The Quantus runtime accepts only ML-DSA signatures. qapi offered every signer
polkahub knows, and none of those could sign here:
- Polkadot Vault, Ledger and WalletConnect produce sr25519, ed25519 or ecdsa
signatures (and WalletConnect was configured only for Polkadot, Kusama and
Paseo);
- the external multisig signer hands signing to multisig.usepapi.app;
- the browser-extension list offered polkadot{.js}, Nova, Talisman,
SubWallet, PolkaGate and Fearless.
These providers, their management buttons, and the Vault and multisig modals
are removed. What remains: browser extensions, read-only (watch) addresses,
and proxies, which sign through whichever signer they wrap.
@polkahub/pjs-wallet is patched (pinned to 0.9.1, like the substrate-bindings
patches) so the extension list is blackbeard alone, with its sigil as the
logo. Its provider only ever sees, offers or connects blackbeard: anything
else injected into window.injectedWeb3 is ignored, not merely unlabelled.
Verified against a local build in Firefox with blackbeard installed. The
Account Providers panel shows blackbeard (with the sigil), Address and Proxy,
and nothing else, including after fake polkadot-js and talisman entries were
injected into the page and the provider's 2 s re-scan had run.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
The Quantus browser wallet now injects itself as `blackbeard` instead of
`polkadot-js` (quantus/extension#15), so it no longer collides with the real
polkadot{.js} extension. qapi already found it by enumeration; this gives it
a label in the extension list instead of the raw key.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
Diagnosed. It is not the Quantus header layout and it is not the header patch —
it is a missing null check in papi, surfacing through three layers of minified
code.
`archive.header$` in @polkadot-api/observable-client is
const header$ = (blockHash) => rawHeader$(blockHash).pipe(map(blockHeader[1]))
with no guard, and `archive_v1_header` answers `{"result": null}` for any hash
the node does not know — a normal answer, not a fault. scale-ts then reaches
`new DataView(null)`. V8 words that "First argument to DataView constructor must
be an ArrayBuffer"; Firefox words the identical error "e is not an object",
which mentions neither blocks nor headers nor the node.
The trigger is a chain switch. The block list still holds the previous chain's
hashes, every one is fetched from the new client, chainHead reports them
unpinned, and the archive returns null for each — hence a burst of identical
errors, one per listed block, milliseconds apart, then silence. Harmless: the
list refreshes a moment later. It just said nothing a reader could act on.
Reproduced deliberately (switch Quantus -> Heisenberg -> Quantus) rather than
waiting for it, and confirmed in the browser before and after:
before fetch header failed TypeError: e is not an object
after fetch header failed Error: no block header: the node does not know this block
The null check lives in the patched decoder because that is the narrowest place
we control that sees the value. The real fix belongs upstream in
observable-client, where `header$` should not map a null result through a codec
at all.
Refs #4
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
**Fork with Chopsticks / Forklift is gone.** Neither can fork a chain in this
list. Chopsticks is built on `@polkadot/types`, which cannot decode a Quantus
block at all — it caps fixed arrays at 2048 bytes where ML-DSA signatures are
5261 and 7219, reads the extrinsic preamble byte as a version, and knows nothing
of this chain's header layout. Forklift resolves its own unpatched copy of
`@polkadot-api/substrate-bindings`, so it hits the very header bug this console
patches around.
So the two buttons offered things that could only fail, and fail without saying
why. Removed rather than disabled: a greyed-out control still asks the reader to
work out why. `forkMethod` stays in SelectedChain because the hash params and
chain.state still read it; nothing in the UI can now set it to anything but
"none", so the two light-client guards that reset it go with it.
**The workflow step called "the patch is applied"** — an assertion sitting in a
list of imperatives (install, build, ship the bundle), reading like a claim CI
was making rather than a thing it was doing. Now "verify the signers-common
patch".
Verified in a browser: the switcher shows Quantus, Heisenberg, Planck and
Localhost with both endpoints per chain and no FORK WITH row, and the explorer
still runs — Finalized 54,153, Best 54,253.
Refs #3
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
**Every known endpoint per chain.** Each Quantus network listed only one RPC, so
the CONNECTION panel offered a single choice and a node going down took the
console with it. All of these were probed and answer `system_chain` today:
Quantus QTC wss://rpc1-mainnet.quantus.com wss://rpc2-mainnet.quantus.com
Heisenberg HEI wss://a1-heisenberg.quantus.cat wss://a2-heisenberg.quantus.cat
Planck PLK wss://a1-planck.quantus.cat wss://a2-planck.quantus.cat
rpc3/rpc4, a3, a4 and the b* names do not resolve, so they are not listed.
Planck's PLK symbol is from the node rather than assumed — it was a guess in the
first version of this file.
**Polkadot, Kusama, Paseo and Westend are gone**, with their parachains. Every
one signs with sr25519, ed25519 or ecdsa — discrete-log schemes Shor's algorithm
breaks together — so none has a quantum-safe account type to offer, and this
console could not sign for them anyway. Offering them made it look like a
general-purpose Substrate tool that happens to include Quantus, which is the
wrong way round.
I had kept them deliberately as a control, on the argument that a signature
working on both proves the signers-common patch widened a check rather than
broke one. That argument does not need them in the UI: the header codec's
Substrate layout still has a test against a real Polkadot header, and Localhost
and Custom can still point anywhere, so the round-trip disambiguation has to
keep working regardless.
Verified in a browser against the real chains, not by inspection: the switcher
lists Quantus, Heisenberg, Planck, Localhost and nothing else; selecting Quantus
offers rpc1 and rpc2, Heisenberg offers a1 and a2; and the explorer shows live
mainnet data — Finalized 53,999, Best 54,099.
Refs #3
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
The console rendered nothing against Quantus and I had reported tier 3 as
working on the strength of a unit-level test. It was not working. This is the
fault.
`qp_header::Header` is not `sp_runtime::generic::Header`. `number` is a plain
u32 where Substrate writes a Compact, and a `zk_tree_root: H256` sits between
`extrinsics_root` and `digest` — deliberately, so the ZK root has a fixed offset
in the header preimage that miners cannot shift by manipulating the digest.
Reading a Quantus header as a Substrate one consumes 2 bytes where 4 were
written. Every field after shifts, and the digest vector eventually reads a byte
that is not a known DigestItem index, which surfaces three layers away as
`TypeError: innerDecoder is not a function`. papi retried the subfollow forever,
`runtime$` never emitted, and the page stayed blank.
The patched codec carries both layouts and picks by **round trip**: a layout is
right only if decoding and re-encoding reproduces the input byte for byte, which
also catches a short read, trailing bytes and a non-canonical compact. Trying
them in a fixed order and taking the first that survives is deterministic;
choosing by inspecting a byte would not be.
Pinned per version rather than by bare package name, unlike the signers-common
patch: four copies of substrate-bindings resolve in this tree and blockHeader.js
is not identical across majors — a bare-name key fails the whole install trying
to patch 0.19.0 and 0.6.0.
Two things this cost, both recorded because they are the kind that recur:
- My first attempt replaced the codec with a bare [enc, dec] pair, which
dropped scale-ts's `inner`. This console's own block.state.ts does
`blockHeader.inner.digests.inner`, so that module threw while evaluating,
`createRoot().render()` never ran, and the page was blank with nothing in
the UI — the same symptom as the bug, from the opposite cause. The patch now
copies the original codec and overrides only the decoder.
- The Poseidon block hash is NOT a second blocker, which I had claimed on #1
and #4 without checking. `getHasherFromHeader` returns a function that
throws rather than throwing, and only the extrinsic Analyzer page consumes
`hasher$`. Everything else works without it.
Verified in a browser this time, not by unit test: against mainnet the console
renders live data — Finalized 53,989, Best 54,089, block time — advancing, and
matching what the node reports. Polkadot still decodes through the same patched
codec, and garbage is refused rather than mis-read.
Residual: four "fetch header failed TypeError: e is not an object" on first load,
from the per-block detail fetch, not recurring since. Not diagnosed.
Refs #1, #4
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
The deployed page was a bare black screen for minutes with nothing but the tab
spinner to suggest it was not simply broken. Two separate faults.
**No fallback.** `main.tsx` wraps the whole app in
`<Subscribe source$={merge(dynamicBuilder$, …)}>`, and Subscribe's `fallback`
defaults to null — "it will render null until the subscription exists".
`dynamicBuilder$` does not emit until a chain has been followed and its metadata
decoded, so until then the document body is empty. On a slow connection that is
seconds of nothing; on a chain the console cannot read it is forever, and a
visitor cannot tell the two apart. There is now a splash naming the chain and
the endpoint, which escalates at 8s and again at 25s and tells the reader how to
force a different network.
**The default endpoint was the light client.** `defaultSelectedChain` used
LIGHT_CLIENT_ENDPOINT unconditionally, which routes through smoldot — and
smoldot needs a chain spec. The Quantus networks have none
(`hasChainSpecs: false`), so the default asked it to follow a chain it had never
heard of. It now picks AUTO_RPC for any network without chain specs, which is
what the endpoints in quantus.json are for.
This does not make the console work against Quantus. It makes it explain itself
while failing, which it could not do before — the remaining fault is much
deeper and is written up on #1.
Refs #1, #3
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
The first run of this workflow failed before it did anything:
pnpm: error while loading shared libraries: libatomic.so.1:
cannot open shared object file: No such file or directory
##[error]Process completed with exit code 127.
`@pnpm/exe` is a native binary and the fedora-4x runner images lack libatomic,
so the pnpm they advertise (gitea-runners.md §4) cannot run at all.
`runner-rust` is built on `runner-fedora-44` and adds gcc, musl-gcc and cmake,
which pull libatomic in as a side effect — which is why blackbeard.observer has
been building its SPA there without hitting this.
A workaround, not the fix. The fix is libatomic in the fedora-4x Containerfiles,
per gitea-runners.md §5 — bake build dependencies into the image, not the
workflow — and this should move back when that lands: a 4 CPU / 4 GiB image to
run `vite build` is more than this needs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
oolon is a shared edge proxy. blackbeard.observer and others already grant
gitea_ci `/usr/bin/rsync` into their own webroots, so checking for the bare
command path passed on somebody else's grant — and the deploy would then fail at
the rsync, halfway, having already been told everything was fine.
The grants are destination-qualified in script/infra-setup.sh for exactly this
reason; the check now matches them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
The console is now **qapi console**, served at https://qapi.blackbeard.observer.
The papi logo and the upstream licence stay: this is a fork of
polkadot-api/papi-console, not a rewrite, and the sidebar link points at our
fork rather than theirs.
Deployment follows architecture/deployment-gitea-actions.md — the workflow is
the source of infra truth, and one-time host provisioning is an operator script:
script/infra-setup.sh dns -> the Cloudflare CNAME to bl.thgttg.com
cert -> Let's Encrypt, DNS-01, ECDSA
edge -> gitea_ci, scoped sudoers, webroot, vhosts
.gitea/workflows/deploy.yaml build (pnpm) -> rsync the bundle -> reload
The roles run in that order because certbot uses a DNS-01 challenge and nginx
fails its config test on a missing ssl_certificate — which would block every
reload on a SHARED proxy, not just this vhost. The same reasoning bounds what CI
may do: the sudoers drop-in grants rsync into one webroot, restorecon on it,
a config test and a reload. No certbot, no /etc/letsencrypt, no sites-available
write, no useradd.
Two vhosts, per architecture/reverse-proxies.md: the public one on the https
tier at 127.0.0.1:14443 behind the stream SNI router that owns TCP 443 (binding
443 directly is undetectable by `nginx -t` and ends with nginx silently serving
stale certificates), and a qapi.internal one for mesh clients, which stays
disabled until someone mints its internal certificate.
There is no application host and no upstream: the console is a static SPA that
opens WebSockets straight from the browser to the chains' own RPC endpoints.
The build gate is `pnpm build` (tsc -b + vite build) plus a check that the
signers-common patch is applied to the copy node actually resolves. Without that
patch every signing attempt dies with `Unkown signer` in a browser, after
deploy, in front of a user — and a lockfile drift is all it would take.
`pnpm lint` is deliberately not in the gate: it is broken upstream and was
before this fork touched anything (typescript-eslint 8.69 refuses to load
against the TypeScript 7.0 this repo resolves).
Live and verified: the public name answers 200 with this console's title over
the WAN address, serving the Let's Encrypt certificate for it, and the whole
deploy path — rsync as gitea_ci through the scoped sudoers, restorecon, config
test, reload, fetch — has been run by hand end to end.
Refs #3
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
## The check that fired before code that would have worked
`getSignerType` pulls the extrinsic's `Address` and `Signature` types **out of
the metadata** — the runtime-as-oracle approach, and better than polkadot-js,
which hardcodes `ExtrinsicSignature: 'MultiSignature'` in a type definition file.
Then it threw the answer away:
if (signature.type !== "enum" || ["Ecdsa", "Ed25519", "Sr25519"].some(...))
throw unkownSignerType();
Quantus's `DilithiumSignatureScheme` carries `Dilithium87` and `Dilithium65`, so
this raised `Unkown signer` and nothing downstream ever ran. Asking the runtime
and then not believing it is the trap this whole port exists to avoid.
Everything past that point was already correct: `createV4Tx` concatenates and
compact-prefixes and never asserts a signature size, and the address prefix is
the `MultiAddress::Id` variant index read from metadata. The name whitelist only
separated the Substrate shape from the Ethereum one, and the Ethereum arm one
line above already decides that structurally. So the patch drops the names and
keeps `signature.type !== "enum"`.
pnpm `patchedDependencies`, keyed on the package name rather than a version, so
it reaches all fifteen resolved copies in the tree — the nested ones under
pjs-signer, ledger-signer, raw-tx-creator and polkadot-api itself are what
actually run.
## Evidence
Byte-for-byte against the quantus/extension#7 tier-1 harness, same call, same
nonce, same signature:
papi assembled 7300 bytes
IDENTICAL to the tier-1 harness
That is the corroboration this repo exists for. polkadot-api shares no code with
the five polkadot-js forks, so until now our stack had only agreed with itself.
Also verified the patch is load-bearing and narrow:
- the unpatched copy still in the store raises `Unkown signer` on the same
inputs, so the check really was the blocker
- Polkadot metadata still takes the Substrate path, and still gets its `01`
variant byte prepended when a caller names a signing type
## Networks
Quantus, Heisenberg and Planck, with the endpoints verified reachable on
2026-09-15, and Quantus as the default. The Substrate networks stay: a signature
that works on both is the only evidence that the patch widened a check rather
than broke one.
Refs #1, #3. Closes quantus/extension#7's cross-tier comparison.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
* feat: fork with forklift
* fix: missing entry input in storage set
* fix: use best number to produce new blocks
* fix empty block table on chain stop
* fix: make network selector highlight the selected chain
* fix: handle case where forklift has all storage diff values
* refactor: break down SubmitTx into separate files
* add validate transaction, start dry run
* add dry run
* fix worker getting stuck after forklift is disposed
* handle rejections in promiseWithTeardown
* fix: show error on invalid transactions
* fix: leave nonce unset if not changed by the user
Co-authored-by: Carlo Sala <carlosalag@protonmail.com>
* avoid spamming nonce requests
---------
Co-authored-by: Carlo Sala <carlosalag@protonmail.com>
* playground
* playground tx and weights
* vibe UI
* chart improvements
* wip fix ai slop
* wip fix ai slop
* fix ai slop on charts
* subscribe to main state
* show blocks in chronological order, fix performance issue on startup
* update node health
* add connected peers chart
* fix unused locals
* integrate teleport with paraspell
* add some style
* finish up styles
* format token decimals, token input component
* fill in genesis to paraspell map
* add link to paraspell, fix invalid address on destination chain check
* codesplit teleport page
* add button to setup wallet
* chore: update dependencies
* add hash params state
* remove console logs, remove support for negative values in token input
* relayout extrinsics
* feat: extrinsics submit panel
* restyle submit, scroll to submit on small screens
* disable sign&submit buttons when no signer is selected
