1. The formal v0.78.1 release now includes CLPR, but does not activate it.
The Consensus Node v0.78.1 release was published on October 22. Its release notes explicitly list the native CLPR implementation.
The same release also includes commit d638baff, which changes the defaults for tss.hintsEnabled, tss.historyEnabled and tss.wrapsEnabled to false. CLPR itself continues to default to clpr.enabled=false.
Effect on the prior finding: This formally packages CLPR in a production release, but does not activate the service or its Hiero proof-generation stack. It is therefore a deployment-readiness milestone, not evidence of live CLPR messaging.
Economic/HBAR implication: Shipping disabled code creates no Connector payments, CLPR-generated network fees or incremental HBAR demand.
2. A major official PR proposes removing CLPR’s dedicated mTLS architecture.
Consensus Node PR 27823, opened October 22 at head 4609982994a09ca383c2044da52f23cd050f8fac, proposes replacing the dedicated CLPR mTLS listener, certificate authority and ephemeral leaf-certificate system with the ordinary HAPI TLS listener.
Under the proposal:
CLPR clients would accept any server certificate without certificate-chain or hostname validation.
A manifest certificate would merely select TLS instead of plaintext.
If no certificate is present, synchronization could occur over plaintext.
Transport would no longer authenticate the remote endpoint.
Bundle authenticity would instead depend on state-proof verification.
The on-ledger tls_certificate and account_id fields would remain temporarily but would be marked unused and candidates for deprecation.
The change deletes approximately 3,380 lines and removes classes including ClprCaCertManager, ClprLeafCertManager, ClprMtlsTrust and ClprMtlsContexts. Implementation commit
TestLens reports 61,253 tests executed with no test failures. Formatting and code-owner jobs still failed, and the PR remains open.
Effect on the prior mTLS finding: This does not add per-Channel mTLS authorization. It proposes eliminating transport authentication entirely and moving the security boundary to cryptographic payload verification.
Security assessment: State proofs can prevent an unauthenticated peer from forging valid ledger state. They do not, by themselves, prevent active interception, traffic analysis, connection disruption, downgrade interference or resource-exhaustion attacks against an unauthenticated synchronization endpoint. TLS without certificate or hostname validation protects primarily against passive observation, not an active man-in-the-middle.
The proposal also conflicts with the current LFDT specification, whose mTLS ADR defines the manifest certificate as a durable mTLS trust anchor. The LFDT specification has not been updated. If this architecture is adopted, it needs a corresponding normative specification decision and focused security review.
Economic implication: Removing the custom certificate stack could reduce deployment and operational cost for endpoint operators. It does not change Connector pricing, reimbursement or HBAR flows.
3. Chain identification and CLPR throttle administration now have an implementation PR.
Consensus Node PR 27809, opened October 22 at f675a8f71036aa0d29c15f835a92e78c5b6f9e4b, implements the two configuration proposals reported previously.
It removes the independent clpr.chainId property and derives the CLPR identifier from contracts.chainId:
Mainnet becomes eip155:295.
Testnet becomes eip155:296.
Previewnet becomes eip155:297.
Development and preproduction use eip155:298.
This removes a configuration-drift risk and gives Hedera CLPR Channels the same CAIP-2 identity as Hedera’s EVM environment.
The PR also introduces clprLedgerConfiguration.json. The file controls protocol throttles such as:
maxMessagesPerBundle=1000
maxMessagePayloadBytes=65536
maxGasPerMessage=15000000
maxQueueDepth=10000
maxSyncBytes=4194304
At an upgrade boundary, a changed file produces a synthetic ClprUpdateLedgerConfiguration. The update is skipped when CLPR is disabled, the state singleton does not yet exist or the values are unchanged. maxGasPerMessage is capped at contracts.maxGasPerTransaction.
The file may set only throttles. Chain identity, protocol version, service address, timestamps and trust anchors cannot be supplied through it. Every node must receive identical contents or the network could encounter inconsistent state.
This implements issue 27737 and issue 27738, although both remain open until the PR merges.
Verification status: TestLens reports 20,777 tests executed with one failed CLPR upgrade test. The failure says a shared embedded network was already running when the test attempted to create a per-method network. This appears to be a test-harness conflict, but the proposed upgrade path does not yet have a clean CI result.
Economic implication: This creates an operator-governed capacity mechanism for bundle size, queue depth, payload size and execution gas. Those limits can shape CLPR throughput and congestion, but they do not establish application-facing Connector prices, actual-cost reimbursement or Hashgraph revenue allocation.
4. The CLPR SDK design has been accepted into an official Hiero repository.
The externally authored SDK PR 287 merged into hiero-ledger/sdk-collaboration-hub/main on October 22 as d04df37c.
This materially changes its status. It began as an outside proposal, but it is now an accepted document in an official Hiero repository following code-owner approval.
The merged design establishes an initial JavaScript, Java and Go scope covering:
Eight typed CLPR transactions.
Two free HAPI queries.
All 33 CLPR response statuses.
Twelve HederaFunctionality mappings.
Private-key ownership-proof helpers for Ed25519 and ECDSA.
Hbar typing for locked Connector stake.
A low-level SubmitBundle wrapper.
It explicitly defers external or hardware ownership signing, dedicated contract convenience classes, endpoint or relay implementation and Mirror Node lookup classes pending a stable REST contract.
Effect on the prior finding: The SDK proposal is no longer merely unsolicited. Its design and initial scope are now repository-accepted. It remains documentation, not implemented or released SDK functionality, and the approving maintainer explicitly did not claim broader Consensus Node or Mirror Node signoff.
Economic/HBAR implication: Standard SDK bindings should reduce integration friction for applications and Connector operators. That could eventually expand CLPR transaction volume, but the merge itself generates no usage, revenue or HBAR demand.
5. The Mirror Node design changed again and still has unresolved data-model questions.
Mirror Node PR 14362 advanced to 9f8fefd41ce14fb55660c52386c0107df67d9557.
The October 22 revisions now require channel.id whenever a Connector query also uses connector.id, deleted or timestamp. An entirely unfiltered Connector listing may still span all Channels, but a Connector-ID lookup can no longer operate globally without its Channel ID.
Consequently, the proposed standalone connector_id database index was removed. Lookups instead use the composite (channel_id, connector_id) key.
The design also changes the message table from storing only a configuration object in control_configuration to storing the complete ClprControlMessage in control_message JSONB. This preserves the complete payload oneof and accommodates future control-message types without another schema change.
An unresolved maintainer review asks whether re-registration with the same ownership_commitment can produce two simultaneously active pending records. If so, the current main/history-table transition and primary-key model may be incorrect. Another open review questions exposing a deleted filter at all. Current review discussion
Effect on the SDK design: Deferring Mirror Node lookup classes was prudent. The REST query and persistence contracts are still changing.
Economic implication: Reliable Connector discovery and historical observability are prerequisites for operator tooling and commercial services. These design changes do not create fees or revenue themselves.
6. New tests target Connector reentrancy and atomic-batch isolation.
Consensus Node PR 27806 adds a malicious Connector contract that calls sendMessage() recursively from authorizeOutboundMessage().
The expected result is transaction reversion with CLPR_AUTHORIZATION_FAILED. This is useful coverage for a contract-controlled callback boundary, but the current CI run executed zero tests because compilation and formatting failed. The intended protection therefore has not yet been demonstrated by that PR’s CI.
Separately, PR 27786 now defaults the atomic-batch whitelist to every transaction type currently allowed by main, while continuing to exclude every CLPR transaction type. Unknown future transaction types remain rejected unless deliberately added.
Its current head, 5d13ffe91e36e4c0558bb94a84a44bdba628dea8, reports 25,982 tests executed without test failures. Code-owner approval remains pending.
Effect on prior findings: These changes improve callback and composition boundaries. They do not alter Connector reimbursement or charging.
7. A proposed block-stream wire-format optimization needs coordinated consumer upgrades.
Consensus Node PR 27718 proposes optional delta encoding for block-stream state changes. Instead of repeatedly emitting complete values, a state update could contain only changed top-level fields plus an explicit cleared_fields list.
The feature defaults to false, and the genesis block remains full. A reader starting later must already possess trusted prior state so it can reconstruct complete values.
An October 22 commit, 93b5bd46, moved the new singleton metadata fields to high field numbers to preserve compatibility with the existing payload tags.
This is not a CLPR bundle-format change. It is relevant because Block Nodes, Mirror Nodes and state-reconstruction services supporting CLPR proofs must interpret the state stream correctly. The PR itself warns that older readers could treat sparse values as complete, so consumers must support deltas before a network enables them.
The author reports substantial synthetic size reductions for updates whose large fields remain unchanged. Those measurements are local development benchmarks, not independent production benchmarks, and some predate the final schema adjustments.
The current head f6e76d198969001efe2759c05ace0486c2c91f88 has zero tests executed after compilation and formatting failure.
Economic implication: Smaller block streams could reduce infrastructure bandwidth, storage and replay costs. That improves operating economics but does not directly accrue HBAR fees or Hashgraph revenue.
8. TSS and WRAPS integration advanced, but the universal proof upgrade remains unmerged.
Block Node PR 3880 merged on October 22 as fed15e06. It raises the constrained Block Node profile to 192Mi and adds a 160Mi RSS soft ceiling after the larger TSS library caused the old 128M profile to be OOM-killed.
This resolves the previously reported merge-status uncertainty for that operational fix.
The larger Consensus Node WRAPS PR 27506 synchronized with main and now reports 61,811 tests executed without test failures. Its current head is 1cca72b8b0d471a85089bbc01c07dafccd7b874c. The new head is principally a main-branch synchronization, not a new CLPR design change, and code-owner approval remains pending.
The real Ethereum BLS integration is still unresolved. Current main retains FakeBlsSignatureVerifier, while cryptography PR 689 remains open and unchanged.
Economic implication: Reliable, efficient proof verification is a prerequisite for commercially useful cross-ledger traffic. Memory-limit integration and broader WRAPS testing advance that foundation, but do not yet unlock secure Ethereum-origin traffic or associated Connector activity.
9. Current economic and deployment status.
The LFDT core repositories remain unchanged at:
clpr-spec/main — 945082d69e65dd0fd9e9bdf8d59cb8121579f6fd
clpr-smart-contracts/main — 276c8d524e6ce3b5ef01da9d68ce3e8f27798a44
clpr-endpoint/main — 2ccd48d2d5d0d2f15d0829b1a057f27d88fd085e
None has a release or tag.
No new evidence appeared of CLPR activation, production Connector operation, a standardized Connector tariff, Hashgraph operating commercial Connectors, independent security audits, production CLPR benchmarks, cross-ledger liquidity, attributable revenue or incremental public-HBAR value capture.
The October 22 work materially advances packaging, SDK planning, configuration and testing. The most consequential open question is now architectural: whether CLPR will retain the LFDT specification’s authenticated mTLS transport or deliberately rely on unauthenticated transport plus cryptographic payload proofs.