v431 release

.github/scripts/deploy/README.md

@@ -81,7 +81,25 @@ btcli multisig pending -w <ms>  # pending sudo-multisig ops; also lists pending
 
 Do not sign a WASM you were simply handed. srtool builds are deterministic:
 identical source at the same toolchain produces a byte-identical runtime. The
-pre-release tag *is* the code being deployed, so:
+pre-release tag *is* the code being deployed.
+
+The short version is one command (requires docker). Run it from a checkout
+you already trust — reviewed `main`, not the proposal tag, so the proposal
+cannot supply the verifier that vouches for it:
+
+```
+git fetch origin && git checkout origin/main
+./scripts/verify-upgrade.sh
+```
+
+It downloads the release manifest and wasm, fetches the proposal commit and
+rebuilds it from a pristine clone in the same srtool container CI used,
+byte-compares the result against the released runtime, runs
+`btcli upgrade check` against the chain if btcli is installed, and prints
+the `btcli upgrade sign` command pinned to your own build. It never submits
+anything.
+
+The manual recipe, if you prefer to run each step yourself:
 
 ```
 git fetch origin && git checkout v<spec>

.github/workflows/cargo-audit.yml

@@ -35,7 +35,7 @@ jobs:
           sccache-writer-secret-access-key: ${{ secrets.SCCACHE_R2_WRITE_SECRET_ACCESS_KEY }}
 
       - name: Install cargo-audit
-        run: cargo install --force cargo-audit
+        run: cargo install --force --locked cargo-audit
 
       - name: cargo audit
         # Each ignore is a known, accepted advisory; revisit when bumping

.github/workflows/check-bittensor-e2e-tests.yml

@@ -125,7 +125,7 @@ jobs:
         run: |
           set -euo pipefail
           manifest=sdk/bittensor-core/tests/e2e-manifest.json
-          jq -e 'length == 113' "$manifest" >/dev/null
+          jq -e 'length == 112' "$manifest" >/dev/null
           jq -e 'map(.test) | length == (unique | length)' "$manifest" >/dev/null
           jq -e 'all(.[]; (.test | startswith("intent_")) or (.test | startswith("test_")))' "$manifest" >/dev/null
           test_matrix=$(jq -c . "$manifest")

.github/workflows/deploy-docs.yml

@@ -63,6 +63,17 @@ jobs:
             npx --yes vercel build --token "$VERCEL_TOKEN"
             url=$(npx --yes vercel deploy --prebuilt --token "$VERCEL_TOKEN")
             echo "Deployed: $url"
-            npx --yes vercel alias set "$url" "staging.$DOCS_DOMAIN" --token "$VERCEL_TOKEN"
+            # `vercel alias set` only accepts domains in the team-level domain
+            # registry; staging.$DOCS_DOMAIN is attached (and verified) at the
+            # project level, so the CLI rejects it with "you don't have access
+            # to the domain". The deployments API honors project domains.
+            dep_id=$(curl -sf -H "Authorization: Bearer $VERCEL_TOKEN" \
+              "https://api.vercel.com/v13/deployments/${url#https://}?teamId=$VERCEL_ORG_ID" \
+              | node -pe 'JSON.parse(require("fs").readFileSync(0, "utf8")).id')
+            curl -sf -X POST \
+              -H "Authorization: Bearer $VERCEL_TOKEN" \
+              -H "Content-Type: application/json" \
+              -d "{\"alias\":\"staging.$DOCS_DOMAIN\"}" \
+              "https://api.vercel.com/v2/deployments/$dep_id/aliases?teamId=$VERCEL_ORG_ID" > /dev/null
             echo "Aliased to https://staging.$DOCS_DOMAIN" >> $GITHUB_STEP_SUMMARY
           fi

.github/workflows/docker.yml

@@ -1,13 +1,16 @@
 name: Publish Docker Image
 
-# Node images publish on runtime releases and on demand. Releases cut by
-# watch-mainnet-release.yml use the default GITHUB_TOKEN, which never emits
-# `release: published`; the watcher therefore dispatches this workflow
-# directly with the release tag. Release-version tags (vN) move :latest.
+# Node images publish when a network mirror moves, on runtime releases, and on
+# demand. Releases cut by watch-mainnet-release.yml use the default
+# GITHUB_TOKEN, which never emits `release: published`; the watcher therefore
+# dispatches this workflow directly with the release tag. Release-version tags
+# (vN) move :latest; network mirror tags do not.
 
 on:
   release:
     types: [published]
+  push:
+    branches: [devnet, testnet]
   workflow_dispatch:
     inputs:
       tag:
@@ -31,7 +34,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.tag || github.ref_name }}
+          # Push/release events carry the immutable promoted commit. Manual
+          # dispatches may override it with a branch or tag.
+          ref: ${{ github.event.inputs.tag || github.sha }}
 
       - name: Resolve immutable source revision
         id: ref
@@ -116,18 +121,15 @@ jobs:
     runs-on: [self-hosted, fireactions-turbo-8]
     timeout-minutes: 30
     steps:
-      - name: Determine tag, ref, and image name
+      - name: Determine tag and image name
         env:
           INPUT_TAG: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
-          ref="$INPUT_TAG"
-          # `ref` is what we check out (a real branch/tag, may contain '/').
           # Docker tags cannot contain '/', so derive the tag by replacing any
           # disallowed characters — otherwise a ref like `feat/x` fails tag
           # validation at push time.
-          tag="${ref//[^a-zA-Z0-9._-]/-}"
+          tag="${INPUT_TAG//[^a-zA-Z0-9._-]/-}"
           echo "tag=$tag" >> $GITHUB_ENV
-          echo "ref=$ref" >> $GITHUB_ENV
           # Move :latest for release events and for dispatched release-version
           # tags (the watcher dispatches with tag=vN because its GITHUB_TOKEN
           # release cannot fire the `release` trigger).

.github/workflows/publish-sdk-dev.yml

@@ -53,6 +53,12 @@ jobs:
         working-directory: sdk/python
         run: uv build --out-dir ../../dist
 
+      # PEP 740 provenance, same as the rc/stable publish jobs. Running it on
+      # the dev channel means a broken attestation step fails here on every
+      # push to main instead of for the first time during a release.
+      - name: Generate PEP 740 attestations
+        uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
+
       - name: Publish to TestPyPI
         run: |
           uv publish --trusted-publishing always \

.github/workflows/release-train.yml

@@ -360,6 +360,12 @@ jobs:
       - name: Build SDK wheel and sdist
         working-directory: sdk/python
         run: uv build --out-dir ../../dist
+      # PEP 740 provenance: sign every dist with this job's OIDC identity
+      # (must match the trusted publisher, so it runs here rather than in
+      # build-core-wheels.yml). uv publish uploads the resulting
+      # *.publish.attestation files alongside each dist.
+      - name: Generate PEP 740 attestations
+        uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
       # --check-url makes a re-run after a partial upload idempotent: files
       # already on the index are skipped instead of failing with a 400
       # duplicate (e.g. the SDK wheel landed but bittensor-core didn't).

.github/workflows/watch-mainnet-release.yml

@@ -254,6 +254,14 @@ jobs:
         working-directory: sdk/python
         run: uv build --out-dir ../../dist
 
+      # PEP 740 provenance: sign every dist with this job's OIDC identity.
+      # Must happen here, not in build-core-wheels.yml — PyPI only accepts
+      # attestations whose Sigstore identity matches the trusted publisher
+      # doing the upload. uv publish picks up the *.publish.attestation
+      # files from dist/ automatically.
+      - name: Generate PEP 740 attestations
+        uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
+
       # --check-url makes a re-run after a partial upload idempotent: files
       # already on the index are skipped instead of failing with a 400
       # duplicate (e.g. the SDK wheel landed but bittensor-core didn't).

README.md

@@ -50,7 +50,7 @@ contracts alongside native Substrate extrinsics.
 | Shared Rust | [`common/`](./common/), [`primitives/`](./primitives/), [`support/`](./support/) | Shared types, math primitives, lints, macros, weight tooling. |
 | Client core | [`sdk/bittensor-core/`](./sdk/bittensor-core/) | The Rust core for Bittensor clients (keypairs, keyfiles, SCALE codec, extrinsic assembly, RFC-0078 digest, drand timelock, ML-KEM) — built against the same crate revisions as the chain; Python bindings in [`sdk/bittensor-core-py/`](./sdk/bittensor-core-py/). |
 | Python SDK | [`sdk/python/`](./sdk/python/) | The `bittensor` package and `btcli` CLI. Generated from chain metadata so reads, writes, and docs cannot drift. |
-| Documentation | [`docs/`](./docs/) | Source for bittensor.com/docs. `docs/tx/`, `docs/query/`, and `docs/errors.mdx` are generated — do not hand-edit. |
+| Documentation | [`docs/`](./docs/) | Source for bittensor.com/docs. `docs/tx/`, `docs/query/`, and `docs/errors/` are generated — do not hand-edit. |
 | Website | [`website/`](./website/) | Yarn + Turbo monorepo; `apps/bittensor-website` renders marketing pages and these docs. |
 | Tests | [`ts-tests/`](./ts-tests/), [`clones/`](./clones/), [`eco-tests/`](./eco-tests/) | Moonwall/zombienet integration tests, mainnet-clone regression harness, indexer contract tests. |
 | Operations | [`chainspecs/`](./chainspecs/), [`scripts/`](./scripts/), [`Dockerfile`](./Dockerfile) | Chain specs, CI/dev scripts, production and localnet Docker images. |

chain-extensions/src/mock.rs

@@ -345,7 +345,7 @@ parameter_types! {
     pub const InitialColdkeySwapAnnouncementDelay: u64 =  50;
     pub const InitialColdkeySwapReannouncementDelay: u64 = 10;
     pub const InitialDissolveNetworkScheduleDuration: u64 =  5 * 24 * 60 * 60 / 12; // Default as 5 days
-    pub const InitialTaoWeight: u64 = 0; // 100% global weight.
+    pub const InitialTaoWeight: u64 = 0; // 0% TAO weight.
     pub const InitialEmaPriceHalvingPeriod: u64 = 201_600_u64; // 4 weeks
     pub const InitialStartCallDelay: u64 =  7 * 24 * 60 * 60 / 12; // Default as 7 days
     pub const InitialKeySwapOnSubnetCost: TaoBalance = TaoBalance::new(10_000_000);

chain-extensions/src/types.rs

@@ -140,6 +140,10 @@ impl From<DispatchError> for Output {
             Some("SlippageTooHigh") => Output::SlippageTooHigh,
             Some("SubnetNotExists") => Output::SubnetNotExists,
             Some("SameAutoStakeHotkeyAlreadySet") => Output::SameAutoStakeHotkeyAlreadySet,
+            Some("InsufficientTaoBalance") => Output::InsufficientBalance,
+            Some("InsufficientAlphaBalance") => Output::InsufficientBalance,
+            // Other pallets (e.g. swap, crowdloan) still emit their own
+            // `InsufficientBalance`; keep mapping it to the same ABI code.
             Some("InsufficientBalance") => Output::InsufficientBalance,
             Some("AmountTooLow") => Output::AmountTooLow,
             Some("InsufficientLiquidity") => Output::InsufficientLiquidity,

docs/concepts/meta.json

@@ -1,4 +1,4 @@
 {
   "title": "Concepts",
-  "pages": ["network", "emissions", "wallets", "money", "client", "transactions", "advanced"]
+  "pages": ["network", "emissions", "wallets", "money", "staking-pools", "client", "transactions", "advanced"]
 }

docs/concepts/money.mdx

@@ -49,7 +49,9 @@ slippage.
 
 ## Slippage
 
-Staking and unstaking are swaps against a pool, so the trade itself moves the
+Staking and unstaking are swaps against a pool
+([staking and pools](/docs/concepts/staking-pools) explains the pool
+mechanics with interactive charts), so the trade itself moves the
 price: your order consumes reserves as it fills, and the gap between what the
 spot price promised and what you actually receive grows with the trade's size
 relative to the pool's liquidity. Strictly, that self-inflicted gap is