v1.13.0

A wallet-held party that signs with an ECDSA key can now be co-validated, and an operator can check and repair DAR vetting across a party's hosts from the packages page.

No peer compatibility break. WIRE_VERSION is unchanged and MIN_PEER_VERSION stays 0.1.9. Partner nodes sign the same payload they always did.

No new migration. 1.13.0 runs on a 1.12.0 volume as is.

The tenant API accepts a party key that is not Ed25519. add-hosts/onboard and threshold/onboard labelled every wallet signature as Ed25519, so a party whose key is secp256k1, P-256 or P-384 was refused by Canton with an opaque INVALID_ARGUMENT. The host now reads the signer's key off the party's authorized mapping and labels the signature with the matching algorithm. An ECDSA signature may arrive as the fixed-width r || s pair, which the host re-encodes as DER, or as DER itself; DER is recognised by its structure, not its length. The form check that refused anything but 64 bytes follows the same rule, and the threshold path gets that check too. Initial onboarding and local-party key adoption still take Ed25519 only, because their request carries a raw key with no spec (#507).

A party page can check its hosts' DARs. A Check DARs action opens the packages page with the party's hosting participants selected and compared. The packages page gets a participant selector, and GET /packages/compare-peers takes an optional participants list. A selected host that is not a configured peer still compares, because its vetting is read from the synchronizer (#486).

The packages page tells an older version from a missing package. Each comparison cell now reads match, other version with the versions the peer vets, missing, unknown or unavailable. The search takes a pasted list of names, and Splice, Utility and Registry chips add a whole package group. A summary counts the differences for the selection, and a Differences only switch hides the rows that match (#487).

A mismatch can be fixed from its cell. A cell that is missing or at another version gets a Distribute button for admins. POST /dars/distribute-package takes { package_id, peer_ids }, finds the DAR on this node that holds the package, and runs the usual distribution to those peers. The peer still accepts or rejects the DAR in its feed. A host with no peer row cannot receive one, so its button is disabled (#488).

The dec party page shows who governs the party. A new Governance section lists the members and the additional proposers with their roles, the threshold next to the member count, the confirmation timeout, the governance party, and the rules contract with its package. GovernanceState gains additional_proposers, read as an empty list from a rules contract that predates the field (#502).

The Authentication section says whether this node's party is a governance member. A green token used to prove only that the node held the right ledger rights. A node could show all green and still confirm nothing, because its member party was missing from GovernanceRules.members. The section now shows member, not a member with a warning, or unknown (#480).

Execute sends only the confirmations Canton will count. The UI sent every confirmation cid, and one expired entry next to a live quorum made the Execute fail. Both governance action DTOs gain executable_confirmation_cids: confirmations that expire more than 30 seconds out and whose confirmer is a current member. confirmation_count and can_execute count the same set (#483).

A peer checks a party proposal against the chain. A peer only checked that its own namespace and Daml key were present, so a coordinator could swap the owner or key of a member that does not sign this round. check_party_proposals now reads the party's namespace definition and PartyToParticipant from the synchronizer and requires the proposal to be the expected delta: nothing changes for a threshold change, exactly one owner and key leave on a kick, at most one owner and key join on an add (#484).

GET /contracts/query can return decoded fields. With include_payload=true each contract carries a payload: the create arguments for a template query, the queried interface's view for an interface query. The JSON renders exactly like the audit trail's details. Without the parameter the response is unchanged (#491).

Three form fixes. Changing the proposal type resets the form to that type's defaults, so a value typed for one type no longer lands in the next type's payload (#500). The reward beneficiaries form refuses a list the instrument template would reject, and the server now rejects an empty list instead of letting the proposal pass the vote and fail at execution (#498). A pasted party id is committed when its input loses focus, so Deploy includes it without an Enter (#485).

Starred parties stay on top. Each row on the Decentralized Parties tab gets a star. Starred parties sort first, in a stable order, and the choice persists in the browser. Enter on the star or hide button no longer opens the party (#503).

API

• GET /packages/compare-peers takes an optional comma-separated participants list. Without it the endpoint compares every configured peer, as before (#486).
• POST /dars/distribute-package and GET /packages/expected-versions are new (#488).
• GET /contracts/query takes include_payload=true; the payload key is absent otherwise (#491).
• GovernanceAction and DomainGovernanceAction gain executable_confirmation_cids. An older client that sends every confirmation keeps working (#483).
• GovernanceState gains additional_proposers, defaulting to empty (#502).
• POST /auth/grant-rights returns 422 when the IdP rejects the pasted admin client id or secret, 503 with the IdP's Retry-After when it is rate limited, and 502 when it is down. Seven governance handlers return 404 instead of 401 for a party with no configured credentials. A 401 means an expired session again, which is what the UI treats it as (#481).
• On the packages page the data-status values mismatch became other_version and missing; match and unreachable are unchanged (#487).

Operations

• POST /governance/propose and the CLI reject an empty reward beneficiary list (#498).
• Partner nodes that host a party with an ECDSA key need this release before a wallet-signed add-hosts or threshold change succeeds on them (#507).
• docs/CUSTOM_DAML_TEMPLATES.md gains three execution gotchas: a failed executeImpl leaves the proposal open, a non-member proposer fails at the first confirmation, and every member's node stores what the governance party sees (#490). It also documents a pattern for business sign-offs checked at execute time, built on GovernableAction (#493).
• A partial ?prefix= on GET /decentralized-parties is pinned by regression tests against Canton; no behaviour change (#482).