Skip to content
- use stored threshold from DynamoDB during reconstruction (#57)
- enable registration during rotation + multi-credential rotation
- replace built-in hyper metrics server with Axum and add HTTP request metrics
- add AWS Nitro Enclave support (#56)
- deep review (#58)
- vault-style unseal, API-first key management & security hardening (#59)
- pre-release consolidation (#62)
- add credential_id field to RegisterRequest and RegisterResponse
- add challenge_response dependency and yubikey module
- extend DynamoDB ops for multi-credential storage
- add —yubikey and —yubikey-slot flags to operator commands
- support multi-credential registration
- add credential management endpoints
- implement YubiKey HMAC-SHA1 challenge-response module
- update unseal_handler to try all credentials
- wire YubiKey module into operator passphrase flow
- add multi-credential seal/unseal integration tests
- add credential management integration tests
- use per-variant log levels in error handler
- set health check TraceLayer to TRACE level
- migrate to vergen 9 API with vergen-git2
- migrate to OpenTelemetry 0.31 API
- resolve lighthouse_types and rusqlite 0.38 breaking changes
- use cast_signed/cast_unsigned for clippy compliance
- pre-release hardening — constant-time auth, error mapping, graceful shutdown
- deny unsafe_code, disable test retries, apply nightly fmt
- harden security, fix metrics port, add terminationGracePeriodSeconds
- flatten containmentChamber wrapper from values.yaml
- wire fork_schema and signing request oneOf into spec
- add servers field and clean handler summaries
- correct signing_auth format in README and remove stale screenshots
- remove handler doc leaks and orphaned schemas
- remove incorrect .trim() from base64 Authorization header decode
- preserve error chain in From implementations
- add 5s timeout to health check handler
- sanitize error responses + standardize JSON format
- upgrade OTLP failure log from warn to error
- update classic dashboard metric names to containment_ prefix and add missing panels
- update kubernetes dashboard metric names to containment_ prefix and add missing panels
- use correct error variant for semaphore closure and missing config
- add debug logging to noop backend
- validate stored GVR length in Postgres and name advisory lock constants
- make SQLite permission failure fatal and validate stored GVR length
- add jitter to DynamoDB GVR retry backoff
- validate stored GVR length in Postgres and name advisory lock constants
- validate allowed/denied operations mutual exclusivity and document CLI flag semantics
- convert list_yaml_files to sync and follow symlinks
- use NonZeroUsize for concurrency fields to prevent zero-value bugs
- make TokenHash pub(crate) to satisfy clippy visibility lint
- update test to reflect PubkeyHex accepting pubkeys without 0x prefix
- replace string-based ConditionalCheckFailed detection with SDK error types
- make create_isolated_table idempotent for re-runs (#22)
- harden DynamoDB backend against data corruption and non-atomic reads (#24)
- comprehensive security remediation (#28)
- flaky test
- remove cache and deadcode
- remove dead code
- remove more dead code
- better postgres URL parsing
- exhaustive match
- hash comparison
- flaky test
- better error chain on AWS SDK
- better logging
- make dynamodb reload more efficient
- decrease startup delay
- add warning when no backup encryptor
- dashboard should not sum
- aggregate and proof based on lighthouse types
- update lighthouse to v8.1.2 (#48)
- action for crane
- conditional cpu flag for different arch
- add hmac and sha2, move rand to dependencies
- use nightly rustfmt in fmt and ci recipes
- add cargo-deny supply chain audit job
- simplify and align workflows with justfile (#16)
- add doc comments and #[must_use] to public functions
- scaffold Astro Starlight documentation site
- add website project foundation
- add Docker and nginx preview server
- add site assets, styles and content config
- migrate existing documentation to Starlight
- add getting started guides
- add feature guides, configuration reference and deployment guides
- add dormant GitHub Pages workflow and update README
- add hierarchical AGENTS.md knowledge base
- fix outdated recipe names, CLI flags, and config format
- remove developer-only pages from documentation site
- clean Rust-specific language and fix accuracy issues in operator pages
- add operator guides for key formats, security, troubleshooting, upgrade, and validator clients
- remove signing behavior matrix, add metrics reference, unify deployment section, fix Helm values
- add advisory lock safety comment and sign() architecture note
- update metric references to containment_ prefix
- update AppState references to remove stale generic parameter
- documentation overhaul — restructure, fix, and automate (#39)
- refactor pg errors
- aurora tls
- aurora tls
- aurora tls
- add force_ipv4 flag to gate IPv4 DNS resolution
- add truncate_pubkey utility and Key Manager API startup log
- add auth rejection logging
- add DynamoDB anti-slashing init logging
- verify antislashing backend health and fix test
- comprehensive metrics audit — new metrics, operation labels, backend instrumentation, build info
- add classic Grafana dashboard with instance selector
- add Kubernetes Grafana dashboard with namespace/pod selectors
- prepare release
- prepare release
- prepare release
- prepare release
- prepare release
- prepare release
- add unauthenticated_policy and update keystore import return type
- signing auth hardening — HMAC hashing, unauthenticated_policy, validation, and exhaustive matrix tests
- remove multi protocol support
- refactor to use ahash
- security review
- security review
- add utoipa dependency and gen-openapi bin target
- add ToSchema derives to project-owned types
- add manual schemas for external Lighthouse types
- annotate HTTP handlers with utoipa::path
- add ApiDoc and gen-openapi binary
- add gen-openapi justfile recipe
- add Scalar API reference page to docs site
- remove hand-written API reference, update links
- add named variant schemas with discriminator mapping and examples
- add custom histogram buckets for signing + antislashing
- add W3C Trace Context propagator + extraction middleware
- add containment_keys_load_errors gauge for startup failures
- add metrics and update dashboard
- small fixes
- small fixes
- use zeroize string for auth token
- add HexSignature type safety
- create PubkeyHex newtype and update KeyStore key type
- update EthereumSigner to use PubkeyHex
- update HTTP layer to use PubkeyHex
- complete PubkeyHex newtype integration across all call sites
- add new tests
- add new tests
- update cargo
- DynamoDB + KMS key management with Shamir secret sharing (#20)
- upgrade DynamoDB backend to Hybrid mode (#23)
- various fixes (#27)
- make
--network flag functional (Eth2Network enum, GVR guard, network-aware keygen) (#30)
- unified auth policy engine with scope-based access control (#31)
- release readiness — config defaults, API redesign, AWS docs, Helm docs (#32)
- chamber API redesign — State+FromRef, /chamber/keys namespace, KeySource, writable config (#33)
- enhance config parsing
- rework tracelayer
- simplify policy handling
- test auth fallback
- more tests
- more sensible and safe defaults
- holistic Prometheus metrics overhaul — label-based unification + full error path coverage (#37)
- add more integration tests
- cleanup test
- cleanup test
- cleanup test
- update chart netpol
- better response format for import
- update grafana dashboard
- rework dynamodb antislashing logic
- rework dynamodb antislashing logic
- update logging config
- website visual overhaul + docs restructure (#44)
- Chamber API superset — KeySource::Memory, KeyStatus, type unification, PATCH endpoint (#45)
- add cors support
- align naming across the project (#47)
- add reproducible build (#50)
- eliminate double-allocation in signature hex encoding
- eliminate double-allocation in signature hex encoding
- cache list_keys result to avoid per-request DashMap iteration
- replace RwLock cache with ArcSwap for lock-free list_keys reads
- skip cache rebuild during bulk key loading, rebuild once at end
- borrow static slashing protection instead of cloning
- use into_iter() instead of iter().clone() in import handler
- remove unnecessary PublicKey clone in keygen deposit data
- audit log messages, levels, and pubkey truncation
- revert pubkey truncation and delete utility
- rename sign_owned to sign
- remove dead Deposit variant and unused PublicKeyBytes import
- rename project from vortessence/remote-signer-rs to containment-chamber
- remove AppState
generic, use concrete Arc
- merge KeyStore dual DashMaps into single map
- eliminate provider clone, deduplicate subscriber init, improve OTLP error message
- extract helper functions to reduce main() complexity
- remove unused AntiSlashing trait and NoopAntiSlashing
- introduce TokenHash newtype for HMAC policy map keys
- remove phantom EthSpec generic from SigningRequestOwned
- replace SlashingViolation(String) with typed SlashingViolationType enum
- encapsulate hex encoding in HexSignature::from_bytes()
- split DynamoDbUnavailable into specific error variants
- move EncryptedBlsSk to keys.rs as private implementation detail
- replace DynRecipient trait object with concrete x25519::Recipient
- add Display impl for ValidatorStatus, remove status_to_str()
- use NonZeroUsize/NonZeroU64 for config fields that must be positive
- replace stringly-typed import status with ImportStatus enum
- use anyhow::Context instead of anyhow::anyhow! in backup.rs
- code cleanup — design pattern consolidation & deduplication (#25)
- migrate CLI to Figment Provider pattern with 37 structured flags (#29)
- standardize on ahash::AHashSet across codebase for consistency (#34)
- standardize error handling on thiserror across library code (#35)
- idiomatic Rust quality improvements (#36)
- idiomatic repository structure cleanup (#38)
- post-Chamber API code quality cleanup (#46)
- add error-path loading tests
- add HTTP-level slashing edge case tests
- add graceful shutdown drain test
- update sign tests to reflect PubkeyHex format validation (400 vs 404)
- replace committed keystore fixtures with runtime generation (#17)
- improve test coverage from 79% to 82% (#21)
- add backpressure and load shedding integration tests (#26)
- add isolated BLS, concurrent, and scaling benchmarks
- zeroize imported keystore passwords
- zeroize Key Manager API token in memory
- sanitize import error messages in API responses
- zeroize FileRaw private_key field
- fix zizmor findings (#41)
- rename chart to vortessence and restructure values
- adapt templates for vortessence binary
- remove migration hook, update README, finalize chart
- Vortessence v0.1.0-rc.0 — Ethereum remote signer
- initial release
- fix naming in logs
- initial release
