CLPR made substantial progress between October 3 and October 15, 2026. HIP-1535 is now approved, a direct fix for the Hiero Channel-binding finding has merged, and dedicated CLPR tests are part of Hiero’s CI. The implementation also shipped in Hedera’s testnet software behind a feature flag. Larger cryptographic changes remain under review.
The most consequential developments are below. Dates refer to the source records in UTC. Statuses reflect the October 15 review.
1. October 7: HIP-1535 approved and merged.
HIP-1535 merged as 042ea686. Its status changed from Draft to Approved, with Hashgraph identified as the requester.
I compared the current document with the original audit revision. The body is unchanged. The changes are approval metadata, discussion link and update date.
This replaces the previous “HIP remains open” finding. It is a formal governance milestone, while implementation readiness and network activation remain separate decisions.
2. October 8: CLPR reached distributed testnet software.
Hedera’s official v0.78 release notes explicitly include the CLPR implementation behind a feature flag. The testnet upgrade completed October 8. This updates our previous position that the implementation existed only in upstream development code. Release notes · Network status
This establishes software distribution, not CLPR activation. Current Hiero main still defaults clpr.enabled to false. The separate proposal to enable CLPR throughout HAPI test networks, PR 27619, remains open and concerns development/testing configurations.
Mainnet is listed as v0.77.5. I found no official announcement of native CLPR activation on mainnet.
3. October 14: the specific Hiero Channel-binding defect was addressed.
PR 27592, merged as 34483a4b, contains a significant security fix beyond its maintenance-oriented title.
The native Hiero verifier now consumes the supplied Channel context, rejects missing or truncated context, and requires the proven Channel ID to match the requested Channel.
It also includes a regression test using a captured, genuinely signed proof. Verification succeeds for its correct Channel and fails for a different Channel.
Assessment: this directly addresses the earlier wrong-Channel acceptance finding. It should no longer be described as entirely unresolved. It does not establish the correctness of every verifier or every aspect of Channel identity. Verifier code
The same merge improves consensus determinism by sourcing configuration trust anchors from consensus history state rather than node-local snapshot availability.
4. October 5–12: Connector operation and economic safeguards improved.
Two previously proposed changes are now merged.
On October 5, PR 27429 added guards against overflow in slashing arithmetic and prevented duplicate transaction IDs during rapid bundle submission. This makes penalties and repeated submissions more reliable. It does not change the commercial fee model.
On October 12, PR 27380 changed Connector authorization to execute within the sending transaction’s EVM call stack. Connectors can update storage and emit logs, with rollback if authorization, sending or an enclosing call fails. This gives operators a more useful foundation for spending limits, authorization accounting and commercial services.
The authorization change preserves the existing 50,000-gas stipend and billing policy.
Analysis: these are practical improvements for operating Connectors. They do not introduce a standardized application-facing tariff, actual-gas reimbursement or a revenue allocation to Hashgraph.
5. October 7–14: endpoint trust, recovery and shutdown received concrete fixes.
Several related changes merged.
PR 27436, October 7, makes proven endpoint manifests the sole endpoint-distribution mechanism. Manifest versions come from proven state, and obsolete verifier interfaces are removed.
PR 27498, October 8, fixes an empty-manifest replacement that previously left stale endpoints cached. It now replaces the cache and rebuilds the inbound mTLS CA trust index.
PR 27517, October 14, removes the deprecated endpoints field from ledger configuration.
PR 27497, October 14, removes the obsolete discovery RPC.
PR 27592, October 14, allows closing Channels to propagate their proven shutdown status even with empty message queues.
Assessment: endpoint replacement and orderly shutdown now have stronger implementation support. These changes do not establish per-Channel mTLS authorization or complete verifier trust-anchor rotation.
The maintenance work also introduces explicit internal block-stream transactions for initialization and manifest maintenance. They charge no fees, so their appearance in a stream should not be counted as paid CLPR usage. Maintenance transaction design
6. October 14–15: CLPR testing became more systematic and exposed remaining integration problems.
PR 27354 merged October 14, wiring the CLPR, embedded and multi-network HAPI suites into regular MATS CI. This is stronger evidence than merely having test files in a development branch. Its final TestLens report records 7,476 tests executed, all passing, across the reported run, not exclusively CLPR tests. Report
Two follow-ups remain proposed.
PR 27606 enables stream/log validation and fixes issues it exposed, including lost boundary singleton changes, attribution of contract storage writes and embedded-test races.
PR 27547 improves parallel execution of multi-network tests.
Assessment: the project is moving toward repeatable integration validation. Passing summaries must still be interpreted against the exact revision, enabled checks and scenarios.
7. October 6–15: a substantial TSS/WRAPS upgrade is proposed, with new cryptographic releases available.
Open PR 27506 proposes adopting cryptography 3.20.1, universal WRAPS history proofs and a more explicit lifecycle for roster changes and cryptographic setup.
Material changes include a 64-byte ledger identity, generation-bound cryptographic state, startup verification support for CLPR-only nodes and revised proof sizes/gas allowances. The author reports a local genesis WRAPS proof taking approximately 22 seconds on a specified laptop setup. That is useful development evidence, not a production benchmark.
The latest CI is not passing: TestLens reports 113 failed tests within the CLPR multi-network task, out of 57,931 tests executed overall. Published failures include setup transactions returning WAITING_FOR_LEDGER_ID. These results establish an integration problem, not 113 independently diagnosed protocol defects. October 15 test report
Meanwhile, the cryptography repository released two updates.
v3.21.0, October 13 checks that WRAPS verification binds the genesis hinTS key as well as the genesis address book, and adds a verifier-oriented artifact.
v3.21.1, October 15 rejects identity-point partial signatures and hardens batch verification against invalid signatures whose errors cancel.
Current Hiero main still pins the TSS components to 3.15.0. The open adoption PR pins 3.20.1, so the newer fixes cannot yet be credited to those node dependency revisions.
Analysis: faster, more robust proof infrastructure could reduce operating costs and improve trust-anchor transitions. Dependency adoption and passing end-to-end validation remain necessary.
8. October 14–15: SHA-256 verification work advanced across repositories.
Block Node PR 3780 merged October 14, implementing SHA-256 block hashing and verification support.
The corresponding consensus-node PR 27336 remains open. Its latest report now shows 12,326 tests passing, with a recorded flaky retry and an outstanding codeowner check. This improves on the failing results reported October 2. Current report
The proposal retains SHA-384 as the default. Its description still identifies first-restart migration and SHA-256 HAPI coverage as unfinished. Block Node’s new verifier rejects unsupported hash formats, making coordinated rollout important.
Economic implication: this continues the effort to make Hiero-origin proofs cheaper to verify on EVM destinations. Those savings improve the attractiveness of cross-ledger applications, while public-HBAR capture depends on the Hedera-mainnet activity those applications generate.
9. October 14: new tests explicitly document unresolved QBFT adapter behavior.
Alongside the Channel-binding fix, PR 27592 adds tests whose comment explicitly describes unsafe adapter behavior. They demonstrate that the QBFT adapter can return relay-supplied metadata and trust-anchor values when the mocked underlying verifier has not authenticated those values. Tests
Assessment: this is new, explicit repository evidence of an unresolved proof-binding concern, separate from the earlier QBFT quorum-model finding. Because the tests mock the cryptographic verifier, they are not an end-to-end exploit demonstration.
The native Ethereum path also still uses the accepting FakeBlsSignatureVerifier. The new TSS releases do not replace that Ethereum-specific placeholder.
External contributions and proposals remain separate from adopted CLPR functionality.
On October 7, community HIP proposals covering Channel recovery, financial security profiles, canonical asset transfers and intent settlement were closed without merging. The intent-settlement proposal is therefore not part of approved HIP-1535. PR 1543 · 1544 · 1545 · 1546
On October 5, external PRs 37 and 38 documented a Hedera contract-trace size constraint and proposed staging Ethereum sync committees across smaller transactions. The author supplies testnet transaction links for Channel opening and committee rotation. These are author-reported testnet demonstrations from an unmerged fork, not native Ethereum-verifier remediation or production usage.
Also on October 5, CLPRouter’s reference-application proposal offered routing and bonded-settlement tests, with explicit testnet-only and no-external-audit disclosures. Its one-way Channel discussion identifies an economically relevant limitation: without reverse acknowledgements, outstanding-message quotas eventually stop further sending. No protocol change has been adopted.
On October 14–15, external Sei verifier PR 41 proposed a fix for an address-alignment error in the Solidity storage comparison. A maintainer acknowledged it, but it remains unmerged. External draft spec PR 2 proposes aligning protobuf fields and verifier metadata with Hiero. It makes specification drift more concrete but does not yet resolve it.
The economic model has gained implementation maturity, not a new revenue entitlement. Connector authorization is more usable, penalties are safer and proof-cost reduction is progressing. Current native defaults still specify the flat execution-cost component and endpoint margin. No new official Connector tariff or Hashgraph-operated Connector business was documented.
The three LFDT implementation/specification main revisions remain at the audited baselines, with no standalone releases or tags. Native Hiero also removed message redaction on October 14, while explicitly deferring the coordinated running-hash change, another compatibility item to track. PR 27549
The newly verified milestones improve the route toward usable interoperability. Public-HBAR demand and attributable Hashgraph revenue still depend on funded, live commercial workflows. This review found no new verified mainnet CLPR volume, production liquidity, commercial revenue or independent audit report.
