C# / .NET SDK for Canton Network #46 - Milestone 3: Stabilisation, Audit & Compatibility Verification

OPENIssue
by pedrodneves08-07-2026
525K CC requested
View on GitHub ↗← All Proposals

Milestone 3: Stabilisation, Audit & Compatibility Verification

  • Estimated Delivery: 7 weeks after M2 acceptance (covers the Cure53 audit window, remediation of critical/high findings landed in parallel with the audit, and cross-version compatibility verification)
  • Focus: Pre-launch hardening, cross-version compatibility verification, and hosting the Cure53 security audit window
  • Deliverables / Value Metrics:

| Deliverable | Acceptance Criteria | |-------------|---------------------| | Cross-version compatibility verification | Cross-version compatibility matrix (built in M2) exercised in CI and reported in release notes; passes against every Canton release live at M3 acceptance — 3.4.x today, plus 3.5 if released by M3 acceptance | | Pre-launch hardening | Final release engineering — version pinning, NuGet signing, release-notes generation, package metadata; residual bug-fix work surfaced during M2 integration testing closed before public release |

The Cure53 security audit window sits in M3 between M2 acceptance and M3 acceptance — the fee is held outside the M1–M4 engineering envelope as a pass-through line (Appendix C) and remediation engineering is absorbed within the M1–M3 envelope per the severity-tiered turnaround commitments in the same appendix. The audit is therefore a milestone event, not a billable deliverable.

Verification: Cross-version compatibility matrix passing in CI against every Canton release live at M3 acceptance; Cure53 audit completed with findings remediated or documented per Appendix C.

| Milestone | Amount | Description | |-------------|---------------------|---------------------| | Milestone 3 - Stabilisation, Audit & Compatibility Verification | 525,000 CC + 205,000CC (audit) = 730,000 CC | Cross-version compatibility verification against every live Canton release, pre-launch release engineering, Cure53 audit and remediation. |

_Originally posted by @pedrodneves in https://github.com/canton-foundation/canton-dev-fund/issues/46#issuecomment-4914228226_