v0.17.0

Release v0.17.0

Protocol support updated from 0.15.3 to 0.17.0.
Rust MSRV updated from 1.93 to 1.98.1.
Node migration required. Run miden-node migrate.
Validator migration required. Run miden-validator migrate.
NTX Builder migration required. Run miden-ntx-builder migrate.

Breaking Changes

• Validator: Renamed the validator signing key options: --key.hex / MIDEN_VALIDATOR_KEY is now --signing-key.hex / MIDEN_VALIDATOR_SIGNING_KEY, and --key.kms-id / MIDEN_VALIDATOR_KEY_KMS_ID is now --signing-key.kms-id / MIDEN_VALIDATOR_SIGNING_KEY_KMS_ID. (#2342)
• Node: Added multiple Validator genesis bootstrap and tx/block validation (#2323)
• RPC: Changed NoteSyncRecord metadata to return raw values for single-word attachments and commitments for larger attachments, allowing clients to inspect compact attachments without an additional GetNotesById request. (#2423)
• Node: Updates recover command to involve all validators. (#2432)
• Validator: Native faucet changed to a network account controlled by a separate operator account (#2454)
• Validator: The genesis validator set is now passed to miden-validator genesis via repeatable --validator.key flags instead of the validators list in the genesis configuration file; configuration files containing validators are rejected. (#2484)
• RPC: Storage map proofs for multiple keys in AccountResponse are now represented as a batched PartialSmt. (#2439)
• RPC: Transactions which don't pay fees are rejected when fees are enabled (#2547)
• General: Bumped MSRV to 1.98.1 to avoid a miscompilation bug on 1.98.0 (#2560)
• RPC: Updated to miden-protocol v0.17 and miden-crypto v0.30. (#2570)
• RPC: RPC and prover protobuf APIs now use canonical Miden object bindings and structured proof and submission messages. Clients must regenerate bindings and update request and response handling. (#2580)
• General: Persist and verify the genesis protocol configuration. Genesis files must now include the full configuration; existing deployments require a new genesis artifact and a fresh bootstrap. (#2590)
• RPC: Expose protocol configurations through gRPC and use verified configs across synchronization, recovery, NTX execution, monitoring. (#2596)
• RPC: Changed the validator’s SignBlock API to use a dedicated SignBlockRequest and removed the signing-only protocol_config field from BlockProofRequest. (#2621)
• Network Monitor: Fees are funded from the funding service via --funding-service-url; the faucet is no longer a source of fees. (#2603)
• RPC: Require native-asset fee output notes for standalone transaction submissions when fees are enabled. (#2564)
• Node: Require the batch builder's wallet account ID when starting the sequencer. (#2647)
• Note Transport: An initial implementation of the note transport service without support for subscriptions has been added. (#2632)
• Note Transport: Changed FetchNotes cursor to a structured message containing a nonce. (#2640)
• Note Transport: Added new SendNoteWithProof endpoint requiring inclusion proofs for submitted notes. (#2648)
• Validator: Require native faucet, funding account, fee, and timestamp arguments for genesis; use --accounts-config for additional accounts. Imported accounts require names. (#2683)
• General: Migrated structured database payloads and node-owned binary files to protobuf. (#2690)
• RPC: Updated all gRPC methods to use dedicated request and response messages for independent schema evolution. (#2699)
• RPC: Standardized node gRPC package and service names under versioned miden.*.v1 namespaces. (#2708)
• Network Monitor: In the /status JSON, the faucet details replace last_tx_id with last_note_id, and the faucet metadata replaces max_supply and note_transport_url with balance. (#2710)
• Note Transport: Removed SendNote and unverified block hints; note submissions now require inclusion proofs. (#2711)
• NTX Builder: Removed --idle-timeout and --max-account-crashes. (#2585)

Changes by Scope

General

• Breaking: Bumped MSRV to 1.98.1 to avoid a miscompilation bug on 1.98.0 (#2560)
• Breaking: Persist and verify the genesis protocol configuration. Genesis files must now include the full configuration; existing deployments require a new genesis artifact and a fresh bootstrap. (#2590)
• Breaking: Migrated structured database payloads and node-owned binary files to protobuf. (#2690)
• Added: User visible log events have been added for startup and shutdown to all services. (#2359)
• Added: docker compose file for local development network is now published (#2387)
• Added: Local dev network now bundles the block explorer (#2398)
• Added: Official faucet is now deployed as part of the local dev network (#2400)
• Added: Local dev network now supports DNS e.g. http://rpc.localhost (#2401)
• Added: Local dev network now supports the note transaction layer (#2402)
• Added: User-visible warnings for unreachable external service endpoints have been added, making potential mis-configuration easier to spot. (#2360)
• Added: Enriched traces with service.version (#2498)
• Added: Add a USDCx genesis Docker image built from a pinned submodule. (#2682)
• Added: Added the miden-usdcx-genesis crate. (#2712)
• Changed: Bump miden protocol dependencies to 0.16.0-rc.6. (#2526)
• Changed: Reduce Docker image size and build disk usage while retaining file and line information for backtraces. (#2672)
• Changed: RegisterAccount now works when allowlist disabled, providing a prefund path on such networks. (#2685)
• Changed: Removed the vendored USDCx genesis binary and use the local USDCx genesis binary instead. (#2713)
• Fixed: Account, note, storage and mempool lifecycle events are now logged on stdout. (#2358)
• Fixed: Protobuf Rust bindings now compile on Windows (#2506)
• Removed: Debian packages have been removed, use the provided Docker images instead (#2607)
• Removed: Remove the faucet and seed services from local Docker Compose. (#2683)

RPC

• Breaking: Changed NoteSyncRecord metadata to return raw values for single-word attachments and commitments for larger attachments, allowing clients to inspect compact attachments without an additional GetNotesById request. (#2423)
• Breaking: Storage map proofs for multiple keys in AccountResponse are now represented as a batched PartialSmt. (#2439)
• Breaking: Transactions which don't pay fees are rejected when fees are enabled (#2547)
• Breaking: Updated to miden-protocol v0.17 and miden-crypto v0.30. (#2570)
• Breaking: RPC and prover protobuf APIs now use canonical Miden object bindings and structured proof and submission messages. Clients must regenerate bindings and update request and response handling. (#2580)
• Breaking: Expose protocol configurations through gRPC and use verified configs across synchronization, recovery, NTX execution, monitoring. (#2596)
• Breaking: Changed the validator’s SignBlock API to use a dedicated SignBlockRequest and removed the signing-only protocol_config field from BlockProofRequest. (#2621)
• Breaking: Require native-asset fee output notes for standalone transaction submissions when fees are enabled. (#2564)
• Breaking: Updated all gRPC methods to use dedicated request and response messages for independent schema evolution. (#2699)
• Breaking: Standardized node gRPC package and service names under versioned miden.*.v1 namespaces. (#2708)
• Added: Added the GetTransactionEncryptionKey endpoint, returning the shared transaction encryption public key attested by a validator's signing key. (#2342)
• Added: Started logging gRPC request and response sizes (#2447)
• Added: Added RegisterAccount which adds an account to the allowlist using an invitation code (#2610)
• Added: IsAccountAllowed which returns true if the given account ID can be deployed. (#2628)
• Added: Added new error codes to the SyncNullifiers, SyncAccountVault, SyncAccountStorageMaps and SyncTransactions endpoints (#2700)
• Fixed: Tokio worker threads no longer panic when connections reach maximum age. (#2350)
• Fixed: Subscription clients now receive terminal gRPC statuses when the stream buffer is full. (#2425)
• Fixed: Client Accept header now carries the version and genesis parameters in one media range, so RPC methods that require genesis accept requests from clients that set both. (#2646)
• Fixed: gRPC error responses now correctly include the error code byte where applicable (#2669)
• Removed: Removed node-level RPC rate limits (per-IP and max concurrent connections) and the max-connection-age closure, along with their CLI flags; rate limiting should be imposed at the load-balancer layer (see the operator guide). (#2493)

Node

• Breaking: Added multiple Validator genesis bootstrap and tx/block validation (#2323)
• Breaking: Updates recover command to involve all validators. (#2432)
• Breaking: Require the batch builder's wallet account ID when starting the sequencer. (#2647)
• Added: Mempool now tracks uncommitted transaction count (#2496)
• Added: Added a new sequencer database for tracking account allowlist (#2608)
• Added: Added an admin REST API to the sequencer for managing the account allowlist (#2609)
• Added: Sequencer now rejects unregistered non-network accounts (#2612)
• Added: A genesis [[wallet]] entry accepts an optional name, which sets its account file name. (#2600)
• Added: Create and deploy a fee collector account miden-node fee-collector commands. (#2568)
• Added: Aggregate transaction fees into a single P2ID note sent to the batch builder's wallet. (#2647)
• Added: Support native faucet callbacks during batch fee collection. (#2650)
• Added: Sequencers can prefund newly registered accounts through a configured funding service. (#2636)
• Added: CLI for interacting with the sequencer's allowlist (#2665)
• Added: The store applies account code upgrades: it stores the new code and updates the code commitment of the account. (#2707)
• Changed: Applying blocks with changes to accounts having large storage maps is now significantly faster. (#2341)
• Changed: Store reads are lock-free: readers use atomically published in-memory snapshots and are no longer blocked while blocks are applied. (#2345)
• Changed: Add open_tree_storage and open_forest_storage spans for observing startup times. (#2465)
• Changed: Docker runtime images now run as a non-root miden user (uid 10001). (#2495)
• Changed: Improved node startup time by loading and verifying Merkle tree structures in parallel. (#2466)
• Changed: Clarify the genesis-block deserialization error to hint at a possible node-version mismatch (#2593)
• Changed: Reject standalone transactions that consume fee notes from uncommitted transactions. (#2563)
• Fixed: History pruning no longer deletes account state rows still required to reconstruct historical vault, storage-map, or code state within the retention window. (#2438)
• Fixed: Mempool now correctly includes transactions in uncommitted batches in its capacity check (#2496)
• Fixed: Mempool chain tip no longer includes the pending block (#2496)
• Fixed: Mempool no longer includes recently committed blocks in its stats (#2496)
• Fixed: Pre-fund the generated native faucet operator with 1,000 MIDEN at genesis so it can pay transaction fees. (#2523)
• Fixed: Respect user batch's reference block instead of always using the chain tip (#2549)
• Fixed: Pre-fund the generated native faucet's own vault at genesis so its mint network transactions can pay fees. (#2526)
• Fixed: An invalid accept header no longer invalidates a later one (#2579)
• Fixed: Correctly support multiple separate Accept headers (#2578)
• Fixed: Reject prefixes in SyncNullifiers that have more than 16 bits instead of silently truncating them (#2589)
• Fixed: Preserve user-submitted batch proofs instead of rebuilding the batches. (#2565)
• Removed: Batch prover URL has been removed as it is disabled for now (#2662)

Prover

• Removed: Removed the miden-remote-prover-client crate (#2315)

NTX Builder

• Breaking: Removed --idle-timeout and --max-account-crashes. (#2585)
• Added: Network transactions now set an on-chain expiration delta (default 30 blocks, configurable via --tx-expiration-delta) using the canonical miden-standards expiration transaction script. Serviced network accounts must allowlist the script's root (ExpirationTransactionScript::script_root()) via AuthNetworkAccount::with_allowed_tx_scripts, or their network transactions will be rejected. (#2321)
• Added: Network transactions now bundle each feature note with the FEE_SPONSORSHIP notes that pay its fee, so a network note whose fee a sponsor covers is executed rather than left pending. (#2514)
• Added: RPC request timeout is now configurable via --rpc.timeout (#2537)
• Added: Transaction prover request timeout is now configurable via --tx-prover.timeout (#2537)
• Added: gRPC server timeout is now configurable via --grpc.timeout (#2537)
• Added: Added the notes.next_eligible_block column. (#2582)
• Added: Added --max-concurrent-txs to bound the number of network transactions computed concurrently. (#2585)
• Added: Added --priority-account to serve named network accounts before all others. (#2586)
• Added: The network transaction builder applies code upgrades of network accounts to its tracked account state. (#2707)
• Changed: Drive account actors from a per-account watch instead of a dataless Notify, eliminating per-block DB polling for landing checks and note availability. (#2301)
• Changed: Network transactions are now built by short-lived per-account attempts driven by the committed-block loop. (#2585)
• Fixed: Network notes are no longer punished for tipping a transaction over its cycle capacity. (#2322)
• Fixed: Network accounts no longer stop reactivating after idle periods: gRPC clients now use HTTP/2 keepalive to detect silently dropped block-subscription connections, plus a subscription stall watchdog and a liveness heartbeat. (#2369)
• Fixed: Reload account state from the database after a rejected submission so the actor stops re-submitting against a stale account commitment. (#2371)

Validator

• Breaking: Renamed the validator signing key options: --key.hex / MIDEN_VALIDATOR_KEY is now --signing-key.hex / MIDEN_VALIDATOR_SIGNING_KEY, and --key.kms-id / MIDEN_VALIDATOR_KEY_KMS_ID is now --signing-key.kms-id / MIDEN_VALIDATOR_SIGNING_KEY_KMS_ID. (#2342)
• Breaking: Native faucet changed to a network account controlled by a separate operator account (#2454)
• Breaking: The genesis validator set is now passed to miden-validator genesis via repeatable --validator.key flags instead of the validators list in the genesis configuration file; configuration files containing validators are rejected. (#2484)
• Breaking: Require native faucet, funding account, fee, and timestamp arguments for genesis; use --accounts-config for additional accounts. Imported accounts require names. (#2683)
• Added: Validators are now provisioned with a shared transaction encryption key via --encryption-key.hex / MIDEN_VALIDATOR_ENCRYPTION_KEY and serve it through the new GetTransactionEncryptionKey endpoint. (#2342)
• Added: Operators can list stored private inputs and issue Golden decryption shares through a private admin API. (#2407)
• Added: Adds a genesis-bound DKG ceremony for validator storage keys. (#2433)
• Added: decode and acquire_validation_permit spans on the validator's sign-block and transaction submission paths. (#2487)
• Changed: Upgraded to golden-dkg 0.3.0 (#2475)
• Changed: The validator now stores encrypted transaction effects instead of full transaction inputs, reducing each private record by more than an order of magnitude. Existing records remain readable. (#2655)
• Fixed: The docker-compose network now gives each validator a distinct Golden storage-key share, so 2-of-3 threshold recovery of stored transaction inputs works. (#2411)
• Fixed: Fixed 1-of-N storage key setup. (#2695)

Note Transport

• Breaking: An initial implementation of the note transport service without support for subscriptions has been added. (#2632)
• Breaking: Changed FetchNotes cursor to a structured message containing a nonce. (#2640)
• Breaking: Added new SendNoteWithProof endpoint requiring inclusion proofs for submitted notes. (#2648)
• Breaking: Removed SendNote and unverified block hints; note submissions now require inclusion proofs. (#2711)

Network Monitor

• Breaking: Fees are funded from the funding service via --funding-service-url; the faucet is no longer a source of fees. (#2603)
• Breaking: In the /status JSON, the faucet details replace last_tx_id with last_note_id, and the faucet metadata replaces max_supply and note_transport_url with balance. (#2710)
• Added: Mempool now tracks uncommitted transaction count (#2496)
• Added: Show note transport version, total notes and total tags on the status dashboard. (#2521)
• Added: Support fee-charging chains: the monitor funds its accounts from the faucet, attaches fee sponsorships to increment notes, and tops its balance up automatically. (#2526)
• Added: Add an Agglayer bridge card that reads the bridge E2E test results from an agglayer-monitor /v1/status endpoint, enabled with --agglayer-monitor-url / MIDEN_MONITOR_AGGLAYER_MONITOR_URL. (#2687)
• Fixed: Fixed network monitor increment transactions failing under the 0.16 transaction kernel by creating notes through the account context (#2344)
• Fixed: Accept attestations from all configured validators when verifying transaction encryption keys. (#2683)
• Fixed: Show the genesis commitment on the RPC card as a hex string. (#2710)
• Fixed: Accept the /get_tokens and /get_metadata responses of faucet 0.17, so successful mints no longer mark the faucet as unhealthy. The faucet card shows the last note ID and the funding account balance. (#2710)
• Fixed: Show service error messages on the dashboard cards. (#2710)
• Fixed: Keep long values (URLs, commitments, IDs) on one line with an ellipsis, and fit cards on narrow screens. (#2710)

Funding Service

• Added: New service which reports its funding account and balance over a Status endpoint. (#2600)
• Added: RequestFunds sends the native asset to an account as a private pay-to-ID note and returns it once committed. (#2601)
• Added: The service collects public pay-to-ID deposits sent to its funding account. (#2615)
• Added: GET /status now reports the asset ID, symbol, decimals and name of the native asset. (#2688)

Docs

• Added: Operator documentation for the funding service. (#2603)

Internal

• Added: Bespoke SQLite framework aimed at replacing Diesel (#2265)
• Changed: Validator now uses our own SQLite framework instead of Diesel (#2265)
• Changed: Crates are now published using trusted publishing (#2346)
• Fixed: Fixed premature eviction of account vault and storage map history when frequent updates occurred within the 50-block retention window. (#2599)
• Fixed: Bootstrap USDCx for local benchmarks and fail smoke tests on rejected or missing transactions. (#2683)