The day-1 pull list from IOTA's repos · 01_iota_deep_research/IOTA_TECH_EXTRACTION.md
QALS / Qalnet build — concrete shopping list. Generated 2026-09-06. Every path below was verified against the shallow clones in repos/ on this date (via directory listing); "unverified" is flagged explicitly where a path is not in our clones and must be fetched upstream.
Use-decision vocabulary: USE-AS-IS (build against it unchanged) · FORK+REBRAND (copy, rename IOTA→QALS/qalnet) · PATTERN (re-implement the design, don't copy code) · REF (read-only reference) · DROP (do not pull).
Blanket license note: everything in repos/ is Apache-2.0 (confirmed in component map + repo LICENSE files) except iota.go (MIT) and docs (no license — dead anyway). Apache-2.0 is fork-friendly: keep NOTICE/attributions, relicense our modifications as we like. Re-check LICENSE in every crate before shipping a public binary.
⚡ DAY-1 PULL LIST — the 10 things we literally copy in week one
| # |
Pull |
From |
Into |
| 1 |
The whole node repo → rename to qalnet |
repos/iota |
new private GitHub repo |
| 2 |
Private-network docker stack |
repos/iota/dev-tools/iota-private-network/ + pg-services-local/ |
qalnet/dev-tools/ (unchanged at first) |
| 3 |
One-command devnet (iota-localnet start --force-regenesis --with-faucet --committee-size 4) |
repos/iota/crates/iota-localnet/ |
used as-is for qalnet-dev-1 |
| 4 |
Genesis builder → mint 4.6B QALS, Fleet validator keys, epoch params |
repos/iota/crates/iota-genesis-builder/ (+ iota-genesis-common/) |
config + a qalnet-genesis script |
| 5 |
Move framework (coin, balance, pay, kiosk, display, transfer_policy) → fork as qal_framework, rename IOTA→QALS, 9-dec "doof" |
repos/iota/crates/iota-framework/packages/ |
qal_framework Move package |
| 6 |
In-tree Rust SDK for qalctl + fleet tooling |
repos/iota/crates/iota-sdk/, iota-rust-sdk/, iota-keys/, iota-transaction-builder/ |
dependency of qalctl |
| 7 |
Indexer + GraphQL + Docker images → explorer/RPC backend on the cloud VM |
repos/iota/crates/iota-indexer/, crates/iota-graphql-rpc/, docker/ |
compose deployment |
| 8 |
Identity stack → Qal ID (agent + human DIDs, VCs, revocation) |
repos/identity.rs (crates identity_iota, identity_storage, identity_stronghold, identity_credential) |
service crate in qalarc infra |
| 9 |
Stronghold vault → agent & wallet key storage |
repos/stronghold.rs (client/, engine/, stm/) |
pinned dependency |
| 10 |
Faucet + RPC hardening for Doofnet/gateway |
repos/iota/crates/iota-faucet/, crates/iota-traffic-controller/, crates/iota-metrics/ |
gateway node deployment |
1. Core node — repos/iota (the fork itself)
Apache-2.0, 104-crate Rust workspace, daily upstream activity (last commit 2026-09-04). Confirmed Sui-lineage (~2,023 files carry Mysten Labs copyright). This is Option B: FORK+REBRAND wholesale.
1.1 Consensus & execution
| Verified path |
What it does |
QALS use |
License |
crates/starfish/core/ |
Starfish DAG-BFT consensus (IOTA's own, evolved from Mysticeti; live on mainnet since Apr 2026; provably liveness-tolerant of slow/home validators — exactly The Fleet's profile) |
USE-AS-IS (part of fork) |
Apache-2.0 |
crates/starfish/config/, simtests/, dag-visualizer-proto/ |
Consensus config, simulation tests, DAG visualiser |
USE-AS-IS; visualiser is great for ops dashboards |
Apache-2.0 |
crates/iota-core/ |
Validator/authority logic: tx ordering, epoch state, consensus adapters |
USE-AS-IS |
Apache-2.0 |
crates/iota-node/ |
The validator binary |
FORK+REBRAND binary name → qalnet-node |
Apache-2.0 |
crates/iota-types/ (+ gas_model/) |
Objects, txs, effects, computation+storage gas duality |
USE-AS-IS |
Apache-2.0 |
crates/iota-execution/ (+ latest/iota-adapter, iota-move-natives, iota-verifier) |
Chain↔Move-VM adapter |
USE-AS-IS |
Apache-2.0 |
crates/typed-store/ (+ -derive, -error) |
RocksDB wrapper (from Sui) |
USE-AS-IS |
Apache-2.0 |
crates/iota-authority-aggregation/ |
BFT signature aggregation |
USE-AS-IS |
Apache-2.0 |
1.2 Move framework & language
| Verified path |
What it does |
QALS use |
License |
crates/iota-framework/packages/iota-framework/sources/ |
Move stdlib: coin.move, iota.move (gas coin → rename to qals.move), balance, pay, bag/table/vec_set, display.move, token, timelock, deny_list, authenticator_state, crypto/, kiosk/ (incl. kiosk/transfer_policy.move — verified), package_metadata |
FORK+REBRAND → qal_framework |
Apache-2.0 |
crates/iota-framework/packages/iota-system/ |
On-chain system state: genesis.move, staking_pool.move, storage_fund.move (refundable storage deposits — our data-anchor economics), validator*.move, voting_power.move |
FORK+REBRAND (adjust supply/allocations) |
Apache-2.0 |
crates/iota-framework/packages/move-stdlib/ |
Core Move stdlib |
USE-AS-IS |
Apache-2.0 |
crates/iota-framework/packages/stardust/ |
UTXO-emulation modules (alias, unlock conditions) for legacy migration |
DROP as code; REF only |
Apache-2.0 |
external-crates/move/ |
Complete vendored Mysten Move monorepo (~60 crates: VM runtime, compiler, verifier, prover, CLI) |
USE-AS-IS (vendored — do not de-vendor) |
Apache-2.0 |
crates/iota-move/, iota-move-build/, iota-move-lsp/, iota-package-management/ |
Move toolchain: build/publish, LSP, package manager |
USE-AS-IS |
Apache-2.0 |
| Verified path |
What it does |
QALS use |
License |
crates/iota-localnet/ |
One-command localnet: --force-regenesis, --with-faucet, --committee-size N, --epoch-duration-ms — a real multi-validator private net in one binary |
USE-AS-IS for qalnet-dev-1 |
Apache-2.0 |
crates/iota-swarm/, crates/iota-swarm-config/ |
In-memory test swarms + network configs |
USE-AS-IS (test harness) |
Apache-2.0 |
crates/test-cluster/, crates/simulacrum/, simulacrum-server/ |
Test cluster harness; synthetic-chain simulation |
USE-AS-IS for CI |
Apache-2.0 |
dev-tools/iota-private-network/ |
Docker compose private-network deployment (verified) |
USE-AS-IS — this is the Fleet starter kit |
Apache-2.0 |
dev-tools/pg-services-local/ |
Postgres + indexer + GraphQL + explorer-backend compose |
USE-AS-IS |
Apache-2.0 |
dev-tools/grafana-local/, jaeger-local/, iota-indexer-monitoring/, iota-network/ |
Grafana dashboards, Jaeger tracing, indexer monitoring |
USE-AS-IS |
Apache-2.0 |
docker/ |
Dockerfiles: iota-node, iota-localnet, iota-indexer, iota-graphql-rpc, iota-faucet, iota-data-ingestion, iota-proxy, iota-rest-kv, iota-tools (all verified) |
FORK+REBRAND image names → qalnet/* |
Apache-2.0 |
1.4 Genesis, tokenomics, names
| Verified path |
What it does |
QALS use |
License |
crates/iota-genesis-builder/ + iota-genesis-common/ |
Builds genesis.blob: validator set, allocations, migration blob (skip migration) |
USE-AS-IS + our config |
Apache-2.0 |
crates/iota-faucet/ |
Gas faucet service |
FORK+REBRAND → Qal Pass dev faucet |
Apache-2.0 |
crates/iota-names/ |
IOTA Names service (SuiNS analogue) |
FORK+REBRAND → qalnames (agent-nameable identities, later phase) |
Apache-2.0 |
crates/iota-mainnet-unlocks/ |
IOTA's vesting-unlock schedule queries |
DROP (IOTA-history-specific) |
Apache-2.0 |
crates/iota-gas-station/ — not present |
Gas Station sponsor service lives in a separate upstream repo (iotaledger/gas-station), not cloned |
PULL NEXT → Qal Pass |
Apache-2.0 |
1.5 APIs, indexing, networking, ops
| Verified path |
What it does |
QALS use |
License |
crates/iota-json-rpc/ (+ -api, -types) |
Sui-compatible JSON-RPC surface |
USE-AS-IS |
Apache-2.0 |
crates/iota-graphql-rpc/ (+ -client, -config, -headers) |
GraphQL API |
USE-AS-IS |
Apache-2.0 |
crates/iota-grpc-server/ |
gRPC incl. tx execution/simulation service |
USE-AS-IS |
Apache-2.0 |
crates/iota-indexer/ (+ iota-indexer-builder, iota-indexer-streaming, iota-analytics-indexer) |
Postgres-backed indexer + analytics |
USE-AS-IS (explorer + Qal Trails backend) |
Apache-2.0 |
crates/iota-data-ingestion/ + -core/ |
Checkpoint ingestion pipeline |
USE-AS-IS (also feeds our IOTA-anchoring relayer later) |
Apache-2.0 |
crates/iota-light-client/ |
Trust-minimized state verification |
USE-AS-IS (later, for apps that shouldn't trust our gateway) |
Apache-2.0 |
crates/iota-sdk/, iota-rust-sdk/, iota-keys/, iota-transaction-builder/, iota-transaction-checks/, iota-ledger-signer/ |
The current (Rebased) Rust client SDK — the old iota-sdk repo is deprecated; this is the live one |
USE-AS-IS → base of qalctl + agent wallets |
Apache-2.0 |
crates/iota-traffic-controller/ |
RPC rate-limiting + IP blocking |
USE-AS-IS on public gateway |
Apache-2.0 |
crates/iota-metrics/, iota-metric-checker/, iota-metrics-push-client/, telemetry-subscribers/, prometheus-closure-metric/, prometheus-filtered/ |
Metrics/tracing suite |
USE-AS-IS → Grafana per dev-tools/ |
Apache-2.0 |
crates/iota-network/, iota-network-stack/, iota-tls/, iota-multiaddr/ |
P2P networking |
USE-AS-IS (runs over Tailscale) |
Apache-2.0 |
crates/iota-vm-sdk/, iota-replay/, transaction-fuzzer/, iota-source-validation/ |
Debug/replay/fuzz/security tooling |
USE-AS-IS in CI |
Apache-2.0 |
EVM — CONFIRMED ABSENT from repos/iota. No evm crate in the workspace (104 crates enumerated; zero EVM hits), no EVM dir at repo root. IOTA's EVM product is a separate chain/tech line. See §5 wasp for the Phase-4 pattern and the QALS_ARCHITECTURE decision memo. Do not plan Move+EVM duality on Qalnet without a porting project (downgrade §5.7 of the architecture doc accordingly).
2. Identity stack — repos/identity.rs
Active (2026-08-20), Apache-2.0, 14+ crates + WASM bindings (verified bindings/wasm/identity_wasm). Whole stack = FORK+REBRAND as Qal ID.
| Verified path |
What it does |
QALS use |
License |
identity_core/, identity_did/, identity_document/, identity_credential/ |
W3C DID + VC data model, JSON-LD, crypto primitives |
USE-AS-IS |
Apache-2.0 |
identity_iota/ + identity_iota_core/ |
IOTA-specific DID method + ledger anchoring → becomes our DID method on Qalnet |
FORK+REBRAND |
Apache-2.0 |
identity_credential/src/revocation/ — revocation_bitmap_2022/, status_list_2021/, validity_timeframe_2024/ (all verified) |
Credential revocation: bitmap + W3C StatusList2021 + timeframes |
USE-AS-IS (agent-key revocation drills) |
Apache-2.0 |
identity_credential/src/sd_jwt_vc/ (verified) |
SD-JWT VC support (selective disclosure) |
USE-AS-IS |
Apache-2.0 |
identity_jose/ (jwk/jws/jwt, verified) |
JOSE layer |
USE-AS-IS |
Apache-2.0 |
identity_storage/ + identity_stronghold/ |
Storage abstraction + Stronghold-backed key storage |
USE-AS-IS — pins Stronghold for us |
Apache-2.0 |
identity_resolver/, identity_eddsa_verifier/, identity_ecdsa_verifier/, identity_pqc_verifier/ |
Resolution + signature verification incl. post-quantum |
USE-AS-IS |
Apache-2.0 |
(not cloned) iotaledger/hierarchies |
Trust hierarchies (root authority→federation→accreditation→attestation) — §5.6 of architecture doc |
PULL NEXT upstream |
Apache-2.0 |
3. Stronghold — repos/stronghold.rs
Dormant upstream (2023-06-29) but stable and still consumed by identity_stronghold. Apache-2.0. USE-AS-IS, pin the version.
| Verified path |
What it does |
QALS use |
License |
client/ |
Vault + store API (snapshot-encrypted secret DB) |
Agent keys, QALS hot-wallet seeds |
Apache-2.0 |
engine/ |
Runtime, snapshot encryption, Location abstractions |
USE-AS-IS |
Apache-2.0 |
stm/ |
Software transactional memory for concurrent procedures |
USE-AS-IS |
Apache-2.0 |
4. SDKs & UI
| Repo / verified path |
What it does |
QALS use |
License |
repos/iota/crates/iota-sdk/ + iota-rust-sdk/ |
The live Rust SDK (in-tree) |
USE-AS-IS |
Apache-2.0 |
dApp Kit / TS SDK — NOT in any clone. repos/iota/pnpm-workspace.yaml lists only docs/site (verified); no sdk/, dapps/, or apps/ dir. The Rebased TypeScript SDK + @iota/dapp-kit live in a separate iotaledger TS monorepo upstream |
React hooks + wallet-connect UI kit |
PULL NEXT upstream — embed in every qalarc web app ("Connect Qal ID") |
Apache-2.0 |
repos/firefly/packages/desktop/, packages/shared/ |
Electron+React desktop wallet UI patterns (Stardust-era, tied to old wallet stack) |
PATTERN only (UI/UX, i18n, key-guard flows); do not build on the old bindings |
Apache-2.0 |
repos/iota-sdk/ (sdk/, bindings/, cli/ — verified structure) |
Deprecated unified SDK (Rust/TS/Py/WASM) for Stardust |
DROP (frozen 2025-05-22); REF for bindings layout if we need Python/WASM |
Apache-2.0 |
repos/iota.js/, repos/wallet.rs/, repos/iota.go/ |
Chrysalis-era TS client / legacy wallet engine / Go client (MIT) |
DROP all |
Apache-2.0 / MIT |
5. Patterns from archived repos (research value only)
| Repo / verified path |
What it teaches |
QALS use |
License |
repos/streams/streams/src/message/ — keyload.rs, announcement.rs, subscription.rs, signed_packet.rs, tagged_packet.rs (all verified) |
Channel-encryption pattern: announce → subscribe → keyload (per-recipient encrypted channel keys) → signed/encrypted packets. This is the blueprint for qal_data channel encryption (§5.5 of architecture doc) |
PATTERN (rebuild with ed25519/AEAD on Qalnet; code itself is dead) |
Apache-2.0 |
repos/wasp/packages/vm/core/evm/ — emulator/, iscmagic/, evmimpl/ (verified) + packages/evm/ |
EVM-as-a-core-contract inside another chain + jsonrpc/ Ethereum JSON-RPC sidecar, committee DKG (packages/dkg/), L1 anchoring via nodeconn/+statemanager/ |
PATTERN — the reference for the Phase-4 "EVM on Qalnet" decision memo (JSON-RPC sidecar shape, iscmagic bridgeless-token idea) |
Apache-2.0 |
repos/goshimmer/packages/protocol/congestioncontrol/ (verified) |
DAG congestion-control/mana-era scheduler research |
REF only (whitepaper-reading; no code extraction) |
Apache-2.0 |
repos/entangled/common/crypto/troika/ (troika.c/.h verified) |
Ternary hash — historical |
LORE only ("trit" joke unit); zero extraction |
Apache-2.0 |
repos/bee/ |
Legacy Rust node framework, abandoned |
DROP |
Apache-2.0 |
6. External (not iotaledger)
| Repo / verified path |
What it does |
QALS use |
License |
repos/deepbook/crates/ (indexer, server, schema + dashboard) and packages/ (Move: deepbook, deepbook_margin, margin_liquidation, usdc, token, fixed_math, predict, …) |
DeepBook v3 CLOB DeX: on-chain order book + margin + liquidations |
Phase B for Qalx: fork Move packages, rebrand; port to Qalnet Move (Sui-lineage, should be near-drop-in) |
Apache-2.0 |
MystenLabs/sui (upstream, not cloned) |
IOTA's parent codebase |
Upstream tracker option if iotaledger stalls — our fork investment stays portable (Sui↔IOTA diffs are the porting surface). Watch, don't clone yet |
Apache-2.0 |
7. DO-NOT-PULL list (dead ends — explicit)
| Item |
Why not |
Old Tangle node logic: bee/, entangled/ (except troika lore), coordinator & milestone code anywhere |
Pre-Rebased architecture; dead upstream; we have real BFT |
| Ternary crypto (Curl, Kerl, troika, trytes) |
Historical; binary-only policy (branding homage only) |
iota-mainnet-unlocks/ |
IOTA's specific vesting history, meaningless on Qalnet |
Stardust migration tooling: crates/iota-framework/packages/stardust/, iota-genesis-builder's migration.blob path |
UTXO-emulation for legacy IOTA funds; REF only |
repos/iota-sdk/ (legacy), wallet.rs, iota.js, iota.go |
Deprecated/archived Chrysalis-era clients |
wasp/ as a runtime (ISC chains) |
Confirmed dead end — Shimmer sunsets 30 Sep 2026; extract patterns (§5) only |
firefly/ code as wallet base |
Bound to old wallet stack; take UI patterns, not the Electron app |
Coordinator/MANA tokenomics not in repos/iota |
Mana is docs-only upstream — don't assume it exists in the fork (verified absent) |
8. Pull-next queue (upstream repos not yet cloned)
iotaledger/gas-station — sponsored-tx service → Qal Pass (core product promise).iotaledger/hierarchies — trust delegation crates (Rust/WASM) → Qal Trust.- TS SDK / dApp Kit monorepo —
@iota/dapp-kit, @iota/iota-sdk → every qalarc web app.
- IOTA explorer frontend — Rebased-era explorer UI to rebrand (locate exact repo when online).
MystenLabs/sui — shallow clone for diff-tracking only.
Verification method: directory listings of repos/ clones, 2026-09-06. Companion docs: IOTA_COMPONENT_MAP.md (deep detail), QALS_ARCHITECTURE.md (decisions).