Changelog

2026-10-18

• API (Queued Secure Event Acknowledgement): add_secure_event (hierachain/api/admin/endpoints.py) stamps event/timestamp, retains the signed content in event_data["signature_content"] before journaling, returns SecureEventResponse(status="queued") with the ordering event ID in event_hash and the acknowledgement time in timestamp, and maps OrderingBackpressureError to HTTP 503 ({message, event_id, journaled}) plus ValueError to 422; SecureEventResponse (hierachain/api/admin/schemas.py) now describes status as queued with asynchronous block commitment — responses no longer report "committed", so clients that awaited a committed status must treat the acknowledgement as queued and await block commitment.

2026-10-15

• Packaging (Drop Python 3.10 Support): requires-python in pyproject.toml rises from >=3.10 to >=3.11 with the 3.10 classifier removed; Ruff target-version moves to py311, Black drops py310, Mypy python_version moves to 3.11, the CI compatibility matrix in .github/workflows/test.yml covers 3.11–3.14, and uv.lock is regenerated — environments still on Python 3.10 must upgrade to 3.11+ before installing this checkout.

2026-10-06

• Config & Core (Remove Unused Cache Metadata): Remove Settings.ADVANCED_CACHING_ENABLED, BLOCK_CACHE_SIZE, EVENT_CACHE_SIZE, ENTITY_CACHE_SIZE, BLOCK_CACHE_POLICY, EVENT_CACHE_POLICY, ENTITY_CACHE_POLICY, ENTITY_TTL, and hierachain.core.cache.DEFAULT_CACHE_CONFIG. Direct imports/accesses must migrate to actual cache-instance or service configuration; these names had no runtime consumers. AdvancedCache, KeyManager caches, and Ordering's block_cache_size retain their behavior. BFT node-count validation now receives node IDs directly without generating wrapper classes; quorum validation is unchanged.
• Error Mitigation (Advisory Logs): Capacity log events become consensus_capacity_recommendation (both payload and wrapper) and resource_capacity_recommendation; update filters for auto_scaling_triggered, consensus_scaling, and resource_scaling_triggered. Remove the fictitious key_rotation_scheduled event and next_rotation deadline. Public methods, legacy configuration, Parquet paths, BFT quorum checks, and retained-key AES-256-GCM behavior remain unchanged; provisioning and rotation belong to the host application.
• Consensus (Ordering Processor Consolidation): Remove OrderingExecutor (hierachain/consensus/ordering/processor.py) and fold process_batch()/process_single_event() into OrderingProcessor; __init__ takes a typed OrderingService and reads event_pool/pending_events/metrics/certifier/block_builder/storage_handler/should_stop/config live off service instead of caching attribute copies, with -> None annotations on lifecycle methods. Direct imports of OrderingExecutor and access to processor.event_pool/processor.should_stop/processor.executor (and sibling cached attributes) must migrate to processor.service.* or process_batch/process_single_event on the processor; certification/batch/replay flow (process_replayed_event() with allow_stale_timestamp) is unchanged.

2026-10-05

• Consensus & Config (PoA Interval Opt-in, No Implicit Delay): ProofOfAuthority.__init__ (hierachain/consensus/proof_of_authority.py) defaults block_interval from 10.0 to 0.0 (None = 0.0), rejects non-finite/negative values with ValueError, and _check_block_timing() only enforces explicitly configured spacing while still rejecting decreasing timestamps; Settings.BLOCK_INTERVAL (hierachain/config/settings.py) changes the HRC_BLOCK_INTERVAL default from "10.0" to "0.0" — previously forced a 10s spacing delay unless overridden.
• Channel (Durable Append-only Ledger Stream): ChannelLedger (hierachain/hierarchical/channel/ledger.py) replaces the _persist callback with bind_storage() requiring append_channel_record/load_channel_records, appends typed event/block records guarded by expected_sequence plus registry revision, adds refresh()/_replay_record() with trusted-key block validation rolling back only newly applied records, and shares _validate_block()/_validate_pending_event() between restore() and replay; Channel (hierachain/hierarchical/channel/channel.py) refreshes the ledger inside _registry_operation, records stats via _record_event_statistics() skipping events without submitter_org, and drops manual rollback in add_event()/finalize_block() — previously persisted via opaque callback with full-state rollback.
• Hierarchy (Split Recovery/Registry & Versioned Ledger Seeds): HierarchyManager (hierachain/hierarchical/hierarchy_manager/base.py) delegates main-chain replay/sub-chain restore to new hierarchy_manager/recovery.py and snapshot persist/restore/apply to new hierarchy_manager/registry.py, stops embedding channel-ledger snapshots in the registry state, persists channel ledgers atomically with the registry revision via _channel_ledger_version seeds written through append_channel_record/load_channel_records (bound ledgers restart at sequence 1), validates the full snapshot before mutating coordinator objects, and migrates legacy snapshots in place with 3-attempt retry — previously stored monolithic snapshots with embedded ledger data.
• Database (Channel Ledger Tables & Atomic Registry+Ledger Write): new ChannelLedgerSQLStorage mixin plus create_channel_ledger_tables() (hierachain/adapters/database/channel_ledger_sql.py) gives SQLBase (SQLite/PostgreSQL) append_channel_record/load_channel_records with registry-revision and ledger-sequence guards (channel_ledger_heads/channel_ledger_records tables created in postgres_schema.py/sqlite_schema.py); save_hierarchy_registry() accepts channel_ledgers and commits registry plus ledger seeding in one transaction (commit moved out of _execute_save_hierarchy_registry, Postgres placeholder/lock/BEGIN IMMEDIATE overrides); RedisStorageAdapter (hierachain/adapters/database/redis_adapter.py) adds WATCH/MULTI ledger seeding/conditional append/suffix reads and fixes load_hierarchy_registry key handling — previously had no channel-ledger storage and committed registry alone.

2026-10-04

• Serialization (Strict stdlib JSON, No orjson): new hierachain/serialization.py (dumps_json/loads_json/dumps_canonical_json) replaces orjson across ~40 modules (hierachain/adapters/database/base/sql_adapter.py, hierachain/adapters/database/postgres_adapter.py, hierachain/adapters/database/redis_adapter.py, hierachain/core/block.py, hierachain/core/blockchain.py, hierachain/core/merkle_tree.py, hierachain/network/zmq_transport.py, hierachain/network/message_cryptographic.py, hierachain/security/*, hierachain/api/**/*, hierachain/sdk/client.py, hierachain/sdk/async_client.py, hierachain/consensus/ordering/utils.py, hierachain/error_mitigation/*, hierachain/monitoring/*, hierachain/risk_management/types.py, hierachain/config/*, hierachain/cli/key.py) with compact (",", ":") encoding, allow_nan=False, integer preservation, and NaN/Infinity rejection; RedisEventManager raises RedisStorageError on malformed/missing event records instead of returning [], and SQLite _execute_delete_chain now deletes proofs rows alongside events/blocks/chains — previously serialized via orjson, tolerated non-finite floats, silently skipped bad Redis records, and left proofs behind.
• Core (Cache MutableMapping & Key Coercion): AdvancedCache (hierachain/core/cache.py) now implements collections.abc.MutableMapping[str, Any] instead of subclassing dict, drops keys() -> list[str] in favor of __iter__, coerces every key via str(key) in get/set/delete/contains/__getitem__, distinguishes stored None from missing via a sentinel in __getitem__, and only evicts when evict_key is not None — previously behaved as a dict with uncoerced keys, conflated None values with misses, and skipped falsy eviction keys.
• Hierarchy (Durable Channel Ledger & Signed Registration Rebuild): Channel.__init__ (hierachain/hierarchical/channel/channel.py) accepts node_identity/trusted_public_keys and builds a signed ChannelLedger(node_identity, trusted_public_keys, channel_id); ChannelLedger (hierachain/hierarchical/channel/ledger.py) adds snapshot()/restore() with full signature/sequence/channel_id validation, threading.RLock, _save() fail-closed persistence with rollback on add_event/finalize_block, deepcopy isolation plus channel_id/timestamp stamping, and Channel.restore_statistics(); HierarchyManager (hierachain/hierarchical/hierarchy_manager/base.py) lazily acquires transaction_manager (raising RuntimeError when closed), adds close(), and rebuilds registered_sub_chains/sub_chain_metadata/authorities from signed sub_chain_registration MainChain events with finite-timestamp, metadata-shape, and domain-conflict checks — previously accepted unsigned/unchecked ledgers and re-appended registrations on every restart.
• Consensus (Canonical Digest & Strict Quorum Pipeline): hash_request (hierachain/consensus/bft/types.py, hierachain/consensus/bft/helpers.py) uses dumps_canonical_json with new _request_digest_is_valid(); BFTConsensus/BFTConsensusEngine (hierachain/consensus/bft/consensus.py, hierachain/consensus/bft/engine.py) deepcopy operations/messages, block new proposals while pending_apply_events is non-empty, reject duplicate PRE_PREPARE sequences, record the local PREPARE vote before broadcast via record_local_prepare_vote(), enforce in-order commit (seq == committed_sequence + 1, buffering futures, draining after recovery), and persist/apply via _build_consensus_event with retry; OrderingService (hierachain/consensus/ordering/service.py) adds stable ID generation for cross-tier checks — previously hashed str(operation), allowed overlapping proposals/out-of-order commits, and mutated shared messages.
• Domain & Sync (Transactional Projections & Canonical Lockdown Signatures): BaseChain (hierachain/domains/chains/base_chain.py) serializes register_entity/operation handlers under lock, gates on _domain_projection_healthy, persists initial_data_json (canonical bytes) for restart rebuild_domain_state() with event_id-then-content dedup and domain_projection_errors, tracks custom vs default handlers, and isolates payloads via deepcopy/snapshot cloning in CrossChainValidator (hierachain/domains/utils/cross_chain_validator.py); DomainChain/TxManager (hierachain/domains/chains/domain_chain.py, hierachain/domains/chains/tx_manager.py) replay projections from the accepted log; CrossLevelSyncManager (hierachain/cluster/cross_level_sync.py) adds RLock plus _operation batch context with active-operation tracking, and LockdownMessageGuard/lockdown_types.py bounds admission with replay tracking while signatures move to strict JSON helpers — previously mutated shared state without locks, lost initial data on rebuild, and signed via orjson, invalidating old signatures.
• API (Enforced Auth, Permissions & 501 Stubs): strict JSON helpers replace orjson in hierachain/api/* (hierachain/api/ledger/blocks.py, hierachain/api/ledger/chains.py, hierachain/api/ledger/events.py, hierachain/api/ledger/schemas.py, hierachain/api/graphql/resolvers.py, hierachain/api/graphql/types.py, hierachain/api/storage/*, hierachain/api/websocket/*); graphql_handler.py adds async execution with permission checks and context auth, websocket/endpoints.py enforces subscription auth, business/contracts.py/business/private_data.py return HTTP 501 for unimplemented contract/private-data execution, ledger endpoints apply stricter query-parameter validation, and depds.py/server.py add hierarchy-manager closure/lifecycle helpers — previously allowed unauthenticated GraphQL/WS paths, silently stubbed unimplemented endpoints, and accepted loose query params.
• CLI & Config (Unified Node Config & Master-Key Removal): load_chains_from_file replaced by load_node_config(ctx, config) (hierachain/cli/store.py, hierachain/cli/__init__.py) with YAML/JSON support, settings.CLI_CONFIG_FILE default changed from chains.json to data/config.yaml, and create/list_chains/add_event/show_events/init_node (hierachain/cli/chain.py, hierachain/cli/event.py, hierachain/cli/node.py) apply stricter validation plus durable get_hierarchy_manager(); Settings (hierachain/config/settings.py) removes MASTER_KEY_SOURCE/MASTER_KEY_FILE (HRC_MASTER_KEY_SOURCE/HRC_MASTER_KEY_FILE now raise ValueError), loads dotenv via HRC_ENV_FILE at import, centralizes parsing in _first_nonblank_environment_value()/_environment_csv() (HRC_NODE_ID/NODE_ID, HRC_P2P_PORT/NODE_PORT, HRC_PEERS/PEERS, HRC_REDIS_HOST/REDIS_HOST, HRC_REDIS_PORT/REDIS_PORT), and drops master_key from diagnostics — previously accepted legacy chain files, defaulted to chains.json, and silently ignored unsupported key sources.
• Journal, Network, Audit & ERP (Fail-closed Strictness): TransactionJournal (hierachain/error_mitigation/journal.py) walks directories via pinned descriptors rejecting symlinks (O_NOFOLLOW, 0600/0700), holds POSIX fcntl write exclusivity, serializes via strict helpers, extends the journal envelope with fields/details, and rolls back failed writes; DataValidator (hierachain/error_mitigation/data_validator.py) tightens schema compatibility; SecureConnectionManager (hierachain/network/secure_connection.py) adds timestamp/nonce replay protection with strict certificate/org/signing-key alignment and rejects stale/unsolicited handshake acks; ArrowAuditStorage (hierachain/risk_management/audit_logger.py, hierachain/risk_management/__init__.py) adds AuditReadResult/AuditIntegrityStatus, normalizes stored events, and raises instead of silently failing with enhanced legacy handling; ERP (hierachain/integration/enterprise.py, hierachain/integration/erp/base.py, hierachain/integration/erp/change_detector.py, hierachain/integration/erp/mapping.py) deepcopy-isolates profiles/metadata, validates config/key_fields/detect_changes, and enforces simulation mode for synthetic fixtures — previously allowed symlinked paths, concurrent writers, stale handshakes, silent audit drops, and mutated shared ERP profiles.

2026-10-03

• Database (Registry Revision Guard): SQLBase.save_hierarchy_registry() / RedisStorageAdapter.save_hierarchy_registry() (hierachain/adapters/database/base/sql_adapter.py, hierachain/adapters/database/postgres_adapter.py, hierachain/adapters/database/redis_adapter.py) now require state["_revision"] to be a new str distinct from expected_revision (SQL conditional INSERT/UPDATE on the stored _revision, Redis WATCH/MULTI compare, Postgres %s dialect override) and reject missing/unchanged revisions — previously accepted any snapshot and overwrote unconditionally.
• Hierarchy (Optimistic Concurrency & Admin Enforcement): _persist_hierarchy_registry() (hierachain/hierarchical/hierarchy_manager/base.py) stamps a uuid4 _revision and rejects stale saves via expected_revision, get_organization()/get_channel()/_restore_hierarchy_registry() refresh from persisted state (raising on missing/invalid snapshots), and new _apply_hierarchy_registry()/_mutate_registry() retry with rollback; _build_channel_orgs() (hierachain/hierarchical/hierarchy_manager/organization.py) now takes a registered dict instead of the manager, and register_organization_member(..., actor_user_id) raises PermissionError via shared _is_organization_admin() for non-admins — previously overwrote newer state and allowed any caller.
• Channel (Live Refresh & ACTIVE Gate): Channel (hierachain/hierarchical/channel/channel.py) serializes registry operations via _registry_operation RLock with live _refresh_registry() before each call (org add/remove, private-collection creation, event query/info, policy update, suspend/resume), and submit_event() returns False when status != ACTIVE before role resolution — previously served stale membership and accepted events on non-active channels.
• Ordering (Backpressure, Timeout & Gap Detection): OrderingService (hierachain/consensus/ordering/service.py) validates enqueue_timeout (0 < timeout <= 60, default 1.0) raising ValueError otherwise, reserves queue capacity before the journal write via _enqueue_event() raising OrderingBackpressureError(event_id, journaled) (hierachain/consensus/ordering/types.py) when full/inactive, and OrderingStorageHandler._load_from_db() (hierachain/consensus/ordering/storage.py) loads via get_blocks_from_index() raising ValueError on index gaps — previously queued unconditionally and stopped silently at the first missing block.
• API (Backpressure 503 & Admin 403): add_event (hierachain/api/ledger/events.py) maps OrderingBackpressureError to HTTP 503 with {message, event_id, journaled} for client retry; register_organization_member (hierachain/api/business/organizations.py) reuses shared _is_organization_admin() and maps manager PermissionError to 403 while forwarding actor_user_id — previously backpressured events surfaced as generic errors with duplicated inline admin checks.
• Core (Block Event Snapshot): Block.to_event_list() (hierachain/core/block.py) converts the verified Arrow table on every call returning an independent snapshot, dropping _cached_events memoization and __slots__ entry (plus _block_from_dict cleanup in hierachain/consensus/ordering/storage.py) — previously returned a shared mutable cached list that could drift from underlying events.

2026-10-01

• Error Mitigation (Retained Keys & Strict Validators): EncryptionValidator (hierachain/error_mitigation/encryption_validator.py) now resolves a caller-managed 32-byte key by key_id via key_resolver (no ephemeral os.urandom fallback) with AAD-bound AES-256-GCM (algorithm/key_id/timestamp), adds decrypt_data() with bytes/tag-IV length/algorithm/finite-timestamp checks, and masks failures behind generic SecurityError; _run_single_custom_validator (hierachain/error_mitigation/data_validator.py) enforces (bool, str) return and promotes validator failures/exceptions from warning to add_error with field name — previously passing validations now fail.
• ERP (Fail-closed Transformers): EventTranslator (hierachain/integration/erp/mapping.py) shares the caller's MappingEngine (hierachain/integration/erp/base.py) so registered transformers apply consistently, and unknown transformer names raise MappingError instead of silently returning the input value.
• Cluster (Quarantine Signature Payload): QuarantineReport.compute_signature (hierachain/cluster/lockdown_types.py) signs the full orjson sorted-keys payload instead of node_id:timestamp:last_block_index, from_dict() validates msg_type/lockdown_type and rejects non-finite timestamps before signing, and verify_signature() returns False on missing/invalid signatures instead of raising — previously issued signatures no longer verify.
• Config (AWS Secret JSON Field): _get_from_aws/SecretManager._get_aws (hierachain/config/secret_manager.py) parse SecretString as a JSON object via orjson and return the validated string field named by key, requiring HRC_AWS_SECRET_NAME as the SecretId instead of falling back to key — non-JSON secrets, non-string fields, and missing secret names now return None.

2026-09-30

• Domain (Strict Resource Allocation): BaseChain.add_domain_event (hierachain/domains/chains/base_chain.py) now rejects events for unregistered entities and invalid resource transitions via _can_apply_resource_allocation() (event type must equal resource_{allocation_type}, membership checks for assigned/reserved/released/transferred including target_entity_id existence); ResourceAllocationEvent.is_valid (hierachain/domains/events/custom_events.py) requires non-empty target_entity_id distinct from entity_id for transferred — previously accepted events now return False.
• Validator (Strict Proof Fields): ProofValidator._validate_single_proof (hierachain/domains/utils/cross_chain_validator.py) requires sub_chain_name/proof_hash to be non-empty str and timestamp to be a positive non-bool int/float, recording missing_proof_fields with an inconsistent_proofs increment instead of silently skipping field-less proofs.

2026-09-29

• Core & Hierarchical (Strict Event Validation): Blockchain.add_event (hierachain/core/blockchain.py) and SubChain.add_event (hierachain/hierarchical/sub_chain/base.py) now enforce validate_event_structure() (plus dict type check in SubChain) and raise ValueError on invalid structure; ledger add_event (hierachain/api/ledger/events.py) maps it to HTTP 422 instead of accepting malformed events.
• API (Fail-closed Redis Rate Limiting): RedisRateLimiter moved to (hierachain/adapters/database/redis_rate_limiter.py) with check()/RateLimiterBackendError; add_rate_limit (hierachain/api/middleware.py) runs Redis checks via asyncio.to_thread and returns 503 when the backend is unavailable instead of the previous fail-open allow, and reuses the checked remaining quota for headers.
• API (GraphQL Bounded Limits): resolvers (hierachain/api/graphql/resolvers.py) cap results via _bounded_limit()/MAX_QUERY_RESULTS=100 with limit=None meaning 100, clamped from_index/to_index/start+limit slicing, and early exit on limit=0 — larger requested limits now return at most 100 items.
• Network (Strict Replay & Nonce Checks): _is_valid_replay (hierachain/network/zmq_transport.py) requires nonce to be str with 1..128 chars, finite numeric timestamp within replay_tolerance, and rejects when the 1000-entry replay buffer stays full after expiry pruning instead of silently evicting.

2026-09-28

• Core & Security (Mandatory Trusted Block Signatures): Blockchain.__init__/add_block/is_valid_new_block/is_chain_valid (hierachain/core/blockchain.py) now resolve the signer via require_block_identity() and verify against trusted_public_keys with _sign_block()/sign_block(); BlockVerifier (hierachain/security/verify/block_verifier.py) requires strict_mode=True and unconditionally rejects unsigned/malformed signatures, verifying only against caller-supplied trusted keys; load_trusted_block_keys()/require_block_identity() (hierachain/security/identity_loader.py) require HRC_BLOCK_TRUSTED_KEYS_FILE (new Settings.BLOCK_TRUSTED_KEYS_FILE) with an Ed25519 hex map and node-key alignment; initialize_default_keys() (hierachain/security/key_manager.py) now blocks defaults whenever Settings().env == "production".
• Consensus & Ordering (Signed Blocks, Quorum & ZK): creator_id added to block construction with finalization-position checks in verify_quorum_signatures (hierachain/consensus/base_consensus.py, hierachain/consensus/proof_of_federation.py); ZK proofs are validated during verification, rejecting missing/invalid proofs when required and checking consensus_finalization structure/order/hash; BlockManager signs on creation and storage rejects unsigned/untrusted blocks with reconcile_journal_event() dedup on replay (hierachain/consensus/ordering/block_manager.py, hierachain/consensus/ordering/service.py, hierachain/consensus/ordering/storage.py).
• Hierarchical Main/Sub-Chain (Durable Proofs & Signing): replaced in-memory proof counts with durable storage plus _refresh_durable_proofs()/proof_sequence/_durable_block_events (hierachain/hierarchical/main_chain/base.py, hierachain/hierarchical/main_chain/proofs.py, hierachain/hierarchical/main_chain/registry.py); SubChain proof submission enforces durable storage, rejects duplicates, adds ZK-proof metadata validation, and signs finalization with trusted keys per consensus type (hierachain/hierarchical/sub_chain/base.py, hierachain/hierarchical/sub_chain/block.py, hierachain/hierarchical/sub_chain/proof.py).
• Hierarchical Registry (Durable Hierarchy & Stricter Validation): _persist_hierarchy_registry()/_restore_hierarchy_registry() with locking (hierachain/hierarchical/hierarchy_manager/base.py); restoration supports placeholder sub-chains with dynamic replacement; organization/channel registries enforce stricter member checks (hierachain/hierarchical/hierarchy_manager/organization.py, hierachain/hierarchical/hierarchy_manager/validation.py).
• Channel (Signatures, Endorsement & Roles): block finalization verifies signatures against trusted keys, endorsement evaluation supports configurable eligible org sets, policy/org/status updates gain rollback, and submit_event/registry persistence require member-role validation (hierachain/hierarchical/channel/channel.py, hierachain/hierarchical/channel/ledger.py, hierachain/hierarchical/channel/policy.py, hierachain/hierarchical/channel/types.py).
• Cluster (Cross-level Sync Without Copy): proof submission no longer merges history or copies cross-chain blocks (hierachain/cluster/cross_level_sync.py); anchors persist via _persist_proof_anchor() with durable verification under storage locks.
• Audit (Schema & Hash Change): AuditEvent gains affected_entities with SQLite migration, JSON optional-field handling, and calculate_hash() over the full sorted dict (hierachain/risk_management/types.py, hierachain/risk_management/audit_logger.py) — stored digests change; new PostgresAuditManifest (hierachain/adapters/database/audit_manifest.py) with verify_integrity() and stricter persistence validation.
• Config (Strict Env & Backend): Settings.env (hierachain/config/settings.py) raises ValueError on unknown HRC_ENV/ENV values (only production/prod/product, dev, test aliases), STORAGE_BACKEND allowlists memory/redis/sqlite/postgres/postgresql via _configured_database_url() (DATABASE_URL/HRC_DATABASE_URL), adds BLOCK_TRUSTED_KEYS_FILE, and ProductionSettings.AUTH_ENABLED is unconditionally True with HRC_AUTH_ENABLED=true enforced; get_settings() routes only on normalized production/test.
• API/CLI/Business (Prod Auth & HierarchyManager): server lifespan requires require_block_identity() plus explicit DATABASE_URL/HRC_DATABASE_URL for production Postgres, mandates HRC_API_KEYS_FILE via _load_production_key_manager() (≥32-char keys, permissions, active key), replaces ENV with env, and tightens CORS/logging to production (hierachain/api/server.py, hierachain/api/graphql_handler.py); business channels/organizations move off in-memory _channels/_organizations to HierarchyManager with stricter validation and member-role schemas (hierachain/api/business/channels.py, hierachain/api/business/organizations.py, hierachain/api/business/schemas.py, hierachain/api/business/state.py); ledger proof submission delegates to HierarchyManager (hierachain/api/ledger/proofs.py); CLI submit_proof rejects registry submissions (durable authenticated API required) and verify enforces trusted-key chain validation (hierachain/cli/chain.py, hierachain/cli/verify.py).

2026-09-27

• Storage (IPFS Encryption Key): create_ipfs_client_from_env() (hierachain/api/storage/ipfs_client.py) now requires HRC_IPFS_ENCRYPTION_KEY to be exactly 64 hexadecimal characters (32 bytes) and raises IPFSError otherwise — it no longer falls back to generating an ephemeral key with a warning, so deployments without a stable key fail fast at startup instead of producing undecryptable payloads.

2026-09-26

• Config (Journal Sync): Removed Settings.JOURNAL_FSYNC / HRC_JOURNAL_FSYNC (hierachain/config/settings.py); TransactionJournal (hierachain/error_mitigation/journal.py) dropped the background writer queue/thread and always writes synchronously with os.fsync.
• Core (Merkle Payload): Unified event payload serialization into serialize_event_payload() (hierachain/core/merkle_tree.py) reused by hierachain/core/block.py; Merkle leaves now include the data field (previously excluded), so leaves/roots/hashes change for identical events.
• Database (Fail-hard Reads & Event Envelope): SQLBase.get_block_by_index/get_latest_block/get_event_by_id (hierachain/adapters/database/base/sql_adapter.py) now propagate database errors instead of returning None; PostgresAdapter._execute_save_block (hierachain/adapters/database/postgres_adapter.py) persists the full event envelope (orjson.dumps(event)) with submitted_by/sender_id fallback, and fetchers decode via the shared _create_event_from_row/_decode_jsonb.
• Hierarchical (Storage Fail-fast): HierarchyManager._create_storage() (hierachain/hierarchical/hierarchy_manager/base.py) no longer falls back to SQLite when PostgreSQL is configured but unavailable — it raises RuntimeError instead; __init__/add_sub_chain now persist metadata and restore via list_chains(), raising on failure.

2026-09-24

• Core (Parquet Logs): write_parquet_log() now writes immutable segments of up to 1,024 records under <path>.segments; read_parquet_log() reads the segments and legacy single-file logs. Consumers that read <path> directly must switch to the helper.

2026-09-22

• Error Mitigation (Validators): Removed APIValidator (including the "api" entry of the create_validator factory and forbidden-term Arrow/legacy validation) from hierachain/error_mitigation/validator.py and package exports (hierachain/error_mitigation/__init__.py); corrected the ConsensusValidator import path to hierachain/error_mitigation/consensus_validator.py in hierachain/consensus/bft/helpers.py.
• Monitoring: Removed the alert_manager global singleton instance and export from hierachain/monitoring/__init__.py (the AlertManager/PerformanceMonitor classes remain available).
• Config (Storage Backend): Changed the default storage backend from sqlite to postgres in hierachain/config/settings.py (DEFAULT_STORAGE_BACKEND, default DATABASE_URL now postgresql://hiera:hiera@localhost:5432/hierachain, HRC_DATABASE_URL support with explicit sqlite:// handling) and hierachain/config/product_config_template.py (HRC_STORAGE_BACKEND=postgres with per-node DATABASE_URL/HRC_DATABASE_URL); ProductionSettings.DEFAULT_STORAGE_BACKEND switched from redis to postgres.

2026-09-21

• Monitoring: Removed PrometheusMetrics and singleton metrics from hierachain/monitoring/metrics.py (file deleted), removing Prometheus metrics collection utilities.
• Risk Management: Removed RotatingAuditStorage from hierachain/risk_management/audit_logger.py and package exports (hierachain/risk_management/__init__.py).

2026-09-20

• Core (Cache): Removed BlockchainCacheManager, CacheInvalidator, EntityEventFetcher, and CachePerformanceTracker from hierachain/core/cache_manager.py (file deleted).
• Error Mitigation (Recovery & Rollback): Removed RollbackManager and associated types (RollbackType, RollbackStatus, StateSnapshot, RollbackOperation), recovery engines (NetworkRecoveryEngine, ConsensusRecoveryEngine, BackupRecoveryEngine, AutoScaler), and RecoveryError from hierachain/error_mitigation/.
• Risk Management: Removed RiskAnalyzer, MitigationManager, MitigationStrategies, and related risk/mitigation types (RiskAssessment, RiskSeverity, RiskCategory, MitigationAction, MitigationResult, MitigationStatus) from hierachain/risk_management/, keeping only audit logging primitives.
• Monitoring: Removed PerformanceMetrics, MetricType, and PerformanceSnapshot from hierachain/monitoring/performance_metrics.py (file deleted).
• Cluster: Removed ClusterManager, ClusterLockdownManager, ClusterState, and quorum-based lockdown coordination from hierachain/cluster/ (cluster_manager.py and lockdown_protocol.py deleted).

2026-09-19

• Hierarchical & Config: Removed deprecated packages k8s_namespace_manager, proof_aggregation, and rebalancer from hierachain/hierarchical/ (K8sNamespaceManager, ProofAggregator, SubChainRebalancer) along with related configuration settings (K8S_*, PROOF_*, REBALANCE_*) in hierachain/config/settings.py.

2026-09-18

• Cluster: Removed StateSyncManager (hierachain/cluster/state_sync_manager.py) and associated exports from hierachain/cluster/__init__.py.

2026-10-22

• Network (Transport Release & Explicit MSP Checks): ZmqNode.start() (hierachain/network/zmq_transport.py) now calls stop() and chains the original error with raise ... from e when socket setup fails, NetworkClient.start() (hierachain/network/network_client.py) runs stop() on failure, and stop() no longer returns early when _is_running is false — a failed start can be retried without leaking sockets. validate_msp_from_message() (hierachain/network/secure_connection.py) replaces the all(...) generator with explicit str/non-empty checks per handshake field so every missing field reports its own rejection reason.
• Adapter (Runtime Edge Cases): PostgresAuditManifest.__init__ (hierachain/adapters/database/audit_manifest.py) accepts a None fetchone() row; PostgresAdapter (hierachain/adapters/database/postgres_adapter.py) loads the psycopg2 fallback via import_module, makes _execute_store_proof() static with submitted_at/created_at defaulting to time.time(), and the SQLite _execute_update_state() return type widens to bool | None (hierachain/adapters/database/base/sql_adapter.py); ChannelLedgerSQLStorage (hierachain/adapters/database/channel_ledger_sql.py) declares _get_connection() under TYPE_CHECKING, and RedisLedgerAdapter.get_latest_block() (hierachain/adapters/database/redis_ledger.py) filters empty tips before max() and returns None when no chain has blocks.
• API (GraphQL Filtering & Type Hardening): resolve_events (hierachain/api/graphql/resolvers.py) forwards entity_id/event_type/from_timestamp/to_timestamp/limit/after explicitly to select_event_page() for non-Blockchain chains, _to_event_type() assigns EventType fields after construction so details_metadata no longer hits an invalid constructor keyword, and _required_graphql_permissions() (hierachain/api/graphql_handler.py) detects fragments with isinstance(..., FragmentDefinitionNode) instead of the raw definition.kind string; GraphQL fields in hierachain/api/graphql/types.py are annotated with cast() (with EventType.resolve_events() allowed to return None), and the WebSocket chain_name parameter (hierachain/api/websocket/endpoints.py) is typed str with the same "all" default.
• Consensus (Journal Requeue & Rule Naming): OrderingService.receive_event() (hierachain/consensus/ordering/service.py) raises ValueError when a journal hit has no record before requeueing, and _find_stable_event() rejects non-dict stored payloads with the same ValueError instead of an AttributeError; _run_custom_rules() (hierachain/consensus/ordering/certifier.py) names rules lacking __name__ via type(rule).__name__ so callable objects no longer abort certification, and BFTConsensus (hierachain/consensus/bft/consensus.py) hashes self.current_request directly.
• Hierarchical & Cluster (Durable Recovery Guards): _restore_main_chain() (hierachain/hierarchical/hierarchy_manager/recovery.py) raises RuntimeError when durable storage is unavailable and casts the registration timestamp before float(); ChannelLedger._replay_record() (hierachain/hierarchical/channel/ledger.py) rejects non-dict snapshot/event/block payloads through the existing validation and RuntimeError paths; _durable_block_events() (hierachain/hierarchical/main_chain/proofs.py) and _verify_anchor_exists() (hierachain/cluster/cross_level_sync.py) treat a missing proof_storage explicitly as unavailable so strict and non-strict paths return documented results instead of relying on getattr(None, ...).
• Core & Error Mitigation (PyArrow 25 Compute API): _iter_block_rows() (hierachain/core/event_query.py) builds the entity/timestamp mask with pc.call_function("and"/"equal"/"greater_equal"/"less_equal"/"indices_nonzero"), and _check_forbidden_terms_in_array() (hierachain/error_mitigation/validator_helpers.py) lowercases and matches via pc.call_function with pc.MatchSubstringOptions(term); _open_safe_file() (hierachain/error_mitigation/journal.py) narrows mode to Literal["rb", "ab", "wb", "r+b"], and AdvancedCache.get() (hierachain/core/cache.py) accepts any key object before str() coercion.
• Domains (Event Marker & Validator Narrowing): _rebuild_domain_state() (hierachain/domains/chains/base_chain.py) skips replayed events whose event type is not a str before dispatch, recover_committed_transaction()/commit_transaction() (hierachain/domains/chains/domain_chain.py) return False when _transaction_event_markers is None instead of indexing it, and ProofValidator._validate_single_proof() (hierachain/domains/utils/cross_chain_validator.py) casts the already-validated sub_chain_name/proof_hash before lookups.
• SDK & Security (Timeout & API Key Source): HieraChainAsyncClient (hierachain/sdk/async_client.py) wraps config.timeout in aiohttp.ClientTimeout(total=...), and HieraChainClient (hierachain/sdk/client.py) raises HieraChainAPIError when the response carries no HTTP status code; APIKeyVerifier._extract_api_key() (hierachain/security/verify/api_key_verifier.py) resolves the source explicitly — query_params for APIKeyQuery, headers otherwise — and calls check_api_key() on that mapping instead of invoking the FastAPI dependency with the connection, while KeyManager.storage (hierachain/security/key_manager.py) is annotated Any.
• Monitoring & CLI (Typed Alert Stats & Command Registration): AlertManager.stats (hierachain/monitoring/alert_system.py) is typed with a _AlertStatistics TypedDict, so counter updates drop the per-access cast() calls, and hierachain/cli/__init__.py registers commands without the redundant cast(Command, ...) wrappers.

2026-10-18

• API (Ledger Sender Identity & Default Nonce Validation): _build_event_data (hierachain/api/ledger/events.py) now also writes sender alongside submitted_by so ordering can read the signing identity from either field, and EventRequest.details_nonce (hierachain/api/ledger/schemas.py) sets validate_default=True so the None default is validated too — previously the default nonce bypassed hex/length validation and the stored event omitted sender.
• Ordering (Canonical Signature Recheck & Shutdown Drain): _extract_verification_items (hierachain/consensus/ordering/processor.py) skips events carrying signature_content (already verified by the certifier during live processing and replay), verifies legacy signatures with 0x-stripped hex sender/signature, and polls event_pool at most every 0.1s while keeping batch_timeout; new _verify_canonical_event() (hierachain/consensus/ordering/utils.py) rebinds the ordered business fields (entity_id, event_type, event, timestamp) to the original signed signature_content and rejects altered or extra fields via SignatureVerifier().verify_event_signature(), while verify_event_signature() runs the canonical branch for such envelopes instead of the legacy payload path; OrderingService.stop() (hierachain/consensus/ordering/service.py) joins the processing thread without the 5-second timeout so in-flight work finishes before storage and the journal are closed — previously canonical secure events were re-verified only as legacy payloads, altered or extra fields escaped the binding checks, and shutdown could close storage under an active batch.

2026-10-07

• Ordering (Committed-event Latency Accounting): OrderingStorageHandler.save_block() (hierachain/consensus/ordering/storage.py) consumes processed_events timing entries only for event_ids in the persisted block, retaining timings for events still pending in another batch, and types trusted_public_keys as dict[str, bytes] with the same configured/file-backed fallback — previously cleared the whole timing map on every commit.
• Storage (IPFS Availability Check): IPFSClient.is_available() (hierachain/api/storage/ipfs_client.py) probes /api/v0/files/stat with arg=/ipfs/<cid> instead of the removed /api/v0/object/stat?arg=<cid>, returning False on unsuccessful responses or connection failures — previously called the unsupported endpoint.

2026-10-04

• Parquet (Seal-on-error & No Silent Overwrite): write_parquet_log() (hierachain/core/parquet_log.py) seals the active segment when directory/file fsync or publish fails and unlinks the temp file, so a failed append can never be silently overwritten by a later one.
• Journal & Monitoring (Rollback & Strict Types): failed journal writes roll back envelope mutations preserving integrity (hierachain/error_mitigation/journal.py); ErrorClassifier (hierachain/error_mitigation/error_classifier.py) and monitoring types (hierachain/monitoring/alert_system.py, hierachain/monitoring/performance_monitor.py, hierachain/monitoring/types.py) adopt strict JSON helpers with corrected alert payload types instead of lossy orjson coercions.

2026-10-03

• Ordering (Serialized Commits & Lockdown): share a single service._commit_lock RLock across OrderingBlockManager/OrderingMaintenance/OrderingProcessor (hierachain/consensus/ordering/block_manager.py, hierachain/consensus/ordering/maintenance.py, hierachain/consensus/ordering/processor.py, hierachain/consensus/ordering/service.py); in-flight commits retry via OrderingPausedError keeping the cut batch intact, LOCKDOWN/SHUTDOWN/ERROR are no longer clobbered by MAINTENANCE, collection pauses in LOCKDOWN, shutdown wakes capacity-blocked producers, and rejected events are removed from the pending map.
• Hierarchy (In-place Registry Refresh): _apply_hierarchy_registry() refreshes orgs/channels in place preserving Channel object references and events_by_org counts while closing removed channels, and _mutate_registry() retries registry mutations 3x with rollback (hierachain/hierarchical/hierarchy_manager/base.py).
• Channel (Serialized Registry Access): _registry_operation decorator (hierachain/hierarchical/channel/channel.py) serializes org add/remove, private-collection creation, event query, channel/org info, policy update, and suspend/resume under the shared registry RLock with live refresh.
• API (Centralized Org Admin Check): register_organization_member (hierachain/api/business/organizations.py) reuses shared _is_organization_admin() (hierachain/hierarchical/hierarchy_manager/organization.py) replacing duplicated inline role/identity checks.

2026-10-02

• Hierarchical (Journal Load Cleanup): CrossChainTransactionManager.__init__ (hierachain/hierarchical/transaction_manager.py) closes the internally created journal when _load_journal() raises (caller-supplied journals are left to the caller) instead of leaking the handle.
• Core (Sender Validation): validate_event_structure() (hierachain/core/utils.py) excludes the signed-envelope sender public-key field from business-content cryptocurrency-term scanning and validates sender separately, keeping envelope keys out of content checks.
• API (Hierarchy Recovery Concurrency): get_hierarchy_manager() (hierachain/api/ledger/depds.py) uses non-blocking lock acquisition (503 "in progress" when another thread is recovering) with a 5-second monotonic retry backoff bounding recovery attempts during request storms instead of blocking concurrent requests.

2026-10-01

• ERP (Scheduler Deadlock): SyncScheduler.get_all_tasks (hierachain/integration/erp/scheduler.py) builds statuses via detached _task_status() snapshots under a single lock instead of calling get_status() per task, fixing a nested-lock deadlock when listing tasks.

2026-09-28

• Network (Production Env Check): SecureConnectionManager (hierachain/network/secure_connection.py) checks settings.env == "production" instead of the stale "product", restoring insecure-P2P warnings.

2026-09-27

• Storage (CID Resolution): resolve_cid_field() (hierachain/api/storage/endpoint_helpers.py) now re-raises CID resolution failures instead of silently returning the original unresolved data, preventing downstream consumers from operating on un-resolved payloads.

2026-09-26

• Journal (Framing & Replay): Added _JOURNAL_MAX_FRAME_SIZE/_JOURNAL_DATA_MARKER envelope preserving data versus extra fields, partial-write loops, torn-tail truncation repair on open, leading-magic PAR1 detection, and fail-hard replay raising ValueError on corrupt/truncated frames instead of skipping (hierachain/error_mitigation/journal.py).
• Consensus (Ordering Fail-closed): OrderingBlockManager.commit_block/processor loop/executor (hierachain/consensus/ordering/block_manager.py, hierachain/consensus/ordering/processor.py) set MAINTENANCE and re-raise; recovery forces block creation (force=True) and raises RuntimeError on null/corrupt entries; _block_from_dict (hierachain/consensus/ordering/storage.py) verifies the Merkle root before the hash with strict data is None termination.
• Hierarchical (Recovery Validation): SubChain init (hierachain/hierarchical/sub_chain/base.py) fails fast on wait_for_active() timeout with ordering shutdown and delegates genesis persistence to OrderingService; _process_and_finalize_single_block (hierachain/hierarchical/sub_chain/block.py) validates via is_valid_new_block; rehydration (hierachain/hierarchical/sub_chain/ordering.py) raises ValueError on integrity/queue conflicts and discards already-rehydrated queued blocks.

2026-09-25

• Journal (Error Mitigation): Made TransactionJournal.log_event() (hierachain/error_mitigation/journal.py) fail-closed for async writes by waiting on the per-event Future completed by the background writer instead of acknowledging on enqueue; the queue-full path still falls back to a synchronous write.
• Consensus (Ordering Recovery): Set OrderingStatus.MAINTENANCE at the start of _initialize_service (hierachain/consensus/ordering/processor.py) so the service never exposes ACTIVE during replay, and made OrderingRecovery (hierachain/consensus/ordering/recovery.py) raise RuntimeError on journal error entries instead of silently skipping them.

2026-09-24

• Database (PostgreSQL Adapter): Hardened _execute_save_block (hierachain/adapters/database/postgres_adapter.py) to delete stale events rows for the overwritten (chain_name, index) before inserting, and to upsert blocks via ON CONFLICT (chain_name, "index") DO UPDATE instead of ON CONFLICT (hash) DO NOTHING, keeping block overwrites consistent with their events.
• Consensus (Ordering Service & Storage): Made submit_event (hierachain/consensus/ordering/service.py) raise RuntimeError when journal.log_event() fails instead of silently queueing an unpersisted event, and made OrderingStorageHandler.save_block (hierachain/consensus/ordering/storage.py) raise on storage-adapter rejection with idempotent block_history/last_block updates (replace on same index, append only when advancing).

2026-09-23

• API (Admin Secure Event): Fixed add_secure_event (hierachain/api/admin/endpoints.py) to call request.model_dump(exclude_unset=True) so unset optional fields (nonce/timestamp/chain_id) are no longer forwarded as None when adding chain events.

2026-08-31

• Security (Secret Manager): Sanitized exception logging templates in _get_from_aws (hierachain/config/secret_manager.py) to eliminate false-positive credential disclosure warnings during static security audits.

2026-08-29

• Security (Sanitization): Fixed _sanitize_html_context (hierachain/security/sanitization.py) to neutralize SSTI with [TEMPLATE_BLOCKED] instead of no-op html.escape, and tightened _sanitize_filename_context with allowlist ^[a-zA-Z0-9_\-~.]+$ and ../. filtering to prevent path traversal.

2026-08-27

• Security (Key Manager): Added PYTEST_CURRENT_TEST/pytest guard in initialize_default_keys (hierachain/security/key_manager.py) to prevent default API key creation in test environments when HRC_ENV=product and allow safe initialization under pytest.
• Hierarchical (Rebalancer): Handle both callable and non-callable pending events in _get_pending_events (hierachain/hierarchical/rebalancer/split_ops.py) by checking callable() and falling back to the pending_events list.
• Consensus (BFT): Relaxed timestamp drift threshold from 30s to 120s in verify_message_signature (hierachain/consensus/bft/helpers.py) to avoid drift failures when the suite runs long with a statically created message at import time.
• Config (Env Manager): Added HRC_ENV=test/PYTEST_CURRENT_TEST checks in init_env_config (hierachain/config/env_manager.py) to prevent creating .env.HRC.example and loading the product .env while running pytest.
• Cluster (Lockdown): Hardened verify_signature in hierachain/cluster/lockdown_types.py with empty str type checks and try/except around hmac.compare_digest to safely handle invalid signatures while maintaining backward compatibility with legacy 32-char truncated signatures.

2026-08-24

• Consensus (Ordering): Added empty batch check (if not self.current_batch: return False) to is_batch_ready in BlockBuilder (hierachain/consensus/ordering/block_builder.py) to prevent false-positive readiness checks and no-op block creation triggers during idle timeout periods.
• Core (Merkle Tree): Added domain separation prefix (0x01) to internal node hashing in MerkleTree._build_tree (hierachain/core/merkle_tree.py) to prevent node duplication and second-preimage collision risks.
• API (Payload Limit): Enforced upload payload size limits (1MB) on streaming/chunked requests lacking Content-Length in add_payload_limit (hierachain/api/middleware.py).

2026-08-23

• Consensus (BFT): Enforced strict signature verification in _validate_consensus_message (hierachain/consensus/bft/helpers.py), ensuring that incoming BFT messages (PRE-PREPARE, PREPARE, COMMIT) with invalid or missing signatures are always rejected (return False) across all strictness modes.
• Hierarchical (Proof Verification): Added fallback chain scanning in _verify_proof_in_main_chain (hierachain/hierarchical/main_chain/proofs.py) to search committed blocks when a proof submission is not yet reflected in the O(1) proof_index.
• Cluster (Lockdown Protocol): Standardized LockdownMessage HMAC-SHA256 signatures in hierachain/cluster/lockdown_types.py to use the full 64-character hex digest (256-bit) while maintaining backward compatibility with legacy 32-character truncated signatures in verify_signature.

2026-08-14

• Security (ZK Mock Proof): _generate_mock_proof in hierachain/security/zk_prover.py now accepts a sub_chain_name parameter and includes it in public_inputs, fixing the SHA-256 commitment being computed with sub_chain_name="" while the verifier hashed with the real sub-chain name (causing every proof to be rejected when ENABLE_ZK_PROOFS=true). _verify_mock_proof replaces the lax mock_proof prefix check with the standard _verify_mock logic from zk_verifier (commitment hash vs public_inputs), rejecting fake proofs.
• Hierarchical: Moved the genesis-only chain guard above get_latest_block() in _submit_proof_for_sub_chain (hierachain/hierarchical/sub_chain/proof.py), preventing an IndexError on an empty SubChain and returning False as intended.

Consensus & Ordering Stability:

• Resolved critical race condition in block commit and pending event handling in OrderingService.
• Ensured lockdown and resume operations are atomic to prevent inconsistent state during maintenance.
• Prevented silent data loss during transaction journal recovery with proper validation.
• Improved state recovery logic with config validation and modularized recovery from transaction journal.

Core & Hierarchical Chain:

• Fixed race condition in hierarchical chain management and added graceful shutdown procedures.

Stability & QA:

• Fixed Chain Rehydration bug for correct state restoration after restart.