Create 2025-10-06.md (#301)

Author: Cofson

content/updates/2025-10-06.md

@@ -0,0 +1,301 @@
+---
+title: 2025-10-06 Vac weekly
+tags:
+  - vac-updates
+date: 2025-10-06
+lastmod: 2025-10-06
+draft: false
+---
+
+## Vac 2025/09/29
+
+### highlights
+
+- QA: Status-go Waku functional testing progressed with multiple bugs reported and new community membership tests added.
+- QA: Waku RLN contract property-based fuzz testing (PR 40) in review; new adversarial security simulations planned.
+- QA: Waku interop Lite protocol tester updated per feedback; new scenarios added and reports shared; task pending further confirmation.
+- QA: Waku rendezvous tests retested after fix but still failing; reopening planned.
+- QA: Nim-libp2p Gossipsub performance tests advanced with QUIC scenario merged and multiple refactors in final review.
+- QA: Status desktop QA ongoing across maintenance, notifications debugging, syncing devices with Igor, Squish upgrade, and Qt6 migration analysis.
+- QA: Status mobile QA merged several Appium test PRs, advanced password reset test, and began investigating CI workflow issues.
+- ACZ: Released [Zerokit v0.9.0](https://github.com/vacp2p/zerokit/releases/tag/v0.9.0).
+- ACZ: Delivered [next iteration of libp2p-mix RFC](https://github.com/vacp2p/rfc-index/pull/173) by refactoring sphinx format. 
+- RFC: Completed the first iteration of Logos POC module specs, next step is reaching out for reviews.
+
+
+
+
+### vac:p2p:
+
+- `vac:p2p:ift:2025q4-nimlibp2p-kad-dht:bootstraping-and-lookup`
+    - [vacp2p/nim-libp2p#1733](https://github.com/vacp2p/nim-libp2p/pull/1733) refactor(kad-dht): find node and put val
+- `vac:p2p:ift:2025q3-nimlibp2p-maintenance:maintenance`
+    - [vacp2p/nim-libp2p#1736](https://github.com/vacp2p/nim-libp2p/pull/1736) fix(autonatv2): close dialback connection 
+    - [vacp2p/nim-libp2p](https://github.com/vacp2p/nim-libp2p/pull/1742) feat: reset
+    - [status-im/nim-chronos#589](https://github.com/status-im/nim-chronos/pull/589)feat: add WaitGroup 
+    - [vacp2p/nim-libp2p#1739](https://github.com/vacp2p/nim-libp2p/pull/1739)chore: remove some catchable errors
+    - [vacp2p/nim-libp2p#1730](https://github.com/vacp2p/nim-libp2p/pull/1730) chore: remove commented flaky experimental hole punching tests
+    - [vacp2p/nim-libp2p#1727](https://github.com/vacp2p/nim-libp2p/pull/1727)  chore: disable flaky hole punching interop tests
+    - [vacp2p/nim-libp2p#1728](https://github.com/vacp2p/nim-libp2p/pull/1728) fix: testhelper incorrectly setting program result 
+    - Revive old PRs from external contributor @MorganaFuture
+        - [vacp2p/nim-libp2p#1741](https://github.com/vacp2p/nim-libp2p/pull/1741) feat(autotls): add configurable options to AutotlsConfig
+        - [vacp2p/nim-libp2p#1731](https://github.com/vacp2p/nim-libp2p/pull/1731) feat: add onRunning asyncEvent to Transport base type
+        - [vacp2p/nim-libp2p#1732](https://github.com/vacp2p/nim-libp2p/pull/1732) chore(switch builder): options instead of nils
+    - Fix nim-websock issue caused by nim-stew version bump
+        -  [status-im/nim-websock#176](https://github.com/status-im/nim-websock/pull/176) chore: bump version (0.2.1) 
+        -  [vacp2p/nim-libp2p#1740](https://github.com/vacp2p/nim-libp2p/pull/1740) fix: update nim-stew version
+- `vac:p2p:ift:2025q4-nimlibp2p-quic:stabilization`
+    - created new tests for testing quic nil pointer derference issues that only uses quic and chronos libraries
+        - server never stops opening stream when client ungracefully closes
+        - "out of memory" issue
+    - [vacp2p/nim-quic#132](https://github.com/vacp2p/nim-quic/pull/132) fix: stop opening stream after connection closes 
+    - [vacp2p/nim-quic#133](https://github.com/vacp2p/nim-quic/pull/133) refactor: list raised errors
+    - [vacp2p/nim-quic#134](https://github.com/vacp2p/nim-quic/pull/134) fix: compile time warnings
+    - Call with DST to understand memory issues experienced in lab
+### vac:tke:
+
+
+### vac:qa:
+
+- `status:2025q4-status-go-functional-testing:waku`
+  - [Issue 6975: MyPendingRequestsToJoin still return request after decline](https://github.com/status-im/status-go/issues/6975)
+  - [Issue 6976: checkAndDeletePendingRequestToJoinCommunity doesn’t clear pending requests](https://github.com/status-im/status-go/issues/6976)
+  - [PR 6977: community membership requests](https://github.com/status-im/status-go/pull/6977)
+  - Started working on community chat endpoints
+- `waku:2025q4-rln-smart-contract-testing:property-based`
+  - [PR 40: fuzz test expansion](https://github.com/waku-org/waku-rlnv2-contract/pull/40) - in review
+- `waku:2025q3-interop-testing:liteprotocoltester`
+  - Fixed review points on [PR 138](https://github.com/waku-org/waku-interop-tests/pull/138)
+  - Added new scenarios and attached reports based on Zoltan’s feedback
+  - Task on hold pending confirmation
+- `waku:2025q4-waku-testing:rendezvous`
+  - Retested after Simon’s fix [PR 132](https://github.com/waku-org/waku-interop-tests/pull/132); still failing, issue reopening planned
+- `status:2025q4-status-go-functional-testing:settings`
+  - Built environment locally and explored structure
+  - Added wrappers for settings.go APIs
+  - Draft test opened in [PR 6984](https://github.com/status-im/status-go/pull/6984)
+- `vac:2025q3-nim-libp2p-testing:gossipsub-performance`
+  - [PR 1631: Add QUIC scenario](https://github.com/vacp2p/nim-libp2p/pull/1631) - merged
+  - [PR 1718: chart generation refactor](https://github.com/vacp2p/nim-libp2p/pull/1718) - awaiting 2nd review
+  - [PR 1735: Refactor runner](https://github.com/vacp2p/nim-libp2p/pull/1735) - awaiting 2nd review
+  - [PR 1729: reliability workflow](https://github.com/vacp2p/nim-libp2p/pull/1729) - near completion
+- `status:2025q4-status-qa-desktop:maintenance`
+  - Debugged Linux notification test failures
+  - Investigated Windows syncing issue with Igor
+  - Updated to Squish 9.1 locally
+  - [Issue 18954](https://github.com/status-im/status-desktop/issues/18954) - opened
+- `status:2025q4-status-qa-desktop:qt6-migration`
+  - Tested Qt 6.9.3 locally; found [Issue 18947](https://github.com/status-im/status-desktop/issues/18947); upgrade paused pending decision
+- `status:2025q4-status-qa-desktop:e2e-windows` (0%)
+  - Started PoC for testing non-status apps on CI with Squish (infra request)
+- `status:2025q4-status-qa-mobile:port-tests`
+  - [PR 18796](https://github.com/status-im/status-desktop/pull/18796) - merged
+  - [PR 18848](https://github.com/status-im/status-desktop/pull/18848) - merged
+  - [PR 18852](https://github.com/status-im/status-desktop/pull/18852) - merged
+  - Password reset test ready locally; pending CI workflow fix
+- `status:2025q4-status-qa-mobile:test-ci`
+  - Investigating GitHub workflow issue
+- `admin/misc`
+  - Updated standup page with new Q4 tasks
+  - Interviews
+  - OOO: 7 CC Days
+### vac:dst:
+
+- `admin/misc`
+    - Call with P2P team to show Quic issues in call
+    - DST Monthly
+    - Help with some Mix issues
+- `vac:dst:status:2025q3-status-go-chat-protocol-benchmarks:relay-node-benchmark-2`
+    - Had to improve how we manage sending RPCs to status
+        - [Github PR: Async utils](https://github.com/vacp2p/status-benchmarks/pull/33)
+        - [Github PR: Second benchmark](https://github.com/vacp2p/status-benchmarks/pull/32)
+        - [Notion: Status discovery gathering information](https://www.notion.so/Status-benchmark-discovery-issues-27a8f96fb65c80e9bc09e356371556a0)
+- `vac:dst:status:2025q3-status-go-chat-protocol-benchmarks:cleanup-resources`
+    - Merge missing PRs and update some minor parts
+        - [Github PR: Create private group](https://github.com/vacp2p/status-benchmarks/pull/25)
+        - [Github PR: Send group messages](https://github.com/vacp2p/status-benchmarks/pull/26)
+- `vac:dst:nomos:2025q3-nomos-scaling:nomos-deployment-test`
+    - [Github PR: Nomos deployment files](https://github.com/vacp2p/10ksim/pull/145)
+    - [Notion: Nomos quic document for deployment issues](https://www.notion.so/Nomos-compose-to-K8s-27d8f96fb65c8077b5cefa236a0dddda)
+- `vac:dst:vac:2025q3-libp2p-evaluation:mix-re-evaluation`
+    - [Notion Mixnet Report](https://www.notion.so/Mixnet-findings-WIP-2768f96fb65c805cae83f7c4f67c4860)
+    - Error `Too many connections` error. Solved with `withMaxConnections`
+    - Error `Unable to establish outgoing link in internalConnect`
+    - Warning `no destination read behavior for codec tid=12 codec=/meshsub/1.2.0`
+- `vac:dst:waku:2025q3-waku-evaluation:js-waku-follow-up`
+    - [Github PR: Add jswaku files #146](https://github.com/vacp2p/10ksim/pull/146)
+- `vac:dst:ift:2025q3-dst-tooling:deployment-refactor`
+    - [Github PR: Deployment refactor #143](https://github.com/vacp2p/10ksim/pull/143)
+- `vac:dst:waku:2025q3-waku-theoretical-analysis:bandwidth`
+- `vac:dst:waku:2025q3-waku-theoretical-analysis:message-dissemination`
+    - Finalised latency/bandwidth theoretical analysis for waku. [Github PR: Latency/Bandwidth analysis #206](https://github.com/vacp2p/research/pull/206)
+- `vac:dst:ift:2025q3-dst-tooling:nim-libp2p-cron-removal`
+    - Finalised http publisher endpoint for removing cron jobs. 
+    -    [Github PR: nim-libp2p publisher #139](https://github.com/vacp2p/10ksim/pull/139)	
+- `vac:dst:ift:2025q3-dst-tooling:nim-libp2p-dst-node-refactor`
+    - [Github PR: HTTP endpoint #3](https://github.com/vacp2p/dst-libp2p-test-node/pull/3)
+		- http endpoint for interacting with publish controller
+		- Prometheus metrics collection for shadow simulator
+		- Muxer selection 
+		- Still need to merge [Github PR: Mix protocol support in refactored node](https://github.com/vacp2p/dst-gossipsub-test-node/pull/12/files)
+    - [Github PR: Topology generation and shadow configuration script #4](https://github.com/vacp2p/dst-libp2p-test-node/pull/4) for publish controller/refactored node.
+
+### vac:sc:
+
+
+### vac:acz:
+
+- `ift:2025q4-de-mls-tesnet:de-mls-maintaining`
+    - Start to prepare code base for multi-steward  
+- `ift:2025q3-zerokit:release`
+    - Released v0.9.0 [release doc](https://github.com/vacp2p/zerokit/releases/tag/v0.9.0)
+- `ift:2025q3-rln-status-l2:stress-test`
+  - Benchmark on 128 Core CPU server - results [here](https://www.notion.so/Prover-Benchmarks-25d8f96fb65c80a1bef2e317338f528b)
+- `ift:2025q4-rln-status-l2:multi-tree`  
+  - [Multi tree + rebalance benchmark PR](https://github.com/vacp2p/status-rln-prover/pull/44)
+    - Benchmark done - consistent hashing is too slow
+    - [Multi tree PR](https://github.com/vacp2p/status-rln-prover/pull/49) - WIP
+- `ift:2025q4-ift-zk-calls:ift-zk-call-1`
+    - Began work on zk call slides.
+- `nes:2025q4-nescience-consulting:consensus-survey`
+	- Began consensus survey with Avalanche, HotStuff and Tendermint.
+- `ift:2025q4-zerokit:ffi-rework`
+    - Started implementing this task [PR](https://github.com/vacp2p/zerokit/pull/337)
+- `ift:2025q4-rln-status-l2:maintaining`
+    - Tested all current smart contracts on the DST test machine and local machine.
+    - Sent Nadeem a fixed deployment script
+    - [PR Zerokit 0.9 + no parallel feature](https://github.com/vacp2p/status-rln-prover/pull/36)
+    - updated for Benchmark on 128 Core CPU server - merged
+  - [Serializer / Deserializer init PR](https://github.com/vacp2p/status-rln-prover/pull/45) - merged
+  - [More args in commandline PR](https://github.com/vacp2p/status-rln-prover/pull/46) - merged
+  - [User spam limit PR](https://github.com/vacp2p/status-rln-prover/pull/47) - WIP
+  - [No GRPC reflection](https://github.com/vacp2p/status-rln-prover/pull/48) - WIP
+- `ift:2025q4-zerokit:zerokit-maintaining`
+    - Merged this [PR](https://github.com/vacp2p/zerokit/pull/342)
+    - Reviewed these [PR](https://github.com/vacp2p/zerokit/pull/344), [PR](https://github.com/vacp2p/zerokit/pull/345)
+    - code review for [PR](https://github.com/vacp2p/zerokit/pull/342)
+    - Updated binary name generaion in CI [PR](https://github.com/vacp2p/zerokit/pull/344)
+- `ift:2025q3-discovery-exploration:disc-ng-specs`
+    - Review the [discNG RFC draft version](https://www.notion.so/Disc-ng-RFC-2708f96fb65c80c7836cdd9fffde4423).
+    - Completed initial draft for [Disc-ng RFC](https://www.notion.so/Disc-ng-RFC-DRFAFT-2708f96fb65c80c7836cdd9fffde4423)
+- `ift:2025q3-rln-status-l2:rln-spec-maintain`
+    - Updated [gas confirmation section](https://www.notion.so/RLN-Deployment-Spec-on-Review-1f98f96fb65c806c8737d94851b4d14d?source=copy_link#2728f96fb65c8058826ed6d3b2139a0a). 
+    - Address SC team questions on decentralized slashing progress.
+- `ift:2025q3-libp2p-mix-testnet:update-rfc`
+    - Reviewed ([PR #173](https://github.com/vacp2p/rfc-index/pull/173)).
+- `nes:2025q4-nescience-consulting:account-security`
+	- Started to review [document](https://www.notion.so/Account-security-and-privacy-in-NSSA-v0-1-27e8f96fb65c80699e8ae51c321c25a7) on NSSAv0.1 security and cryptographic assumptions.
+	- Prepared a [document](https://www.notion.so/Account-security-and-privacy-in-NSSA-v0-1-27e8f96fb65c80699e8ae51c321c25a7) on NSSAv0.1 security and cryptographic assumptions.
+- `admin/misc`
+    - Iterated think-tank with [primitives and techniques](https://www.notion.so/Primitives-and-techniques-2708f96fb65c80529142f0fd402e5091) for Pedersen commitments.
+    - 1 cc was ooo for 2 days
+
+### vac:rfc:
+
+- `vac:rfc:ift:logos-poc`
+    - Logos Protocol Modules - https://github.com/vacp2p/rfc-index/pull/197:
+    - Logos Package Management - https://github.com/vacp2p/rfc-index/pull/198
+    - Logos Performance Scalability - https://github.com/vacp2p/rfc-index/pull/199
+- `vac:rfc:codex:2025q4-rfc-iteration`
+    - Picked up to work (and started researching Purchase and Sales Modules)
+- `admin:misc`
+    - 1 CC OO
+### vac:nim:
+
+- `vac:nim:ift:2025q3-nim-core-libs:nim-cbor-serialization`
+- `vac:nim:ift:2025q3-nim-core-libs:compile-time-support-for-json-and-cbor`
+    - `nim-cbor-serialization`
+        - Compile-time tests https://github.com/vacp2p/nim-cbor-serialization/pull/8
+        - Write text/byte-string in chunks and byte-by-byte https://github.com/vacp2p/nim-cbor-serialization/pull/6
+- Chronos regression in Nim devel found in libp2p https://github.com/nim-lang/Nim/issues/25202
+
+### vac:sec:
+
+- `ift:2025q3-awareness-program:web3-security-essentials`
+    - Shared web3 news about crime, phishing, malware, hacks and IoC with Finance (Weekly Update)
+- `ift:2025q3-wallet-policy-update:backup-and-recovery-policies`
+    - Finished Backup and Recovery guidelines for critical assets (based on Threat Model)
+- `ift:2025q3-continuity-plan:write-guides-and-best-practices`
+    - Continued developing Operational Continuity guidelines based on Threat Model
+- `ift:2025q3-awareness-program:signing-process-resilience-testing`
+    - Continued testing and refining the multi-layer verification mechanisms in the Signing Process (All members)
+- `ift:2025q2-iam-operations:defi-strategy-access-control:cap-money-protocol`
+    - Added support for Cap Money protocol (CUSD and STCUSD) with scoped interactions
+- `ift:2025q2-iam-operations:defi-strategy-access-control:nexus-patch`
+    - Expanded Nexus Mutual integration
+    - Introduced a patched whitelist applying updated Nexus Mutual scoping across relevant contracts
+- `ift:2025q3-cicd-security-review:status-design-reviews`
+    - Completed validation of recent Status audit remediations to ensure all vulnerabilities were effectively patched
+    - Developed and executed PoC scripts to confirm fixed exploits are no longer reproducible
+    - Performed SBOM and dependency scans to detect any new or unexpected third-party additions
+    - Backported critical audit fixes to maintained release branches for consistency and security parity
+- `ift:2025q3-vulma-and-ir:incidents`
+    - Investigated organization GitHub Pages for phishing or injected scripts and removed suspicious content
+    - Collected and analyzed phishing attempts targeting X.com, extracting indicators of compromise (IOCs)
+    - Deployed lightweight detection checks to monitor new X.com mentions for suspicious URLs or activity
+    - Rotated exposed GitHub tokens and revoked unused integrations discovered during the investigation
+- `ift:2025q3-vulma-and-ir:remediation-tracking`
+    - Triaged Dependabot alerts, tested and merged verified safe dependency upgrades
+    - Evaluated recent supply chain CVEs and initiated mitigations for impacted repositories
+    - Audited CI/CD pipelines to confirm integrity protections (hash pinning, lockfiles) are enforced
+- `ift:2025q3-iam-operations:remove-unnecessary-users`
+   - Built workflows to test endpoints for Notion assets
+        - identify old pages
+        - identify access frequency and filter out inactive pages
+        - identify endpoint to archive old pages
+- `ift:2025q4-Create hierarchy boards in Miro`
+    - Repurposed workflow to use a step by step item generation in Miro
+    - Include new hierarchy report as data source
+- `ift:2025q4-finance-automation-enhancements`
+    - Hierarchy report - Finalized and delivered
+        - Identified reusable components from existing n8n worfklows
+- `admin/misc`
+    - Q3-2025 Retrospective
+    - Finished 4Q-2025 commitments and 2026 roadmap
+### vac:nes:
+
+- `state-separation-architecture-poc:validium`
+    - Tried to run Nomos validium example on my machine anddid not succeeded. Also tried to run the local testnet and if was so difficult. Contacted Nomos and spent a significant amount of time to solve the issue. Problem is that they don't have an image for macOs and had to configure mostly everything manually.
+    - Worked with Sergio on understanding how sovreign rollup examples are built and implemented in Nomos. Went through some documentation and code figured out how it works.
+    - Went through Celestia to understand how DA works.
+    - Wrote a small [document](https://www.notion.so/zkSync-Era-Validium-27f8f96fb65c803c9939c1e56f141313?source=copy_link) about Validium, Nomos, and result interpretation.
+
+- `state-separation-architecture-poc:cpc`
+    - Researched how to make cross program calls work on NSSA. Finally, came up with a high level way to do it and discussed it briefly with Sergio.
+    - Worked on expanding the idea and the plan is to have a first version next week.
+    - Dived into the details of the Nomos [validium](https://github.com/logos-co/nomos-example-validium) and [rollup](https://github.com/logos-co/nomos-example-sovereign-rollup) examples.
+    - Ran a Nomos local testnet and learned how to disperse data into NomosDA.
+
+- `vac:nes:2025q3:state-separation-architecture-poc:wallet-2`
+    - Addressed the comments of PR 115 discussion in PR 119. While doing so I discovered some bugs and issues. Proposals to fix them are in 
+        - [PR 119](https://github.com/vacp2p/nescience-testnet/pull/119): wallet improvements and some protocol deviation fixes,
+        - [PR 120](https://github.com/vacp2p/nescience-testnet/pull/120): inflation bug stemming from a missing check in the privacy circuit,  and
+        - [PR 121](https://github.com/vacp2p/nescience-testnet/pull/121): account uniqueness for private accounts mechanism.
+
+### vac:web:
+
+
+### vac:infra:
+
+- Deployed BNs and ELs for Nimbus Portal network fleet
+- Adjusted Nimbus Portal fleet storage to be homogenous
+- Improved memory alerting for LIDO fleet by taking ZFS into account
+- Imported contributors list from BambooHR into OpenKM
+- Added ENRTrees addresses to Waku fleets dashboard
+- Preparing of proposal for LIDO fleet layout changes
+- Fixed `status-go` benchmark issues by adjusted host size
+- Researched Windows 10 in VirtualBox as alternative for E2E tests
+- Implemented dry running Rocketpool rewards tree generation
+- Cleanined up and merged PR for `bitcoinpodcast.com` Wordpress
+- Implemented Kuma status pages for each Waku fleet
+- Converted Holesky testnet Windows host to Hoodi testnet
+- Upgraded all nodes on Holesky fleet before Fusaka fork
+- Fihished deployment of Aztec L2 Sepolia testnet sequencer node
+- Implemented ElasticSearch cleanup ILM policy, started Waku logs cleanup
+- Research into ElasticSearch 8 upgrade
+- Fixed issues with loading of Wazuh alerting rules
+- Development of CLI tool for Airbyte
+- Rollout of containerized Jenkins agents and builds
+- Further implementation of unit tests for LIDO services
+
+### vac:bi: