Xahau/xahaud 2026.10.13-release+4119 on GitHub

Feature: RNG

Adds a consensus random number generator for Hooks. Each proposing UNLReport validator commits to a secret and reveals it in a later ledger, using a new Entropy pseudo-transaction placed in its initial position. The reveals seed a singleton Random ledger object. Hooks draw from it with two new APIs:

int64_t dice(uint32_t sides);                                 // uniform in [0, sides)
int64_t util_random(uint32_t write_ptr, uint32_t write_len);  // 1–512 random bytes

Draws return TOO_LITTLE_ENTROPY (-46) when fewer than 80% of the UNLReport contributed to the current ledger's seed. Each Hook execution may draw at most 256 times. Hooks cannot read or slot the RNG state, so no Hook can predict a later draw. Node operators can inspect the object with:

{ "command": "ledger_entry", "random": true }

Feature: PWALoader

Accounts may publish a small HTML "bootloader" document for a Progressive Web App directly on ledger, using a new AppLoader field on AccountSet. The document must be valid UTF-8 HTML of up to 4096 bytes. It costs 1 drop per byte in fees and takes no reserve. Setting an empty value removes it.

{
  "TransactionType": "AccountSet",
  "Account": "r...",
  "AppLoader": "<hex of <!DOCTYPE html><html>...</html>>"
}

Node operators may optionally serve these documents over a new pwa port type, which must sit behind a TLS-terminating reverse proxy. Please read the pwa ports section of xahaud-example.cfg before enabling this, as it makes your node a web host for third-party content.

[server]
port_pwa

[port_pwa]
port = 8088
ip = 127.0.0.1
protocol = pwa
secure_gateway = 127.0.0.1
domain = pwapp.example

[pwa_blocklist]
rBadAccount...

New RPCs:

{ "command": "ledger_entry", "app_loader": "r..." }
{ "command": "pwa_validate", "account": "r...", "hash": "<SHA512Half of served bytes>", "domain": "app.example.org" }
{ "command": "pwa_info", "reset": false, "flush_dns": false }

pwa_info is admin only.

Feature: OnChainManifests

Validator manifests (including key rotations and revocations) can now be published on ledger with a new SetManifest transaction. The transaction is authorised by the manifest's own signatures, and the fee is paid by the master key's r-address, so that account must be funded. A manifest can be submitted directly:

{ "command": "submit", "manifest": "<manifest hex>" }

Once a validator has published, nodes will automatically re-publish newer manifests for their trusted validators. New syncing nodes read on-ledger manifests before the rest of the state, which resolves validator keys within seconds. This is on by default:

[early_manifest_sync]
1

Hooks can locate manifest objects with the new MANIFEST (37) keylet type.

Feature: EscrowDestinationCancel

The destination of an escrow may cancel it at any time with EscrowCancel, returning the funds to the owner. Self-escrows are excluded, so a timelock on your own funds remains binding.

Feature: HookOnV2_1

This replaces HookOnV2, which is now marked unsupported. The HookOnIncoming/HookOnOutgoing behaviour is the same, but validation is stricter:

HookOn and HookOnIncoming/HookOnOutgoing are mutually exclusive.
HookOnIncoming and HookOnOutgoing must be supplied together and must differ.
These rules are enforced on both install and update.

Fix: fix20261005 (Default Yes voting)

Foreign Hook State writes (state_foreign_set) now touch the foreign account (featureTouch).
slot_set accepts only keylets. Slotting by 32-byte transaction hash is removed.
sto_validate returns 0 for buffers under 2 bytes, instead of TOO_SMALL.
Float overflow and underflow now report EXPONENT_OVERSIZED/EXPONENT_UNDERSIZED instead of INVALID_FLOAT.
Emitted transaction objects are now stored correctly, so they can be slotted in the same ledger.

Fix: fix20260929 (Default Yes voting)

This is an omnibus Hook fix:

Stricter STO and Path parsing in sto_subfield, sto_subarray and sto_emplace.
An out-of-bounds accept/rollback reason now ends as a visible rollback.
emit and etxn_fee_base fees are computed against the applied view rather than the node-local open ledger.
An empty HookName is rejected.
HookName validation is added to ClaimReward.

RPC

hook_validate runs the guard checker and WASM validation against the current rules. It is off by default on networked nodes and on in standalone mode. Enable it with:

[hook_validate_rpc]
1

{ "command": "hook_validate", "code": "0061736D..." }
→ { "valid": true, "instruction_count_hook": "...", "instruction_count_cbak": "...", "log": [] }

account_info now accepts "hooks": true. This returns the account's effective Hook configuration, with the definition and installation merged (parameters, HookOn, HookCanEmit and so on).

server_definitions now includes a HOOK section listing API signatures, keylet types and return codes. Amendments now report ledger_enabled (active on ledger) separately from enabled (active on this server, including config-forced).

Feature: UDP Superhighway (XUSH)

Experimental. This is a best-effort UDP transport that runs alongside the peer protocol. Relayed transactions are also fanned out over UDP to a random set of other highway-enabled nodes. It uses the peer port number, so inbound UDP must be allowed on that port. Private nodes and validators only exchange highway traffic with [ips_fixed] peers.

[udp_highway]
1

Other

Amendment blocked: xahaud now stops with XAHAUD STOPPED: UPGRADE REQUIRED shortly before an unsupported amendment activates, instead of running in a degraded state.
rwdb: now a pure in-memory node store. online_delete is no longer required, but rwdb cannot be combined with pinned_type.
UNLReport: reports are no longer dropped from flag ledgers when too few validators pass the N-UNL reliability gate.
fixXahauV1 and fixXahauV2 are retired. AMMClawback is marked unsupported.
Boost has been updated to 1.91.
Fixes for webhook delivery stalls, idle JSON-RPC keep-alives, a ReportFeeChange data race, base58 decoding, and ARM and clang-16 builds.