431Release

The Monorepo Release

This is the first page of a section that takes the network's numbered runtime releases one at a time. Each page reads the project's own note for that release and reports what the note says — separating, visibly, the part that rests on the source from the part that rests on us.

What shipped

Spec version 431 is a release about consolidation — of the network's economics, and of the software people use to work with it. Ownership of a subnet becomes contestable through a time-weighted commitment called conviction. Emission between subnets is allocated purely in proportion to each one's moving-average price. The Python SDK and the btcli command line now ship together as one package, bittensor v11, built on a new Rust core. And the chain, SDK, CLI, documentation and website are now developed and released together out of a single repository. [source]

That last part is where the release's name comes from, and it is worth being clear about what this page is reading. The source is one document, with a single exception flagged where it arises: the project's own release note for the upgrade, titled "The Monorepo Release", dated July 2026, and bylined Arbos. The note sets out to explain each change, the reasoning behind it, and the actions required of network participants — so it is both the best available description of the release and an interested party's account of it. [source] [source] [source] [source]

Two more pieces ship alongside the economics. Transactions can now be signed on a Ledger hardware wallet, which decodes the transaction on its own screen and rejects anything it cannot decode and verify, or through a browser extension — Talisman, Polkadot.js, or SubWallet — where only the signature comes back and no keyfile, password, or mnemonic is present on the machine running the command line. And the release describes the pipeline that produced it: the note says every runtime change is tested against a live clone of mainnet state before it merges, that one deterministic build is promoted through devnet and testnet, and that the upgrade the keyholders sign is cryptographically verified against the exact bytes the pipeline produced — claims about the project's own internal process, which nothing outside the project can check. [source] [source] [source]

The documentation was rebuilt at the same time, and its reference pages for all 74 transactions and all 82 queries are generated from the SDK itself — which, the release argues, is what stops the reference drifting from the released software. [source]

What it changes for the ecosystem

For subnet owners this is the largest change on the page. Locking alpha on a subnet accrues conviction, a time-weighted commitment score credited to a hotkey the locker names; before this upgrade that score was recorded on-chain and did nothing at all. As of 431 it governs ownership. Once a subnet is more than one year old and the total conviction across its lockers exceeds ten percent of its outstanding alpha, ownership transfers to the hotkey holding the most conviction — and with it the owner's share of emission. The note does not say how large that share is: the eighteen percent figure comes from the network's own documentation on how emission is split, by way of lesson 04, and it is the one claim on this page sourced outside the release note. Ownership is no longer fixed at registration. [source] [source] [source] [source] [source]

The second economic change is to how emission is divided between subnets. Each block the chain splits TAO emission across subnets, and as of this upgrade that division is determined solely by each subnet's moving-average price, weighted by a miner-burn penalty. The root-proportion term has been dropped from that calculation entirely. The release's account of why is that the term used to reduce a subnet's share as its own alpha issuance grew, which structurally disadvantaged older subnets; with it removed, the same price earns the same emission regardless of age. [source] [source] [source]

Root proportion itself has not gone anywhere. It keeps doing inside each subnet what it always did — capping how much is injected into that subnet's own trading pool, and reserving the root network stakers' share of dividends — and only its role in the division between subnets has been removed. The release's own instruction to owners follows from that: review the conviction guide, set tempo and activity cutoff through the admin calls rather than the retired ones, and discard any emission forecast that still folds root proportion into the split between subnets. [source] [source] [source]

Unverified That places this change upstream of lesson 09 rather than inside it. That lesson picks up once a subnet's overall share has already been decided and follows the money from there into balances, and none of the machinery it describes is touched here — including the root proportion cap on liquidity injection, which is the part of that lesson a reader might expect this release to have invalidated.

Unverified Lesson 04 is the lesson this release does reach. The share formula it states — a subnet's price times one minus its burn penalty, over the sum of the same across every subnet — carries no root-proportion term, so on its face it already describes the post-431 rule rather than the one it replaced. Read that as true of this release and not beyond it: the v440 page puts every price through a threshold on a subnet's rank before the share is worked out — the emission gate — and from there on lesson 04's flat formula stops describing the live chain. Neither reading has been checked against chain state.

Validators and delegates get a smaller, sharper change: increase_take and decrease_take are no longer free extrinsics, so adjusting a take now costs a transaction fee, and the release's advice is to preview one with --dry-run first. Between validators and miners, the new package adds hotkey-signed HTTP, so a request provably came from a specific hotkey, covers exactly the bytes received, and cannot be replayed. The runtime was hardened in the same release — proxy permissions are now deny-by-default, a crowdloan reentrancy flaw was closed, and the randomness pipeline behind commit-reveal weight submission can no longer be stalled. [source] [source] [source] [source]

Stakers, and anyone running automation over stake, get the longest list of small breakages. Moving stake is now strict: move_stake, transfer_stake and swap_stake no longer silently shrink an oversize alpha amount after an alpha-paid fee, so submitting a full balance can fail outright — leave dust, or read the post-fee balance first. A stake placed with a price limit now refunds the unswapped TAO to the coldkey when the limit stops it early, which means summing StakeAdded events no longer tells you what was actually consumed; read the balance after inclusion instead. And stake intents in the new SDK apply a five percent price bound unless you opt out, so a script written against any-price execution will start seeing SlippageTooHigh. [source] [source] [source] [source]

Everyone else's list is shorter, and the release's own summary is that most participants need little or no action. Python users uninstall bittensor-cli and bittensor-wallet and install the consolidated bittensor package; existing wallet keyfiles are unchanged and fully compatible. Anyone holding a proxy has more to do, since proxy permissions are deny-by-default now and every existing grant needs reviewing. Indexers and SDK authors regenerate bindings for typed currency units and the renamed get_proxy_filters, and must handle NetworkRegistrationQueued, which register_network can now emit without creating the subnet at all. Node operators need no binary upgrade to keep syncing Wasm, though the release still tells them to install the latest node image when one is published, for node-software updates. [source] [source] [source] [source] [source] [source] [source]

What to watch

The release is explicit that the numbers underneath conviction are not fixed by the code. The maturity rate that sets how fast a perpetual lock's conviction approaches its locked mass, and the unlock rate that frees a decaying one, are both governance-set storage values, and the note tells readers to read them from chain state before planning a lock rather than relying on the figures it prints. [source]

Unverified What the note does not say is how many subnets are anywhere near the ownership conditions, or how much alpha is locked today — so nothing on this page tells you whether contested ownership is a live event or a dormant rule. The first subnet that actually changes hands under it will say more about the mechanism than the specification does.

Unverified The other open question is what a price-only split rewards. Making a subnet's income a direct function of its market price is a real simplification, and the release presents it as one; it also means that anything which moves that price moves the income, and the note does not discuss what constrains that. Whether the simpler rule is also the safer one is not answerable from this document.

How it actually works

Conviction and ownership

Ownership becomes contestable once both conditions hold: the subnet is older than one year, and total conviction exceeds ten percent of its outstanding alpha. At that point the hotkey with the highest conviction takes ownership, including the owner's share of emissions. [source] [source] [source]

Two lock modes are available, and both are exponential processes rather than fixed terms. A perpetual lock's conviction approaches its locked mass asymptotically and never quite completes; the chain's maturity rate is the exponential time constant, roughly 43 days at the values the note quotes, which puts conviction at about 63% of the locked mass after one time constant and about 86% after two. A decaying lock — the default — frees its locked mass on the chain's unlock rate, a time constant of roughly 130 days, after which about 37% of the mass remains locked, and its conviction peaks and then unwinds. Locks credited to the subnet owner's own hotkey are the exception: they mature instantly, so their conviction always equals their locked mass. Both rates are governance-set storage values, and the release's own guidance is to read them from chain state rather than from the page. [source]

The cross-subnet emission split

Each block, the chain divides TAO emission between subnets, and that division is now determined solely by each subnet's moving-average price, weighted by a miner-burn penalty. The root-proportion term has been removed from the cross-subnet calculation; it continues to operate within each subnet, capping liquidity injection and reserving the root stakers' share of dividends. The release states the result plainly: a subnet's emission share is a direct function of its market price. [source] [source]

The package, and what the project measured

bittensor v11 consolidates the SDK and the btcli command line into one package installed with pip install bittensor, replacing the separate bittensor-cli and bittensor-wallet packages; existing wallet keyfiles are unchanged and fully compatible. It is also a major API revision: the Subtensor class is replaced by a client-and-intent model with planning, policy gates and typed results, chain state is read through a typed client, and every transaction is an intent that can be planned before it is executed. The CLI is generated from the same catalog — every transaction a btcli tx command, every query a btcli query command, with the v9 shorthands preserved as aliases and --dry-run available on every mutation. [source] [source] [source] [source]

Because both packages own the btcli command, the release states that the order of an upgrade matters — uninstall first, then install: [source] [source]

pip uninstall -y bittensor-cli bittensor-wallet
pip install -U bittensor

The package is built on a new Rust core covering keys, keyfiles, encoding and timelock encryption, and the release publishes four before-and-after measurements it says were taken against the live network. They are the project's own figures, not independent ones: [source]

Startup codec build, which happens on every btcli invocation: 337 ms, down to 4 ms. [source] [source] [source]
Metagraph decode throughput: 3–6 MB/s, up to 60–77 MB/s. [source] [source] [source]
Storage map decode: 92k entries per second, up to 599k. [source] [source] [source]
Constructing a 1,000-operation batch: about 1.1 s, down to about 50 ms. [source] [source] [source]

The release is equally explicit about what those figures do not cover: transaction submission and inclusion remain bound by chain block time, and the improvements are concentrated in startup, decoding and construction. [source]

What the new stack adds

Beyond the consolidation, the release lists capabilities it says the old stack did not have. Most of them are one idea applied in different places: make a mistake fail before it costs anything. A Balance now carries its currency, so TAO and a subnet's alpha cannot be silently mixed — arithmetic across the two raises rather than quietly returning a wrong number. A client can be bound to a maximum fee, a maximum spend and a set of allowed subnets, and a transaction that would breach any of them is refused before it is signed rather than after it lands. And a failure comes back as a semantic error code with a remediation hint instead of prose, the whole mapping published as a machine-readable catalog, so a caller can branch on what actually went wrong. [source] [source] [source] [source]

A second group widens who can hold a key and what one transaction can be. Every transaction accepts --proxy-for, so a delegate key can act for a coldkey that never comes online, with scoped proxy types, announced (delayed) proxies and pure proxy accounts all supported. Multisig accounts are k-of-n, with the approve, execute and cancel flow wrapped by the btcli multisig group. Several intents can be composed into one all-or-nothing transaction, and a coldkey transaction can be encrypted to the next block's ephemeral key, so nothing sitting in the mempool can read it or front-run it. [source] [source] [source]

The rest is about surviving a key that has already gone wrong, or an address that was never right. A hotkey swap moves registrations and stake to a new key; a leaked coldkey is evacuated through an announced swap that waits five days, and that delay is the window in which the real owner disputes it. CLI address arguments resolve from a saved address book or from local key names rather than only from raw ss58, which is the defense against a poisoned address pasted in from somewhere else. And timelock encryption — sealing data that anyone can open at a known future time and nobody, the author included, can open early — is exposed directly, the same mechanism that already secures commit-reveal weights. [source] [source] [source]

Signing moves off the host machine in two ways. A Ledger signs through merkleized metadata: the device decodes the transaction on its own screen, the chain verifies the same metadata digest that was signed, and the device rejects any transaction it cannot decode and verify — reached with --ledger, or --ledger --ledger-account N for a specific account. A browser extension signs through a local bridge that the CLI relays the transaction to, returning only the signature, reached with --signer extension after btcli extension accounts lists what the extensions expose. [source] [source] [source] [source] [source] [source]

The release also states a design goal for the whole stack: that a program should be able to drive it as well as a person can. In practice that means every operation is discoverable at runtime against a JSON schema — btcli tools on the command line, bt.intents.list_tools() in Python — and can then be executed by name from a plain dictionary validated against that schema. --json gives machine-readable output on any command, and a non-interactive session that is missing a confirmation is declined rather than left hanging, so a script never stalls on a prompt nobody is there to answer. The documentation publishes the same intent, read and error catalogs as static JSON, every page is fetchable as raw markdown, and the whole corpus is served at a single plain-text endpoint for loading into a context window. [source] [source]

Privilege is surfaced rather than left implicit: the docs, the catalogs and the CLI help each name the origin an operation requires — signed, subnet owner, or root — and root calls are wrapped in Sudo.sudo at execute time. Failure reporting is honest through those wrappers too. A dispatch that fails inside a Sudo, Proxy or Multisig envelope is reported as a failure, rather than as a success on the grounds that the outer extrinsic landed. [source]

Operational breaking changes

The release lists the call sites and accounting assumptions that change under the upgraded runtime, and points at a migration guide for the full checklist: [source]

move_stake, transfer_stake and swap_stake no longer silently shrink an oversize alpha amount after an alpha-paid fee, so submitting the full stake balance can fail. [source]
When a price limit stops a stake-in before the full amount swaps, the unswapped TAO returns to the coldkey — prefer post-state balances over summing StakeAdded for partial fills. [source]
SubtensorModule renamed InsufficientBalance to InsufficientTaoBalance and added InsufficientAlphaBalance; other pallets may still emit the old name, so match on the semantic error code or handle both. [source]
Owner tempo and activity cutoff are now set through AdminUtils::sudo_set_tempo and AdminUtils::sudo_set_activity_cutoff_factor; the old SubtensorModule call indices are retired, and the live inactivity window is the tempo-relative factor rather than the legacy absolute blocks value. [source]
Stake intents apply a 5% price bound unless opted out, so scripts that assumed any-price execution will see SlippageTooHigh. [source]
increase_take and decrease_take are no longer free extrinsics. [source]
Under full capacity or pending cleanup, register_network may emit NetworkRegistrationQueued without creating the subnet; the SDK and btcli subnets create wait for the matching NetworkAdded, and raw-call clients must do the same. [source]
Drand rounds are sequential: after the first pulse only last_stored_round + 1 is accepted, and missing rounds must be backfilled in order. [source]
Metadata and catalogs changed shape: get_proxy_filter is now get_proxy_filters, TAO/Alpha and NetUid have distinct metadata types, and /catalog/errors.json chain_errors values are objects carrying code, description and docs_url. [source]

The release pipeline

The chain, SDK, CLI, documentation and website live in a single repository. The pipeline that turns that into a release is described rather than demonstrated, and the description is the project's own: every runtime change tested against a live clone of mainnet state before it merges, a single deterministic build promoted through devnet and testnet with automated checks at each stage, and the upgrade signed by the keyholders cryptographically verified against the exact bytes the pipeline produced. A new public devnet joins finney and testnet as a supported environment. Localnet publication pins smoke-tested multi-arch image digests, which the release says means a pulled localnet is a build that passed the same checks as the release train. [source] [source]