[corpetty]

Summary

lez-msig (epic exo-0d3): an M-of-N multisig on LEZ that is private by default, with a muster room as its coordination layer. It answers RFP-005 (logos-co/rfp). Design and decision log: docs/design/lez-msig.md.

• The program (programs/lez-msig/), new, rather than a port of lez-multisig:

  • msig_core holds every rule as pure functions with no LEZ dependency. 24 tests, two of them property tests.
  • A thin v0.3 run_program(plan, apply) adapter. The rules sit outside it, so moving to dev's transactional actors (LEZ PR #935) is another thin adapter.
  • Members approve with per-multisig BIP-340 keys. The approvals are collected in the room and verified inside the program at execution (R.1).
  • A config epoch voids older approvals (R.2; the cutoff is the queue), plus roles, expiry, a time lock with immediate cancels, spending limits, weights, an action set, and a 256-nonce window against replay.
  • The plan re-derives the multisig's own PDA and refuses any other account, which closes the exo-325 class (one quorum moving another multisig's vault) by construction.

• Both postures, one program:

  • Public PDA: driven from the room end to end on a local LEZ v0.3 zone (module/tests/lez_msig_live_e2e.nim).
  • Group-owned private PDA: create, shield and a 2-of-3 payment, each one privacy-preserving transaction accepted by a live sequencer. Nothing public exists at the multisig's id (programs/lez-msig/host/tests/live_private.rs).

• Real-proving benchmark (programs/lez-msig/BENCHMARKS.md, 64-core CPU, RISC Zero's accelerated k256): a private payment with M approvals proves in 150.7 s at M=1, 208.5 s at M=5 and 288.1 s at M=10. The transaction is a constant 228 KB. M ≥ 5 is viable (P.2).

• Muster:

  • The lez.msig driver: the effect is the proposal's exact bytes, which the card decodes (U.6). Its contributor is msig:<key>, attested by that same key.
  • The creation ceremony: approval keys proved by themselves and author-signed; the opener creates the multisig and discloses it.
  • A chain seam, and a settlement that chooses Execute, Queue or ExecuteQueued from the program's state and judges finality by state, never by inclusion.
  • Hosted methods lez_msig_open, lez_msig_ceremonies, coordinate_propose_lez_msig, lez_msig_state, and Settings → lez-msig-program.
  • Nim's copy of the program's bytes (lez/msig.nim) is held byte for byte to vectors the program's own host generates.
  • Registered everywhere a family must be: the registry entry, kinds, profile, conformance, readiness, and the action corpus and atlas.

• The UI (exo-e38): the room's accounts panel creates a multisig (public or private), shows who has joined, pays, sets the time lock and cancels a queued action. The card decodes the signed bytes: the amount in LEZ, the expiry, and the approvers by name. Seen on a display (Xvfb, two runners); scripts/lez-msig-self-test.sh drives two real runners through create → propose → approve → settle.

• The private posture from the room (exo-efa):

  • The prover. lez_msig_module, a Rust Logos module (programs/lez-msig/module, .#lgx on logos-module-builder 0.3.3), proves and sends private transactions. It holds no key: a deposit is proved from the payer's public key, signed in the member's keystore, and sent by send.
  • The room. The opener seals a fresh group secret to each member. After each included transaction, the member who sent it seals the new note to everyone, so members read the multisig without scanning the chain.
  • Settlement. MsigPrivate reads the state from the newest note and sends through the prover, so the settlement rules are the public posture's code.
  • What exists. A lez.msig-private family, a lez_msig_fund method, and the UI's "Create a private…" and "Put in from my account" buttons.

• infra/lez/localnet.sh prefers the host's libclang and libpcsclite, because nixpkgs' copies fail on Ubuntu 24.04's glibc.

• Recovery (exo-abc): a member whose room never got the newest note reads it back from the chain with the group's viewing key (lez_msig_recover, also started automatically when a private settle fails).

• Release 0.3.3:

  • lez_msig_module is published in Muster's catalogue and bundled in the runner and the AppImage. The published muster_ui does not require it.
  • Delivery is accepted at >=0.3.2. Basecamp's default, delivery 0.4.0 (the same code as 0.3.3), had made it refuse every fresh catalogue install of Muster.
  • muster-v0.3.3 is published from 6a74158. Its catalogue index is catalog: Muster 0.3.3, and lez_msig_module 0.1.0 #345; merge this PR first.

Not in this PR:

• spending limits proposed from the room;
• updating room membership on a config change;
• testnet runs.

Tests

• module/tests/run-suite.sh: the whole suite (re-run on the final head before merge).

• module/tests/run-suite.sh e2e lez_msig_live on infra/lez/localnet.sh, with the program deployed (MUSTER_LEZ_MSIG_BIN).

• module/tests/run-suite.sh e2e lez_msig_private (dev-mode zone, the msig_exec CLI as prover), 7/7:

  • the group secret: one per multisig, sealed per member;
  • Create through the prover, and its note read by every member;
  • a deposit signed in the keystore;
  • a 2-of-3 payment;
  • the chain's copy names no member key or create key;
  • an overdraft is refused while proving;
  • below threshold, nothing is sent.

• On a display (two runners, Xvfb, a dev-mode local zone), the private path ran through the bundled prover:

  • create a private 2-of-2: disclosed in 66 s;
  • deposit 5000 from A's own account;
  • B approves;
  • Settle on-chain clicked on A's screen: final, vault 3800.

  The settled line now shows the transaction hash, not the prover's job id.

• cargo test -p lez_msig_module; scripts/lez-msig-self-test.sh (two runners); scripts/ui-lint.sh 0 new.

• In programs/lez-msig: cargo test (core and the in-process state machine), the live private test against the local zone, and msig_bench with real proving.

🤖 Generated with Claude Code