIN + DE), 1.5–1.8× faster.

---

Key Links This Week

• Previous report — ElastOS Weekly Shipping Report — Week of June 12 – June 19, 2026 (#24)
• Active Runtime branches — feat/marketplace-runtime · feat/ddrm-hardening-and-creator-parity · claude/branch-deep-audit-yiez86
• Active PC2 branch — feature/elastos-node-manager
• Merged this week — Runtime PR ElastOS Weekly Shipping Report — Week of Mar 14–20, 2026 #7 — DDRM/dKMS hardening + audit verification + library/serve performance
• Marketplace keystone — d17b03a3 — live-source buy terms from sellersOf/listings, fully UI-driven, no env pins
• Buy/Acquire path — 016f362b (buy_authority) · f9d655d6 (POST /api/market/acquire) · 3236772c (object-provider Acquire op)
• ENM landing — de5890aa (Merge PR Elastos Node Manager app (service-type app — requires #18) #19 enm-app) · 094c6e06 (Merge PR Necessary PC2 changes for the Node Manager (service-type app support) #18 pc2-service-apps) · 05549498 (fail-closed Ed25519 verify)
• Public RPC — api.elastos.io · rpc.elastos.info (now served 100% from the new self-hosted stack)
• Network Map — map.ela.city · Portal — portal.ela.city · Elacity Labs — elacitylabs.com

Table of Contents

1. The Big Picture — Hardening Becomes a Market
2. Runtime — Marketplace Runtime, Buy/Trade Rails on Live Base
3. Runtime — Storefront Shell, Brand Transplant & A11y Pass
4. Runtime — Pre-Audit Verification & Library/Serve Performance (PR ElastOS Weekly Shipping Report — Week of Mar 14–20, 2026 #7)
5. Runtime — Forensic Variant Pipeline Goes Live in the Gateway
6. Runtime — DKMS Quorum: Recover-Proof Revert, Replay-Safe Retries, Warm-Session Self-Heal
7. Runtime — Per-Capsule WASM Limits & Operator-Terminable Runaways
8. Runtime — Browser VM as Product Boundary & Remote Carrier Exit
9. PC2 — Elastos Node Manager Lands: Service-Type App Rails
10. PC2 — ENM Hardening, Multi-Arch Packaging & Server Perf
11. Platform Security Sweep — Marketplace, Protocol, Keystore & Transcode
12. dDRM Protocol v3 & Key Services
13. Hyper — Post-Quantum Messaging Matures + Independent Multi-Round Audit
14. Public RPC Stack — Self-Hosted, Two-Region, Byte-Compatible Replacement
15. ElacityLabs.com — Newsletter, Blog & Social Automation
16. Convergence Lens — PC2 ↔ Runtime
17. Looking Ahead
18. Summary Statistics
19. Data-Quality & Off-Repo Notes
20. Architecture Alignment — Direction This Cycle

1. The Big Picture — Hardening Becomes a Market

Three things happened in parallel, and they were all the same thing: turning a hardened dDRM stack into something a buyer can actually pay for, a node operator can actually run, and an auditor can actually trust.

• Audit closes, the foundation locks. PR ElastOS Weekly Shipping Report — Week of Mar 14–20, 2026 #7 (claude/branch-deep-audit-yiez86 → feat/ddrm-hardening-and-creator-parity) merged 29 commits of AI-pair-programmed deep-audit work into the dDRM hardening branch: 7 of 8 pre-audit findings recorded closed, single-copy CENC decrypt (d2705009), fail-closed bounds on untrusted CENC box counts (fea728bc), single-use grant-nonce refresh on quorum retries (edb02ec5), library directory-list caching (72550c46), per-capsule WASM memory budgets (253d0995 → ce2bd96e), and operator-terminable runaway capsules (8bf1d299). The build-visible audit-verdict ratchet (1e9e7125) and conformance GAP-8 closure (4894f50a) make the verified state legible to CI. This is the soak floor the rest of the week was built on.
• The market layer lands. A new branch — feat/marketplace-runtime — was opened, scoped, and built from abb5fdf9 (Phase-1 buy-invariant spec) through ad8bc712 (elacity brand transplant): spec → shell capsule that holds no authority → contract reconciliation against deployed Base bytecode → buy_authority → trade_authority → KID→tokenId resolver → Phase-2 routes (/api/market/get, /vault, /acquire) → an object-provider Acquire op that pins a bought encrypted asset into the Library. A mid-branch re-scope (2bd87238) explicitly dropped mint and in-app playback — the marketplace is buy/trade only; minting stays in the Studio path, playback stays in the Runtime viewer.
• The operator path lands. In PC2, two long-running PRs (Necessary PC2 changes for the Node Manager (service-type app support) #18 pc2-service-apps, Elastos Node Manager app (service-type app — requires #18) #19 enm-app) merged into the feature/elastos-node-manager integration branch — the +82,483-line landing in de5890aa is the Elastos Node Manager service + operator UI finally entering the integration tree. Then it was hardened (Ed25519 fail-closed verify, lifecycle test), gated (device-compatibility on requirements.platform), packaged for multi-arch, and patched for same-origin/auth-header and download-progress.
• The platform gets a security sweep. Beyond the runtime, a coordinated remediation pass closed findings across four repos — the marketplace frontend (elacity-web), the on-chain DRM protocol (v3-drm-protocol), the key-transfer service (lit-keystore-moleculer), and the transcode service (transcoder-gcloud) — turning the prior security review's triage into landed fixes (§11–12).
• The transport gets cheaper and safer. A self-hosted, two-region public RPC stack went live as a byte-compatible, faster, $0-managed-cloud replacement for the legacy api.elastos.io / rpc.elastos.info endpoints (§14).
• Conformance held. PC2 v1.3.0 stayed the frozen conformance oracle for the dDRM render path — every marketplace contract decision in Runtime cross-referenced PC2 SSOT (e1fef691, 6325099a, c4e4b682, 98b28bdb) rather than re-deriving terms. The next PC2 node release and the ElastOS Launcher are in final pre-release testing (§17).

2. Runtime — Marketplace Runtime, Buy/Trade Rails on Live Base

feat/marketplace-runtime went from empty to a working buy/trade backend over three days (Jun 22–24), ~69 commits, +6,506/−1,171 lines, against real Base contracts. Highlights in build order:

• Spec + shell — Phase-1 buy-invariant spec + layout mock (abb5fdf9), marketplace-content shell capsule that holds no authority (79f63089), Phase-2 spec for /api/market/* routes (c004eebc).
• Contract reconciliation against deployed Base — gateway selectors confirmed against deployed bytecode (f4643abe), runtime↔elacity addresses reconciled (6325099a), pay-token corrected to canonical Base USDC and PC2 v3 conformance banked (983642d5), V3 event topics live + source-confirmed (5dbdcf81), and a full PC2-SSOT contracts reconciliation (e1fef691).
• Working content-index against LIVE Base — 393b3dd0 proves Phase-2 discovery decoding AssetCreated events from live Base; b4bd48ef lands the cache + search/sections slice; 2a2d0264 adds GET /api/market/get with live re-verified detail terms via sellersOf+listings.
• buy_authority — Phase-1 invariant — 016f362b lands the core (value×qty, approve via paymentProcessor); 0a752437 adds abort-on-drift; 781d226d corrects the listings() qty/price word order from the SSOT and fail-closes non-hex decode; c5599e30 enforces the SCOPE unsigned-only hard-gate and fail-closes on missing seller.
• KID→tokenId resolver — initial ResolveTokenId op (9bd5489b), pivoted (6bde757c) to an empirical AssetCreated+calldata path (the on-chain op was absent from the deployed bytecode), then fail-closed on ambiguous bindings (e175c1da — flagged HIGH).
• trade_authority — resale/withdraw/approval calldata assembler (1be33c64), arg asymmetry fix (134ab2a0), compiled into elastos-server + wired into resale routes (f47f71fb), gated behind the Home token with destination-address validation (c634b60e).
• Acquire — buy → pin into Library — 3236772c adds the object-provider Acquire op; f9d655d6 lands the entitlement-gated POST /api/market/acquire; f6eef622 adds GET /api/market/vault; 66a901ca binds the acquire CID to the gated KID via metadata (closing a deep-audit LOW).
• Live-source the entire buy path — d17b03a3 (the keystone): buy terms now sourced live from sellersOf/listings, fully UI-driven, no env pins. 5f1b855c corrects an empirical key (listings/sellersOf key on ACCESS_TOKEN id=1, not the content token id) — the largest live-pass correction of the cycle.
• Listing enrichment — 4c09f92c parses metadata.json into /get; 4b239d46 computes has_access live via hasAccessByContentId (the "you own this" badge); 4eed086f enriches discovery listings; 0265d857 bounds enrichment + negative-caches a public-route fetch-amplification.
• Short-TTL cache — 084c67ac collapses a burst to one chain sweep; e0e728ef gates+caches /get (MED finding), caps acquire fetch, binds doc.
• Re-scope to buy/trade ONLY — 2bd87238 drops mint + in-app playback from marketplace scope; 4ff4c63b aligns ROADMAP/README/PLAN/layouts.

Stats: 69 commits, +6,506/−1,171, 174 files. (AI-pair-programmed deep-audit work landed earlier in the cycle on the audit branch — see §4.)

3. Runtime — Storefront Shell, Brand Transplant & A11y Pass

In parallel with the backend, the storefront shell capsule got the design-and-polish pass it needs to be a real surface, not a prototype:

• Token-driven design system — craft, motion, a11y tokens (f1bd18c0).
• Wire the storefront to the live gateway — Home token, /get, /acquire, /vault, activity (056142c4).
• Marketplace-content launcher — a38b2eb3 builds the marketplace-content.wasm launcher mirroring the marketplace capsule.
• "Make Interfaces Feel Better" deep-audit pass — feel-polish gaps (9a57b7d2), UI/UX quick-wins (ea60cce6), a11y operability (cards/nav keyboard-operable, semantic anchors/buttons) (9b791476), accessible modals + async money-path feedback + stepper patch-not-rebuild (dcbfd6d9), emoji → inline lucide-style SVG icons — "the biggest prototype → product gap" (fcb17c70), detail loading skeleton + theme sun↔moon cross-fade (3f76d9e8), subtle modal exit animation (a5fc366f).
• Brand transplant from elacity-web — ad8bc712: turquoise+gold tokens, on-accent flip, glass/gradient — the storefront now reads as Elacity-native.
• Honesty in the UI — 4b239d46 renders the live "you own this" badge from hasAccessByContentId; cbf6c604 renders the enriched poster as the card/detail cover.
• Shell hardening — 7f6e7d77 makes esc() also escape single quotes, routing content_id/medium through it.

4. Runtime — Pre-Audit Verification & Library/Serve Performance (PR #7)

PR #7 closed on Jun 20 — 29 commits from an AI-pair-programmed deep-audit branch (claude/branch-deep-audit-yiez86) into feat/ddrm-hardening-and-creator-parity. No CEK-path, served-byte, or wire-format change.

Verified-and-recorded (closed without code; the finding was already safe):

• PRE-3 / GAP-8 audit tamper-evidence — already resolved (e47f2bea).
• Pre-audit verification pass: 7/8 findings resolved, ElastOS Weekly Shipping Report — Week of Feb 3-9, 2026 #2 partial (b823c62b).

Real fixes:

• d2705009 — perf(serve): single-copy in-place CENC decrypt + boot-stable gateway DID memoization. Byte-identical output (golden test).
• fea728bc — harden(ddrm): fail-closed bounds on untrusted trun/senc sample counts (DoS via forged box counts / OOM). Pins the H1 watermark-anchor verdict.
• edb02ec5 — fix(open): refresh the single-use per-request grant nonce on quorum-open retries (A7) — the dKMS node's replay guard stops rejecting legitimate retries after transient Carrier transport loss. Pins the M1 verdict.

Library / serve performance:

• 98b57c95 — hash each file once on the directory-list hot path (was twice).
• 72550c46 — bounded (path, len, mtime) cache of file-listing facts; self-invalidating on write; the CAS gate stays fresh.
• 9d8e6d90 — bound the cover cache (LRU) and revoke evicted object URLs.
• ad84904b — drop redundant per-segment capsule re-resolve from the viewer authz path.

Conformance ratchet: 4894f50a (close GAP-8's tamper-evidence half + pin), 1e9e7125 (build-visible DDRM audit-verdict ratchet + pin PRE-2 log redaction).

Roadmap + handoff: 38b45bd0 (path to 10/10: audit, node-bundle redeploy, permissionless/TEE), 3567f549 (point the external firm at the verified-safe scope-out registries), cec30861 (release profile: LTO + strip), e5e6ad0b (branch-handoff note).

Stats: 18 commits in this cluster, +889/−86, 25 files. AI-pair-programmed under the team's direction and review; merged 2026-06-20.

5. Runtime — Forensic Variant Pipeline Goes Live in the Gateway

Phase-5 of the forensic watermarking work crossed from "core landed" to "live in the gateway":

• 2bbd45ba — docs(av): reconcile Phase 5 status — 3/4/5 core landed, wiring + cert open.
• 64372ea — bounded placeholder variant embed in ddrm-media (mint DSP seam).
• 4574eede — end-to-end variant pipeline test on real fMP4 + CENC (chunks 3/4/5).
• 16770237 — wire forensic variant mint-emit + serve selection into the live gateway (+790/−50). The keystone for forensic delivery: the mint side emits the variant set, the serve side selects per-buyer.

Stats (combined with the perf+harden serve work): 8 commits, +1,519/−111, 25 files.

6. Runtime — DKMS Quorum: Recover-Proof Revert, Replay-Safe Retries, Warm-Session Self-Heal

Three small but pointed fixes on the dKMS quorum path:

• b241e1f8 — fix(smoke): build dkms-authority with dev-modes in quorum-helper-verify. CI plumbing for the verify path.
• c596f1fa — fix(dkms): revert recover-proof to v1 to match the deployed quorum nodes (−245 lines). Aligning the runtime to the running cluster, not the other way around.
• 13573299 — fix(dkms): self-heal stale warm key-provider sessions on the quorum recover. Closes the warm-key-provider durability gap raised after last cycle's Phase-A landing.

Stats: 3 commits, +216/−250, 11 files.

7. Runtime — Per-Capsule WASM Limits & Operator-Terminable Runaways

The WASM substrate got the budget enforcement the runtime needs to host untrusted capsule code:

• 253d0995 — enforce per-capsule memory / table / instance limits and share a single Engine across capsules (+104/−10).
• ce2bd96e — honor each capsule's declared memory budget (clamped), matching the VM path (+56/−28).
• 8bf1d299 — make a runaway capsule operator-terminable via Wasmtime epoch interruption (+77/−3). B2a on the WASM-runaway roadmap; B2b (per-tick CPU budget) deferred.
• f2e9c53f, 0d904c63, 43eee84c — roadmap entries: B1 (memory) DONE, B2a (terminable) DONE, B2b (per-tick CPU) pending.

Stats: 3 feature commits + 3 roadmap commits, +237/−41, 3 source files.

8. Runtime — Browser VM as Product Boundary & Remote Carrier Exit

A second runtime arc this cycle made the encapsulated Browser VM the product boundary — the proof that a capsule can be a full virtualised surface streamed across machines (team-reported; not all on the public remote yet — see §19):

• VM became the boundary — hosted/source-home Browser paths were removed or demoted, WebRTC VM display became the default, runtime-frame input/click handling was fixed, launch races reduced, and VM preflight/control contracts added.
• Jetson Browser VM — best state so far — local crosvm, rootfs pool, initrd/rootfs fixes, local TURN, private guest control, WebRTC remote display, and usable ela.city browsing end-to-end on the device.
• Mac Browser VM — much further — acceptance audit, proof collector, handoff scripts, manual UX validation, authenticated-modal proof, datachannel-input proof, restart proof, viewport/display/zoom proof, and source-home restart-freshness checks.
• Identity / profile isolation — persistent auth profiles, hashed profile disk keys, principal-owned VM profiles, scoped profile reset, reset-refusal for live route pages, and VM identity-bound proof.
• Remote Carrier Exit (Mac branch) — remote exit discovery/modeling, route tickets, grant expiry, source config/readiness gates, principal-scoped streams/accounting, route-bound cleanup evidence, leak/spoof rejection, and stream-close ownership.
• Shell coherence — People panel + contact read model, profile-card identity, Chat join links, Home opening Chat links, roster/model fixes, System/Settings naming cleanup, PC2-style System settings, a Mac internal-update wrapper, signed-app proof, and a Mac staging-parity gate.

9. PC2 — Elastos Node Manager Lands: Service-Type App Rails

After a long arc on feature/elastos-node-manager, the ENM landing happened on Jun 24:

• 094c6e06 — Merge PR Necessary PC2 changes for the Node Manager (service-type app support) #18 (pc2-service-apps) into the ENM integration branch (+1,383/−15). This brings the service-type app plumbing into PC2: an installable app class that runs as a long-lived service rather than a one-shot launcher.
• de5890aa — Merge PR Elastos Node Manager app (service-type app — requires #18) #19 (enm-app): Elastos Node Manager service + operator UI (+82,483/−0). The full ENM service drop. PRs Necessary PC2 changes for the Node Manager (service-type app support) #18 and Elastos Node Manager app (service-type app — requires #18) #19 remain open against main upstream — the merges landed into the integration branch first, where they are now soaking + hardening before the main-bound PRs close.

This is what the bulk of the PC2 insertion total this week reflects. Subtracting the two service merges, the remaining PC2 commits are the truer effort signal (§18).

10. PC2 — ENM Hardening, Multi-Arch Packaging & Server Perf

Once the ENM landed, the rest of the week was making it shippable:

• Fail-closed Ed25519 verify — 05549498 (+16/−0): type:service installs now Ed25519-verify the bundle fail-closed. No bypass on missing signature.
• Lifecycle integration test — d12197a0 (+230/−0): AppProcessManager lifecycle test — start, stop, restart, crash, recover, all asserted.
• Device-compatibility gating — 7f48dd3a (+354/−3): requirements.platform gating in dapp-centre; an app declares the architectures it supports and the centre filters accordingly.
• Multi-arch packaging — 0fa024e9 (+678/−66): multi-arch ENM packaging + per-arch distribution variants. amd64 + arm64 + macOS shipped from one packager pass.
• Same-origin proxy + session-DB path fix — 0d9715aa (+204/−14): same-origin backend proxy + correct session-DB path; the first real-host integration fix after the merge.
• Doubled-Auth-header fix — c0d2eea2 (+22/−5): resolve a doubled Authorization header to the live session — a regression from the proxy merge.
• Pre-install icons + real download progress — 303722a1 (+108/−6): the install UX shows the app icon before install completes and reports real bytes (not a fake spinner).
• Production registry staged (not live) — 958071d3 (+141/−0): staged production registry entry + flip procedure documented. The flip is gated on the soak; the registry is not live yet.
• Server perf — e469a2db (+93/−2): gzip text responses with a stream-safe filter that doesn't break the chunked-streaming path.

ENM is now installable via the dApp store on compatible hardware; the coordinated node release that carries it is in final pre-release testing (§17).

11. Platform Security Sweep — Marketplace, Protocol, Keystore & Transcode

The prior security-review triage turned into landed fixes this cycle, spread across four repos — the same "fail-closed by default" discipline applied at every layer of the paid-content path:

• Marketplace frontend (elacity-web, release/base-network + feature/ui-polish-2026) — an interface-polish pass plus its regression closure (ELACITY-2281): fixed CSV-export injection, 1970-epoch tax dates, and a hardcoded explorer; stopped a service-worker race in the Elastos in-app browser; restored the wallet sign-in prompt and a dead thumbnail-required validation; fixed a subscription-renewal crash and an EIP-1193 executor that never invalidated the RTK cache after a tx; corrected undercounted market stats and kept the approval toast until approval resolves.
• On-chain DRM protocol (v3-drm-protocol, v0.9.2) — rejected the native sentinel in the ERC-20 createOffer overload (ELACITY-2252, native-escrow drain) and in buyAccess (ELACITY-2254, native/ERC-20 confusion); fixed an unbuyable-channel DoS when there are no royalty holders (ELACITY-2256); deferred MultiChannel child-wrapping to post-creation so creation no longer reverts (ELACITY-2262); confirmed reseller-cut settlement as intended owner policy (ELACITY-2259); upgraded MultiChannelFactory and improved the security-audit framework/toolchains.
• Key-transfer service (lit-keystore-moleculer) — HPKE-seal the CEK to the WASM recipient (RFC 9180), gate /transfer on live on-chain access (acquireLicense-bound) so a transfer can't be issued without a verified entitlement (KES-1), and a Lit action for CEK encryption with recipient/ownership binding (ELACITY-2244).
• Transcode service (transcoder-gcloud) — confined the bento4 /execute endpoint to /opt/bento4/bin and removed the unauthenticated code-exec/file surface (GWF-1); restored MBR handling during transcode.
• Media player (media-player) — bound the response pubkey into the signed entitlement and scoped it to the owner (CRP-4), closing the response-pubkey-not-bound finding on the consumer side.

12. dDRM Protocol v3 & Key Services

The contract and key-service layer that the marketplace and runtime both depend on advanced this cycle: v3-drm-protocol cut v0.9.2 with the gateway/channel hardening above, and the key-transfer service moved to HPKE-sealed, on-chain-gated CEK transfer (§11). Work also began on integrating the new post-quantum hybrid-threshold CENC scheme (cenc:elastos-pq-hybrid-threshold-v0) into the media-player and ddrm-reader paths — the next-generation protected-content format that succeeds the current web3-DRM path. This is foundation work for the runtime dDRM port; the integration itself continues next cycle.

13. Hyper — Post-Quantum Messaging Matures + Independent Multi-Round Audit

Hyper-Android — the Hyper messaging/social/calls capsule built on the same runtime — had a strong week on both features and assurance:

• End-to-end encrypted A/V calls — post-quantum media (ML-KEM-768 + X25519 + ChaCha20) with an out-of-band SAS human-verification check and accept-to-verify on calls; one-way QR-pairing fix; A/V call delivery hardening.
• Resilience + UX — offline Nearby Mesh, carrier auto-recovery, soft-delete chats, BEAM opt-in self-host wallet + sync, text posts, downloads, and a lighter scalable vector brand mark replacing the old logo.
• Independent multi-round audit — Hyper went through several rounds of deep adversarial review (the latest run verified line-by-line against the live build). Of the round-5 findings, one genuinely real issue was fixed — a group-media fail-open where a single member advertising "not media-capable" could downgrade a whole room to plaintext; the fix keeps media sealed and excludes the non-capable member from the media mesh instead of downgrading. The remaining items were either low-severity hardenings (rotating ephemeral nearby beacon, soft-delete attachment unpin, tap-to-accept for un-keyed 1:1 offers), accepted-by-design (the public broadcast feed is public; the gossip mesh is cryptographic-not-ACL), or false/stale against current code.
• Network-exposure verification — live measurement confirmed no internet-facing server (the only listener is loopback), the carrier is an authenticated QUIC endpoint (random packets dropped), and messaging/social/call traffic is read-proof, MITM-resistant, and sealed-sender. The one unavoidable residual is that a passive observer can see that two IPs exchanged encrypted packets (the serverless tradeoff) — closing even that requires onion/relay-always routing, scoped as future work.

14. Public RPC Stack — Self-Hosted, Two-Region, Byte-Compatible Replacement

A self-hosted, two-region, highly-available public RPC stack went live as a drop-in replacement for the legacy public Elastos RPC — same endpoints, same responses, so wallets and dApps need no changes. It now serves 100% of production traffic on api.elastos.io and rpc.elastos.info.

• Faster — 1.5–1.8× faster than the legacy endpoints (e.g. eth_chainId 0.17s vs 0.31s, eth_getBalance 0.18s vs 0.29s, getblockcount 0.19s vs 0.29s), with a Cloudflare edge cache serving reads from the user's nearest PoP instead of round-tripping to the EU origin (~1 ms cached read latency).
• Safer — five independent defense-in-depth layers (Cloudflare edge → ufw firewall → nginx gateway → eRPC → geth nodes that are localhost-only with no keystore), with eth_getLogs range caps, read-only public method scoping, scrubbed error envelopes, and per-IP rate limiting. Operating principle: the edge is smart, the node is dumb — and the node holds no keys.
• More complete — the new stack runs a full archive (10M+ blocks of state), so historical reads (e.g. a balance at an old block) resolve instead of erroring. Chain IDs, block hashes, DID docs, and governance data are byte-identical to what's live now.
• Resilient + $0 managed cloud — two active-active bare-metal boxes (Finland + Germany) on a WireGuard tunnel, ~90–96k req/s per box on cached reads, Cloudflare DNS failover (~30s), systemd auto-restart (~5s), and a stall watchdog; a mid-traffic node kill recovered in ~5s with no downtime.

15. ElacityLabs.com — Newsletter, Blog & Social Automation

ElacityLabsWeb grew its content + distribution surface this cycle:

• Newsletter — double opt-in email capture on the blog, migrated from an expired SendGrid to Resend, branded email template with logo, richer welcome email with LinkedIn follow link, borderless rounded signup, and contact-form migration to Resend.
• Blog — a Notion → Blog API relay job, server-rendered JSON-LD, author pages with the homepage scroll carousel + avatar, internal publishing, and finalized SEO/author metadata.
• Social automation — auto-post to social channels via Postiz after an article publishes, single-copy posting across channels, and article-URL injection into social copy (with the X path temporarily paused pending a link fix).

Stats: ~24 commits on main (+ feat/blog-newsletter, feat/newsletter-resend), +3,457 lines; large deletion counts are vendored-asset/node_modules untracking, not regression.

16. Convergence Lens — PC2 ↔ Runtime

Theme	PC2 (this week)	Runtime (this week)	Convergence
dDRM contract surface	v1.3.0 frozen (conformance oracle)	Marketplace buy/trade cite PC2-SSOT (e1fef691, c4e4b682)	Runtime treats PC2 as the truth source for contract addresses, V3 event topics, and mint-event shape — not re-derived
Authority pattern	fail-closed Ed25519 verify on service installs (05549498)	fail-closed bounds on untrusted CENC counts (fea728bc); fail-closed on ambiguous KID binding (e175c1da)	Fail-closed-by-default is now the cross-repo norm — applied at install-time, quorum-time, on-chain resolution, and (this week) across the whole security sweep (§11)
Service rails	ENM = installable service-type app (PR #18, #19)	marketplace-content capsule + object-provider Acquire op (3236772c)	Both repos converge on "the operator/user runs a small managed thing that gates a larger capability" — PC2 around node ops, Runtime around content acquisition
Live integration first	same-origin proxy + session-DB path fix (0d9715aa)	live-source buy terms from sellersOf/listings (d17b03a3); empirical KID→tokenId pivot (6bde757c)	Both teams moved from spec-against-docs to spec-against-the-deployed-thing; both record an "empirical pivot" commit
Performance, stream-safe	gzip text responses with stream-safe filter (e469a2db)	single-copy in-place CENC decrypt (d2705009); cover-cache LRU with object-URL revoke (9d8e6d90)	Compression + zero-copy paths on the runtime, gzip-without-breaking-chunking on PC2 — both leave streaming semantics intact

17. Looking Ahead

• Marketplace runtime → soak + handoff. feat/marketplace-runtime is at ~72% end-to-end by the roadmap's own count (62d602ee); next cycle should close the remaining ~28%, run a live-Base buy on a real wallet for the integration test, and merge toward the next runtime cut.
• dDRM final 1/8 audit finding (ElastOS Weekly Shipping Report — Week of Feb 3-9, 2026 #2 partial) → close. Clears the way for the external-auditor handoff (3567f549).
• WASM B2b — per-tick CPU budget. Memory + operator-terminable runaway are done; per-tick CPU is the remaining capsule-substrate item.
• New dDRM scheme integration. Continue moving cenc:elastos-pq-hybrid-threshold-v0 into the media-player / ddrm-reader path.
• ENM main-bound PRs (Necessary PC2 changes for the Node Manager (service-type app support) #18, Elastos Node Manager app (service-type app — requires #18) #19). Both still open against main upstream; after integration-branch soak + the production-registry flip (958071d3 staged, not live), close them into main.
• PC2 node + ElastOS Launcher release. Both are in final pre-release testing; macOS notarization with Apple is complete, with a hardened, verified notarize-and-staple step in CI. A coordinated publish lands next cycle.
• Forensic variant cert. Phase-5 wiring is live in the gateway (16770237); the variant-cert open item is the next forensic milestone.
• Hyper. Land the low-severity hardenings (ephemeral nearby beacon, soft-delete unpin, tap-to-accept) and complete the multi-round audit's gap-closure verdict.
• Browser VM. Continue Jetson + Mac VM parity and remote Carrier Exit toward a shippable encapsulated-browser surface.

18. Summary Statistics

Window: 2026-06-19T16:14:56Z → 2026-06-26T10:10:28Z (7 calendar days; cutoff = previous report's createdAt).

Repository (active branch)	Commits	Insertions	Deletions
elastos-runtime — feat/marketplace-runtime	102	~9,375	~1,660
elastos-runtime — feat/ddrm-hardening-and-creator-parity (incl. PR #7)	30	~2,408	~197
elastos-runtime — claude/branch-deep-audit-yiez86 (AI-pair, merged via PR #7)	29	—	—
pc2.net — feature/elastos-node-manager	16	~85,734*	~130
v3-drm-protocol	9	4,787	633
Hyper-Android	6	5,366	664
elacity-web — release/base-network	15	2,515	1,493
lit-keystore-moleculer	4	897	84
transcoder-gcloud	3	928	760
media-player	2	62	16
ElacityLabsWeb	24	3,457	†(asset cleanup)
Public RPC stack	off-repo infra	—	—

*PC2 insertions are dominated by the two ENM integration merges (094c6e06 +1,383, de5890aa +82,483). Excluding them, the remaining PC2 commits land in ~+2,083/−115 — the truer effort signal.
†ElacityLabsWeb deletions are vendored-asset / node_modules untracking, not regression.

• PRs merged in window: Runtime PR ElastOS Weekly Shipping Report — Week of Mar 14–20, 2026 #7 — DDRM/dKMS hardening + audit verification + library/serve performance (claude/branch-deep-audit-yiez86 → feat/ddrm-hardening-and-creator-parity).
• Open PRs referenced: PC2 Necessary PC2 changes for the Node Manager (service-type app support) #18 (pc2-service-apps) and Elastos Node Manager app (service-type app — requires #18) #19 (enm-app) — both still open against main; merged into the feature/elastos-node-manager integration branch locally (094c6e06, de5890aa).
• Releases / tags in window: none announced. PC2 remains at v1.3.0 as the public conformance reference; the next node release + ElastOS Launcher are in final pre-release testing (§17).
• Runtime branch overlap: feat/marketplace-runtime is branched off feat/ddrm-hardening-and-creator-parity (which absorbed PR ElastOS Weekly Shipping Report — Week of Mar 14–20, 2026 #7); per-commit dedup is by SHA.

19. Data-Quality & Off-Repo Notes

• Attribution. All work this cycle is reported as the Elacity team's output, without individual names. Commits authored under the name "Claude" are AI-pair-programmed under the team's direction and review — counted as real shipped work, attributed to the team.
• Browser VM / Hyper context (§8, §13) is partly team-reported and not all on the public remotes yet; it is included as context and not all of it is reflected in the commit table above.
• Public RPC stack (§14) is off-repo infrastructure (bare-metal in Finland + Germany); there is no tracked org-repo commit count for it.
• Windowing. Author/commit-date windowing across 2026-06-19 → 2026-06-26; counts on the most active in-window branch per repo, non-merge where noted. Cross-branch shared history is deduped by SHA.
• Line-count caveats. Runtime totals include vendored/generated content; PC2 insertions are dominated by the two ENM merges; ElacityLabsWeb's large deletions are vendored-asset/node_modules cleanup. Commit counts + narrative are the truer signal.
• Off-repo context (travel, conferences, partner/founder conversations, ecosystem presence) is summarised at a high level in §20 and may be expanded in a human pass before/after publish.

20. Architecture Alignment — Direction This Cycle

A direction-setting architecture conversation this cycle reaffirmed the core bets the team is building on, and they map cleanly onto the week's work:

• Capsules are the unit; the runtime is a small, frozen, audited secure messenger. Keep the core minimal and add capability through capsules, not by growing the runtime. This week's per-capsule WASM limits + operator-terminable runaways (§7) and the marketplace-content "shell capsule that holds no authority" (§2) are this principle in code.
• The Rust rewrite is the right foundation. Full speed on the pure-Rust runtime; the storefront, the Browser VM surface, and the dDRM crates all build on it.
• The runtime is the single source of truth; shells are free to multiply. Different front-ends (classic desktop, agentic, Hyper) interoperate because they obey the same runtime, namespaces, capsules, and carrier — which is exactly why Hyper (§13) and the encapsulated Browser VM (§8) can be different surfaces on one engine.
• Open core, real-device value, carry-anywhere form factor. Open-source the runtime; anchor value where it's hardest to fake (real devices/sensors and, eventually, a hardened carry-anywhere dongle once the API is frozen).
• Ship a few things that truly work, then beta, then audit. A handful of real end-to-end capsules — supernode/BPoS, media player, marketplace, Hyper chat — running daily, with a community beta for momentum and full external auditing before a "safe and finished" release. The dDRM pre-audit pass (§4), the platform security sweep (§11), and the Hyper multi-round audit (§13) are that discipline in practice.

---

Cadence: weekly Friday updates. Previous report — Week of June 12 – June 19, 2026 (#24).