IC GuestOS proposal 144568: 5e8370e ends base fee on invalid calls

DFINITY submitted NNS proposal 144568 on October 26, 2026. It elects GuestOS release release-2026-10-22_03-29-base at commit 5e8370e0a84ffb783d6a9d77e0d3e90fa3914cfe, which brings a fee fix for invalid calls, P-256 master keys in ic-secp256r1 and smaller consensus traffic for HTTP outcalls. Canister developers should note the cycle-charging change, and NNS voters should rebuild the image and compare hashes before they vote.

What changed in 5e8370e

The new release is based on changes since release-2026-10-16_03-29-base (661a9806c9eef7106475c396e6348fba63e74066). That is the version covered in IC GuestOS proposal 144468. The release notes list three features, seven bug fixes and one performance change that touch the GuestOS image:

PR #11908 contains the change that developers will notice most. Before this fix, invalid calls (including inter-canister requests) were rejected only after execution cycles had been prepaid. The canister still paid the base execution fee, even though the called method never ran. With this release, the system rejects these calls without charging that fee.

Two changes cut the amount of data that nodes exchange. Block proposals no longer carry canister HTTP responses (#11719). The release also fixes the refresh period for these stripped messages (#11878) and makes sure a block proposal's payload is loaded before p2p receives it (#11872). For subnet-to-subnet messaging, CertifiedStreamSlice no longer includes the height witness (#11901). This is the commit that names the release.

Who is affected and why it matters

Canister developers. Once subnets run 5e8370e, a call that is rejected as invalid before the method runs will not cost the base execution fee. If you wrote tests or cycle-accounting code that expect this fee on failed calls, those numbers will change. Canisters that make many inter-canister calls are the most likely to see a difference.

Chain Fusion builders. Commit e623ec3c5 adds the mainnet and PocketIC master keys to the ic-secp256r1 crate. This matters for teams working with threshold ECDSA on P-256 (secp256r1), because the same crate can now refer to the key used on mainnet and the key used in local PocketIC tests. Builders who rely on HTTPS outcalls, such as RPC-based integrations with other chains, are affected by the block-proposal change. HTTP responses are no longer sent inside block proposals, so less data moves through consensus. The release notes do not say that outcall behavior or pricing changes.

Node providers. GuestOS now reboots on a kernel Oops, panic or soft lockup, instead of staying in a broken state. The orchestrator now waits for processes to fully exit before it restarts them. On all-in-one nodes, ic-gateway no longer performs DNSSEC validation.

NNS voters. This proposal only elects a version. No subnet runs 5e8370e until separate NNS proposals deploy it to each subnet. The election is the step where voters can check that the published image matches the source code.

What to do now

If you vote on IC-OS elections, or follow a neuron that does, you can rebuild the image. The command below comes from the proposal and applies only to commit 5e8370e:

# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/5e8370e0a84ffb783d6a9d77e0d3e90fa3914cfe/ci/scripts/repro-check | python3 - -c 5e8370e0a84ffb783d6a9d77e0d3e90fa3914cfe --guestos

Checklist:

1. Install curl if you need it (sudo apt install curl), then run the script above.
2. Compare the two SHA256 sums the script prints: one for the image downloaded from the CDN and one for the image you built locally. They must be identical.
3. Check that this hash matches the SHA256 in the payload of proposal 144568 on the dashboard.
4. Optional: run the same script with --hostos or --setupos instead of --guestos. The proposal says this is not required, because it only elects a new GuestOS version.
5. Read the full change list, including changes that do not affect GuestOS, in the DRE release notes file, or compare release-2026-10-16_03-29-base...release-2026-10-22_03-29-base on GitHub.
6. Canister developers: look for tests or dashboards that assume a base fee on rejected calls, and plan to update them after your subnet's upgrade proposal is executed.

Caveats

The proposal was submitted on October 26. Check the dashboard for its current vote status before you plan around it. The release notes say that some commits may be left out because they do not modify the GuestOS image, and that some descriptions were reworded. The full commit list on GitHub is the complete record. Even after adoption, subnets move to 5e8370e one at a time through their own deployment proposals.