The public repos carried no license, so nobody could legally copy or build
on the code, and the whitepaper's "free software" had nothing behind it.
Theseus and its companions take the Mozilla Public License 2.0, the
file-level copyleft Firefox and Brave use, which is compatible with every
component they bundle. The resolver and gateway libraries take Apache-2.0
so that other implementations of the registry can reuse them without
copyleft in the way. The protocol documents and the whitepaper are CC BY 4.0.
A third-party notices file lists what the browser ships and fetches, with
the source offer the GPL sing-box binary the VPN add-on downloads requires;
the matching source archive is now published beside the binaries. The
names and marks are reserved in TRADEMARKS.md, separate from the code
license, so a fork must ship under its own name. Settings › General says
the license and links the three files; the whitepaper says the same.
- site/hephaestus.x/index.html: replace single 'Sign in with wallet' CTA with
a <details> dropdown labelled 'Bitcoin Cash wallet'. Menu items:
Sign in -> /user/oauth2/hephaestus-wallet#import
Sign up -> /user/oauth2/hephaestus-wallet#create (pill: easiest)
WizardConnect -> /user/oauth2/hephaestus-wallet#connect (pill: most private)
Same emoji + copy scheme as the wallet accordion, so the landing previews
the choices the user will see after clicking through.
- Hephaestus/auth-proxy/public/wallet.js: renderTabs() now reads location.hash
and auto-opens the matching <details> option on load (create/import/connect).
Fragments survive Forgejo's OAuth redirect chain, so a click on 'Sign up'
from the landing lands the user directly on the Create accordion.
Clicking Create / Import / WizardConnect now expands the flow *inside* that
option (native <details>/<summary>) instead of hiding the picker and rendering
a separate view. Opening one option auto-closes the others. Chevron flips and
border turns accent-orange on the open card. "Back" buttons removed — closing
is a click on the same summary.
- wallet.js: renderTabs() emits three <details class="wallet-opt">; the
per-option flow content is populated lazily on first `toggle` and lives
inside `.wallet-flow` (no more global #panel). Accordion behavior is
enforced by closing sibling <details> on toggle.
- login.css: .wallet-opt reworked as details-summary card; chevron rotates
on [open]; .wallet-flow is the divider-topped body inside each card.
- login.css/wallet.js: replace 2-tab (generate/import) UX with 3 big options
— Create a new wallet [easiest], Import / add a wallet, Connect a wallet —
WizardConnect [most private] (Cashonize/Paytaca placeholder, "coming soon").
- Caddyfile (both hostnames): /user/login now 302→ /user/oauth2/hephaestus-wallet.
Escape hatch: /user/login?password=1 falls through to Forgejo's password form,
linked from the picker footer as "Prefer old-school? Sign in with username & password".
Only bitcoincash: was being stripped; bchtest: (chipnet) addresses ended up
producing preferred_username="bch_bchtest:qzew3dqcsj0g" — Forgejo rejected
that with "name is invalid ... must be valid alpha or numeric or dash(-_)
or dot characters" because of the colon, callback 500'd, session never
finished. Regex-strip any [a-z]+: prefix so all three prefix families
(bitcoincash, bchtest, bchreg) produce clean usernames.
Verified end-to-end with a Node smoke test signing a real chipnet challenge
with the main wallet from Argus/wallets.json:
bchtest:qzew3dqcsj0guwe5y3uxf9q2xs5ajgy9lca4z093cu
→ bch_qzew3dqcsj0guwe5y3ux (auto-provisioned in Forgejo)
→ 303 to dashboard, session live.
Site:
- Rename the "Tools" nav label to "Theseus" on every subpage. URL slug
/tools/ is kept intact so bookmarks and cross-links survive; the page's
own title + h1 rename to Theseus; homepage product card retitled.
- Remove the /tlds/ self-nav entry so its 7-item header matches every
other subpage (was 8 items, causing the same "header rearranges" glitch
Hephaestus had before).
Auth-proxy (fixes reported by a concurrent session working with a chipnet
wallet):
- verify.ts now auto-detects the CashAddr prefix (bitcoincash, bchtest,
bchreg) instead of hardcoding "bitcoincash". Chipnet wallets sign the
same message with the same key but display bchtest: addresses; the old
code compared their claim against a re-encoded bitcoincash: version and
always rejected. Same key material, different envelope.
- /challenge accepts any of the three known prefixes at the input gate.
- /verify accepts an optional `state` param in the request body — used as
a fallback if the challenge record didn't carry one (which happens when
a scripted caller runs the /verify step without passing state through
/challenge). Ensures RFC 6749 §4.1.2 compliance: the OAuth callback URL
always echoes state when the client provided one.
Behind Caddy's /auth/* → auth-proxy rewrite, absolute fetch('/challenge')
resolved to origin root and hit Forgejo instead of the auth-proxy, so every
real user got "challenge request failed" when clicking sign-in.
Same root cause as the earlier fix for the CSS/JS asset paths — relative
paths work under both direct (:4000) and prefixed (/auth/) mounts.
Add Hephaestus/caddy/Caddyfile - Caddy reverse-proxies both containers on
{$SITE_HOSTNAME} (from docker-compose .env): /auth/* -> auth-proxy:4000 with
the prefix stripped, / -> forgejo:3000 with a 2GB body cap for git push, LFS,
and release uploads. HTTPS via automatic Lets Encrypt (HTTP-01 on :80); SSH
git access stays on 2222 outside Caddy.
docker-compose.yml wires the new caddy service alongside the two existing
containers; auth-proxy/src/index.ts gets the minor upstream adjustment so
paths line up after Caddy strips the /auth prefix.
Broad-scope commit sweeping in work from parallel sessions plus this session's
dev-only utilities. No single unifying theme — this is the "commit everything
that's ready" pass. Grouped by area below.
AriadneResolver / mobile
* Small updates to BchFetcher, Bns, MainActivity, AriadneVpnService, and the
Android manifest — from a parallel mobile-resolver session.
* AriadneResolver/mobile/webpreview/ — new local dev webview (index.html +
server.mjs) for iterating on the mobile UI without a device.
Email / SnappyMail
* Email/snappymail-plugin/silentmode-addresses — new SnappyMail plugin
(README, CSS, PHP entry, JS) for surfacing @silentmode.st address
management inside the webmail UI.
Hephaestus (Forgejo + auth-proxy)
* auth-proxy/src/oidc.ts + docker-compose.yml updates.
* scripts/bootstrap-auth.sh — idempotent script that registers the wallet
auth-proxy as Forgejo's OIDC provider after `docker compose up -d`. All
secrets read from .env — no literals in the script.
TheseusNavigator / dev tools
* dev/list-tlds.mjs — enumerate every registered BNS name grouped by TLD via
our own indexer.
* dev/show-tlds-bch.mjs — dump the full records payload of the legacy
tlds.bch name (kept as a diagnostic for the list-in-one-NFT era).
Deviant sites + brand
* site/deviant/ — new microsites (anthemus, potidaea, brand, mindmap, main
index) plus the full brand kit under site/deviant/brand/ (logos, icons,
palette, social exports as SVG source + PNG renders).
* site-sirius-x/portal.html — updates.
Coordination
* _coordination/sessions/mobile-resolver.md — parallel-session notes.
Deliberately excluded from this commit:
* scratchpad/ — this session's temp drafts (Sia doc mockups, tlds UPD payloads).
* TheseusNavigator/_prev/ — ~372 MB of prior release binaries; belongs in
a separate artefacts store, not the git tree. Add to .gitignore next pass.
