Wide week — several new fronts opened. A Solana wallet went public, a universal decompiler/compiler shipped its first crates, a molecular-dynamics engine showed up out of nowhere, and the Windows code-signing path was rebuilt in pure Go.

ClawdWallet: TibaneLabs opens up

TibaneLabs is a new org. The flagship is a non-custodial wallet for the Solana Seeker phone, multi-chain (Solana / EVM / Bitcoin), with MPC keys, DEX-aggregator swaps, and a dApp browser. It went open-source this week as TibaneLabs's entry in the Colosseum hackathon, in two pieces.

TibaneApp is the Flutter front end. Build 39 was the "Initial open-source release", then the week added: WatchAsset approval sheet, NFT viewer + token CRUD screens, BTC address-format picker, swap polish (auto-track output token, USD fiat values), staking detail with copyable addresses, About-screen libwallet version surfacing, browser fallback to DuckDuckGo for non-URL bar input, and a UK region gate hiding swap/staking for GB users.

clawdwallet is the agent CLI in Go: TSS-over-Spot, Solana TX building, x402, MCP stdio. Mid-week refactor for "ClawdWallet Stage 1" — agent pairing deep-link, peer JSON tag alignment with the tss-lib protobuf, REST client routed through Crypto/WalletSign:signByPolicy, and a tibane:// URL scheme for the pairing handshake (rendered as a unicode QR in the terminal).

libwallet picked up the supporting APIs alongside: libwallet v0.4.21 → v0.4.32 with Wallet:initiateKeygen + Wallet:joinSign, ClawdWallet:pair (Stage 1 deep-link verification), ClawdWallet:createAgentWallet, Solana SPL auto-discovery via Helius DAS, wltswap improvements (per-provider quote attempts, Jupiter retry on quote failure), a curated contract-label registry, Network.AddressUrl + resolved block-explorer wiring, and maxSendable switching to estimateGas + Amount.MAX sentinel.

univdreams: universal decompiler/compiler

univdreams — "ELF, PE, Mach-O, 6502 round-trip byte-identically through a readable .ud source language" — shipped its first crates.io release this week (v0.1.0, then 0.1.1, 0.1.2, 0.1.3 by Sunday).

The origin is "code that outgrew its container": the emulator and binary-analysis machinery had been growing inside oxideav-vfw and had reached a point where calling it "a Video for Windows shim" had stopped being accurate. The code was excised into its own workspace this week, and oxideav-vfw now depends back on the ud-* crates.

The workspace, after the extraction:

• ud-format — unified PE / ELF / Mach-O / raw front end (with PE parsing the DOS + optional headers into structured fields and rebuilding byte-identically via from_parts).
• ud-translate — compile + decompile (merged from the older ud-compile / ud-decompile).
• arch-x86 — assembler / disassembler with RIP-relative encoding, nop [mem], push imm, indirect call / jmp.
• ud-emulator — pure-Rust i386 + PE + Win32 emulator (the part that used to live inside oxideav-vfw). Codec corpus harness: ICOpen trace probes against real Lagarith / MagicYUV DLLs, ICCompress / ICDecompress driven by ud encode / ud decode. Kernel32 / msvcrt stubs, ordinal-import resolution, FWAIT, an FFI-style Guest layer over Sandbox.
• ud-cli — ud analyze runs a PE32 DLL in the sandbox and reports an instruction budget + JSON analyse report. ud vfw … namespace for the codec probes.

The extraction lets it keep growing without distorting whichever module it happens to live next to, and picks up two non-VfW use cases for free along the way: any PE / ELF / Mach-O binary as a general decompiler target, and the round-trippable .ud source language.

origami: molecular dynamics in Rust

origami showed up this week — replica-exchange molecular dynamics in Rust, with real fold trials on real fixtures.

Headlines from one week of work:

• Chignolin — 1.43 Å Cα RMSD via REMD. Beat every prior fold trial in the project.
• Trp-cage — 3.31 Å Cα RMSD. Best Trp-cage fold the engine has produced.
• Villin — 6.14 Å after 1 ns × 8 replicas; the long run reached 4.25 Å min over 5 ns × 8 replicas.
• Insulin (2HIU) — multichain fold trial wired up with a chain-aware Structure type.
• Crambin (1CRN) — fixture + native-MD acceptance test covering disulfide bonds.

The supporting machinery shipped alongside: Kabsch-Sander DSSP H-bond classification (with a Ramachandran fallback), per-residue secondary structure in origami analyze, agglomerative single-linkage trajectory clustering with one PDB per cluster, SHAKE X-H constraints unlocking dt = 2 fs (2× wall-clock throughput), Verlet neighbour-list caches for the SoA nonbonded kernel and the SASA / GB Born-radius integrals (5.3× on the SASA forces), and rayon-parallel REMD replicas hitting 5-6× core utilisation. RNA support arrived too: a Nucleotide type with per-base atom topology, RNA-aware PDB reader, and a NeRF-extended RNA backbone + ribose chain builder.

This one's personal curiosity. DNA reads to me like machine code, and I've wanted to dig in properly for a long time. Proteins are what it builds — understanding what gets built has to come first if I ever want to be hacking DNA itself.

authenticode + gosigner: pure-Go Windows signing

Two new repos replace the long-standing osslsigncode shellout for signing Windows PE files.

authenticode is the library: pure-Go Authenticode PE signer with SignerInfo attribute parity against osslsigncode, optional-header CheckSum computation, TSA-token nesting under SPC_RFC3161_OBJID, and a fuzz + TSA-stub + sign-matrix test suite on CI.

gosigner is the remote signer: hsm.Key + authenticode glue over Spot, with signreq -name / -url flags to pass SpcSpOpusInfo program name + URL through. The signing daemon stops calling osslsigncode entirely — every byte is produced through crypto.Signer + encoding/asn1.

goro: VM correctness + perf

The VM that landed in W19 spent W20 catching up to PHP's actual edge cases. The week's commits are a mix of new ops, fast paths, and per-bug-number fixes (PHP bug numbers like bug53511, bug26639, bug60598, bug79784) that the regression suite keeps surfacing.

• AST-delegate fallbacks — unknown-callee function calls with writable args, NoDiscard-wrapped statements, indirect calls with writable args, reference assignment ($b = &$a).
• Slot-safety analysis — mark function bodies slot-unsafe when a typed return, an include / require / eval, or class const access is present; detect external slot mutation in arraySetLocal.
• Bug-driven fixes — invoke __destruct on catch-variable rebind (bug53511), allocate a fresh ZVal on local assignment (bug26639), avoid Dup-ing hashtable values inside IterateRaw and during FuncContext.Release (bug60598).
• Fast paths — int-int for OpDiv, OpMod, OpBitAnd/Or/Xor, OpShl, OpShr; bool fast path for OpJmpIf{False,True,FalsePeek}.
• Type checks at boundaries — TypeError on object / array bitwise operands, object / array array-key, non-numeric string-offset key. Numeric-string offset converted to int on string containers. Undefined-variable warning on ++ / -- of unset locals. foreach iterators unwound on multi-level break / continue.

Also this week

• minlz-rs v1.1.0 — finished porting the rest of klauspost/compress/s2's hand-written asm (encodeBlockAsm{8B,10B,12B,4MB}) to Rust; two correctness bugs caught in the port. Honest single-thread Rust-vs-Go bench in the README.
• oxideav-vfw — state surface + forensics through r70. Now consumes ud-emulator from the extracted univdreams workspace (above).
• oxideav-av1, vp9, h264, h266 — encoder rounds continuing.
• oxideav-aac, oxideav-cinepak, oxideav-audio-filter, oxideav-image-filter — incremental.
• oxideav-mov — QuickTime container, new this week.
• oxideav-fbx — Autodesk FBX, joining the 3D-asset siblings from W19.
• oxideav-gif — GIF support landed.

Next week

ClawdWallet's pairing flow goes through the full real-device path; univdreams keeps feeding the VfW codec-decode pipeline; origami points at a harder fold target.