OathConnect 0.3.0-alpha.3 — Solana network evidence

Development preview with public Solana network receipts and reproducible finality checks. This release does not enable production use or integrate Oath Wallet.

• A free-funded 0.001 SOL transfer completed through the local relay on Solana devnet (slot 516914340). A separate transfer completed through the deployed Cloudflare relay on Solana testnet (slot 458656746). Each used one approval, one signature and one submission, with a 5,000-lamport fee and the expected recipient increase.
• Read-only reconciliation verified signatures, fixed messages, receipt effects and agreement with provider-reported finalized status. It never resubmits; provider assertions do not independently prove consensus. Earlier stopped and unsuccessful attempts remain public.
• The fixed Solana fixture pins cluster endpoints, genesis hashes and capabilities, uses unsigned simulation, retains the public signature before a single submission, and verifies the exact receipt. It is not a reusable general-purpose Solana adapter.
• Includes the earlier deployed native Sepolia receipt and adversarial finality reconciliation tests. Fuji/BNB probes were read-only and do not establish transaction qualification.
• Temporary validation access was disabled through GitHub deployment. An existing still-valid grant and a fresh grant were rejected; the private issuer file was removed.

Validation: 48 core TypeScript/Cloudflare tests, 21 Solana tests, 5 EVM finality tests, 16 Swift SDK host tests, 1 Swift fixture host test and 3 JavaScript fixture tests. CodeQL security-extended and dependency audits passed. All four exact CI package archives were installed together and checked in a fresh consumer project. Native sources remain unchanged from the earlier generic iOS build; no simulator or physical device checks were run.

Download the four package archives together; they are not published to the npm registry. SHA256SUMS covers the archives and RELEASE-EVIDENCE.json, which links the exact source, successful CI, deployment and scoped public receipts.

Remaining: other chain/method tests, THORChain swaps, operational qualification, independent security audit and remediation verification. No zero-bug or production-safety claim is made.

OathConnect 0.3.0-alpha.2 — Sepolia proof and relay quota repair

Development preview: safer provider error reporting, corrected relay quota accounting and the first confirmed restricted EVM transfer through the local relay.

• HTTP errors expose only the RPC method and numeric status; unread error bodies are cancelled. Uncertain submissions are never retried automatically.
• Capacity-rejected allocations now consume the project's global request budget. A reproduced case with 100 accepted allocations and 500 rejected ones now rejects request 601. Over-budget traffic still requires quota lookups; distributed load/cost qualification remains open.
• A fresh disposable account completed a one-wei Sepolia transfer in block 12028472 using the reusable EVM adapter, one approval/signature/submission and PublicNode. Two providers agree on the canonical receipt; the expected transfer log, gas and balance change were checked. See the dated evidence for finality scope. Earlier failed and uncertain attempts remain archived, with no resubmission.

Validation: 48 TypeScript tests, 16 Swift SDK host tests, one Swift fixture host test, three JavaScript fixture tests, dependency audits and Cloudflare dry run. Native source is unchanged from the successful generic iOS build at the previous milestone. No simulator or physical-device test. Separate internal reviews found no additional actionable issues in their stated scopes; these are not an independent external audit.

Four exact GitHub CI package archives, SHA256SUMS and RELEASE-EVIDENCE.json are attached. Install all four archives together; this is not an npm registry publication. Deployed-relay EVM tests, ERC-20 qualification, other networks, THORChain swaps and production approval remain open. Oath Wallet is untouched.

OathConnect 0.3.0-alpha.1 — EVM signing preview and execution contexts

Development preview of the restricted EVM adapter and request execution contexts. Production integration and real-funds use remain blocked.

• New @oathconnect/evm package validates exact native/ERC-20 fields, recovers the signer, checks wallet-pinned network/state and submits once. Native transfers are limited to positive sends to an existing different account; arbitrary contracts, THORChain router swaps and unqualified fee models are rejected.
• TypeScript and Swift expose an execution context for checking request lifetime after asynchronous work. Native owning-request cancellation now reaches detached adapter tasks. Swift callback signatures change; see the migration notes.
• Failed and unconfirmed Sepolia attempts are retained with the public transaction hash and read-only reconciliation. No confirmed EVM transfer or full-chain qualification is claimed. Earlier XRP/Stellar/Sui evidence remains available.

Validation: 46 TypeScript tests, 16 Swift SDK host tests, one Swift fixture host test, three JavaScript fixture tests and generic iOS compilation. Package-consumer installation uses all four release archives together. No simulator or physical-device test. Internal review is not an independent security audit.

The attached archives come from the exact main-branch GitHub verification run identified in RELEASE-EVIDENCE.json. Verify them against SHA256SUMS. These are GitHub release packages, not an npm registry publication. Oath Wallet remains untouched.

OathConnect v0.2.0-alpha.5 — live browser/native qualification

Development preview; not approved for production, real funds, or Oath Wallet integration.

• Real Chrome 155 ↔ standalone Swift macOS 27 interoperability through Cloudflare: authenticated pairing, both peer identities, one digest-bound approval/execution, Unicode reply and closure. This fixed echo uses no blockchain signing key.
• Confirmed Stellar and Sui testnet transactions through the deployed relay, with public hashes and receipts alongside earlier local evidence and live XRP evidence. No THORChain swap has been tested.
• Same-origin browser polling works with exact browser metadata and the relay’s own origin; signed admission and proof of possession remain mandatory.
• Disposable validation approval is disabled. Issuer, pairing and authorization files were removed. Source, fixtures, evidence and limitations remain public.

Automated verification: 30 TypeScript/Cloudflare tests, 14 Swift SDK host tests, one Swift fixture host test, three JavaScript evidence/file tests, CodeQL and dependency audits. No simulator or physical-device checks.

Independent security audit, remaining chain adapters/testnets, broader client runtime and operational qualification are still open. These results cannot establish zero bugs or production safety.

Assets are npm-format packages for protocol, SDK and THORChain example, with checksums and release evidence; no npm registry publication is claimed.

OathConnect v0.2.0-alpha.4 — integrator revocation and Sui evidence

This preview blocks existing relay traffic when either integrator loses approval. Both peers' issuer keys/origins are pinned and checked on every operation; observed revocation closes the session and removes queued messages. Old sessions lacking this metadata must re-pair. The relay cannot recall messages already delivered to a signer. See PR #12 and the targeted review evidence.

The release includes a confirmed fixed one-MIST Sui Testnet transfer (PR #11), in addition to earlier XRP and Stellar receipts. The Sui evidence writer now preserves separate receipts and atomically replaces its latest snapshot. These fixtures do not establish general-purpose chain adapters or THORChain swap readiness.

Verified: 28 TypeScript/Cloudflare tests, 14 Swift host tests, two evidence-recorder tests, CodeQL security-extended checks, and dependency audits. GitHub Actions deployed commit 89748be; the live health endpoint reports that commit and productionReady=false.

Package archives were downloaded from successful main-branch CI. SHA256SUMS and RELEASE-EVIDENCE.json record provenance. No npm registry publication is claimed.

Independent audit, all-chain qualification, browser/native runtime checks, and operational qualification remain open. No Oath Wallet integration or simulator/device testing was performed.

OathConnect v0.2.0-alpha.3 — approval lifetime safeguards

This development preview enforces session expiry while a signing approval is pending and rejects native task cancellation before dispatching execution. Controlled regressions reproduced the defects and now observe zero executions. See PR #10 and the checked-in lifetime review evidence.

It also includes the confirmed one-stroop Stellar Testnet payment and preserved earlier harness failures (PR #9). This is a fixed local-relay fixture, not a general-purpose Stellar signer or THORChain swap.

Verified: 26 TypeScript/Cloudflare tests, 14 Swift host tests, CodeQL security-extended checks, dependency audits, and a local generic iOS build. GitHub Actions deployed commit 205073f; the live health endpoint reports that commit and productionReady=false.

Package archives come from successful main-branch CI. SHA256SUMS and RELEASE-EVIDENCE.json record provenance. The packages are not published to npm.

Independent audit, full chain adapters/testnet coverage, browser/native runtime checks, and operational qualification remain open. No Oath Wallet integration or simulator/device testing was performed.

OathConnect v0.2.0-alpha.2 — shutdown and replay protection

This development preview prevents signing after local session closure, retains request replay protection when an application replaces its authorizer, and aligns TypeScript request encoding and byte limits with the native SDK. See PR #8 and the checked-in targeted review evidence.

Verified: 25 TypeScript/Cloudflare tests, 12 Swift host tests, CodeQL security-extended checks, dependency audit, and a local generic iOS build. GitHub Actions deployed commit b0f31f9; the live health endpoint reports that exact commit and productionReady=false.

The three npm-format package archives were downloaded from the successful main-branch CI run. SHA256SUMS and RELEASE-EVIDENCE.json record their provenance. These archives are not published to the npm registry.

This remains a preview. Independent security audit, complete chain adapters, all-chain testnet evidence, browser/native runtime testing, and operational qualification remain open. No Oath Wallet integration, simulator testing, or physical-device testing was performed.

OathConnect v0.2.0-alpha.1 — deployed protocol and native SDK preview

OathConnect provides independent TypeScript packages and a native Swift wallet package, authenticated encrypted sessions, explicit request approval, signed peer identity and an approval-controlled Cloudflare relay. It has no WalletConnect dependency. Oath Wallet has not been modified or integrated.

This is a development preview, not a production release or a zero-bug guarantee.

Validation:

• 22 TypeScript/Cloudflare runtime tests and 11 Swift host tests passed in GitHub Actions. Generic iOS compilation passed locally; no simulator/device tests were run.
• GitHub CodeQL extended JavaScript/TypeScript analysis reported no findings; npm audit reported no known vulnerabilities. This does not replace an independent audit.
• GitHub deployed and verified the exact source commit at the public preview health endpoint.
• A real XRP Ledger Testnet payment passed through the deployed relay: E3ECF650F640CA58658F2D2FA1317E4AF23158E2366026DFFA8C4376D128B544, ledger 21940233. The receipt records the tested commit. This was not a THORChain swap.
• Live revocation rejected an existing grant after its project was disabled. The disposable issuer key was removed. No active hosted integrator approvals remain.
• Solana devnet funding returned HTTP 410 before signing. Other chain transactions and every THORChain swap remain unverified.

The three npm-format archives below were built by the linked GitHub verification run. Install the protocol and SDK archives together; they are not claimed to be published on npm. Swift clients can pin this release tag. Check SHA256SUMS and RELEASE-EVIDENCE.json.

Verification · Deployment · Production qualification milestone

Protocol and relay alpha 1

TypeScript integration preview

Build with npm run build. Workspace packages export ESM and TypeScript source types. Published prerelease artifacts are development previews, not npm production packages.

Pairing

Website: call createIdentity() for the admission proof key and createPairing(trustedRelay). Obtain a short-lived grant from your approved backend bound to the invitation session, local proof public key, role and exact origin. Construct RelayClient, call create(invitation.expires), and render pairing.uri as a local QR. Never send that URI to third-party rendering or analytics services.

Wallet: require an explicitly trusted relay, call joinPairing(uri, trustedRelay), obtain its wallet grant with a fresh proof identity, construct RelayClient, and call join(hello). The website polls hello() and authenticates it with pairing.accept(hello).

Construct Session(channel, relayClient) on both ends. Website calls propose(capabilities) and the wallet calls approveSession(localDecision). Only the exact approved subset is usable. Each entry specifies a CAIP-2 chain, an exact address and method list. This draft expects the website to know the desired account; privacy-preserving wallet-selected account discovery is not implemented yet.

Signing requests

The website calls request(capability, method, params). The wallet registers WalletAdapters by exact chain/method, constructs a WalletAuthorizer using the negotiated capabilities and its local approval UI, then calls serveOnce(authorizer).

An adapter must decode the actual transaction and validate the network, sender, recipients, amounts, fees and all contract/approval effects. It returns a review bound to digest(canonical(request)). The local user decision must return the same digest. Only then can execute() access the wallet's own signing engine. Unknown formats are rejected. No signing engine, private key import or seed handling is provided by the connection SDK.

The test adapter demonstrates transport and approval control flow only. It does not prove blockchain signing correctness. Integrators must implement and audit chain adapters; a chain listed in the compatibility inventory is not an audited adapter.

Lifecycle

Only one operation may run per endpoint at a time. Sessions expire after at most an hour, requests after two minutes, grants after five minutes. Refresh grants through the integrator backend without changing the proof key. Call close() on lock, logout, account/network changes or disconnect; revoke the local authorizer too. Endpoints do not persist encryption keys/counters. On process restart, timeout or ambiguous delivery, re-pair. Never automatically retry a request that might already have signed or broadcast.

The minimal SDK polls every two seconds with bounded mailboxes. Push notifications, background wakeup, session resumption and account discovery are deliberately not advertised as completed features.

Foundation: scope, license and security gates

Milestones

Every release is a prerelease until the readiness gates are satisfied.

1. Public foundation: scope, license, threat model and release gates.
2. Protocol: bounded schemas, authenticated pairing, encrypted frames, conformance tests.
3. Relay: approved admission, proof of possession, isolated mailboxes, quotas/expiry/revocation, Cloudflare runtime tests.
4. SDKs: website/wallet session lifecycle, permissions, native interoperability and integration examples.
5. Delivery: CI, GitHub-controlled deployment, public version provenance and adversarial testing.
6. Network qualification: per-chain real testnet evidence and THORChain example; independent audit and production decision.

Unfinished milestones must not be labeled complete to justify a version tag.