Merge branch 'master' into acz-2025q3-w11-12

2026-01-07 23:04:01 -05:00 · 2025-10-21 14:47:00 +02:00
parent 8cd16299fb 56f8e096d4
commit 162b852c51
2 changed files with 414 additions and 1 deletions
--- a/content/updates/2025-10-13.md
+++ b/content/updates/2025-10-13.md
@@ -220,8 +220,23 @@ draft: false
    - Finished Operational Continuity guidelines based on Threat Model
 - `ift:2025q4-training-and-awareness-program:secure-the-signing-process`
    - Tested the multi-layer verification mechanisms in the Signing Process (Dummy Data)
+- `ift:2025q4-cicd-security-review:status-design-reviews`
+    - Completed final validation of audit fix documentation and verified that all related PRs were properly merged
+    - Performed targeted security regression testing across patched Status Desktop and Wallet components to confirm no re-introduced issues
+    - Audited CI/CD signing and artifact verification workflows, confirming integrity and authenticity of recent builds
+- `ift:2025q4-vulma-and-ir:incidents`
+    - Monitored and analyzed new phishing attempts linked to GitHub Pages and X.com activity; no active threats detected
+    - Conducted detailed forensic analysis on phishing-related logs to establish attacker patterns and indicators of compromise
+    - Began drafting updated IR playbook entries covering phishing response and token compromise procedures
+- `ift:2025q4-vulma-and-ir:remediation-tracking`
+    - Verified dependency patch merges through code review and confirmed build stability post-deployment
+    - Prioritized and tracked remediation of outstanding high-risk CodeQL findings with repository maintainers
+    - Assessed exposure to newly published CVEs affecting crypto and network dependencies
+    - Tuned CI alert severity configurations to better prioritize critical vulnerabilities in dependency updates
 - `admin/misc`
    - Reviewed 4Q commitments and discussed future work with SU
+    - Worked on Hackenproof subscription renewal and processed payment extension
+  
 ### vac:nes:

 - `state-separation-architecture-poc:cpc`
@@ -284,4 +299,4 @@ draft: false
 - Automatisation of Airbyte config backup using custom tooling
 - `vac:bi:ift:2025q4-ift-townhall-content-helper` Start working on the tasks
 - `vac:bi:comm:2025q4-comm-x-spaces-analytics` Finished tasks
- `vac:bi:ift:2025q4-ift-townhall-transcript` continue task and documentation 
+- `vac:bi:ift:2025q4-ift-townhall-transcript` continue task and documentation 
--- a/content/updates/2025-10-20.md
+++ b/content/updates/2025-10-20.md
@@ -0,0 +1,398 @@
+---
+title: 2025-10-20 Vac weekly
+tags:
+  - vac-updates
+date: 2025-10-20
+lastmod: 2025-10-20
+draft: false
+---
+
+## Vac 2025/10/20
+
+### highlights
+
+- P2P: Replaced OpenSSL by BoringSSL in libp2p and quic (no more runtime dependencies)
+- P2P: Fixed some memory corruption issues in nim-quic
+- QA: Status-go Waku functional testing continued with contact verification tests and a new timestamp format bug reported.
+- QA: Waku RLN contract property-based fuzz tests and adversarial tests both progressed; new mitigation for spam attack opened.
+- QA: Status-go Settings tests implementation in progress.
+- QA: Nim-libp2p QUIC test plan drafted and under review. Started implementing new tests for QUIC and one issue reported.
+- QA: Status desktop QA advanced Windows E2E CI setup and investigated slow login issues; multiple PRs tested and merged.
+- QA: Status mobile switch CI for BrowserStack integration, expanded test coverage, and supported pre-release validation.
+- ACZ: Released multi-tree and gas-checking support for prover, theoretically prover supports unlimited many user and burnt message-id rights as many user wants for TXs that exceeds maxQuota gas.
+- ACZ: Multi-steward PR is on review
+- WEB: Wallet connecting
+- WEB: Planning depositing
+- WEB: Implementing Spaces Calendar
+- WEB: Adding comprehensive SEO optimization with sitemap, RSS feeds, and robots.txt
+- WEB: Sending FtW book with cover letter to University of Tokyo and Keio University
+- WEB: Updating farewell to westphalia A/B testing pages
+
+### vac:p2p:
+
+- `vac:p2p:ift:2025q4-nimlibp2p-maintenance:maintenance`
+    - Finish release [v1.14.0](https://github.com/vacp2p/nim-libp2p/pull/1751)
+    - [vacp2p/nim-quic#157](https://github.com/vacp2p/nim-quic/pull/157) fix(tests): remove unittest2Compat flag
+    - [vacp2p/nim-libp2p#1769](https://github.com/vacp2p/nim-libp2p/pull/1750) chore(test): utilize checkUntilTimeout
+- `vac:p2p:ift:2025q4-nimlibp2p-mix:stream-reuse`
+    - [vacp2p/mix#90](https://github.com/vacp2p/mix/pull/90) feat: reuse streams
+    - [vacp2p/nim-libp2p#1753](https://github.com/vacp2p/nim-libp2p/pull/1753) feat(mix): reuse streams
+- `vac:p2p:ift:2025q4-nimlibp2p-quic:openssl-replacement`
+    - Ended up replacing aws-lc by boringssl in [vacp2p/nim-ngtcp2#21](https://github.com/vacp2p/nim-ngtcp2/pull/21) and [vacp2p/nim-quic#140](https://github.com/vacp2p/nim-quic/pull/140) due to aws-lc requiring additional third-party that requires being compiled with -O0
+    - [vacp2p/nim-libp2p#1761](https://github.com/vacp2p/nim-libp2p/pull/1761) feat: use BoringSSL for certificate ops
+    - [vacp2p/nim-ngtcp2#22](https://github.com/vacp2p/nim-ngtcp2/pull/22) feat: compile boringssl using assembly files (except windows)
+- `vac:p2p:ift:2025q4-nimlibp2p-quic:stabilization`
+    - [vacp2p/nim-quic#151](https://github.com/vacp2p/nim-quic/pull/151) chore(stream): set stream data only once
+    - [vacp2p/nim-quic#155](https://github.com/vacp2p/nim-quic/pull/155) chore(streamstate): set stream data when opening stream
+    - [vacp2p/nim-quic#152](https://github.com/vacp2p/nim-quic/pull/152) refactor(streamstate): removed optional Stream
+    - [vacp2p/nim-quic#160](https://github.com/vacp2p/nim-quic/pull/160) chore(test): add test with many streams per connection
+    - Investigate ngtcp2 callback usage in nim-quic
+- `vac:p2p:ift:2025q4-nimlibp2p-kad-dht:data-retrieval`
+    - [vacp2p/nim-libp2p#1750](https://github.com/vacp2p/nim-libp2p/pull/1750) feat(kad): add getValue
+    - [vacp2p/nim-libp2p#1760](https://github.com/vacp2p/nim-libp2p/pull/1760) chore(kad): configuration options
+    - [vacp2p/nim-libp2p#1764](https://github.com/vacp2p/nim-libp2p/pull/1764) chore(kad): add alpha handling
+    - [vacp2p/nim-libp2p#1765](https://github.com/vacp2p/nim-libp2p/pull/1765) chore(kad): getVal loop improvements
+- `admin/misc`
+    - [vacp2p/nim-libp2p#1752](https://github.com/vacp2p/nim-libp2p/pull/1752) feat: complementary coding style guidelines 
+    - [vacp2p/nim-libp2p#1762](https://github.com/vacp2p/nim-libp2p/pull/1762) chore(style): add decision about return statements 
+    - Assist in queries and pair programming
+
+
+### vac:tke:
+
+- `admin`
+  - 2 days off due to sickness
+- `vac:tke:nomos:stress-test::review-pos-sims`
+  - implemented probabilistic demand for transactions
+- `vac:tke:nomos:stress-test::dyn-stake-estimation`
+  - Keep working towards improvement of DSE specs
+  - Answer comments from Nomos
+- `vac:tke:status:karma-incentives`
+  - adapting user's Karma dashboard on Streamlit to the new deployment of SCs
+- `vac:tke:ift:support-to-ift-units::price-prediction`
+  - reviewed stochastic and econometric models
+  - proposed a set of models
+  - started implementing the models and the simulation infrastructure
+  - Modeling task by Finance
+- `vac:tke:ift:support-to-ift-units::dex-nescience`
+  - revisiting DEX options for Nescience and mapping similar products live / in dev
+- `vac:tke:ift:logos-token::logos-token-sales`
+  - Flying tulip review and incorporation into doc
+  - Presentation to Jarrad
+- `vac:tke:ift:logos-token::logos-fundraise`
+  - presented the findings to IFT
+- `vac:tke:ift:tokenomics-research-forum::control`
+  - Worked on research on Opt. Control
+- `vac:tke:ift:tokenomics-research-forum::grantico`
+  - further preparations of the workshop for Funding the Commons @ Devconnect
+
+### vac:qa:
+
+- `status:2025q4-status-go-functional-testing:waku`
+  - [Issue 6995: inconsistent replied_at timestamp](https://github.com/status-im/status-go/issues/6995)
+  - [PR 6997: contact verification](https://github.com/status-im/status-go/pull/6997)
+- `waku:2025q4-rln-smart-contract-testing:property-based`
+  - [PR 40: fuzz test expansion](https://github.com/waku-org/waku-rlnv2-contract/pull/40) - in progress
+- `waku:2025q4-rln-smart-contract-testing:security-adversarial`
+  - [PR 42: adversarial tests](https://github.com/waku-org/waku-rlnv2-contract/pull/42) - in progress
+  - [Issue 45: prevent set-filling spam attack](https://github.com/waku-org/waku-rlnv2-contract/issues/45) - open
+- `status:2025q4-status-go-functional-testing:settings`
+  - [PR 6984: settings.go tests](https://github.com/status-im/status-go/pull/6984) - >120 tests, all wrappers implemented, several issues marked xfail
+- `vac:2025q4-nim-libp2p-testing:test-plans`
+  - [QUIC test plan draft](https://www.notion.so/QUIC-28b8f96fb65c8018b6cdc21882cfd98a) - created and sent for review
+- `vac:2025q4-nim-libp2p-testing:quic`
+  - [PR 1768: GossipSub outbound peers fix](https://github.com/vacp2p/nim-libp2p/pull/1768) - merged
+  - Continued review of nim-quic tests and preparing 2nd PR
+- `status:2025q4-status-qa-desktop:maintenance`
+  - [PR 19047: improved wait for object](https://github.com/status-im/status-desktop/pull/19047) - merged
+- `status:2025q4-status-qa-desktop:release-testing`
+  - [PR 19004](https://github.com/status-im/status-desktop/pull/19004) - tested
+  - [Issue 19019: slow login](https://github.com/status-im/status-desktop/issues/19019) - investigated
+  - [PR 19022](https://github.com/status-im/status-desktop/pull/19022) - tested
+- `status:2025q4-status-qa-desktop:e2e-windows`
+  - Configured Virtual Display Driver; e2e now functional locally on Windows; pending infra-side tweaks for CI merge
+- `status:2025q4-status-qa-mobile:test-ci`
+  - [Issue 19088: BrowserStack integration](https://github.com/status-im/status-desktop/issues/19088) - in progress
+  - Jenkins test builds available
+- `status:2025q4-status-qa-mobile:port-tests`
+  - Local test harness set up (Raspberry Pi & phones)
+  - [PR 18977: password change scenario](https://github.com/status-im/status-desktop/pull/18977) - feedback addressed
+- `status:2025q4-status-qa-mobile:release-testing`
+  - Supported mobile pre-release test day
+- `admin/misc`
+  - OOO: 3 CC Days
+
+### vac:dst:
+
+- `vac:dst:status:2025q4-status-evaluation:chat-protocol-benchmarks-followup`
+    - Make simple light scenario to work
+        - Discovered an issue where Status has information that a bootstrap node has filter-subscribe when this is not true. Further investigation.
+        - [Notion: Status Light and Waku Filter](https://www.notion.so/Status-light-and-nWaku-filter-2858f96fb65c8019ac2af3a84c688d68)
+    - Create structure for multiple consumers when working with requests
+        - [Github PR: Multiple consumers #35](https://github.com/vacp2p/status-benchmarks/pull/35)
+    - Created new log level for better debugging
+        - [Github PR: Logger adjustments #37](https://github.com/vacp2p/status-benchmarks/pull/37)
+- `vac:dst:waku:2025q4-waku-scaling:TWN-supports-RLN-tree`
+    - Check how to include memberships in the RLN tree
+    - Check how RLN is used in waku simulator
+    - Check how RLNKeystore works
+- `vac:dst:vac:2025q4-libp2p-evaluation:regression-testing`
+    - Analysis nim-libp2p v1.14
+        - [Notion Report](https://www.notion.so/Nim-libp2p-v1-14-0-regression-testing-October-2025-28d8f96fb65c803ba789ccdb73753cab)
+- `vac:dst:ift:2025q4-dst-tooling:general-tooling`
+    - [Github PR: Fix nimlibp2p tracer #161](https://github.com/vacp2p/10ksim/pull/161)
+    - [Github PR: Move metadata helpers to base_experiment #162](https://github.com/vacp2p/10ksim/pull/162)
+    - [Github PR: nimlibp2p mix node deployment changes #137](https://github.com/vacp2p/10ksim/pull/137)
+    - [Github PR: Mixnet analysis changes #163](https://github.com/vacp2p/10ksim/pull/163)
+    - [Github PR: Allow multiple match groups for the same query in victoria_reader.py #164](https://github.com/vacp2p/10ksim/pull/164)
+- `vac:dst:ift:2025q4-dst-tooling:complete-deployment-refactor`
+    - initContainers, commands, etc. working for lightpush, filter
+    - Store node need a few tweaks, but near complete
+- `vac:dst:ift:2025q4-libp2p-evaluation:mix-in-nim-libp2p-node`
+    - Finalized work on mix integeration PR for the refactored node. The PR is ready for merging
+		- [Github PR: mix-integeration # 7](https://github.com/vacp2p/dst-libp2p-test-node/pull/7) 	
+- `vac:dst:ift:2025q4-libp2p-evaluation:go-libp2p-node`
+    - Worked on running go-libp2p node alongside nim node.  
+		- Both, nim refactored node and go-libp2p nodes are working fine in shadow (using yamux. mplex is obsolete in go-libp2p)
+		- Still need to finalize work on quic in go test node
+		- Still need to log prometheus metrics in go test node  
+
+### vac:sc:
+
+- `statusl2:2025q4-audit-preparation:restructure-test-files`
+    - re-organized Karma test contracts in multiple files https://github.com/status-im/status-network-monorepo/pull/50/files
+    - fixed front-running problem in RLN
+- `statusl2:2025q4-audit-preparation:organize-tests`
+    - Abstract test files into their own files and folders
+- `statusl2:2025q4-audit-preparation:review-documentation`
+    - Review MathSpec.mp matches StakeManager.sol
+- `statusl2:2025q4-pre-audit-protocol-enhancements:distributed-slashing`
+    - Research on Slashing Race Condition solutions 
+- `statusl2:2025q4-audit-preparation:update-properties`
+    - Document application invariant and properties
+        - https://github.com/status-im/status-network-monorepo/pull/51
+- `statusl2:2025q4-audit-preparation:review-documentation`
+    - Updated and added a bunch of documentation
+        - https://github.com/status-im/status-network-monorepo/pull/53
+- `statusl2:2025q4-pre-audit-protocol-enhancements:convert-erc20votes-tests`
+    - Debugged failing ERC20Votes tests in coverage mode, fixed it and landed the PR
+        - https://github.com/status-im/status-network-monorepo/pull/49
+- `admin/misc`
+    - Updated Status Network contract dep to use Foundry v1.4
+        - https://github.com/status-im/status-network-monorepo/pull/52
+
+### vac:acz:
+
+- `nes:2025q4-nescience-consulting:native_zones`
+    - Prepared a [document](https://www.notion.so/NSSA-as-native-zone-28f8f96fb65c80aba613fd118b711cd8) on native zones.
+- `ift:2025q4-de-mls-tesnet:de-mls-maintaining`
+    - Working on updating representation of proposal and frontend part, fully removed websocket anf made code more independent [PR](https://github.com/vacp2p/de-mls/pull/46)
+- `ift:2025q4-zerokit:ffi-rework`
+    - Fixed the current implementation in FFI [PR](https://github.com/vacp2p/zerokit/pull/337)
+    - Updated the C example and added stateless mode.
+    - Implemented initial big-endian support based on Sylvain's idea.
+    - Review changes in [PR](https://github.com/vacp2p/zerokit/pull/337) and update Nim example 
+- `ift:2025q4-rln-status-l2:shared-db`
+    - [Zerokit pmtree rocksdb](ift:2025q4-rln-status-l2:shared-db) - WIP + Draft
+- `ift:2025q2-zerokit:zerokit-maintaining`
+    - [Review 1](https://github.com/vacp2p/zerokit/pull/337#pullrequestreview-3331934923)
+    - [Minor doc PR](https://github.com/vacp2p/zerokit/pull/348)
+    - Supported nwaku team with zerokit version bumping
+    - Made a summary about changes in zerokit for prover in [discord](https://discord.com/channels/864066763682218004/1424698365010251837/1427963361756184626)
+- `ift:2025q4-rln-status-l2:more-user-support`
+    - [Multi tree PR](https://github.com/vacp2p/status-rln-prover/pull/49) - merged
+- `ift:2025q3-rln-status-l2:maintaining`
+    - [Update dependencies PR for security](https://github.com/vacp2p/status-rln-prover/pull/50) - merged
+    - Rebase and merged [Disable grpc reflection PR](https://github.com/vacp2p/status-rln-prover/pull/48)
+    - Tested Decentralized Slashing SCs on the DST machine.
+    - Discussed the front run issue on Discord [thread](https://discord.com/channels/864066763682218004/1418252962689712349)
+	- [Slashing support](https://github.com/vacp2p/status-rln-prover/pull/52) - WIP
+	- [Update to Zerokit 0.9.0 official release](https://github.com/vacp2p/status-rln-prover/pull/53) - merged
+	- [Security dependencies update PR](https://github.com/vacp2p/status-rln-prover/pull/54) - merged
+- `ift:2025q4-rln-status-l2:gascheck`
+    - [Gas checking PR](https://github.com/vacp2p/status-rln-prover/pull/51) - merged
+	  - + rebasing with [User spam limit check PR](https://github.com/vacp2p/status-rln-prover/pull/47) - merged 
+- `ift:2025q4-de-mls-tesnet:multi-steward-rfc`
+    - Update [PR](https://github.com/vacp2p/rfc-index/pull/193) with:
+        - roles that can initiate the 3 types of consensus
+        - deterministic creation of steward list
+        - priority of the consensus messages
+        - adding identification IDs to the members
+- `ift:2025q4-rln-status-l2:rln-public-website`
+    - Release the [first draft doc](https://www.notion.so/Rate-Limiting-Nullifier-RLN-28d8f96fb65c80ab8faef0a72c2836c6)
+- `ift:2025q4-discovery:draft-RFC`
+    - Review and added comments to the draft [Logos Discovery Capability RFC doc ](https://www.notion.so/RFC-Logos-Discovery-Capability-28a8f96fb65c80888df7fc0de13f1e22)
+    - Synced with team and discuss on next step items on at the bottom of the RFC doc. 
+    - Worked on the feedback received for [Logos Discovery Capability RFC doc](https://www.notion.so/RFC-Logos-Discovery-Capability-28a8f96fb65c80888df7fc0de13f1e22)
+    - studied the kad-dht implementation from [kad-dht codebase](https://github.com/libp2p/go-libp2p-kad-dht), [kad-dht-specs](https://github.com/libp2p/specs/tree/master/kad-dht) [docs](https://pkg.go.dev/github.com/libp2p/go-libp2p-kad-dht#section-readme)
+    - Worked on basic data structures for the POC for Logos Discovery Capability
+- `ift:2025q4-rln-status-l2:rln-spec-maintain`
+    - Update [RLN deployment spec](https://www.notion.so/RLN-Deployment-Spec-on-Review-1f98f96fb65c806c8737d94851b4d14d) with multi-tree and decentralized slashing sections. 
+    - Propose the determining minimumKarma and maximum globalRate amounts. 
+    - Having discussion on removing the front-running feature on decentralized slashing part.
+    - Update prover specs for section [gas checking](https://www.notion.so/RLN-Deployment-Spec-1f98f96fb65c806c8737d94851b4d14d?source=copy_link#2728f96fb65c8058826ed6d3b2139a0a)
+- `nes:2025q4-nescience-consulting:multikeys`
+	- Reviewed [document](https://www.notion.so/Hierarchical-Deterministic-wallets-in-NSSA-2878f96fb65c80659325d84dd66a5630).
+	- Finished hierarchical deterministic wallet for NSSA [document](https://www.notion.so/Hierarchical-Deterministic-wallets-in-NSSA-2878f96fb65c80659325d84dd66a5630) and implement in Python.
+- `nomos:2025q4-nomos-consulting:zk-consulting-nomos-1`
+	- Reviewed KKT in attempt to prove this [inequality](https://www.notion.so/nomos-tech/Statistical-mechanics-of-anonymous-communication-262261aa09df80d6aaeecbf54740f592?source=copy_link#277261aa09df80fab01de5ff85963e7b) for Nomos; KKT yielded the same necessary results.
+
+### vac:rfc:
+
+- `vac:rfc:codex:2025q3-rfc-iteration`
+    - Fininshed first draft of DHT rfc codex - https://github.com/vacp2p/rfc-index/pull/187
+    - Finished first draft for codex manifest rfc - https://github.com/vacp2p/rfc-index/pull/191
+    - Worked on erasure coding rfc, work still in progress - https://github.com/vacp2p/rfc-index/pull/192
+    - Adhered to comments on Sales and Purchase specs: https://github.com/vacp2p/rfc-index/pull/201 and https://github.com/vacp2p/rfc-index/pull/200
+    - Started Prover and Merkle Tree RFCs
+
+### vac:nim:
+
+- `ift:2025q4-nimble`
+  - Research an propone a fix for https://github.com/status-im/nim-metrics/pull/98
+  - Research and propone a fix for https://github.com/status-im/nim-json-serialization/pull/136
+  - Research multiple nwaku issues
+  - Interview Chris
+  - Interview Constantine
+  - fixes #1483 Infinite Reading official package list (https://github.com/nim-lang/nimble/pull/1494)
+  - Fixes #1432: Missing package name in warning (https://github.com/nim-lang/nimble/pull/1492)
+  - Fix tempDir causing git checkout failures in tag processing loop (https://github.com/nim-lang/nimble/pull/1490)
+  - Fixes global nim install to update symlink to the correct version (https://github.com/nim-lang/nimble/pull/1488)
+- `ift:2025q4-nim-core-libs:nim-cbor-serialization`
+  - Add regression tests to `nim-serialization` "Test generic suite" (used by cbor) https://github.com/status-im/nim-serialization/pull/110
+  - Support nested tests at comptime in `nim-unittest2` (used by cbor) https://github.com/status-im/nim-unittest2/pull/59
+  - Improve checkpoint output at comptime in `nim-unittest2` (used by cbor) https://github.com/status-im/nim-unittest2/pull/60
+- `ift:2025q4-nim-core-libs:nim-confutils`
+  - Remove `-d:nimOldCaseObjects` requirement https://github.com/status-im/nim-confutils/pull/117
+  - Release `nim-json-serialization` v0.4.4 https://github.com/status-im/nim-json-serialization/pull/138
+
+### vac:sec:
+
+- `ift:2025q4-awareness-program:web3-security-essentials`
+    - Security best practices in free.technology is pending, since we are refining content.
+    - Updated security checklists for Authentication, 2FA, Secure Web Browsing, Email Security
+    - Updated Security Guidelines page
+- `ift:2025q4-secure-signing-process-training:use-case-priority-definition`
+    - Defined the first stage of runs, starting with Signatory Onboarding process
+- `ift:2025q4-secure-signing-env-deployment:evaluate-detection-tools`
+    - Started the search of some tools we can test and evaluate
+- `ift:2025q4-treasury-continuity-plan:develop-recovery-and-emergency-protocols`
+    - Started the development of recovery procedures and emergency protocols
+- `ift:2025q4-treasury-continuity-plan:implement-backup-requirements`
+    - Gap analysis in process
+        - Identifying deviations to backup requirements and critical vulnerabilities
+- `ift:2025q4-cicd-security-review:status-design-reviews`
+    - Completed review of Status Wallet security enhancements implemented after latest audit fixes
+    - Performed targeted penetration and fuzz testing on Status Desktop rendering and IPC
+    - Collaborated with the Status team and Least Authority to review resolved issues and coordinate next steps for audit validation
+- `ift:2025q4-vulma-and-ir:incidents`
+    - Expanded phishing detection coverage by monitoring new GitHub and X.com activity 
+    - Conducted simulations of token-based compromise scenarios 
+    - Worked with infra and ops teams to strengthen OAuth app and API token scopes across key repositories
+- `ift:2025q4-vulma-and-ir:remediation-tracking`
+    - Completed manual verification of remaining high-severity CodeQL alerts and validated implemented fixes through targeted tests
+    - Verified the integrity of supply-chain dependencies by matching package hashes with trusted registries
+    -  Deployed CI safeguards to block merges introducing unverified or unsigned third-party dependencies
+    - Audited Dependabot auto-merge settings to ensure priority handling for critical patches and security updates
+- `ift:2025q3-iam-operations:remove-unnecessary-users`
+   - Workflows for Notion assets
+        - Configured report for DBs created and edited before 01.01.2025
+- `ift:2025q4-finance-automation-enhancements`
+    - Finalized user interactive workflow version with date selection
+- `ift:2025q4-Create hierarchy boards in Miro`
+    - Fixed graphical issues with text inside shapes
+    - Generated boards for other teams
+- `ift:2025q4-Migrate Sec workflows to n8n Sec Cloud`
+    - Migrated workflows related to Sec work
+        - IAM related
+        - Newsletter related
+        - Wallet related
+    - Migrated credentials related to Sec work
+        - Notion
+        - Discord
+        - GitHub
+
+### vac:nes:
+
+- `state-separation-architecture-poc:cpc`
+    - Finished working on [specs for AMM](https://www.notion.so/AMM-spec-28a8f96fb65c80bf93edde876c5a6932).
+    - Handled comments regarding AMM specs.
+- `state-separation-architecture-poc:fee`
+    - Wrote a [document](https://www.notion.so/Fee-mechanism-v0-1-2928f96fb65c80a297edfa2507e9c153) on fee mechanism for NSSA.
+    - Wrote [specs document](https://www.notion.so/Fee-mechanism-specs-2928f96fb65c80ad9e92da633cf4db47) on fee mechanism for NSSA.
+- `Others`
+    - Started playing with the wallet, the goal is to try all commands and output a document explaining all steps.
+    - Had different calls with IFT regarding the project.
+- `state-separation-architecture-poc:wallet-functionality`
+    - Finalized token program private interactions from wallet [PR](https://github.com/vacp2p/nescience-testnet/pull/124)
+    - Finalized wallet updates [PR](https://github.com/vacp2p/nescience-testnet/pull/127)
+- `vac:acz:nes:2025q4-nescience-consulting:multikeys`
+	- Finished hierarchical deterministic wallet for NSSA [document](https://www.notion.so/Hierarchical-Deterministic-wallets-in-NSSA-2878f96fb65c80659325d84dd66a5630) and implement in Python.
+- `vac:acz:nes:2025q4-nescience-consulting:native_zones`
+    - Prepared a [document](https://www.notion.so/NSSA-as-native-zone-28f8f96fb65c80aba613fd118b711cd8) on native zones.
+
+### vac:web:
+
+- `admin/misc`
+  - Summarizing planning meetings
+  - Adding comprehensive SEO optimization with sitemap, RSS feeds, and robots.txt https://github.com/acid-info/logos-press-engine/pull/243
+  - Sending FtW book with cover letter to University of Tokyo and Keio University
+- `status:2025q4-sn-hub`
+  - Planning depositing https://github.com/status-im/status-web/issues/775
+  - Merging Wallet Connect https://github.com/status-im/status-web/pull/804
+  - Implementing Withdraw https://github.com/status-im/status-web/pull/813
+  - Updating links in Feedback Actions https://github.com/status-im/status-web/pull/809
+- `ift:2025q4-psf-website`
+  - Requesting changes to ticketing integration
+- `ift:2025q4-logos-website`
+  - Reviewing Open source collaborators activities sum-up API PR https://github.com/acid-info/admin-acid.logos.co/pull/18
+  - Implementing Spaces Calendar https://github.com/acid-info/admin-acid.logos.co/pull/19
+  - Drafting search architecture on docs pages
+  - Refactoring burger menu & navigation based on new architecture https://github.com/acid-info/logos-co/pull/12
+  - Implementing social proof component:
+    - Backend PR https://github.com/acid-info/admin-acid.logos.co/pull/18 / Frontend PR https://github.com/acid-info/logos-co/pull/10
+- `keycard:2025q4-keycard-website`
+  - Helping to deploy copy changes in Quick Start for Shell [PR#114](https://github.com/keycard-tech/keycard-website/pull/114), [PR#115](https://github.com/keycard-tech/keycard-website/pull/115)
+- `2025q4-maintenance`
+  - Updating farewell to westphalia A/B testing pages https://github.com/acid-info/logos.co/pull/87
+  - Fixing quick syntax on events page https://github.com/acid-info/logos.co/commit/8cc886f9e3994fe9e29e5c30df64e7eb921ba250
+
+### vac:infra:
+
+- `admin/misc`
+	- Research into missing proposals on LIDO fleet
+	- LIDO KAPI service conversion to Systemd definition
+	- New tests and improvements to LIDO fleet integration testing
+	- Upgrade of nodes and while nixpkgs on LIDO fleet
+	- Prepartion of Ethereum archive node for validator monitoring
+	- Follow up with Ultrasound relay about `getPayload` timeouts
+	- Research into ElasticSearch memory issues due to big queries
+	- Monitoring of Sepolia fleet during Fusaka fork
+	- Debugging of issues with Aztec sequencer after Sepolia fork
+	- Nimbus Mainnet fleet storage upgrades
+	- Replacement of UPS battery for local HQ backup host
+	- Android and iOS signing configuration for Status Desktop
+	- Help with last legacy Status Mobile release with backups
+	- Upgrade of MatterBridge fork to new Go and `status-go` versions
+	- Work on Nix builds for `nim-sds` dependency of `status-go`
+	- Translation files inclusion in Status Desktop mobile builds
+	- Status Desktop Windows E2E breakthrough, working with VVD
+	- Continued rollout of Jenkins job containerization
+	- Deployment of Commit-Boost for compairon with MEV-Boost
+	- Debugging of pull issues with Ansible roles management script
+	- Improvements to Admin Acid website deployment
+	- Keycard Shell website deployment setup
+
+### vac:bi:
+
+- `vac:bi:rag:2025q4-rag-evaluation-pipeline`
+	- Extracting and the current usage of RAG.
+- `vac:bi:rag:2025q4-rag-content`
+	- Chunking is taking ages, stopped process and restart with only Waku's data.
+- `vac:bi:ift:2025q4-ift-townhall-transcript`
+	- Work in progress
+- `vac:bi:ift:2025q4-ift-townhall-content-helper` 
+	- n8n pipeline to group and push all update in a [repository](https://github.com/status-im/ift-weekly-news) . 
+	- Added listing of release, blog update, forum updates.
+- `vac:bi:ift:2025q4-vac-website-contributors`
+	- Provide public API endpoint for the ext contributors data