ElastOS Weekly Shipping Report — Week of August 8 – August 14, 2026 #33
SashaMIT
announced in
Announcements
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Elacity Labs — Weekly Team Update for the World Computer Initiative (WCI)
August 8 – August 14, 2026
Runtime rebuilt its social and content foundations this week — collaboration, Profile/People/Chat, protected-content contracts, model-provider, and dKMS hardening — while mainchain stays online and ESC / EID / the bridge stay closed on purpose. Coming out of #32:
review/collaboration-candidatelands a signed network protocol, Runtime-owned Carrier transport on Iroh 1.0.2, Profile authority / contacts / Profile-bound chat, and Home shell chrome;feat/protected-content-contracts(plus custody follow-ons) publishes the v1 authority and threat model so apps never see raw unlock keys;feat/model-provider-rebaseships the offers/runs contract through P5.2 (openai_compat + h3_video, principal-scoped grants, agent harness on the frozen collaboration base);feat/dkms-esp-portremediates DKMS-1..8 and closes marketplace ESP-1/2 buy/trade seams. Open Runtime PRs: #16 collaboration →upstream/0.7-dev, #17 model-provider, #15 dKMS/ESP (being split into stacked reviews). Hyper + hey-engine shipped a heavy migration / radio / DM week. drm-api REST + CI guards landed on both release lines. PC2 stayed product-quiet. Runtimemainquiet; 0.6 tag still pending. ELA tip ~2,272,410.Chain status: mainchain producing under BPoS and still being hardened. Private recovery work on ESC / EID / Arbiter advanced substantially this week (gated safety code exercised in private nets; bridge containment and repair progress) — ESC and EID are still not ready to restart. Do not send funds into paused sidechain or bridge flows. Details that stay public: mainchain postmortem.
Key Links This Week
release/next+release/base-networkbash <(curl -fsSL https://raw.githubusercontent.com/Elacity/pc2.net/main/scripts/update.sh)curl -fsSL https://elastos.elacitylabs.com/install.sh | bashTable of Contents
1. The Big Picture — Runtime Rewires Its Foundations
This was a Runtime-heavy week by design. PC2 stayed quiet; Runtime
mainstayed quiet; the work landed on review and feature lines that will feed 0.7.Zeroth — chain doors. Mainchain is online. ESC, EID, Arbiter, and the bridge remain closed to normal user activity. Private recovery engineering advanced (see §2) — that is not a reopen announcement.
First — collaboration has a shape. Signed network protocol, Runtime-owned Carrier lifecycle, move to Iroh 1.0.2, Profile authority / discovery / contacts, Profile-bound chat, Home chrome alignment. That candidate is frozen enough that model-provider and agent-harness work stacked on top of it rather than chasing a moving base. PR #16 is the integration path into
upstream/0.7-dev.Second — protection got a written contract. Protected-content v1 authority and threat model: what must be signed for access, owner-bound grants, bounded node release decisions, recipient-sealed contributions, authenticated terminal receipts — without exposing raw decryption keys to apps. Custody reconstruction work continues on a follow-on line. Separately, DKMS-1..8 remediation and marketplace ESP-1/2 seams closed on
feat/dkms-esp-port.Third — the AI surface got a real contract. Model-provider offers/runs, openai_compat + h3_video adapters, principal-scoped grant gates, control-plane registration, and a contract-native agent harness browser port on the frozen collaboration base (P0→P5.2). Sparks H3 dogfood continued in parallel.
Also this week: Hyper / hey-engine migration and mesh hardening; drm-api REST exposure + CI guards; marketplace-adjacent security bumps (elacity-web, ddrm-reader); grant-lane monitoring admin polish (secondary).
2. Elastos Status — Mainchain Online, Sidechains Still Closed
Public framing only. Internal recovery registers and live-defect detail stay inside the recovery engagement — same discipline as #32.
What is open vs shut
Long form: Mainchain postmortem (August) · honest recovery log.
Recovery progress this week (high level)
Private engineering on ESC, EID, and the Arbiter / bridge advanced well ahead of what is published on public GitHub. In plain terms:
Bottom line unchanged for users: mainchain back ≠ bridge open. ESC and EID restart still waits on remaining open money-path and shared-library work that cannot all be closed from the sidechain trees alone. Do not grow stuck balances into closed rooms.
Mainchain packaging
Public mainchain GitHub remains quiet by design while point-release / audit packaging continues. Operator toolkit remains Elastos.Node v1.2.3. Formal Runtime 0.6 tag is a separate packaging item (§12).
3. Runtime — Collaboration Transport on Iroh 1.0.2
Anders’ collaboration landings are the load-bearing move of the cycle — split across foundation / product-integration / candidate, then opened as PR #16 →
upstream/0.7-dev.Transport & protocol
Acceptance & closeout
Product story: create a profile, choose discoverability, send/approve contact requests, start a direct conversation, update name, remove and re-add contacts; profile / contacts / conversations survive restart. People, Chat, and Inbox read as one system — names and conversations, not device addresses. Same app-facing contract for same-device and cross-device delivery; Runtime owns identity, permissions, and the actual transport.
4. Runtime — Profile, People, Chat & Home Chrome
Profile / People: signed Profile authority, bounded discovery, contact store, recovery integration, packaged Profile products.
Chat: Profile-bound conversations, direct/shared UI, conversation routes, same-endpoint delivery looped through Carrier.
Auth hardening: safer verified AuthState caching; protected authority root prepared owner-only.
Home shell chrome (Aug 11–13): finish shell visuals/assets, canonical window chrome modes, align first-party apps to Home chrome, restore collaboration chrome + system bar after merges, keep access origin at the HTTP edge, local source setup guide.
5. Runtime — Protected-Content Contracts (+ Custody Follow-On)
feat/protected-content-contracts(Aug 13) writes the v1 authority and threat model down:Framing: pins who can grant, what the release condition is, who the release is sealed to, and how the receipt is authenticated — apps must not receive the raw unlock key. Full custody nodes, key release, decryption, and playback UX follow as separate pieces.
Follow-on this week:
feat/protected-content-custodycontinued with canonical custody envelopes, sealed shares for verified releases, threshold reconstruction, and contract-key validation — building on the collaboration candidate.6. Runtime — Model-Provider Contract (P0 → P5.2) & Sparks H3
Sasha’s model-provider stack went from bare offers/runs to a live harness port in one cycle, stacked on the frozen collaboration base (PR #17).
runs_createSparks H3 dogfood (
experiment/home-studio-h3-dogfood) continued in parallel: 30s Generate, Studio declutter, chat polish, capsule UI ports — the surface the model contract is being validated against.Also opened: PR #18 — ElastOS picture map docs (read order, tree, glossary, gates) on the collaboration candidate.
7. Runtime — dKMS / ESP Hardening (DKMS-1..8, ESP-1/2)
Irzhy on
feat/dkms-esp-port(PR #15):Governance note: the branch is moving away from a single-shot merge toward stacked, reviewable extractions on the collaboration-candidate base — smaller signable landings.
External review triage this week: confirmed findings fixed with acceptance criteria; non-reproducible / already-shipped items dispositioned with evidence; remaining Anders-review items distilled into a tracked plan (extraction strategy, Carrier end-state for dKMS quorum transport, Wallet account binding, installer registry, trusted Runtime slim-down, docs truth pass).
8. Marketplace & Adjacent Hardening
drm-api-layer
REST exposure hardening (restrict automatic mapping of services/actions) plus CI build-step checks that guard against exposing server-key-signed payable actions without authorization — applied in parallel to
release/nextandrelease/base-network. Wave-2 gateway / rate-depth / royalty branches also moved.Adjacent
target=_blankReminder: marketplace indexer readiness against ESC is not an ESC reopen.
9. Hyper + Hey-engine — Migration, Radio, DMs
A major mesh / social week that the Runtime-only draft under-weighted.
Hyper (~22)
Migration path hardened end-to-end: receiver creates the group, join as Wi-Fi client, wait for FORM before credentials, keep listening across retries, auto-connect + percentage that does not mean “done” at 100%, restart on arrival, erase once verified, direction naming in UI, stop radio leaks, BUSY path actually called, JNI symbol check on every APK (caught crash declarations).
Hey-engine (~33)
Radio address-store / re-advertise fixes; contact-add without a route no longer leaves pairs unable to open a conversation; attachments no longer report success when half the files drop; DMs sent while Carrier is starting keep a route; migration receive/send hardening and unauthenticated allocation bounds; receiver enforces policy instead of trusting the sender; dead-code and helper clone cleanup.
10. Supporting Ops — Continuous Monitoring Admin (Grant Lane)
Secondary. Grant-backed continuous monitoring admin for our ecosystem repos (findings → human review → fix PRs) after the July incident stack — not a headline, not third-party hunting.
This week: finish cookie-only session + login rate-limit; verify Postgres TLS certificates in production.
11. PC2 — Quiet by Design
Product landings: none. Operator line remains v1.4.0. Convergence plan keeps PC2 in receive-mode while Runtime rewires the substrate. Prior weekly (#32) publish/edits already on
mainfrom last cycle.12. Release Engineering
maind358dedfrom prior cycle)upstream/0.7-dev· PR #17 stacked on collaboration · PR #15 splitting into stacked reviews13. Convergence Lens
One-sided by design: substrate rebuilds on Runtime; PC2 receives finished contracts rather than chasing moving APIs.
14. Looking Ahead
upstream/0.7-dev) — first meaningful 0.7 merge15. Summary Statistics
Week of August 8 – August 14, 2026.
main16. Notes
Quick fact card
Cadence: weekly updates. Previous report — Week of August 1 – August 7, 2026 (#32). This report — #33.
All reactions