Changelog

The protocol publishes the SDK as @entros/pulse-sdk on npm. Programs are deployed in place—program IDs do not change between versions. Material changes to instructions, PDAs, or scoring functions are documented here.

Pulse SDK

4.x

Current published version: 4.5.0. The 4.x line canonicalises capture at 16 kHz and reworks the transport and failure taxonomy.

4.5.0 Poseidon moved from circomlibjs to a zero-dependency implementation, producing the same field element with far less behind it. The proving key and the crypto modules now load during capture rather than after it. Golden vectors compare with a relative tolerance, so they hold across processor architectures.

4.4.0 capture_timing reports what the microphone delivered, measured before the SDK applies its own gain. A capture can be quiet and fully recoverable, and only these fields separate that from a microphone that was too quiet.

4.3.0 The motion contour aligns to the audio window rather than to its own array length.

4.2.0 onProgress reaches submitViaWallet and submitResetViaWallet.

4.1.0 to 4.1.3 Baseline reset lands on chain again, accounts written before IdentityState last grew decode correctly, and two prompts that could hold a confirmed verification open are now bounded.

4.0.0, breaking. Every capture is band-limited and decimated to 16 kHz before feature extraction, not only captures that arrive at another rate. Browsers treat a requested sample rate as a request rather than an instruction, so the same voice at two rates produced two incomparable feature vectors. Every fingerprint moved. Baselines from 3.x do not carry forward. The release also rebuilt the transport around stalls rather than deadlines, so a slow upload that is still moving is never aborted, and added one exported reason taxonomy in place of six drifting copies.

3.x

The 3.x line tracked the v3 feature pipeline and the client-side signals that accompany it.

3.16.0 — the wallet-connected flow transmits a coarse, timestamp-free outline of the traced challenge curve alongside the existing features. Sixty-four points at equal time intervals, used to check the trace against the curve the server issued.
3.14.0 — the SDK parses the server-issued Lissajous curve from the challenge response and renders that curve rather than generating its own.
3.13.0 — baseline storage is partitioned per wallet, which removes the repeated signature prompt when switching wallets. Storage access is guarded for server-side rendering.
3.11.0–3.12.0 — client capture reports spectral flatness and centroid, and flags virtual audio devices, in the client_signals envelope.
3.9.0 — client_signals carries automation-framework artifacts, without device fingerprinting.
3.3.0 — wallet-keyed encrypted baseline recovery, so a returning user restores their baseline from chain instead of re-enrolling.
3.0.0 — the audio feature set drops the MFCC DC term, which carried microphone energy bias. Feature vectors produced by 3.0.0 and later are not comparable with 2.x vectors.

2.0.0

Expanded motion and touch feature spaces with covariance, curvature, gap distribution and path-efficiency terms.

Upgrading from 1.x

The verification API is unchanged: PulseSDK, createSession, verify, submitViaWallet and verifyEntrosAttestation all keep their signatures. Two changes need attention.

The public surface narrowed to the verification path. Seven statistics helpers that the SDK exported incidentally (mean, variance, skewness, kurtosis, entropy, autocorrelation, condense) are no longer exported; import them from a statistics library if your own code used them.

DEFAULT_CAPTURE_MS moved from 7000 to 12000. If you display your own progress UI, read the constant rather than hard-coding the window.

1.5.x

Final release of the 1.x line: 1.5.3. The 1.5.1–1.5.3 line is responsiveness, audio capture, and dependency hygiene on top of the 1.5.0 baseline; no API or breaking changes.

1.5.3 — Audio capture passes voiceIsolation: true in getUserMedia constraints (W3C Media Capture Extensions); browsers and OS layers that support the constraint apply the platform's voice-isolation pipeline before samples reach the SDK, browsers that don't recognize it fall back to the default constraints. The F0 contour detector also yields to the host event loop between blocks so the verify spinner repaints through the F0 stage. Transitive uuid dependency is overridden to ^14.0.0 to clear advisories surfaced by the upstream chain.
1.5.2 — Heavy feature-extraction stages yield to the host event loop between blocks. The verify spinner repaints during long extraction stages instead of stalling.
1.5.1 — Republish carrying README cross-link to @entros/verify for the drop-in path. No code change against 1.5.0.

1.5.0

submitViaWallet now throws when an on-chain transaction reverts. Earlier versions returned success: true for transactions that were included but failed in execution, which let a "verified!" UI render for a tx that mutated nothing. The thrown error preserves the InstructionError JSON shape so callers can match on Custom codes.
Anchor IDLs (entros_anchor, entros_verifier) are now bundled into the SDK at compile time; the SDK no longer fetches IDLs at runtime. Saves ~150–300ms per identity read and ~300–600ms per re-verification submit. Bundle size grows ~12KB gzipped.

1.4.x

1.4.0 — first-verification mints now bundle a validator-signed receipt as an Ed25519Program::verify instruction immediately before mint_anchor. The on-chain program enforces the binding (see entros-anchor errors 6016–6022). The SDK consumes the receipt from the /validate-features response and prepends the verify instruction transparently; callers do not need to handle the receipt directly.
1.4.0 — instructionsSysvar is now always passed to mint_anchor (the on-chain accounts struct requires it whether or not a receipt is bundled). SDKs older than 1.4.0 are silently broken against the deployed program.
1.4.0 — PulseConfig.onPrivacyFallback callback. Browsers that block encrypted localStorage (iOS Safari private mode, Brave shields, Firefox Total Cookie Protection) trigger this callback; the host app returns true to allow plaintext fallback or false to keep storage in-memory only. Without the callback, the SDK defaults to in-memory only—safer than the previous silent plaintext fallback.
1.4.0 — validator-unreachable returns { ok: false, reason: "validation_unavailable" } instead of silently bypassing server validation.
1.4.1 — Ed25519 receipt instruction is pinned immediately before mint_anchor with an explicit ComputeBudget so wallet adapters can't inject between them.
1.4.2 — requestSasAttestation skips the /attest call when wallet ownership proof can't be produced (no signMessage, signing throws, or no server nonce). Avoids doomed-to-400 requests after the executor's /attest ownership requirement landed.

1.3.0

New PulseSDK.resetBaseline(), PulseSession.completeReset(), and submitResetViaWallet public API for the baseline-reset flow. IdentityState type gains lastResetTimestamp.

1.2.x

Added attestAgentOperator and getAgentHumanOperator for the Agent Anchor integration
Added verifyEntrosAttestation for the SAS attestation read path
Added Lissajous challenge generation for touch capture
Hardened circuit input preparation against malformed fingerprint inputs

1.1.x

Re-export of PROGRAM_IDS and capture-window constants
submitViaRelayer for walletless mode

Current deployment enforces validator-signed mint-receipt binding on first verification: every mint_anchor call must be immediately preceded by an Ed25519Program::verify instruction whose signed message ties the wallet, commitment, and validated_at timestamp to the registered validator pubkey. SDKs at 1.4.0 or later bundle the receipt automatically; older SDKs hit MissingValidatorReceipt (6016). Re-verification (update_anchor) binds via the on-chain VerificationResult PDA produced by the verifier program and is unaffected.
Cross-program binding patch on update_anchor against the verifier program. Discovered and fixed in the same sprint as the T4a security wave.
Reset path (reset_identity_state) gated behind a 7-day cooldown.

entros-verifier

Groth16 verification key matches the published Hamming circuit at ~2,010 constraints.
verify_proof writes a VerificationResult account that the Anchor program reads in the same transaction.

entros-registry

ProtocolConfig initialized on devnet. Validator registration activates as the Anonymity Ring transitions to permissionless operation.
ProtocolConfig extended with validator_pubkey (offset 77, +32 bytes; LEN 77→109) for the mint-receipt binding above. Migration handled by the admin-only set_validator_pubkey instruction with a realloc + raw-byte write so accounts initialized at the legacy 69-byte size are upgraded in place.

Where to look next

Roadmap: Near-term—what lands next
Reference: Programs—current instruction set