Release Checklist

Stressnet stable for 4 consecutive weeks (Phase 7.7)

~~Prerequisite of stressnet ENTRY: K_COVER sealed~~ RETIRED 2026-07-19 (docs/completed/ARCHIVAL_REWARD_GATE_M1.md §13): the gate and the collective reward-withholding concept are retired by ruling — reward withholding is individually-caused only (slash, onset, holdings shape, claim expiry). No seal act remains; the machinery-removal implementation PR is tracked in docs/FOLLOWUPS.md. The stressnet-entry prerequisite this row guarded is dissolved (the gate has only ever run as the k_cover = 0 identity, so no activation boundary exists to exercise).
All stressnet acceptance criteria met (see tests/stressnet/README.md)
Zero tree root divergences for full 4-week run
Block validation p95 < 500ms sustained
Verification cache hit rate > 95% sustained
Stressnet summary report archived
Stressnet artifact links recorded in release notes (metrics dashboards, logs, and report commit hash)

4-scalar leaf circuit audit completed (Phase 9)

Audit engagement initiated after stressnet gate
No critical or high findings in final report
All findings remediated and re-verified
Written security assessment report archived (see docs/AUDIT_SCOPE.md)
Audit artifact links recorded in release notes (report URL or digest, remediation PRs)

Security audit

Code audit

Genesis address format: PQ signing anchor (address v2) — CLOSED 2026-08-16. Fork (ii) SELECTED by SM-R-8 (2026-08-08); freeze-window signed 2026-08-13; layout + vectors landed 2026-08-15 (in-place 0x01, ADDRESS_DERIVATION_V2); R6-a verify gate lifted. See child rows.

192f UX gate (owner: R. Dawson, release owner) — CLOSED 2026-08-13 by release-owner ruling: 192s stands. Closed by decision, not by test: no floor-hardware UX test was run and none is planned. The ~4.3 s session figure was accepted deliberately at SM-R-8 ratification for a rare, deliberate operation ("4 seconds feels like something important is being done"); 192f was only ever pre-priced as a fallback if pre-freeze UX testing found 4 s intolerable, and no such testing exists. Reopen: only if pre-freeze UX testing is actually run and comes back bad. After the freeze the s→f swap stays foreclosed as stated (same length, different scheme — a format change no later round can make). Fallback record retained: 192f = 171 ms floor signing at ~47.7 KB armored.
Genesis-lane freeze-window sign-off on the v2 layout — SIGNED 2026-08-13 (R. Dawson, release owner). The 48-byte SLH-DSA-192s public-key fourth field in the classical segment is the committed frozen wire field, exactly as SM-R-8 ratified it. This row records the ratified position; it decided nothing new.
Address v2 layout + test vectors landed (ADDRESS_DERIVATION_V1 successor) — 2026-08-15. Applied as an IN-PLACE correction by ruling: version byte stays 0x01, the classical segment is version ‖ spend ‖ view ‖ msg_sign_pk(48) (113 B; bound form 129 B), and the 65-byte draft layout is deleted everywhere (multisig MULTISIG_ADDRESS_VERSION precedent — never deployed beyond the pre-genesis test estate). Successor corpus ADDRESS_DERIVATION_V2 regenerated + freeze-hash re-pinned; the persisted wallet-envelope field keeps the 65-byte version‖spend‖view PREFIX so every existing wallet file stays openable. Persona receive addresses carry a per-slot key under the new seventh archival-P label (shekyl-archival-p-msg-sign-slh-dsa-192s-v1, registry row + census bump) — uniformity, not a new capability. The SM-R-6 R6-a verify gate is LIFTED: verify_message is live end to end and the interim -29803 code was retired unused
Message-signing round unblocked — 2026-08-13, by the sign-off above. PR-SM-2's address-integrated verify freezes against the signed-off layout; the SM-R-6 R6-a type-gate lifts in code once the v2 layout row above lands.

Release-asset manifest signing wired into the gitian job (CBOM §6, SA-6; owner: R. Dawson, release owner) — the policy is NOT open: docs/SIGNING.md rules it (GPG; the Shekyl Foundation institutional key — certification-only primary stored offline with the sec# stub check as a verifiable invariant, hardware-token-held signing subkey requiring physical possession + PIN, personal-key fallback documented; the primary/subkey split means a lost token never compromises the identity). The earlier three-way scheme framing (2026-08-14) overstated the gap. What remains is the wiring half, which tag-signing does not close: SIGNING.md governs the release tag (authenticating the commit the release was cut from), while the gitian job publishes assets that carry no signature — a user who downloads shekyld and runs it has verified nothing. Owed before the first non-RC release tag: the signed SHA256SUMS manifest ceremony — the Foundation signing subkey signs one manifest of asset hashes (same key, same hardware-token ceremony as tags; composes with reproducible builds). The ceremony is scripted: scripts/release/sign_release_assets.py (see docs/SIGNING.md §Release assets) — it enforces the key-hygiene invariants before signing, round-trip-verifies before upload, and doubles as the downstream verifier (--verify-only). Because the subkey is token-held the ceremony is the release owner's local act, not a CI step; this row checks when it has been exercised on a real release. Cutting a release with this row unchecked is the failure the row exists to prevent (docs/CRYPTOGRAPHIC_INVENTORY.md §6).

PQC specification frozen

docs/POST_QUANTUM_CRYPTOGRAPHY.md matches implementation — updated in PR-SA-2 to the nested combiner (v2, 64-byte domain-separated preimage), Result<()> verify, and the v2/frozen-v1 test-vector split
canonical transaction/signature serialization documented
signed payload definition documented
V4 PQC Privacy Roadmap published
Hybrid signature construction frozen (SA-2, SIGNATURE_ALIGNMENT.md): the nested combiner (HYBRID_SIG_VERSION = 2, PQ-inner / Ed25519-outer over a domain-separated preimage) and the per-surface SCHEME_DOMAIN_* strings are consensus-visible on bonded/settlement surfaces (bond-post auth, attestation witness, emission auth). After genesis a change here is a hard fork; the version byte is the security boundary. Landed pre-genesis in PR-SA-2.
Bond-preimage reconciliation closed (SA-2b, SIGNATURE_ALIGNMENT.md §2.2): the P-role replay analysis found the surface-A whole-tx hash (which binds the vin type tag) forecloses cross-role replay, so generic won. The bond vin's pqc_auths slot signs the generic surface-A payload hash; S1 + signature_preimage + SCHEME_DOMAIN_BOND_POST deleted. No wire change. Landed pre-genesis in PR-SA-2b.

PQC crypto review

hybrid sign/verify implementation reviewed (external audit pending)
FFI ownership / zeroization reviewed (external audit pending)
test vectors generated and archived (PQC_HYBRID_V2_KAT.json: 6 pinned positives, one per signing surface — bond-post's dropped in SA-2b, §2.2 — with cross-surface rejection; frozen v1 parse-rejection fixture; 3 negative vector integration tests)

PQC interoperability verification

wallet sign/daemon verify path tested
malformed hybrid signature rejection tested (3 negative vector integration tests)
encoded transaction size impact measured (5389 bytes pqc_auth per input via pqc_auth_weight())
payload limit guidance documented in V3_ROLLOUT.md

Ledger integration — deleted 2026-10-01 (docs/HARDWARE_WALLETS.md). There is no in-tree backend to finish. Reopen only when a device ships the V4 primitives that doc names.

Trezor integration — deleted 2026-08-18 (docs/HARDWARE_WALLETS.md). Same reopen criterion. The software device is the key helper the daemon calls, and it does not carry FCMP offload hooks.

Shekyl Stats

Network

Chain

Rewards

Supply

Economics

Staking

Protocol

Node

Release Checklist