- CI (release.yml/build.yml): remove fetch-nym + AWS_LC_SYS_PREBUILT_NASM;
the default cargo build --release is Tor/arti only now (nip44 fetch kept).
- Cargo.toml: nym-sdk is optional behind the `nym` feature so the default
build never pulls it.
- Delete the dead Nym-era probes (xrelay_smoke, connect_timing,
tunnel_measure) that referenced the removed Nym API and broke `cargo test`.
- Untrack the internal E2E harnesses (e2e.rs, nostr_e2e.rs) via .gitignore;
gate `mod e2e` behind the `e2e-internal` feature so clones still compile.
- Refresh stale Nym comments in build.rs and the build scripts.
build133 shipped the Tor transport but two delivery bugs remained; this
fixes both so payments resolve through confirmations again.
- Drop the pinned relay .onion. It was a single fragile hidden-service hop
shared by every wallet; under load it flapped (WebSocket 1006), and when
it dropped mid-handshake a payment stalled after the first gift-wrap --
you'd get the incoming alert but the money never confirmed. Every relay is
now reached over the Tor exit to its clearnet host: your IP still stays
hidden from the relay, with no fragile onion hop to wedge. The has-onion
gate that rejected an onion-less relay list is removed, and the pinned
candidate pool carries no onion/exit fields.
- Tor-friendly relay set. Defaults/fallbacks had included relays that refuse
Tor-exit connections (damus, nos.lol); wallets that fell back to them
couldn't send at all. Defaults and the pinned pool are now
relay.floonet.dev, relay.0xchat.com, offchain.pub.
- confirm-before-sent no longer false-fails across a relay reconnect (a
confirmed-received wrap is treated as sent-pending instead of re-dispatched,
which had duplicated wraps and hung the spinner); a v3 gift-wrap unwrap
failure no longer silently drops the message.
Validated over Tor with two funded wallets on two independent mainnet nodes:
connect in seconds, send to finalize in 8s.
The README still described the old Nym-mixnet transport, including a
reference to src/nym/sidecar.rs which no longer exists post-switch.
Update the intro, feature list, payment-travel diagram, and build
instructions to describe the current embedded-Tor (arti) transport:
in-process, dialed at the relay's pinned .onion, no sidecar, no sibling
checkout needed for the default build.
The wallet's private transport moves from the Nym mixnet to embedded Tor
(arti, copied from GRIM's engine): it dials the relay's pinned .onion, so
the relay never learns your IP, while the relay + NIP-59 gift-wrap hide the
rest - content, sender, and (via a relay-side randomized release) timing.
The Grin node stays on the clear internet as before.
Why leave the mixnet: the Nym free-tier bandwidth this depended on is being
removed upstream (the grant expires at UTC midnight; the paid path requires
holding NYM tokens), so a payments wallet can't stand on it. Tor is
unmetered, embedded in-process on mobile, faster where users wait, and
lighter on the battery.
Preserved intact: the confirm-before-sent guard, relay-gated readiness, and
the lazy warm-on-activity node polling. src/nym/ is feature-gated off (arti
and nym-sdk can't share one binary); full removal is a follow-up.
Adds confirm-before-sent: a payment is not shown as "sent" until the relay
actually confirms receipt. If the path is slow or a send doesn't land, you now
see a clear "not confirmed — retry" instead of a false "sent" that quietly loses
the payment.
Routing is unchanged from prior builds: all wallet nostr traffic — slatepacks,
payment requests, identity, discovery, goblin.st name + relay lookups — rides
the mixnet; the grin node and price/fiat lookups stay direct.
Connect reliability, measured before release:
- Cold start: the wallet races two mixnet entry-gateway connects and takes the
first up, so a dead random draw no longer costs the full timeout (dead-round
rate drops from p to p^2; verified across 30 cold trials).
- Dead exits are condemned in ~10s instead of ~32s (fresh-tunnel probe budget
5s x 2 rounds, 4.2x margin over the worst measured healthy probe), removing
the 50-70s worst-case connects. Established-tunnel keepalive unchanged.
- "Connecting relays..." clears in ~2-4s after saving the relay list (the
Connected flag now tracks the real relay-up signal instead of waiting on a
30s catch-up fetch); identity publishes are time-boxed; the onboarding
Claim button un-gates equally sooner.
- Gateway-race and probe timings are now visible in [timing] logs.
Also: the update banner shows Goblin build numbers (not the inherited 0.3.6),
and the nip44 crate is consumed from crates.io (v0.3.0) - no sibling checkout
needed to build.
Bugfix: the mixnet exit-liveness probe now races two stable targets over two
rounds instead of a single one-shot 1.1.1.1 connect, so a healthy tunnel is no
longer false-condemned and reselected forever. Fixes the intermittent
Connecting to Nym hangs that could take minutes or never resolve (verified:
15/15 cold starts connected, zero hangs).
Also: the Android versionCode/versionName now track the Goblin build number
(were frozen at GRIM's 5 / "0.3.6"), so the OS detects upgrades correctly.
Bugfix: the default and fallback messaging relay moved from relay.goblin.st
(being retired) to relay.floonet.dev, so new installs and reconnects use the
live relay. Built-in relay fallback list updated to match.
Floonet scoped Nym exit on the money-path relay (dial a relay operator's
co-located exit over a MixnetStream, TLS end to end, no public DNS; anchor +
fallback, never pin-only), NIP-44 v3 gift wraps (G4), mix-DNS, localization,
GUI polish. Verified end to end: two wallets complete a real gift-wrapped Grin
payment over relay.goblin.st, finalized + posted on mainnet.
The Settings third-party 'GRIM (upstream wallet)' link opened github.com/ardocrat/grim
— a stale personal fork ~106 commits behind. Point it at github.com/GetGrin/grim, the
live GitHub mirror of canonical code.gri.mw/GUI/grim.
2ro