Protocol 30 GA release train #6028

Tracking issue for the Protocol 30 GA release train across go-stellar-sdk, stellar-rpc,
stellar-horizon, and stellar-galexie. Driven by the /release-train skill; the yaml block
below is the machine-readable source of truth and is reconciled against live GitHub state on
every invocation. Humans: check items off, but the yaml is what the skill trusts.

Protocol 30 carries CAP-0084, CAP-0087 and CAP-0088. Train tuple: stellar-xdr 4f524bba,
stellar-core 30.0.0-3642.0e49751aa (v30.0.0), soroban-env-host 30.0.0 (29.0.2 for the
previous protocol).

Checklist

• preflight (2026-10-20), report below
• main merged into protocol-next in all four repos before the train, all with merge commits: Merge main into protocol-next #6027, Merge main into protocol-next stellar-rpc#1131, Merge main into protocol-next stellar-horizon#252, Merge main into protocol-next stellar-galexie#99
• decisions 1–3 (2026-10-20): Cargo-only host difference waived; CAP-0084, CAP-0087 and CAP-0088 all ship; xdr, protocols/rpc, clients/stellarcore: read ledger keys, envelopes and topic filters through XDR views #6026 held out of v0.8.0
• SDK flip PR (protocol-next): Protocol 30 GA: cut the 0.8.0 changelog #6029, MERGED (squash 3da70d87). Changelog only ([0.8.0] cut, [0.7.3] backfilled); XDR_COMMIT was already 4f524bba with XDR_FEATURES empty
• SDK merge PR: Protocol 30 Support #6030, MERGED as merge commit 921a5b16 (parents 3cac1010, 3da70d87); protocol-next survived
• release sdk: v0.8.0, a lightweight tag on 921a5b16 (main-reachable), with the GitHub release published; proxy.golang.org serves .info and .mod
• rpc: closed Bump current version of soroban-env to latest tip stellar-rpc#916 (automation/bump-soroban-env)
• rpc: Protocol 30 Support stellar-rpc#1133, MERGED as merge commit 13e53516 (parents 40277d1c, c24cf16a); protocol-next survived. release/v30.0.0 was created at 13e53516 with no extra commits, so there is no release PR and the tag goes on 13e53516
• release rpc: release branch, package and docker builds, staging sign-off, tag, promote to stable, kube deploys
  • package build: soroban-package-builder build 220 (BRANCH=release/v30.0.0, VERSION_OVERRIDE=30.0.0), so deb 30.0.0-220 is built from 13e53516 and in noble unstable and testing
  • docker build: soroban-rpc-docker-builder with core 30.0.0-3642.0e49751aa.noble, rpc 30.0.0-220, PUSH_PUBLIC, pushed stellar/stellar-rpc:30.0.0-220 (and the short 30.0.0), amd64 digest sha256:89c01197…b84b. stellar-rpc version in the image reports 30.0.0-13e53516… with xdr 4f524bba and hosts 29.0.2/30.0.0, and its core reports 30.0.0 (0e49751aa)
  • staging kube PR: stellar/kube#5560 (signed commit 2092bf3e, approved, squash-merged as 9a5c40f7 at 05:24Z) moves the three dev-eks soroban-rpc-*-dev apps from dev ECR 29.0.0-210 to docker.io/stellar/stellar-rpc:30.0.0-220
  • staging sign-off (human, 2026-10-21): rpc-testnet-dev and rpc-futurenet-dev report commitHash 13e53516, and simulation and history methods match production (evidence comment below). rpc-pubnet-dev has no public route and the cluster API was unreachable without the VPN, so it was signed off unverified
  • tag v30.0.0 (annotated, tag object ee5a1a3c) on 13e53516 (main tip), GitHub release published 06:07Z and marked latest; release/v30.0.0 deleted
  • promote-to-stable with PACKAGE=stellar-rpc_30.0.0-220_amd64: 30.0.0-220 is in noble and jammy stable, and Docker Hub stable/latest point at the release digest (06:33Z)
  • production kube PR: stellar/kube#5561 (signed commit 9ce8ec5c, approved, squash-merged as 645e5b35 at 06:22Z) moves futurenet-rpc (rpc-futurenet.stellar.org, 29.0.0) and soroban-rpc-testnet-prd (29.0.1) to 30.0.0-220. Rolled out by 06:33Z: every sampled replica of both endpoints reports commitHash 13e53516 and core 30.0.0, and both are healthy
• horizon: Protocol 30 Support stellar-horizon#253 (flip and merge in one PR), MERGED as merge commit b3ff4119 (parents c0e63c2c, 23b05778); protocol-next survived. Both legs run stellar/stellar-rpc:30.0.0-220; the P30 leg passed on re-run after a TestReingestDB timing failure (100 of 101 passed the first time, RPC tests included)
• release horizon: v30.0.0, a lightweight tag on b3ff4119 (main tip), release "Horizon v30.0.0" published 08:38Z; the Horizon release workflow (run 39570773663) attached the darwin-amd64, linux-amd64, linux-arm and windows-amd64 binaries
  • package-builder (Jenkins Platform/stellar-horizon-package-builder-new) build 566 with BRANCH=refs/tags/v30.0.0 and VERSION_OVERRIDE=30.0.0: deb 30.0.0-566 is in jammy and noble testing, and its stellar-horizon binary reports 30.0.0-b3ff4119cc99ebcc8048334f5ec64e78c16d1666. The triggered stellar-horizon-docker-builder build 729 passed: it installed core 30.0.0-3642.0e49751aa.noble and pushed ECR dev/stg stellar-horizon:30.0.0-566
  • staging deploy (Jenkins Platform/deployinator, PACKAGE_TESTING=30.0.0-566): stg_pubnet build 852 (20 web nodes, 2 captive-core ingest nodes) and stg_testnet build 854 (3 ingest nodes), every host failed=0. Not checked on the hosts themselves, which are only reachable on the internal network. From 29.0.0 the upgrade only swaps the binary: no migrations, ingest CurrentVersion unchanged at 20, no flag changes
  • futurenet: deployinator dev_futurenet (build 853) matched no hosts and changed nothing. horizon-futurenet.stellar.org is the futurenet-horizon Argo app on kube001-dev-eks, so it moved by stellar/kube#5576 (signed commit a8266c22, approved, squash-merged as 73461329 at 18:54Z), which bumped stg/stellar-horizon from 29.0.0-563 to 30.0.0-566. Rolled out by 19:09Z: every sample reports 30.0.0-b3ff4119…, supported protocol 30 and stellar-core 30.0.0 (0e49751aa), with ingestion at the core's latest ledger. All requests errored for under a minute during the pod restart
  • promote-to-stable (Jenkins Platform/stellar-horizon-promote-to-stable-new, PACKAGE=stellar-horizon_30.0.0-566_amd64, 2026-10-21): deb 30.0.0-566 is in jammy and noble stable. Docker Hub 30.0.0-566, 30.0.0, stable and latest all point at sha256:d0254566…, pushed at 19:21Z. That image is docker-builder build 729's (VERSION=30.0.0-566, core from noble stable), and public ECR 30.0.0 serves the same image config
  • production deploy (deployinator, PACKAGE_STABLE=30.0.0-566): prd_testnet and prd_pubnet, green and blue, each before its network's protocol 30 upgrade. As of 2026-10-22, horizon-testnet and horizon.stellar.org still report Horizon 29.0.0 (supported protocol 29) on stellar-core 30.0.0. Horizon 29 stops ingesting at the first protocol 30 ledger. Testnet, 2026-10-22: prd_testnet_blue was upgraded, and stellar/terraform#7335 moved the testnet ALB to blue (applied 14:14Z after a re-plan, because Atlantis's Terraform had been upgraded since the first plan). At 14:15Z every sample of horizon-testnet.stellar.org reports 30.0.0-b3ff4119…, supported protocol 30 and stellar-core 30.0.0, with ingestion caught up, and the history, state and fee endpoints answer with current data. Green, on 29.0.0, is the standby. Pubnet: prd_pubnet_blue was upgraded, and stellar/terraform#7336 moved the pubnet ALB to blue (applied 14:34Z). Every sample of horizon.stellar.org then reports 30.0.0-b3ff4119… and supported protocol 30, with ingestion caught up. For about two hours after the flip, /trade_aggregations returned 503 (database timeouts at about 10.5s) for every pair with trades, while other endpoints answered in about 0.5s. By 16:33Z it answered 200 in about 1.5s; the cause isn't visible from outside. Remaining: upgrade the green standbys (prd_testnet_green, prd_pubnet_green) before each network's vote: testnet 2026-11-03 17:00 UTC, pubnet 2026-11-23 17:00 UTC
• galexie: Protocol 30 Support stellar-galexie#101, MERGED as merge commit 4d89b44e (parents 00a8c318, 2ccdd50d); protocol-next survived
• release galexie: galexie-v30.0.0, a lightweight tag on 4d89b44e (main tip, pinning go-stellar-sdk v0.8.0 and core 30.0.0-3642.0e49751aa.noble), released after Push sha tag container image passed. The tag run pushed stellar/stellar-galexie:30.0.0 and :latest
• re-sync protocol-next in all four repos, all fast-forwards: sdk 921a5b16, rpc 13e53516, horizon b3ff4119, galexie 4d89b44e
• follow-ups done or converted to tracked issues: galexie quickstart re-pin is Move the integration-test quickstart image to the latest track once it supports protocol 30 stellar-galexie#102, unblocked 2026-10-22 when quickstart's latest track published v682-b1552.1-latest (core v30.0.0), and closed by Run the integration tests on quickstart's latest track stellar-galexie#103 (approved, squash-merged as c650b13b at 13:31Z; all three integration legs passed at protocol 30 on the new image); the stellar-xdr tag needs no follow-up (decision 6) Outside the train, the rpcv2 archive-node beta was rebuilt for protocol 30 in rpcv2: support protocol 30 in the archive node beta stellar-rpc#1155 (tag rpcv2-v0.1.0-beta.2) and published over stellar/unsafe-stellar-rpc:archive-node-beta (sha256:1c02ccbe…, 2026-10-27).

Decisions (resolved 2026-10-20)

1. soroban-env-host commit vs core's submodule. The strict preflight check fails: rs-soroban-env
   v30.0.0 (0c99950e, the crates.io 30.0.0 source) is not core v30.0.0's src/rust/soroban/p30
   submodule (6e6c4a87). The only commit between them is Use crates.io soroban-wasmi 29.0.0 rs-soroban-env#1751, which
   changes Cargo.toml (+1/-1) and Cargo.lock (+2/-2) to take soroban-wasmi 29.0.0 from
   crates.io instead of 0.31.1-soroban.29.0.0, and those two wasmi releases differ only in the
   version fields of three Cargo.toml files. The previous-protocol host has the same shape:
   v29.0.2 (3d565bda) is core's p29 submodule (a721944b) plus Prepare patch 29.0.1 rs-soroban-env#1748
   and Prepare patch 29.0.2 rs-soroban-env#1752, which touch only Cargo.toml and Cargo.lock. The code the
   preflight hosts run is identical to the code core applies with. Waived.
2. CAPs. No feature gates remain on any protocol-next (XDR_FEATURES is empty; rpc's Cargo.toml
   has no next or cap_* features). Confirm CAP-0084, CAP-0087 and CAP-0088 all ship; core
   v30.0.0 enables all three at protocol 30. All three ship.
3. xdr, protocols/rpc, clients/stellarcore: read ledger keys, envelopes and topic filters through XDR views #6026 targets protocol-next. Ship it in v0.8.0, or hold it until
   after the tag? If it ships, the rpc flip also has to adapt to its API changes
   (SegmentFilter.ScVal and stellarcore.Client.GetLedgerEntries). Held: not in v0.8.0.

Defaults the train will apply unless someone objects:

4. CI core images. The GA images stellar/stellar-core:30.0.0-3642.0e49751aa.{noble,jammy}
   already exist (published 2026-10-16), so the flip PRs pin them directly and there is no
   separate unsafe→GA swap at release time.
5. Horizon's P29 leg moves to the same .noble flavor as its P30 leg (deb
   30.0.0-3642.0e49751aa.noble~buildtests), matching rpc and galexie.
6. stellar-xdr tag. There is no v30.0 tag yet (tags stop at v28.0). release sdk re-checks
   for it; if it is still missing then, the P28 precedent applies (tag the SDK and track the
   tag check separately, as in Verify the stellar-xdr v28.0 tag matches the commit v0.7.0 pinned #5986).
   Resolved 2026-10-21: v30.0 is published as a lightweight tag on 4f524bba, the commit v0.8.0
   generated from, so there is nothing to track. (v28.0 also landed, on v0.7.0's commit, so Verify the stellar-xdr v28.0 tag matches the commit v0.7.0 pinned #5986 is closed.)
7. RPC is not rebuilt from the tag. v30.0.0 goes on 13e53516, the commit build 220 was built from,
   so build 220 is promoted as-is (as P28 and 29.0.1 were) instead of a second package/docker build from the tag.
8. Kube pins the full 30.0.0-220 tag on staging and in production, not the floating 30.0.0.

Preflight report (2026-10-20)

State

train:
  protocol: 30
  opened: 2026-10-20
  last_reconciled: 2026-10-21
  closed: null                  # reopened 2026-10-21: horizon deb + docker image were never built
  votes: {testnet: 2026-11-03T17:00Z, pubnet: 2026-11-23T17:00Z}
stellar_xdr:
  ref: 4f524bbac80c781c06e4fb5fc93a2d0d331d6705
  commit: 4f524bbac80c781c06e4fb5fc93a2d0d331d6705
  tag: v30.0                    # lightweight tag on the commit above, published after preflight (checked 2026-10-21)
  tag_pending: false
core:
  build: 30.0.0-3642.0e49751aa  # stellar-core v30.0.0
  verified_flavors: [noble, noble~buildtests, jammy, jammy~buildtests]
  unsafe_images: [noble]        # stellar/unsafe-stellar-core has no .jammy for this build
  ga_images: [noble, jammy]     # stellar/stellar-core, published 2026-10-16
env_host:
  crates_version: 30.0.0
  rs_commit: 0c99950e96128beba3319aa96b116646ce974e69
  core_submodule: 6e6c4a87f46c7fdab0c2e2be82901b1e32378223       # differs by Cargo-only rs-soroban-env#1751
  prev_crates_version: 29.0.2
  prev_rs_commit: 3d565bda02c522dce089dc42d5e3a94a05111891
  prev_core_submodule: a721944b5a4ea830a4bf5c2dbb8dbe8c1e1354c5  # differs by Cargo-only rs-soroban-env#1748, #1752
  mismatch_waived: true         # decision 1, 2026-10-20: Cargo-only
gates:
  cap_features: []              # no XDR_FEATURES, cap_* or next gates on any protocol-next
  caps_confirmed: true          # decision 2: CAP-0084, CAP-0087, CAP-0088 all ship
  sdk_6026: hold                # decision 3: not in v0.8.0
sdk:
  next_version: v0.8.0
  flip_pr: 6029                # squash-merged 3da70d87
  merge_pr: 6030
  merge_sha: 921a5b16af9a72d973ab9ba666e96ad8bf2f6ce4
  released: true                # v0.8.0, lightweight tag on merge_sha
rpc:
  flip_pr: 1133                # flip + merge in one PR into main
  merge_pr: 1133
  merge_sha: 13e53516633c3ce1281c7edbacb607107d3a4e55
  release_pr: null              # release/v30.0.0 == merge_sha, no release PR needed
  rc_deb_build: 220             # soroban-package-builder #220 from release/v30.0.0 @ 13e53516; noble unstable + testing
  rc_image: stellar/stellar-rpc:30.0.0-220   # sha256:89c011978756ba1408ae92db336ff1db98aae40f26c22aba3e10a321f7c2b84b (amd64); short tag 30.0.0 is the same digest
  kube_staging_pr: 5560         # stellar/kube, signed 2092bf3e; merged 9a5c40f7 2026-10-21T05:24Z
  staging_validated: true       # user sign-off 2026-10-21; pubnet-dev not verified in-cluster
  release_sha: 13e53516633c3ce1281c7edbacb607107d3a4e55
  released: true                # v30.0.0 annotated tag ee5a1a3c -> 13e53516; release published 2026-10-21T06:07Z
  ga_core_image_swapped: true   # GA stellar/stellar-core images pinned from the flip (decision 4)
  ga_deb_build: 220             # no rebuild from the tag (decision 7)
  promoted_stable: true         # apt noble+jammy stable 30.0.0-220; docker stable/latest = sha256:89c01197 (06:33Z)
  kube_dev_pr: null
  kube_prd_pr: 5561             # stellar/kube, signed 9ce8ec5c; merged 645e5b35 2026-10-21T06:22Z (futurenet-rpc + testnet-prd)
  ga_image: stellar/stellar-rpc:30.0.0   # same digest as 30.0.0-220
horizon:
  flip_pr: 253                 # flip + merge in one PR into main
  rpc_image_pinned: stellar/stellar-rpc:30.0.0-220   # both legs, 23b05778
  merge_pr: 253
  merge_sha: b3ff4119cc99ebcc8048334f5ec64e78c16d1666
  released: true                # v30.0.0 lightweight tag on merge_sha
  ga_core_image_swapped: true   # GA stellar/stellar-core images pinned from the flip (decision 4)
  ga_repin_pr: not_needed       # 30.0.0-220 is the released rpc build (same digest as 30.0.0)
  deb_build: 566                # package-builder-new build 566 from refs/tags/v30.0.0; jammy+noble testing
  docker_built: true            # docker-builder build 729: ECR dev/stg 30.0.0-566, core 30.0.0-3642.0e49751aa.noble
  promoted_stable: true         # apt jammy+noble stable 30.0.0-566; Docker Hub 30.0.0-566/30.0.0/stable/latest = sha256:d0254566 (2026-10-21T19:21Z)
  staging_deployed: true        # deployinator 852 stg_pubnet, 854 stg_testnet (853 dev_futurenet matched no hosts)
  futurenet_kube_pr: 5576       # merged 73461329; horizon-futurenet on 30.0.0-566 since 19:09Z
  prd_deployed: false           # prd_testnet + prd_pubnet, green + blue; blue live on testnet since 14:14Z (stellar/terraform#7335) and pubnet since 14:34Z (stellar/terraform#7336); green standbys still 29.0.0
galexie:
  flip_pr: 101                 # flip + merge in one PR into main
  merge_pr: 101
  merge_sha: 4d89b44ed2677fc639bd4aa8e70f0b8e769bb6ad
  sha_image_published: true    # stellar/stellar-galexie:4d89b44
  released: true                # galexie-v30.0.0 -> 4d89b44e
resync:
  sdk: true                     # protocol-next fast-forwarded to 921a5b16
  rpc: true                     # protocol-next fast-forwarded d1916007..13e53516
  horizon: true                 # protocol-next fast-forwarded 17dc53db..b3ff4119
  galexie: true                 # protocol-next fast-forwarded to 4d89b44e
pre_train_syncs:                # main → protocol-next, merge commits, 2026-10-20
  sdk: stellar/go-stellar-sdk#6027
  rpc: stellar/stellar-rpc#1131
  horizon: stellar/stellar-horizon#252
  galexie: stellar/stellar-galexie#99
followups:
  - repo: stellar/stellar-galexie
    issue_or_pr: 102
    fix_pr: 103                 # signed 0b0599b7, merged c650b13b 2026-10-22T13:31Z; v678-b1528.1-nightly -> v682-b1552.1-latest (quickstart dc9a8af1, core v30.0.0)
    done: true
    note: re-pin GALEXIE_INTEGRATION_TESTS_QUICKSTART_IMAGE from v678-b1528.1-nightly to an immutable latest-track build once quickstart publishes core 30