v0.9.0
Alfis 0.9.0
⚠️ This is a breaking release. The consensus rules changed, so 0.9.0 nodes
are not compatible with 0.8.x and older. Every node operator must upgrade —
the minimum accepted peer version is now0.9.0, and older nodes are disconnected
from the swarm. Please update as soon as you can.
Two big things landed in this release: a brand-new native GUI that replaces the
old resource-hungry web interface, and self-healing — a consensus change that
lets the network recover on its own when too few of a block's signers are online.
🖥️ A new native GUI (goodbye, web view)
Until now the desktop interface was a WebView: Alfis embedded a full HTML/JS UI and
handed it to the operating system's browser engine to render. It worked, but it was
heavy — it dragged an entire web stack into the process just to show a list of domains.
0.9.0 replaces it with a native GUI built on Lumio,
a lightweight retained-mode toolkit that renders directly with OpenGL. The result is
a leaner, faster, snappier app with a much smaller footprint.
What's new on the surface:
- Native rendering — no embedded browser, dramatically lower memory and CPU use.
- System tray icon — Alfis can sit quietly in the tray and keep serving DNS.
- Reworked domain and record dialogs for creating and managing names.
Everything you could do before — create domains, manage records, watch sync and
mining progress — is here, just without the browser engine underneath it. Also fixed
along the way: several UI glitches during sync, including the interface flickering
when peers advertised an incorrect chain height.
🩹 Self-healing: the network can recover from missing signers (RFC-0002)
This is the headline consensus change. The full design lives in
docs/rfc/0002-healing-signatures.md; here's the
short version.
The problem. Every full block (a domain registration or renewal) must be locked by
4 signatures from a set of 7 signer keys chosen pseudorandomly and fixed forever
the moment the block is mined. If fewer than four of those specific keys ever come
online, the block stays unlocked forever — there was no timeout, no re-draw, and no
alternative path. The chain simply stalls, permanently. With signing power concentrated
in a handful of veteran keys, this went from theoretical to real.
The fix: healing signatures. After a full block has been stuck for 5 days, the
missing signatures may be supplied by a standby pool of up to 12 keys derived
entirely from chain history:
- 7 anchors — the most productive keys of all time. Practically impossible to grind
your way into (it takes years of block production to overtake them). - 5 recent keys — the most active keys of the recent window, an open on-ramp that
even pure domain-mining keys can enter through genuine activity.
At least one of the counted signatures must come from an anchor key. That anchor
rule, combined with the 5-day wait, is what keeps healing from being abused to fork the
chain across a network partition.
Why this design:
- Fully automatic. No key ceremony, no configuration, no operator action, no new
message types. Healing signatures are ordinary empty signing blocks — a node holding a
standby key just starts offering them once the timeout passes. - Conservative. It completes the existing 4-signature lock rather than inventing a
new quorum. A healthy network locks blocks in minutes and never touches this path. - Adaptive. If a chain is clearly operating in the healed regime, the timeout drops
from 5 days to 3 so throughput isn't throttled unnecessarily. - Loud on failure. If a genuine irreconcilable fork ever forms, it's now surfaced as
an error and a UI event instead of being silently swallowed.
The change also tightens three long-standing gaps in the lock machinery (enforcing the
lock on incoming full blocks, capping empty blocks over a locked window, and checking key
strength for empty blocks).
Activation. These rules only apply above HEALING_ACTIVATION_HEIGHT — set to the
currently stuck full block — so no historical block is re-judged. This is exactly why old
nodes are incompatible: they'd reject healing blocks (and everything built on them), so
0.9.0 raises the minimum peer version to keep the network together.
Also included as groundwork: RFC-0001, the design for human-gated emergency recovery
in the catastrophic case where nearly the entire key population is lost — a backstop
behind the automatic healing shipped here.
🔧 Other changes
- Updated a large number of dependencies.
- Updated CI and the
guifeature wiring for the new toolkit. - Various small fixes and stability improvements.
Upgrading
Just install 0.9.0 and restart. Your keys and blockchain database carry over unchanged.
Because 0.8.x nodes can no longer participate, please upgrade promptly — a stalled
chain quietly costs real domains as their renewal grace windows expire.