All 17 repos mapped · 01_iota_deep_research/IOTA_COMPONENT_MAP.md

IOTA Ecosystem Component / Architecture Map

Generated 2026-09-06 from shallow clones in repos/. Last-commit dates reflect the local clones; "archived" means upstream repository is deprecated/read-only per its README or commit history.

repos/iota — the current core node (IOTA Rebased)

Purpose: The Rebased-generation IOTA L1 node and full protocol stack: a Rust, object-centric, Move-based distributed ledger derived from Mysten Labs' Sui, run by validator consensus and exposed through JSON-RPC/gRPC/GraphQL.

Language + license: Rust (workspace of 104 crates under crates/, plus iota-execution/ and vendored external-crates/move/). Apache-2.0 (LICENSE, individual crates also declare license = "Apache-2.0").

Last commit: 2026-09-04 (refactor(typed-store): make the lower bound of prefix scans exclusive-capable #12831) — very active, daily commits. Not archived; this is the flagship repo.

Sui lineage — confirmed

The fork status is unambiguous:

• File headers throughout the tree read: // Copyright (c) 2021, Facebook, Inc. and its affiliates / // Copyright (c) Mysten Labs, Inc. / // Modifications Copyright (c) 2024 IOTA Stiftung. A bounded search found 2,023 files under crates/ carrying "Mysten Labs" copyright.
• Root Cargo.toml pulls Mysten dependencies by git rev: anemo, anemo-tower, fastcrypto, fastcrypto-vdf, fastcrypto-zkp from github.com/mystenlabs/... / github.com/MystenLabs/fastcrypto.
• external-crates/move/ is the complete Mysten Move language monorepo (move-vm-runtime, move-compiler, move-prover, move-bytecode-verifier, move-cli, ~60 crates) vendored into the workspace.
• The README describes IOTA as "an asset-oriented programming model powered by the Move programming language" — the same framing Sui uses.
• docs/ (a Docusaurus site) still contains Sui-derived pages and tokenomics diagrams referencing Sui.
• Even the deepbook repo in this folder points at docs.sui.io for documentation.

Main crates (grouped)

Node & execution | Crate | Role | |---|---| | iota-node | The validator binary (entry point for running consensus + execution) | | iota-core | Validator/authority logic: transaction ordering, execution driver, epoch state (authority_per_epoch_store.rs), gas price feedback, consensus adapters | | iota-execution | Execution layer glue; latest/iota-adapter, latest/iota-move-natives, latest/iota-verifier — the adapter between the chain and the Move VM (mirrors Sui's sui-adapter) | | iota-vm-sdk | "Local IOTA Move VM SDK: execute transactions against the node's Move VM and analyze the results, offline" | | iota-types | Core types: objects, transactions, effects, gas model (gas_model/), coin_manager, auth_context | | starfish/* | Consensus (see below) | | iota-authority-aggregation | BFT signature aggregation across validators | | typed-store / typed-store-derive | RocksDB wrapper layer (from Sui) | | iota-snapshot, iota-kvstore, iota-node-storage, iota-rest-kv | State snapshots and storage APIs |

Move framework & smart contracts | Crate | Role | |---|---| | iota-framework | The Move standard library + system packages: sources/ contains coin.move, balance.move, pay.move, kiosk/, timelock.move, deny_list.move, authenticator_state.move, zksync/crypto/, plus three sibling packages: iota-system, move-stdlib, stardust | | iota-framework/packages/iota-system | The on-chain system state: iota_system.move, genesis.move, staking_pool.move, storage_fund.move, timelocked_staking.move, validator.move, validator_set.move, voting_power.move, validator_cap.move — the staking/gas/validator contract suite (Sui's sui_system analogue) | | iota-framework/packages/stardust | IOTA-specific: UTXO-emulation Move modules — alias/, basic/, nft/, unlock_condition/ — implementing Stardust ledger semantics (aliased addresses, storage-deposit-return unlock conditions, timelocks, expiry) so the old UTXO ledger migrates onto the object model | | iota-move, iota-move-build, iota-move-lsp, iota-package-management | Move toolchain: build/publish, language server, package manager |

Consensus — Starfish (not Mysticeti)

The consensus lives in crates/starfish/ with sub-crates starfish/core, starfish/config, starfish/simtests, starfish/dag-visualizer-proto. starfish-core is a full DAG-based BFT consensus engine; its src/ includes dag_state.rs, block_header.rs, block_manager/, block_verifier.rs, leader_schedule.rs, commit_syncer/, commit_vote_monitor.rs, commit_solidifier.rs, block_rate_limiter.rs, header_synchronizer.rs, and cordial_knowledge.rs. Starfish is IOTA's own consensus — a descendant/rework of Sui's Mysticeti (Mysticeti is still referenced in comments in iota-core and in iota-protocol-config, e.g. "at 256 by Starfish" notes replacing earlier Mysticeti parameters). In other words: Sui shipped Mysticeti; IOTA forked it, then evolved the consensus into Starfish with its own leader scheduling, block-rate limiting/garbage-collection rules, and commit-sync machinery.

APIs / indexing - iota-json-rpc, iota-json-rpc-api, iota-json-rpc-types — the Sui-compatible JSON-RPC surface - iota-graphql-rpc (+ -client, -headers, -config) — GraphQL API - iota-grpc-server — gRPC endpoint incl. a transaction execution/simulation service - iota-indexer (+ iota-indexer-builder, iota-indexer-streaming, iota-analytics-indexer) — Postgres-backed indexer and analytics - iota-data-ingestion / iota-data-ingestion-core — checkpoint ingestion pipeline - iota-light-client — trust-minimized state verification - iota-rest-kv, iota-proxy — auxiliary REST/KV services

Wallet/keys & network utilities - iota-sdk, iota-rust-sdk, iota-keys, iota-ledger-signer, iota-transaction-builder, iota-transaction-checks — client-side SDK pieces living in-tree - iota-network, iota-network-stack, iota-tls, iota-multiaddr — P2P networking - iota-traffic-controller — "Rate limiting and IP blocking for the IOTA node RPC endpoints"

IOTA-specific differentiator crates (things vanilla Sui does not have): - iota-names — IOTA Names service (SuiNS analogue; registry.rs/name.rs; also a Name subcommand in the CLI) - iota-mainnet-unlocks — "loading and querying token unlock data over time" — implements IOTA's vesting/unlock schedule for migrated (pre-Rebased) funds - iota-genesis-builder + iota-genesis-common — genesis tooling including the Stardust migration path (migration.blob is referenced in iota-config) - stardust Move package (above) - starfish consensus (above) - simulacrum / simulacrum-server — synthetic-chain simulation - iota-faucet — built-in gas faucet service

EVM support — NOT in this repo

There is no EVM implementation in repos/iota. All evm grep hits are false positives (substrings of DisableVmChecks, MoveVM). IOTA's EVM product is a separate chain/tech line; within the ISC world EVM appears as an emulator module in wasp (see below). If you want EVM on a fork of this repo you'd either run wasp-style EVM emulation on an L2 or port an EVM adapter yourself.

Token / coin system

• crates/iota-framework/sources/coin.move + iota.move define the native IOTA coin (gas coin), mirroring SUI's coin but with IOTA supply (4.5B max, Stardust-migrated).
• iota-system: storage_fund.move implements the storage fund with rebates (object storage paid upfront, partially refundable), staking_pool.move implements delegated proof-of-stake with voting_power.move, validator.move, timelocked_staking.move for staking locked funds.
• Gas model in iota-types/src/gas_model/ (gas_v1.rs, gas_predicates.rs, units_types.rs) — computation-gas + storage-gas duality inherited from Sui.
• Mana: IOTA's proposed return-to-tokenomics concept does not appear as implemented protocol code in this tree (no mana module in iota-types or protocol config); it remains a documented future direction. Don't assume mana exists in the fork.

Running a private / own network

Fully supported, three tiers:

1. One-command local network: crates/iota-localnet — documented in docs/content/developer/getting-started/local-network.mdx: - iota-localnet start --force-regenesis --with-faucet (ephemeral, throwaway wallet auto-funded) - iota-localnet start --network.config persisted-localnet --with-faucet --committee-size 2 --epoch-duration-ms 60000 (persistent, configurable committee size and epoch length — i.e. a real multi-validator private net)
2. Docker: docker/ contains Dockerfiles for iota-node, iota-localnet, iota-indexer, iota-graphql-rpc, iota-faucet, iota-data-ingestion, iota-proxy, iota-rest-kv, iota-tools — compose them into a private deployment.
3. Custom genesis: crates/iota-genesis-builder builds a genesis.blob (with validator set, allocations, and optionally a Stardust migration.blob); crates/iota-swarm provides in-memory swarms for testing.

The iota CLI binary itself is client-side (keytool, client, validator, move, name); node operation is iota-node + genesis tooling + iota-localnet.

Maturity: Production. Runs IOTA mainnet since Rebased launch (2024→2026), industrial-grade test coverage (e2e, transactional tests, fuzzing, simulacrum), 100+ crates, daily activity. Heaviest codebase in the folder by far.

repos/iota-sdk

Purpose: The (now deprecated) unified SDK monorepo for the Stardust/chrysalis generation: Rust core (client, wallet, types, POW) with Node.js/Python/WASM bindings and a CLI.

Language + license: Rust + TypeScript + Python + C bindings. Apache-2.0 (per-crate LICENSE files and npm license fields).

Last commit: 2025-05-22, chore: add deprecation warning. Deprecated: README states the repo "has been deprecated since IOTA Rebased went live on Mainnet" — the new SDK lives inside repos/iota (crates/iota-sdk, crates/iota-rust-sdk).

Key modules: sdk/src/client (high-level node client), sdk/src/wallet (account/balance/transaction wallet engine — successor of wallet.rs), sdk/src/types (Stardust block/output/payload types), sdk/src/pow (PoW for block issuance), bindings/nodejs, bindings/python, bindings/wasm, cli/ (wallet CLI).

Maturity: Frozen/deprecated. Still useful for Stardust-era tooling; do not build anything new on it.

repos/wasp — ISC smart-contract chains (Go)

Purpose: Node software for IOTA Smart Contracts (ISC) — L2 chains whose state transitions (anchor blocks) are posted to the L1 Tangle/Ledger, executing both Wasm and EVM/Solidity contracts.

Language + license: Go 1.24 (module github.com/iotaledger/wasp/v2). Apache-2.0.

Last commit: 2026-03-31 (Fixed consensusDelay config not working #804) — active/maintained, niche.

Key packages (packages/): - chain/ — the chain engine: committee consensus over block proposals, plus statemanager/ — batching state blocks and anchoring them to L1 (state manager posts L1 alias-output state transitions) - nodeconn/ (nodeconn.go, chain.go) — the L1 connection layer: watches the L1 chain for chain-alias outputs and milestones, submits anchors - vm/ — contract VM: sandbox/, execution/, gas/, processors/, viewcontext/ (Wasm contract sandbox with gas metering) - vm/core/ — core contracts: root, accounts, governance, blocklog, evm (the EVM emulator as a core contract), migrations - evm/ — EVM support stack: jsonrpc/ (an Ethereum JSON-RPC endpoint for the wasp chain), solidity/ tooling, evmtypes, evmerrors — i.e. EVM-as-a-module inside an ISC chain, not a bespoke chain - dkg/ — distributed key generation for committee-controlled L1 funds - peering/, webapi/, apilib/, solo/ (single-node test harness), origin/, transaction/, trie/ (state commitment Merkle trie)

How anchoring works: each L2 state block is committed by the committee, then the chain's state root/evidence is posted to the L1 chain via its alias output (managed by nodeconn + statemanager); DKG'd committee keys control the L1 output. Finality of L2 = L1 inclusion + committee agreement.

Maturity: Production-adjacent but for the old L1 (IOTA Stardust/SMP). Works against the current L1 via bridge layers; if you fork Rebased, wasp is the reference for ISC/EVM-emulation patterns rather than a drop-in L2.

repos/identity.rs — DID / verifiable credentials

Purpose: The IOTA Identity framework: W3C Decentralized Identifiers (DIDs) and Verifiable Credentials implemented in Rust, anchored on the IOTA ledger.

Language + license: Rust (14+ identity_* crates) + WASM bindings. Apache-2.0.

Last commit: 2026-08-20 (changelog and versions #1851) — active.

Key crates: identity_core (foundation: JSON-LD, crypto primitives), identity_credential (VC data model), identity_did / identity_document (DID core), identity_iota / identity_iota_core (IOTA-specific DID method, ledger anchoring), identity_storage, identity_stronghold (vault-backed storage), identity_resolver, identity_jose (JWT/JWS), verifier crates incl. identity_pqc_verifier (post-quantum), bindings/wasm.

Maturity: Production, the flagship IOTA product on top of Rebased (notarization/hierarchies products build on it).

repos/stronghold.rs — encrypted vault

Purpose: Hardened, encrypted secret-storage engine ("Stronghold") — a snapshot-encrypted database with controlled access procedures, designed to hold seeds/keys.

Language + license: Rust (workspace: client, engine/, stm/ (software transactional memory), derive, utils, bindings/). Apache-2.0.

Last commit: 2023-06-29 (docs-removal commit) — low activity / effectively archived; conceptually superseded by the vault work embedded in newer products (identity_stronghold still consumes it).

Key modules: client/ (vault + store API), engine/ (runtime, snapshot encryption, networking "Location" abstractions), stm/ (transactional memory for concurrent procedures), derive/ (procedural macros).

Maturity: Stable but dormant. Battle-tested crypto storage; pinned dependency for identity.

repos/wallet.rs — legacy wallet engine

Purpose: The Stardust-era account/balance wallet library (accounts, outputs, transactions, participation/voting).

Language + license: Rust. Apache-2.0.

Last commit: 2023-08-23, Add deprecation warning (#2001) — archived/deprecated, moved into iota-sdk's wallet module.

Key modules: wallet/src/account_manager* (multi-account handling), storage/ adapters (rocksdb.rs, memory.rs, wasm.rs), participation.rs (governance voting), task/message-interface for FFI.

Maturity: Dead. Historical only.

repos/iota.js

Purpose: TypeScript client for the Chrysalis (pre-Stardust) node API.

Language + license: TypeScript. Apache-2.0 (declared in package.json).

Last commit: 2023-01-19 (dependabot) — archived/legacy.

Key modules: client service layers, strongly-typed API models, WASM-wrapped crypto via bindings. README itself says to prefer iota.rs.

Maturity: Dead. Superseded by iota-sdk's TS bindings and now the in-repo Rebased SDKs.

repos/firefly — wallet UI

Purpose: Firefly — IOTA's main desktop/mobile wallet application (Stardust-era profiles).

Language + license: TypeScript, React, Electron 27 (packages: desktop, shared). Apache-2.0.

Last commit: 2025-06-04 (feat: add new hex address equivalence for mainnet profiles #8717) — maintained through 2025; being superseded by the new Rebased-native wallet but still the shipped UI for legacy profiles.

Key modules: packages/desktop (Electron main + React renderer), packages/shared (core logic, bindings to wallet.rs/iota-sdk via WASM), specs/, i18n via crowdin.

Maturity: Production (legacy generation). Tied to the old wallet stack, not the Rebased SDK.

repos/streams — data channels (archived)

Purpose: Streams/Channels — a cryptographic messaging framework over the Tangle: authenticated, e2e-encrypted channels for publishing/subscribing to data.

Language + license: Rust (workspace: streams/, spongos/). Apache-2.0.

Last commit: 2022-10-31 — archived.

Message types (exact files under streams/src/message/): - announcement.rs — channel creation / author announce (holds the channel ed25519 public key, app instance) - branch_announcement.rs — multi-branch (subtree) announcements - subscription.rs / unsubscription.rs — subscriber requests to obtain channel keys - keyload.rs — key distribution message: encrypts the current message/anchor keys to each subscribed author/subscriber (PreShared + PSK identities) - signed_packet.rs — author-signed public payload packet - tagged_packet.rs — encrypted (or public) payload with a tag, the bulk data carrier - message_types.rs — the enum/registry of the above

The spongos/ crate carries the Spongos wrap/unwrap and (historically ternary) crypto; the later versions here are binary/ed25519-based.

Maturity: Archived; conceptually continued as IOTA Streams (ChaCha/identity-based) then deprecated. Good reference design for keyload-based channels.

repos/bee — legacy Rust node framework

Purpose: A Rust framework for building IOTA nodes/clients for the Chrysalis/nectar generations (pre-Coordinatorless research); was intended as the production node before being abandoned.

Language + license: Rust. Apache-2.0.

Last commit: 2022-10-05 (clippy fixes) — archived.

Key modules: bee-node (chalcedony/nectar node binaries), bee-ledger (UTXO ledger), bee-tangle (the Tangle storage), bee-message/bee-payload (Chrysalis message format), bee-network (autopeering), bee-rest-api, bee-storage (rocksdb/sled backends), bee-crypto.

Maturity: Dead. Superseded first by Hornet (Go) and then irrelevant after Rebased.

repos/goshimmer — legacy research node

Purpose: GoShimmer — prototype IOTA network without the Coordinator: research node implementing coordinatorless consensus (FPC voting, Drng, Mana concepts, autopeering).

Language + license: Go. Apache-2.0.

Last commit: 2023-06-29 — archived (final commits are wiki/documentation removals, i.e. end-of-life).

Key modules: packages/consensus (FPC finality voting), packages/manamodel (the original mana implementation — note: the idea IOTA later proposed for Rebased comes from this research), packages/drng (dRAND), packages/autopeering, packages/messagelayer, packages/utxo, tools/ (integration tests, spammer).

Maturity: Archived research code. The mana/work-score ideas migrated conceptually into later protocols (iota.go here even has workscore.go from that lineage).

repos/entangled — the ORIGINAL C node (ternary)

Purpose: The original IOTA (pre-Chrysalis, ternary) node software in C: ciri (node), cclient (API client), mam (Masked Authenticated Messaging), tanglescope (monitoring), cppclient.

Language + license: C (C11) + C++. Apache-2.0.

Last commit: 2020-02-03 (Update README. (#1475)) — archived.

Ternary code paths (exact files): - common/trinary/add.c / add.h — trit addition - common/trinary/flex_trit.c / flex_trit.h — flexible trit storage/encoding (1/3/4/5-trit-per-byte packing) - common/trinary/ptrit.c / ptrit.h / ptrit_incr.c / ptrit_incr.h — parallel trits (SIMD-balanced ternary words) - common/trinary/tests/* — trit↔byte, ptrit, add tests - common/crypto/curl-p/curl_p.c (+ tests) — Curl-P (81-round ternary sponge hash) - common/crypto/iss/v1/iss_curl.c, iss_kerl.c (+ headers/tests) — ISS signing schemes over Curl and Kerl (ternary Keccak) - common/crypto/iss/v2/iss_curl.c — ISS v2 - mam/ — the ternary MAM protocol implementation - plus common/model/ (transaction models with 267-trit fields) and common/curl-p sibling implementations in cclient//ciri/ paths.

Note on troika: there is no standalone troika clone in repos/ (the separate iotaledger/troika repo was not fetched), but troika is vendored inside entangled: common/crypto/troika/ (troika.c, troika.h — the balanced-ternary hash), alongside common/crypto/ftroika/ (parallel/fast troika variant), common/crypto/kerl/ (ternary Keccak, header references keccak/KeccakHash.h) and common/crypto/sponge/ (the sponge abstraction layer). So the full ternary crypto stack — Curl-P, Kerl, ISS v1/v2, Troika — lives inside entangled's common/crypto/.

Maturity: Dead museum piece. Ternary IOTA ended with Chrysalis (binary, Ed25519, no coordinator dependency).

repos/hive.go

Purpose: Utility library for GoShimmer and Hornet (the production Go node): websockets, serialization, SQL, stringification primitives.

Language + license: Go (multi-module: root + sql/, web/, serializer/, stringify/ sub-modules). Apache-2.0.

Last commit: 2025-10-01 (Merge pull request #663) — still maintained (because Hornet depends on it).

Key modules: web/websockethub/ (WS hub + client), web/basicauth/, subscriptionmanager/, serializer/typeutils/ (binary encoding per IOTA spec), sql/ (DB layer), stringify/.

Maturity: Stable support library; irrelevant to a Rebased fork (Rust world) but live for Hornet.

repos/iota.go

Purpose: Go client library for the Chrysalis node API (wallet-style helpers, also hosts goshimmer-era workscore.go).

Language + license: Go. MIT (MIT License, Copyright (c) 2019 IOTA Stiftung — the one MIT repo in the set).

Last commit: 2024-05-03 — legacy, mostly quiet.

Key modules: node API client, UTXO builder, (legacy) workscore utilities, ed25519 helpers.

Maturity: Legacy/stale.

repos/docs

Purpose: The old IOTA documentation hub (2019-era): docs site sources with assets for Trinity wallet etc.

Language + license: Markdown/Jekyll-ish; no LICENSE file found — treat as unclear.

Last commit: 2019-01-15 — archived/abandoned. All current documentation lives in the Docusaurus site inside repos/iota (docs/site, docs/content) and the IOTA Wiki.

Maturity: Dead. Historical images only.

repos/deepbook — Mysten Labs CLOB DEX

Purpose: DeepBook V3 — Sui-native centralized-limit-order-book (CLOB) DeX, written as Move packages; included here as the reference DeX for the Move-object model that Rebased inherits.

Language + license: Move (packages/) + Rust (crates/: indexer, schema, server) + TypeScript scripts. Apache-2.0.

Last commit: 2026-09-04 (predict: reject mints above maximum payout #1297) — very active.

Key modules: packages/deepbook (core pool/orderbook contracts), packages/deepbook_margin + margin_liquidation + dbtc (margin trading layer), packages/predict (prediction markets — newest), packages/fixed_math, packages/account / deepbook_core_account, crates/indexer|server|schema (Rust indexing stack), scripts/ (TS deployment/upgrade tooling).

Maturity: Production on Sui; its Move code is the natural candidate to port to a Rebased fork (identical Move dialect and object model, module renames aside).

How the pieces fit together

                          ┌─────────────────────────────────────────────┐
                          │                THE IOTA ECOSYSTEM            │
                          └─────────────────────────────────────────────┘

   GENERATION 1 (ternary, 2015–2020)          GENERATION 2 (binary/UTXO, 2021–2024)
   ┌──────────────────────────┐               ┌────────────────────────────────────┐
   │ entangled (C node)       │               │ Hornet/iota.go  ← hive.go (Go libs)│
   │  common/trinary/*        │   Chrysalis   │ bee (Rust node framework)          │
   │  common/crypto/curl-p/*  │  ──────────▶  │ iota.js (TS client)                │
   │  ISS v1/v2, Kerl         │  binary +     │ wallet.rs (Rust wallet)            │
   │  MAM (mam/)              │  ed25519      │ firefly (wallet UI) ──┐            │
   └──────────────────────────┘               │ goshimmer (research:  │            │
                                               │  FPC, mana, drng)     │            │
                                               └───────────┬───────────┼────────────┘
                                                           │           │
                                     Stardust ledger ──────┘           │
                                                           ▼           ▼
   ┌───────────────────────────────────────────────────────────────────────────────┐
   │               GENERATION 3 "Rebased" (object model / Move)                    │
   │                                                                               │
   │   iota (Rust node = Sui fork + IOTA mods)                                     │
   │   ├── starfish consensus (IOTA's Mysticeti descendant)                        │
   │   ├── iota-core + iota-execution + external-crates/move (Move VM)             │
   │   ├── iota-framework: coin/gas + iota-system (staking, storage fund)          │
   │   │                   + stardust pkg (UTXO-emulation/migration layer)         │
   │   ├── APIs: JSON-RPC / gRPC / GraphQL / indexer / faucet / light client       │
   │   ├── iota-names (naming) │ iota-mainnet-unlocks (vesting) │ genesis-builder  │
   │   └── localnet/docker/iota-swarm  ◀── RUN YOUR OWN PRIVATE NETWORK HERE       │
   │              ▲                                                                │
   │              │ anchoring (alias outputs, state blocks via nodeconn)           │
   │   ┌──────────┴───────────┐        ┌──────────────────────────────┐           │
   │   │ wasp (Go, ISC L2)    │        │ identity.rs (DID/VC, WASM)   │           │
   │   │  Wasm contracts (vm/)│        │   └─ stronghold.rs (vault)   │           │
   │   │  EVM emulation +     │        │      (storage backend)       │           │
   │   │  jsonrpc (evm/)      │        └──────────────────────────────┘           │
   │   └──────────────────────┘                                                   │
   │                                                                               │
   │   Clients: crates/iota-sdk + iota-rust-sdk (in-repo)  ◀─ iota-sdk (archived), │
   │   deepbook (Move CLOB DeX, Sui-native → portable)        wallet.rs, iota.js   │
   │   Data channels reference: streams (archived: keyload/tagged-packet design)   │
   └───────────────────────────────────────────────────────────────────────────────┘

   Data flow: clients (SDK/CLI) ──tx──▶ iota-node validators ──▶ starfish DAG consensus
              ──▶ iota-execution (Move VM) ──▶ effects/checkpoints ──▶ indexer/APIs
              wasp L2 chains anchor state blocks to L1 alias outputs via nodeconn;
              identity.rs anchors DID documents as L1 objects; deepbook-style Move
              packages publish onto the same object model.

Layering summary: the protocol is repos/iota alone. Everything else is either (a) client libraries for older generations (bee/goshimmer/iota.js/wallet.rs/iota-sdk legacy), (b) applications on Rebased (identity.rs, names, deepbook-style Move apps), (c) L2 machinery (wasp), or (d) historical architecture references (streams, entangled, troika-absent).

What this means for forking

Licensing (the good news): - Everything that matters is Apache-2.0: iota (node, frameworks, SDK crates), wasp, identity.rs, deepbook, streams, entangled, bee, goshimmer, firefly, hive.go. Apache-2.0 explicitly permits commercial forks, relicensing of derivatives, closed sourcing — you must retain LICENSE/NOTICE and copyright headers (note the headers inside the code: "Copyright (c) Mysten Labs, Inc. / Modifications Copyright (c) 2024 IOTA Stiftung" — keep both, add yours). - Exceptions: iota.go is MIT (trivially permissive); the old docs repo has no license (don't copy from it); also iota carries a separate LICENSE-docs for its documentation subtree — if you reuse their docs, respect that file.

What to keep (the fork core): 1. crates/iota-node, iota-core, starfish/, iota-execution, external-crates/move, iota-types, typed-store — the whole consensus+execution+VM stack. This is a complete, mainnet-proven L1. 2. iota-framework (coin, iota-system, move-stdlib) — required for the chain to function at all. 3. Genesis + localnet tooling: iota-genesis-builder, iota-localnet, iota-swarm, docker/ — this is how you launch your own network (iota-localnet start --force-regenesis --with-faucet, or --committee-size N persisted nets, or docker images per service). 4. APIs: json-rpc, graphql, grpc, indexer — ecosystem compatibility (Sui-derived tooling largely speaks this dialect). 5. If you want EVM: wasp's packages/evm (EVM-as-a-core-contract + jsonrpc/ sidecar) is the proven in-ecosystem pattern; repos/iota itself has no EVM. 6. Optional: deepbook Move packages as a ready DeX; identity.rs if you need DIDs; streams as a design reference for keyload-based messaging.

What to strip for a lean fork (big wins first): - external-crates/move test/lint crates already excluded from the workspace; you can further drop iota-graphql-*, iota-analytics-indexer, iota-light-client, simulacrum*, iota-replay, fuzzers/transaction-fuzzer, dag-visualizer-proto (~30–40 crates) without touching consensus. - All Stardust-migration machinery (stardust Move package, iota-mainnet-unlocks, migration.blob handling in genesis-builder) is IOTA-history-specific — safe to remove for a fresh genesis, but keep it if you need to import existing IOTA funds. - Legacy repos (entangled, bee, goshimmer, iota.js, wallet.rs, old docs, iota-sdk-standalone) contribute nothing to a Rebased fork — reference only.

Watch-outs: - IOTA Rebased is not Sui-identical: consensus is Starfish (not Mysticeti/Pemberville), the system package is iota-system with IOTA parameters, there are IOTA additions (iota-names, unlocks, stardust emulation) — audit iota-protocol-config where Sui/IOTA feature flags diverge. - Mana is not in the code despite tokenomics messaging; gas is the Sui-style two-pool model. - Copyright headers: 2,023+ files carry Mysten Labs copyright; Apache-2.0 §4(c) requires retaining them. Renaming crates (sui_*→iota_* was done systematically) is fine; scrubbing attribution is not.

Per-repo quick table