v1.11.0

Adding a member no longer leaves its participant hosting a party it holds no contracts for.

No peer compatibility break. WIRE_VERSION is unchanged and MIN_PEER_VERSION stays 0.1.9. Partner nodes sign the same payload they always did; only the coordinator and the joining node need this build.

No new migration. 1.11.0 runs on a 1.10.0 volume as is.

The joining node now leaves the synchronizer before the party authorizes it. It signs, waits until its own topology store holds the coordinator's proposal, switches its synchronizer to manual connection, disconnects, and only then hands its signature to the coordinator. The mapping cannot take effect while the node is connected, so it never journals archives of contracts it does not hold. One reconnect at the end turns manual connection off again (#469).

A member that removed only its hosting entry can be hosted again. Its namespace stays as it is and only the PartyToParticipant is submitted; the peers sign the namespace transaction already in force. new_threshold must equal the namespace's current threshold; use change-threshold to move it afterwards (#469).

Operations

• Un-hosting a participant that still holds the party's contracts needs ForceFlag.DisablePartyWithActiveContracts, and its copy of those contracts must be purged before it is hosted again, or they stay active on it forever. The integration test add_party_rehost_disconnect_first rehearses that order: un-host, disconnect, purge, reconnect, re-add while the party keeps transacting (#469).
• A window opened before the authorization is closed on every path, including an empty ACS: manual connection off, reconnect, health verified; a node left on manual connection is reported, since its next restart would leave it disconnected (#469).

v1.10.0

A broken ACS transfer no longer takes the joining node down.

No peer compatibility break. WIRE_VERSION is unchanged and MIN_PEER_VERSION stays 0.1.9, so nodes can be upgraded one at a time.

No new migration. 1.10.0 runs on a 1.9.0 volume as is.

Which node needs it: #458 acts on the joining node, #456 on the coordinator. Neither needs the other side upgraded.

The ACS import reconnects the participant once per step — after the import succeeded or its last attempt failed, never between attempts. Two knobs, both env: DECPM_ACS_IMPORT_ATTEMPTS (full restarts, default 2) and DECPM_ACS_BLOCK_FETCH_ATTEMPTS (re-asks of one block, default 12).

Bug fixes

• A broken ACS transfer is retried inside the disconnect window instead of through a step retry that reconnected the participant between attempts (#458). Every reconnect replays the ACS journal, and a participant hosting a party without its ACS holds rows that make that replay fatal. A block is re-asked with backoff before the transfer counts as broken; a full restart re-streams the whole snapshot, so it is the last resort.
• Add-party checks that the new member holds every package the party's contracts reference before any topology is written (#456). It used to check at the import, after the party was already hosted on the new participant; a run that then failed left it hosting a party with no ACS.
• The workflows feed no longer carries DAR payloads, so the approvals page loads and the UI stops logging itself out while a DAR run is stalled (#452).

Operations

• A joining node found still disconnected by an earlier attempt continues its import in that window; one that is unhealthy for any other reason is refused rather than reconnected blindly (#458).
• The ACS-import quarantine is recorded when a transfer is given up, counting bytes over every attempt, and is lifted with DELETE /acs-import-quarantine (#458).

v1.9.0

Decentralize a party that already exists, and add a member to a party older than inline signing keys.

The external-party flows are in testing. The /v0/tenant/* API is complete and works end to end on DevNet, but has not been run against a production party.

No peer compatibility break. WIRE_VERSION is unchanged and MIN_PEER_VERSION stays 0.1.9, so nodes can be upgraded one at a time.

One new migration, applied at startup: 000019_tenant_replication_artifacts. A downgrade to 1.8.x on the same volume is not supported once it applies.

Adding a member to a pre-Canton-3.4 party moves its signing keys inline and leaves behind the ones no current member claims (#443). The leftovers are shadowed, not deleted (#453). Run it with every member online: Canton makes each key authorize its own addition.

New features

• Add co-validating hosts to an existing party and replicate the ACS onto them, with the owner's key never reaching DecMan (#381, #387)
• Convert a local party to an externally-signed one (#391), after a spike established Canton accepts the flip mid-life (#388)
• Failover hosting: a host can be added with Submission permission, so any one host can submit for the party (#409). Canton permits it only at threshold 1.
• Raise a party's threshold over the same API (#409)
• A wallet-side client drives all three phases in order and reports success only when a joiner is live (#390). Ships a KMS-capable signer trait.

UI

• Workflow steps are named, with a tooltip per pipeline dot and Step 7 of 13 (#444). The catalogue self-checks against the run and falls back to bare dots rather than mislabelling.
• Peers export and import as CSV on the Config tab (#445). Import merges: rows are chipped New, Update or Unchanged, and absent peers are kept.
• Node health and per-peer ping latency on the Config tab (#446). Each hop is probed separately, so an unreachable participant no longer renders as healthy.

Bug fixes

• Add-party works on a party onboarded before Canton 3.4 (#443). It built the key set from the empty inline field and proposed a mapping whose only signing key was the joiner's.
• A migration cannot half-apply: the namespace change is not submitted when a key the participant change adds has not signed (#443)
• A workflow reports itself done only after its run row is settled, so a follow-up is no longer refused by the in-flight guard (#447)
• The ACS moves through the pipe instead of a staged file (#395)

Security

• rustls moves past RUSTSEC-2026-0285 (#450)

Internal

• tokio-noise points at upstream instead of our fork (#449); it stays a pinned patch because hyper-noise still requires 0.0.5

v1.8.0

Add-party at real ACS sizes, and three OOM paths closed.

Peer compatibility breaks. WIRE_VERSION moves 0xD1 to 0xD2 (#408). That byte is the first byte of every Noise frame and the decoder rejects a mismatch outright, so a 1.8.0 node and a 1.7.x node cannot exchange any peer message — not only add-party. Upgrade every member of a party together; a node left behind is denied at the frame, which is visible as Noise protocol version mismatch in both nodes' logs. MIN_PEER_VERSION stays 0.1.9 and does not gate this.

Three new migrations, applied at startup: 000016_dar_invitation_hashes, 000017_participant_signing_key, 000018_acs_import_quarantine. Once they apply, a downgrade to 1.7.x on the same volume is not supported.

New features

• The add-party ACS moves off the Noise command payload onto a forward-only pipe, export streamed straight into import (#408)
• The add-party card shows ACS transfer progress, so a multi-minute transfer is distinguishable from a wedged run without reading pod logs (#438). There is no percentage: neither Canton endpoint reports a total.
• RequestDevNetFeaturedAppRight governance action, shipped in governance-utility-onboarding 0.4.0 and wired through the API, the CLI composer and the UI (#411). Requesting the DevNet featured-app right is now a committee vote instead of a console call.
• Kick and change-threshold now move the signing threshold and drop the kicked member's Daml key (#429). Before this a kicked member's key stayed in party_signing_keys and still counted toward the party's signing threshold.
• A peer validates every coordinator payload against the invitation its operator accepted (#417). Invitations carry each DAR's SHA-256; an invitation from an older coordinator carries none, so the peer checks filenames and warns rather than failing.

Bug fixes

• The per-party read fan-out is bounded (#416). A node hosting 213 parties was OOMKilled at 2Gi, and any parties poll faster than the 60s cache re-ran the fan-out, so an open UI could OOM-loop a node.
• The reward automation streams the coupon ACS instead of collecting it before filtering (#414)
• The approvals queue pages instead of walking a party's whole ACS on every load (#425)
• tokio-noise is pinned to the patched fork (#434). 0.0.5 replays bytes on the read path when a decrypted packet does not fit the caller's buffer. Upstream PR is conduition/tokio-noise#4.
• A restarted coordinator restores the SyncAcs payload on mismatch, not on absence, so a resumed run no longer serves the bare config in place of the command (#433)
• Decentralized parties are discovered by namespace instead of a read of every party (#412)
• The add-party card counts joined peers while a run waits for them, instead of showing 0 for the whole first step (#418)

Internal

• decman-lib: the governance domain model and the gRPC codecs are extracted into their own crate, with no change to wire behavior (#382)
• The integration test job drops fixed sleeps and serialization (#427)
• Dependency bumps (#405, #435, #437)

v1.7.0

First minor since 1.6.x. It brings the rebuilt operator UI, a Prometheus health signal for the CIP-104 reward automation, and dual-governance onboarding.

On v1.6.3: that release was cut from the release-1.6 branch, not from main, and carried only a backport — the proposal-visibility fix (#314) and the h2 advisory fix (#352), both of which originated on main. v1.7.0 contains everything in v1.6.3. Nothing needs forward-porting, and upgrading from 1.6.3 loses nothing.

Peer compatibility is unchanged: MIN_PEER_VERSION stays at 0.1.9, so a 1.7.0 node still talks to 1.6.x peers. There are no new database migrations.

New features

• Rebuilt operator UI: new sidebar, row cards, dark-first design system and a command center (#212)
• Prometheus health signal for the CIP-104 reward automation, seven instruments on a new metrics endpoint, so a stalled reassignment loop or coupons drifting toward expiry are visible before rewards lapse (#325)
• Dual-governance onboarding for the utility flow (#320)
• Audit trail gains all-activity and local-log modes (#392)
• A proposer can now cancel their own proposal, with a cancel button in the UI (#324)
• Pending approvals now shows unconfirmed proposals (#314) — already shipped in v1.6.3
• A -nonroot image is published next to the root one, running as uid 65532 (#374). The root image keeps its uid 0 base and DECPM_DIR=/, so existing pins are untouched.
• DECPM_JWT_ROLE_CLAIM accepts a provider-specific namespaced role claim, which Auth0 typically requires (#378). The standard roles, realm_access.roles and scope carriers keep working when it is unset.

Bug fixes

• POST /governance/confirm and /execute now validate the governance-type and action pairing up front and answer 400 on a mismatch, instead of letting a hand-written request reach a panic! that took down the worker
• Add-party peer signatures were silently lost when the coordinator restarted (#354)
• A kicked participant stayed in cached membership (#386)
• Vetted packages are now read from the synchronizer store, and removed or out-of-window vettings are dropped (#377)
• Topology discovery is scoped to configured parties and now discovers from all local state, so onboarded party ids are retained (#375)
• The startup IdP check failed on an Auth0-only node (#384)
• A token-fetch failure was indistinguishable from an unconfigured party (#360)
• Peer fan-out failures now name a cause instead of failing anonymously (#353)
• Domain confirmations no longer serialize a placeholder action (#364)
• Filtering parties by prefix now forces a topology refresh (#342)
• A per-party auth failure logs at warn, not error (#329)
• An absent-package sweep failure logs at trace (#335)

Internal

Test-mode wildcard query paths are removed, which fixes queries that silently returned [] (#355). Add-party gained a party-type-agnostic replication core (#380). CI now verifies the Daml upgrade lineage (#368) and the committed DARs (#347). Docs had their stale claims refreshed (#373). Plus handler and helper refactors (#359, #361, #369, #370, #338), Playwright cleanup (#348) and assorted follow-ups (#340, #341, #349, #350). The h2 advisory fix (#352) also shipped in v1.6.3.

Upgrade notes

• No database migrations. Upgrading in place needs no schema work.
• On Auth0 with the admin-role gate, set DECPM_JWT_ROLE_CLAIM to your namespaced claim.
• To move to the nonroot image, use the v1.7.0-nonroot tag and chown -R 65532:65532 the data directory. DECPM_DIR defaults to /home/nonroot there.

New contributors

• @shibaeff made their first contribution in #375
• @monsieurleberre made their first contribution in #384

Full Changelog: v1.6.3...v1.7.0
Changes since the last release off main: v1.6.2...v1.7.0

v1.6.3

What's Changed

• Backport the proposal-visibility fix as v1.6.3 by @ksrichard in #400

New Contributors

• @ksrichard made their first contribution in #400

Full Changelog: v1.6.2...v1.6.3

v1.6.2

What's Changed

• Repair checksums of post-ship-edited migrations by @scolear in #323

Full Changelog: v1.6.1...v1.6.2

v1.6.1

Highlights

Coupon-reassignment reward engine (CIP-104)

A decentralized party earns app reward coupons but has no wallet, so each round's coupons would expire unclaimed after CIP104 comes into effect. The governance now votes once to fix the beneficiary split on-ledger. After that, any single member's node routes each round's coupons to that agreed split automatically, and the beneficiaries self-mint. Rewards become a hands-off income stream, and no single operator can redirect them, because the split is baked into the voted delegation. The automation keeps running as long as any one member is online. (#255)

RegistrarDelegation for holding consolidation

New governance templates let a registrar decentralized party merge a holder's fragmented Holding contracts. One network-wide vote creates the delegation; any named operator can then run the merges or revoke the delegation. (#292)

AWS KMS party-key signing

Party-key signing now sits behind a TransactionSigner trait, and the first non-export backend lands: when a party's key is held in AWS KMS, decman signs prepared transactions through the KMS Sign API. Keys never leave KMS. Exportable vault keys keep the existing path, and a failed local signature now hard-fails the vault export instead of continuing. (#291, #303, #268, #315)

TLS for Canton connections

The Canton admin and ledger gRPC channels now support TLS, with a CA-certificate option. Previously both were plaintext-only and failed against TLS-enabled participants with an unhelpful transport error. (#276)

Covalidating External parties - Tenant API for wallet-held external parties (experimental)

A new /v0/tenant/* API onboards a sovereign external party whose namespace key is generated and held client-side by a wallet; decman never sees the private key. The party is hosted across N participants at an M-of-N confirmation threshold. A client library for wallet integrators ships alongside it. (#245, #318)

Adding a node to a running decentralized party (experimental)

The add-party flow's offline ACS import is now crash-safe: a durable in-flight marker recovers the participant after a crash, reconnection always runs, and a DAR preflight catches missing packages before the disconnect window opens. (#249)

Structured JSON logging

decman now logs JSON with indexed severity and fields, so log platforms can filter by level and alert on error rates instead of parsing ANSI-colored console lines. (#316)

Also notable: the Quantstamp final audit report is now in the repo (#269), the UI shows the CI build version (#267), Canton 3.5.11 protos are adopted (#307), and ACS/update reads use Canton 3.5.1 query pagination for large ledgers (#309).

What's Changed

• New CI pipeline by @PumpkinSeed in #265
• docs: add Quantstamp final audit report by @scolear in #269
• feat(decman): show CI build version in UI (alt to #266) by @scolear in #267
• fix(onboarding): coordinator signs P2P with its namespace key after DNS activation by @schronck in #275
• fix(config): TLS support for the Canton admin and ledger gRPC channels by @schronck in #276
• fix: support KMS-backed nodes in party key generation (spec + fingerprint) by @scolear in #268
• fix(auth): mint the grant-rights admin token from the party's own IdP by @schronck in #279
• chore(deps-dev): bump brace-expansion from 5.0.6 to 5.0.7 in /crates/decman/frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #263
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #290
• chore(deps): bump serde_with from 3.20.0 to 3.21.0 by @dependabot[bot] in #257
• feat(external-party): wallet-driven decentrally-hosted external party (tenant API) by @schronck in #245
• refactor(signing): extract party-key signing behind a TransactionSigner trait by @scolear in #291
• chore(ci): bump actions/download-artifact from 7 to 8 in the actions-all group by @dependabot[bot] in #294
• chore(deps): bump ed25519-dalek from 2.2.0 to 3.0.0 by @dependabot[bot] in #296
• chore(deps): bump base64 from 0.22.1 to 0.23.0 by @dependabot[bot] in #297
• chore(deps): bump jsonwebtoken from 10.4.0 to 11.0.0 by @dependabot[bot] in #298
• chore(deps): bump the cargo-minor-and-patch group across 1 directory with 13 updates by @dependabot[bot] in #301
• fix(ci): unbreak Cargo Audit on the unreachable rkyv advisory by @schronck in #308
• chore(deps): adopt Canton 3.5.11 protos by @schronck in #307
• feat(signing): sign with AWS KMS-held party keys by @scolear in #303
• Add RegistrarDelegation for merging registry holdings by @scolear in #292
• CIP-104 Mode A coupon-reassignment automation by @gyorgybalazsi in #255
• fix(signing): hard-fail vault export on failed local signature by @abelkocsis in #315
• Log JSON so SigNoz can index the fields by @gyorgybalazsi in #316
• fix(add-party): harden offline ACS import (crash-safe + DAR preflight) by @schronck in #249
• perf(canton): use 3.5.1 query pagination for ACS and update reads by @schronck in #309
• feat(external-party): wallet-driven tenant API + client library by @schronck in #318
• chore(decman): bump version to 1.6.1 by @scolear in #317

New Contributors

• @abelkocsis made their first contribution in #315

Full Changelog: v1.4.3-rc2...v1.6.1

Known issues and breaking changes

The image is now distroless — it contains no shell. Through 1.5.x the runtime image was busybox-based, so sh was available inside it. From this release the image holds only the dec-party-manager binary. The entrypoint (dec-party-manager serve) and the binary path are unchanged, so your main container needs no edit. But an init container, exec probe, or kubectl exec that runs sh inside the decman image now fails with exec: "sh": executable file not found in $PATH. Run those on a utility image instead:

initContainers:
  - name: setup-data-dir
    image: busybox:latest
    command: ["sh", "-c", "mkdir -p /app/data"]
    volumeMounts:
      - name: data
        mountPath: /app

Databases created before 2026-07-06 fail to start with migration 4 was previously applied but has been modified. A comment-only edit to an already-shipped migration file changed its checksum. Fixed in v1.6.2, which repairs the recorded checksum automatically on startup — upgrade straight to v1.6.2 if this affects you.