Skip to content

Releases

Vexor is testnet-only, pre-production software; 1.0.0 is reserved for the production-grade milestone. This page mirrors the CHANGELOG.md in the main repository — the changelog is the source of truth; this page exists so the current release is visible from the docs site itself. Newest first.

Verifying a downloaded binary

Starting with v0.9.3-e, each tagged GitHub Release publishes three files for the portable x86_64_v2 binary — for example, the v0.9.3-e release publishes:

  • vexor-v0.9.3-e-linux-x86_64_v2 — the binary
  • vexor-v0.9.3-e-linux-x86_64_v2.sha256 — its checksum
  • vexor-v0.9.3-e-linux-x86_64_v2.sigstore.json — a keyless cosign signature bundle (signature, Fulcio signing certificate, and Rekor transparency-log entry, folded into one file)

No signing key is stored in the repo; trust is rooted in the release workflow's own GitHub Actions OIDC identity. To verify a downloaded binary against the v0.9.3-e release, install cosign and run:

cosign verify-blob \
  --bundle vexor-v0.9.3-e-linux-x86_64_v2.sigstore.json \
  --certificate-identity "https://github.com/DavidB-77/vexor/.github/workflows/release.yml@refs/tags/v0.9.3-e" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  vexor-v0.9.3-e-linux-x86_64_v2

The --certificate-identity is pinned to the release workflow file and the specific tag that triggered it, so it changes with each release — substitute the tag you're verifying (e.g. refs/tags/v0.9.3-f) for later releases. The checksum file provides a lighter-weight (unauthenticated) integrity check if you just want to confirm the download wasn't corrupted:

sha256sum -c vexor-v0.9.3-e-linux-x86_64_v2.sha256

v0.9.3-j

Validator

  • Block production: leader-slot production now executes candidates through the same instruction-dispatch ladder replay uses, retiring the reduced block executor that understood only two System-program instruction shapes. With the reduced executor, a candidate transaction could be packed on the strength of an execution model the cluster does not share, and the whole block would then be rejected. Production and replay now agree byte-for-byte on what a transaction does before it is packed.

Transaction-bearing block production is still gated in this release

This release closes the architectural gap that let production and replay disagree, but the remaining production-path work is not included here. VEX_TXBEARING_BROADCAST should stay off — see the Environment Variable Reference.

Changes

  • Block production: a pre-admission oracle checks each candidate against a scratch child bank before packing — fee-payer balance, program-account existence, already-processed status, and recent-blockhash validity. A candidate the cluster would reject is refused up front instead of being packed blind, and each refusal is counted per reason in the leader-slot ingest log line.
  • Consensus: the block-production arming check reads the SlotHashes sysvar fork-aware. The previous read could observe a sibling fork's SlotHashes; arming on the wrong fork's state risks voting against the chain the cluster converges on. Not arming for one slot costs one slot of vote throughput — arming on a sibling fork's SlotHashes costs the chain — so the read now refuses rather than guesses.

v0.9.3-i

Validator

  • Consensus: the live vote executor now propagates allocation failure instead of reporting it as success. v0.9.3-h described this fix, but the released code did not contain it — see the correction on that release below.
  • Block production: the cache of recently committed signatures is now populated on the parallel replay path as well as the serial one. It was previously populated only by the serial path, so with parallel execution selected it stayed empty and the producer's already-processed check never refused a candidate.

Transaction-bearing block production is still gated in this release

The two block-production items in this release remove defects on that path, but the remaining production-path work is not included here. VEX_TXBEARING_BROADCAST should stay off — see the Environment Variable Reference.

Changes

  • Block production: a leader slot packs for the whole slot rather than taking a single batch, which previously bounded a block far below what the pending-transaction queue held. Two new environment variables bound the work — VEX_PACK_BUDGET_MS (default 60) and VEX_PACK_MAX_SCAN (default 100000). Both have working defaults and need not be set.
  • Consensus: the vote-threshold percentage is computed in 128-bit arithmetic. The multiply by 100 overflowed 64 bits above roughly 184.5 million SOL of cluster-voted stake, which is below the stake already present on live clusters. The path is currently reached only with a zero operand, so no incorrect threshold has been computed.

Build

  • The production optimize mode is ReleaseFast, changed from ReleaseSafe for performance. Note that the --release= value on the command line is inert — build.zig pins the mode — though omitting the flag still yields a Debug build. Binary size cannot detect the mistake, because a Debug binary is smaller than a ReleaseFast one. Verify from the artifact: strings <binary> | grep -c "reached unreachable code" must be 0.

Removed

  • Two .orig files — pre-fix copies of two consensus source files, about 1.0 MB — were tracked in the repository alongside the fixed originals and have been removed.

v0.9.3-h

Correction

The fourth item below — that the live vote executor reports failed vote executions as failures — describes a change that was not present in the v0.9.3-h code. The seven affected paths were still returning success. The fix actually landed in v0.9.3-i. This entry is left in place rather than edited, so the record of what was claimed remains accurate.

Validator

  • Consensus: Ed25519 signature verification on the consensus path uses strict (non-cofactored) verification, per the network's signature-verification rules.
  • Consensus: vote instructions that verify a BLS proof of possession (SIMD-0387) are charged the additional compute-unit cost the protocol specifies, on top of the flat vote-instruction default.
  • Consensus: allocation failures in the epoch-boundary reward computation abort the boundary and are logged, rather than being silently absorbed.
  • Consensus: the live vote executor correctly reports failed vote executions as failures rather than successes.

Changes

  • Diagnostics: a slot abandoned because replay failed is logged at error level and states that the slot was left unfrozen.
  • Diagnostics: failure to record a dead slot, and failure to append to the lattice-hash write- capture buffer, are both reported.

v0.9.3-g

Validator

  • Networking: the AF_XDP copy-mode receive fallback correctly returns frames to the free reservoir after use, keeping UMEM free-pool depth stable under sustained catch-up load.
  • Networking: the frame-accounting invariant check on the AF_XDP UMEM pool is a leak detector that reports sustained growth in unaccounted frames, accounting for frames legitimately in flight inside the kernel.
  • Diagnostics: the parent-slot diagnostic probe is gated behind an environment variable and off by default.

v0.9.3-f

Validator

  • Consensus: the lattice-hash delta computation for a modified account uses the account's real pre-execution executable value for the pre-state hash.

v0.9.3-e

Validator

  • Release: tagged release binaries are now built and attached to the GitHub Release as downloadable assets, alongside a keyless cosign signature, a Fulcio-issued signing certificate, a Rekor transparency-log entry, and a sha256 checksum file. No signing key is stored in the repo; trust is rooted in the release workflow's own OIDC identity, so anyone downloading a release binary can independently verify it was built and signed by this repository's release pipeline rather than trusting an unsigned download. The attached binary is a portable x86_64_v2 baseline for broad compatibility, not a CPU-tuned build; operators who want a tuned build should build from source. No change to validator behavior.

v0.9.3-d

Validator

  • Consensus/boot: the --wait-for-supermajority restart gate's observed-stake calculation excludes gossip peers advertising a different shred version than --expected-shred-version, per the protocol's shred-version-pure accounting convention. No-op when --expected-shred-version is unset.
  • The version-report string (gossip client-id advertisement and boot banner) now reads 0.9.3-d, matching this release.

v0.9.3-c

Validator

  • Consensus/replay: the far-ahead deferral gate is keyed on a monotonic high-water mark of the highest slot ever frozen, preventing contention with the fast-wake gate during out-of-order catch-up.
  • Housekeeping: removed internal-repository path references and legacy pre-rename naming from source comments, a runtime diagnostics log banner, and build test-step descriptions. No behavior change.
  • The version-report string (gossip client-id advertisement and boot banner) now reads 0.9.3-c, matching this release.

v0.9.3-b

Validator

  • Networking: the TPU-ingest QUIC server, mempool, and leader block-production path emit stat counters and rate-limited warning-level log lines covering the full chain from QUIC handshake through mempool admission to a produced slot (handshakes, streams, bytes, parse ok/fail, mempool admit ok/reject with a reason breakdown, and per-slot received/queued/packed deltas). Also adds a one-time boot notice that TPU-ingest mempool admission is not gated to leader slots. Observability only; no change to validator behavior.
  • The version-report string (gossip client-id advertisement and boot banner) now reads 0.9.3-b, matching this release.

v0.9.3-a

Validator

  • Networking: the TPU-ingest QUIC server reuses the pending connection for a client Initial packet retransmitted before the handshake completes (normal client behavior under WAN jitter or a burst of simultaneous handshakes), instead of minting a second connection object.
  • The version-report string (gossip client-id advertisement and boot banner) now reads 0.9.3-a, matching this release.

v0.9.3

Validator

  • Networking: on dual-NIC hosts, the TPU-ingest QUIC server binds to the advertised TPU network interface instead of the wildcard address, so QUIC transaction ingest on dual-NIC hosts completes reliably. The TPU-ingest boot banner correctly reports broadcast status.

v0.9.2

Validator

  • The validator binary is now named vexor, including its help and startup output.
  • Consensus: the non-advancing vote-retarget fallback withholds instead of voting the local fork tip when fork choice has selected a different fork.
  • Snapshot boot: the snapshot-source deny-list is configured via the VEX_SNAPSHOT_DENY_HOSTS environment variable (comma-separated hosts, all ports denied). The built-in list ships empty; operators co-locating other validators should set it to keep boot state isolated.

RPC

  • The identity endpoint returns the unspecified address (0.0.0.0) when no public IP is configured, consistent with the rest of the configuration surface.

v0.9.1-a

Validator

  • Consensus: added a first-root attestation latch that guards against a dead-fork root-divergence class (voting onto a rooted fork the cluster had skipped), together with vote-threshold shadow wiring.
  • Consensus: vote-stake percentage math uses u128 to prevent an overflow at high aggregate stake, with a known-answer test added.
  • Networking: the QUIC/TPU server emits the original_destination_connection_id transport parameter (RFC 9000 §18.2), for compatibility with standards-strict QUIC clients.
  • Block production: synced the transaction-bearing block-production stack and a wave-formation singleton bypass.

Programs

  • The ZK ElGamal Proof program (src/vex_bpf2/zksdk/) is a native, from-scratch Zig implementation — Pedersen/ElGamal, Merlin transcripts, sigma proofs, Bulletproofs range proofs, and grouped-ciphertext validity — byte-parity verified against the conformance corpus.

v0.9.1

Validator

  • Networking: widened the data-shred length floor so the parent_offset field is always covered by a bounds check before it is read (untrusted-wire-parser hardening).

v0.9.0

Validator

  • Initial public release: an independent, Zig-native Solana validator client, byte-for-byte compatible with the Solana protocol by design.
  • Pure-Zig cryptography (ed25519, blake3, bn254/alt_bn128, poseidon, LtHash) — no Firedancer FFI dependency.
  • Zig sBPF interpreter stack and CPI dispatch (see PROVENANCE.md for implementation provenance).
  • Conflict-DAG parallel transaction executor.
  • AF_XDP zero-copy networking (receive path).
  • VexLedger: a Zig-native append-segment blockstore.

Programs

  • Vexor-authored vote program shipped as the sole vote executor.