v4.0.3 — expose comet reindex-event (maintenance, optional)

Passage v4.0.3 — maintenance release

Optional, CLI-only release. Not consensus-breaking. No coordinated upgrade or governance action required — upgrade only if you want the new tooling; v4.0.2 validators remain fully compatible.

What's new

passage comet reindex-event

The v4.0.2 CometBFT bump (v0.38.23) brought event re-indexing support, but the command was not reachable from the passage CLI. This release exposes it:

passage comet reindex-event
passage comet reindex-event --start-height 2
passage comet reindex-event --end-height 10
passage comet reindex-event --start-height 2 --end-height 10

• Upstream command name, reindex_event alias, and --start-height / --end-height semantics preserved (0 = blockstore base / latest height respectively, both inclusive).
• Failures exit non-zero — upstream CometBFT prints the error and exits 0; this build returns proper exit codes so scripts can trust the result.
• Progress bar during the run and a final start_height / end_height / blocks summary.
• Re-running overlapping ranges is safe (the kv indexer overwrites the same keys).

Notes: offline tool — stop your node first. Requires stored ABCI responses (discard_abci_responses = false). Works with kv and psql indexers; refuses null.

Verified on a real-state mainnet fork: range reindex (exit 0), invalid range (exit 1), overlapping re-run idempotency (exit 0).

Checksums (reproducible rbuilder build at fb3005f)

e5021b658f691e70124009dae8fc0b5738ef110edcb74853469f536f034e781d  passage-4.0.3-linux-amd64
e4fd07e081fd90f959d84e4ade9db390db844babc92be7b5c440e7ef2f9dfeca  passage-4.0.3-linux-arm64

Passage v4.0.2 — CometBFT 0.38.23, IAVL 1.2.3, x/group

Passage v4.0.2

Scheduled upgrade following the v4.0.1 emergency fix. Three changes:

Changes

1. CometBFT v0.38.12 → v0.38.23 — restores working transaction reindexing (passage tendermint reindex-event) and picks up the accumulated v0.38.x line fixes.
2. IAVL v1.2.2 → v1.2.3 — fixes a significant performance regression (iavl#1018): getFirstVersion() never cached its result on chains with legacy-format versions — which is every chain upgraded through v4.0.0. Applied to the vendored iavl-fork on top of the existing empty-store load fix.
3. x/group — new module (new group store). On-chain multisig-style groups with weighted members, decision policies, and proposal execution.

Coordination

• This is a consensus-breaking upgrade (new store). It activates via gov software-upgrade proposal — plan name v4.0.2 — NOT a flag-day. Just stage the binary for cosmovisor (upgrades/v4.0.2/bin/passage) or be ready to swap at the halt.
• Upgrade handler name: v4.0.2 (must match plan name exactly).

Verification

Validated by real-broadcast fork-testing on forked mainnet state: gov upgrade applied (applying upgrade "v4.0.2"), module version map shows group: 2, bank/staking/distribution regression txs all code 0, and a full x/group lifecycle (create-group-with-policy → fund policy → group proposal executing a MsgSend from the policy account → vote → exec) all code 0 with balances moving correctly.

Checksums (SHA256)

e46174f14a72efe8be5bdd004144e8e8122cf620a1736b710310bb5f1acc30a7  passage-4.0.2-linux-amd64
b6e139d44d14141cc3aa1e424ba4ecaf35af01cb5af1912b6e98e930fcb9aa77  passage-4.0.2-linux-arm64

Reproducible static (musl) builds via cosmossdk/rbuilder at commit 6bfe7c412a4dead6bb2f74d5fabfd0a1f7de6fa3 (tag v4.0.2).

Build from source: git checkout v4.0.2 && make build (Go 1.22+).

v4.0.1 - emergency tx-layer fix

Passage v4.0.1 — emergency fix for the v4.0.0 tx-layer outage

On v4.0.0, no transaction of any kind can be included in a block — not staking, not IBC, not even a bank send. Signer resolution fails at CheckTx for every message, so the chain produces empty blocks (consensus is healthy; the tx layer is dead). Governance cannot fix this — a proposal is itself a transaction and is rejected too — so the remedy is a coordinated binary swap. All validators must switch at the same height or the chain forks.

Fixes (four defects from the SDK 0.47→0.50 port)

1. Address codec in InterfaceRegistry (app/params/proto.go) — the registry was built without an address codec, so signer resolution fails: InterfaceRegistry requires a proper address codec implementation.
2. Ante handler nil codec (app/app.go) — HandlerOptions.Codec was left unset, so the custom BlockAccountDecorator got a nil codec and nil-pointer panicked on every tx once (1) was fixed. (1) and (2) must ship together, or the chain stays dead — see verification.
3. ibctm / solomachine light-client registration (app/app.go) — ibc-go v8 no longer bundles the light clients; without ibctm, /ibc.lightclients.tendermint.v1.ClientState fails to decode, breaking IBC client-state queries and relayer client updates.
4. cosmwasm_1_3 capability (app/app.go) — restored the wasm capability v3.0.0 had and the port dropped.

Diff: four commits in PR envadiv/Passage3D#210.

Verification — real mainnet state, by broadcast (not generate-only)

On a fork of real mainnet state: v4.0.0 rejects a bank send (code 1); after swapping to v4.0.1 the same send is accepted and included in a block (code 0). The 10-second on-node repro and the harness are in the coordination channel.

Coordinated upgrade

Binary swap at height 19972000 (~Fri Jul 10 17:25 UTC). Build from source only from the v4.0.1 tag (carries the vendored iavl empty-store patch; unpatched trees won't load the DB). SHA256SUMS.txt attached — verify before running.

Passage v4.0.0 (SDK v0.47 -> v0.50)

Passage v4.0.0 — Cosmos SDK v0.47 → v0.50

Coordinated upgrade. On-chain upgrade name: v4.0.0. Target height 19950687 (~2026-07-09 12:00 UTC).

Enables x/circuit, expedited governance, proposal cancellation, Sign Mode Textual, AutoCLI. Handler sets min validator commission 5%, expedited voting 24h / threshold 67%, gov quorum/veto 50%, expedited min deposit 1,000,000 PASG. Includes the required iavl v1.2.2 empty-store load patch.

Real-state fork-tested on forked passage-2 mainnet state: all module migrations apply, 33/33 wasm code hashes and 79/79 contracts preserved, node produces blocks post-upgrade.

Built reproducibly (cosmossdk/rbuilder, muslc netgo ledger, static) from commit 4b687a9.

Checksums (sha256)

ad7817afcc40a0e9159e54a73aedaa71bf80e278c5c5b90e3b91c30aa3db41af  passage-4.0.0-linux-amd64
8a7c6ba6e677f5b915bb7335c3bd992f714e46e0c046e20cced9b150bead67fc  passage-4.0.0-linux-arm64

v3.0.1-querypatch

Unofficial emergency build restoring state queries after v3.0.0 broke them chain-wide (version does not exist on every LCD/gRPC/RPC query; consensus unaffected).

This is a query-path-only patch — NOT consensus-breaking. A patched node produces identical app-hashes and stays in consensus with unpatched nodes, so validators can swap the binary and restart rolling, with no governance vote.

Binary: passage-3.0.1-linux-amd64 — sha256 a45959d26f1aa6199981fc9b1d005a21a5ed64c8d7b9af4fba4438e35da61954

Apply (per validator):

1. Stop the node.
2. Replace the passage binary (cosmovisor: ~/.passage/cosmovisor/upgrades/v3.0.0/bin/passage) — back up the original first.
3. Start. Reads work immediately on that node.

Proven: deployed on the CryptoDungeon validator — balance/staking queries return real data, validator keeps signing on mainnet (fork-free).

Source (rebuildable):

• Passage3D go.mod wiring: branch passage-v3.0.1-query-fix (off the v3.0.0 tag)
• The actual fix: github.com/Ninjaxan/cosmos-sdk branch v0.47.13-passage-queryfix — baseapp.CreateQueryContext serves latest-height queries from the live store instead of the broken versioned path.
• Diff vs v3.0.0: envadiv/Passage3D@v3.0.0...Ninjaxan:Passage3D:passage-v3.0.1-query-fix

Recommend envadiv tag an official v3.0.1 from the v3.0.0 lineage. Built by Crypto Dungeon (validator: CryptoDungeon).

v3.0.0

fix: on-chain upgrade name 3.0.0 -> v3.0.0 (match v2.x naming standard)

Passage SDK v0.47 / upgrade 3.0.0 — rc.2

Passage SDK v0.47 upgrade — release candidate 2

Supersedes sdk-v0.47-rc.1 — do not use rc.1 (it was built with CometBFT v0.37.5, which is vulnerable to Tachyon / CSA-2026-001).

Built from feat/sdk-v0.47-from-v2.6.0 @ db014e0, rebased onto envadiv:release/v2.6.0-sdk-v047 (= v2.6.0 + the January CometBFT security patch).

What changed vs rc.1

• CometBFT v0.37.5 → v0.37.18 — the Tachyon-patched release for the v0.37 line, preserving the v2.6.0-patch security fix across the SDK upgrade
• cometbft-db v0.8.0 → v0.9.5, go directive → 1.22.7 (required by cometbft v0.37.18)
• Rebased onto release/v2.6.0-sdk-v047 so the PR merges clean

Unchanged

• cosmos-sdk v0.47.13, wasmd v0.45.0, wasmvm v1.5.7 (no contract-state format change), ibc-go v7.3.0
• On-chain upgrade name: 3.0.0 (handler app/upgrades/v3.0.0/) — the gov software-upgrade proposal must use 3.0.0

Validation

• go build / go mod tidy / go test ./... green
• Real-state fork test (exported passage-2 snapshot: 11,201 accounts / 79 contracts / 136 validators): gov prop → halt → swap → all module migrations → blocks past upgrade height; 33/33 wasm code hashes bit-identical post-upgrade, 79/79 contracts preserved

Binary

• passage-3.0.0-rc.2-linux-amd64, version 2.6.0-patch-4-gfa46bb6, statically reports cometbft v0.37.18 / wasmvm v1.5.7 / sdk v0.47.13 in version --long
• sha256: c1f649694784058617b22495036d9f4be84771bce4df344803c4c33aa32c364d

Validator build note

Building from source needs Go ≥ 1.22.7 (or Go ≥ 1.21 with GOTOOLCHAIN=auto). CometBFT 0.37 renames fast_sync → block_sync in config.toml.

SDK v0.47.13 upgrade (v047) — release candidate

Warning

Superseded by sdk-v0.47-rc.2. Do not use this binary.
It was built with CometBFT v0.37.5, which is vulnerable to Tachyon / CSA-2026-001 (GHSA-c32p-wcqj-j677). It also predates the on-chain upgrade rename to 3.0.0. Use rc.2.

---

Release candidate for the Passage Cosmos SDK v0.45.16 → v0.47.13 upgrade. Pre-release on the Ninjaxan fork for review/testing — see PR envadiv#204. Passage cuts the official version tag on merge.

What this is

• Built from commit 65f61ff on branch feat/sdk-v0.47-from-v2.6.0, on top of the v2.6.0 mainnet tag (the binary self-reports version: 2.6.0-2-g65f61ff — accurate: v2.6.0 + the 2 migration commits).
• cosmos-sdk v0.47.13, cometbft 0.37, ibc-go/v7, wasmd 0.45.0 with wasmvm pinned at 1.5.7 (no downgrade — existing contract state stays readable).
• On-chain upgrade name (for the gov software-upgrade proposal): v047.

Validation

Real-state fork-test against a passage-2 export (height 19527283: 11,201 accounts, 79 contracts, 136 validators): v047 applied, blocks produced past the upgrade height, 33/33 wasm code hashes bit-identical, 79/79 contracts + state preserved, gov → v1, x/consensus created. go build, make build, go vet, go test ./... all green.

Asset

File	sha256
passage_sdk-v0.47-rc.1_linux_amd64	fcbfd85734b8b4142e6133c834ef4fe5a1cd35f09b176e5e1487d7e151b357fa

linux/amd64, dynamically links libwasmvm 1.5.7 (CGO).

Validator build-from-source requirements

• Go 1.21+
• CGO enabled; libwasmvm 1.5.7 must be resolvable (make build / make install injects version ldflags)
• Linux build host

Upgrade procedure (no cosmovisor)

At the upgrade height the chain halts; then on each validator: stop the service, replace the passage binary with this one, restart. (Cosmovisor users: drop it in upgrades/v047/bin/.)

Operational note

CometBFT 0.37 renamed fast_sync → block_sync in config.toml; this binary ignores the old fast_sync key.