The Signer’s Quietest Upgrade Is Its Safest: v0.5.1 Makes Configuration a Release Invariant

The most consequential change in Chain Fusion Signer v0.5.1 is not the new Bitcoin prehash method. It is the release discipline around upgrades.

The release now generates (variant { Upgrade }) for upgrade proposals. The signer’s documented Candid argument distinguishes this from Init: initialization can replace the canister configuration, while Upgrade preserves the existing configuration. For a signer that controls keys for external chains, that distinction is operationally important. A routine Wasm upgrade should not silently repoint a staging or production canister at a different key configuration.

The repository’s v0.5.1 release runbook turns that safety property into a sequence of checks. It asks operators to verify the release commit, Wasm hash, argument-file hashes, staging module hash, and the retained staging key configuration before preparing production. The final production step remains HSM-gated and requires review of the target canister, upgrade mode, hashes, and neuron details before proposal submission.

This gives Chain Fusion builders a more concrete deployment contract: signing behavior is only one part of the trust boundary. The artifact, its hashes, the upgrade argument, the staging result, and the governance proposal must all describe the same release.

The release also updates quinn-proto to 0.11.15 in response to RUSTSEC-2026-0185, refreshes several development dependencies, and documents credentials needed by the release automation. Those are maintenance details, but they matter because the signer’s delivery pipeline is part of the system that moves cross-chain authority into production.

A practical review checklist follows from the runbook:

• Confirm that the proposal uses Upgrade, not production Init arguments.
• Compare the published Wasm and argument hashes with a reproducible local build.
• Deploy and test the exact artifact on staging.
• Verify that the existing key configuration remains unchanged.
• Treat the HSM-backed proposal as a final artifact review, not a routine button press.

One caveat: v0.5.1 is the latest published release page we verified today, dated July 16, 2026, but the repository indicates 25 commits to main since that release. A team should therefore check the repository state before copying this runbook or pinning a deployment.