IC GuestOS proposal 144468: release 661a980 with all-in-one nodes

NNS proposal 144468, submitted on October 16, 2026, asks neurons to elect the GuestOS build release-2026-10-16_03-29-base at commit 661a9806c9eef7106475c396e6348fba63e74066 as an approved replica version. Node providers and proposal reviewers should check the diff and the image hash now. Developers who rely on HTTPS outcalls, chain keys or cycle metrics should read the 30 listed changes before their subnets upgrade.

What changed in commit 661a980

The proposal is titled "Elect new IC/GuestOS revision (commit 661a980)". Its release notes say the build "is based on changes since" release-2026-10-08_03-33-base (4a0dbb9251df6da0b65ab7a4d35e9a9871f58510), the previous weekly base release. DFINITY has also published a matching GitHub release tag with 13 assets.

The notes list 10 features, 9 bug fixes, 1 performance change, 6 chores and 4 refactorings. These are the changes that matter most to developers and operators:

The refactorings centralize access control for the management canister in validate_sender (#11788). They also add a dedicated CanisterAccess variant to validate the store canister in install_chunked_code (#11829) and validate private custom sections and snapshots of other canisters (#11832). A related change makes the CanisterInvalidController error report the role of the canister (#11842). The last commit in the build is a Node base image refresh, "Update Base Image Refs [2026-10-15-0806]" (#11861).

Who is affected and why it matters

The proposal only adds this build to the list of approved versions. Subnets move to it later through separate deployment proposals, so canister behavior does not change until then.

Chain Fusion builders. Canisters that call EVM RPC providers, price feeds or other Web2 APIs use HTTPS outcalls. Two P2P changes (#11717, #11718) change how consensus moves canister HTTP responses: nodes can serve them out of a block and rebuild blocks whose responses were stripped. The canister API does not change. If an outcall-heavy canister behaves differently after its subnet upgrades, these PRs are the first place to look.

Operators and tooling authors. The cup_explorer change (#11786) lets operators read the threshold master public keys from a catch-up package. These are the keys behind threshold ECDSA and Schnorr signing for Bitcoin, Ethereum and other chains. That is useful when checking key state during recovery or subnet splitting.

Anyone scraping replica metrics. Two per-subnet counters for HTTP and ECDSA outcall cycles are removed. The total consumed-cycles gauge is now monotonic and also counts the consumed cycles of deleted canisters (#11782). Dashboards built on the old series will lose data after the upgrade.

Canister developers using management canister calls. Access checks now run through one function. If your code or tests match exact CanisterInvalidController error text, expect the wording to include the canister's role.

Reviewers and node providers. The rustls and hickory-resolver bumps are security-driven dependency updates. That is one more reason to check that the image hash in the proposal matches a local build. Our earlier pieces on pinning base releases and version provenance cover why this check matters.

What to do now

To inspect the change set yourself, use plain git with the tags named in the proposal:

git clone https://github.com/dfinity/ic.git
cd ic
git fetch --tags
# must print 661a9806c9eef7106475c396e6348fba63e74066
git rev-parse 'release-2026-10-16_03-29-base^{commit}'
# commits since the previous base release
git log --oneline release-2026-10-08_03-33-base..release-2026-10-16_03-29-base
# focus on the outcall and execution changes
git log --oneline release-2026-10-08_03-33-base..release-2026-10-16_03-29-base -- rs/p2p rs/execution_environment

A checklist by role:

1. Reviewers: open the GitHub compare view between the two base tags and read the PRs in the table above, starting with #11349, #11717 and #11853.
2. Reviewers: follow the reproducibility instructions in the forum thread for this release. Confirm that the SHA-256 of your local GuestOS build matches the hash in the payload of proposal 144468 before you vote.
3. Node providers: nothing changes until a deployment proposal targets your subnet. Watch the dashboard for those proposals.
4. Monitoring owners: search alerts and dashboards for consumed_cycles_http_outcalls and consumed_cycles_ecdsa_outcalls. Move them to replicated_state_consumed_cycles_since_replica_started, which is now monotonic.
5. Canister developers: search tests for hard-coded CanisterInvalidController messages and relax them to match on the error code.
6. Teams with heavy HTTPS outcalls: note when your subnet upgrades, and compare outcall latency and failure rates before and after.

Caveats

At publication the vote on proposal 144468 had not finished, and the dashboard showed no recorded votes from known neurons. Check the proposal page for the final result. The release notes say that some commits may be left out if they do not change the GuestOS image, so the full commit list on GitHub is longer than the table above.