Looser spec

.github/workflows/create-release-proposal.yml

@@ -40,7 +40,7 @@ jobs:
       source_branch: ${{ steps.vars.outputs.source_branch }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -118,7 +118,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 

.github/workflows/create-release-tag-and-publish.yml

@@ -29,7 +29,7 @@ jobs:
       is_draft: ${{ steps.extract_version.outputs.is_draft }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -65,7 +65,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code at tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ needs.create-tag.outputs.version }}
 
@@ -92,7 +92,7 @@ jobs:
           - macos-latest
     steps:
       - name: Checkout code at tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ needs.create-tag.outputs.version }}
 
@@ -105,7 +105,7 @@ jobs:
         uses: ./.github/actions/macos
 
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry
@@ -141,7 +141,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout code at tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ needs.create-tag.outputs.version }}
 
@@ -174,7 +174,7 @@ jobs:
             archive: zip
     steps:
       - name: Checkout code at tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ needs.create-tag.outputs.version }}
 
@@ -203,7 +203,7 @@ jobs:
         run: rustup target add ${{ matrix.target }}
 
       - name: Cache cargo registry and target
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cargo/registry
@@ -286,7 +286,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ needs.create-tag.outputs.version }}
           fetch-depth: 0
@@ -339,7 +339,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code at tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: ${{ needs.create-tag.outputs.version }}
 

LIBRARY_USAGE.md

@@ -757,7 +757,7 @@ cargo run --example multisig_library_usage
 
 ## Key Features
 
-- **Quantum-safe cryptography**: Uses Dilithium ML-DSA-87 for all cryptographic operations
+- **Quantum-safe cryptography**: Dilithium ML-DSA signatures — default **ML-DSA-65**, optional **ML-DSA-87** (`DilithiumScheme`)
 - **Wallet management**: Create, import, export, and manage multiple wallets
 - **Blockchain interaction**: Query balances, send transactions, get system info
 - **Thread-safe**: Safe to use in multi-threaded applications

README.md

@@ -368,14 +368,20 @@ quantus developer create-test-wallets
 ### Wallet Management
 
 ```bash
-# Create a new quantum-safe wallet
+# Create a new quantum-safe wallet (default scheme: ml-dsa-65, HD path …/1')
 quantus wallet create --name my_wallet
 
-# Create with explicit derivation path
-quantus wallet create --name my_wallet --derivation-path "m/44'/189189'/0'/0/0"
+# ML-DSA-87 (HD path defaults to …/0' when --derivation-path is omitted)
+quantus wallet create --name my_wallet_87 --scheme ml-dsa-87
 
-# Import from mnemonic
-quantus wallet import --name recovered_wallet --mnemonic "word1 word2 ... word24"
+# Create with an explicit derivation path
+quantus wallet create --name my_wallet --derivation-path "m/44'/189189'/0'/0'/1'"
+
+# Import from mnemonic (phrase is read from a hidden prompt — never pass it on the CLI)
+quantus wallet import --name recovered_wallet
+
+# Import as ML-DSA-87 (same secure prompt)
+quantus wallet import --name recovered_87 --scheme ml-dsa-87
 
 # Create from raw 32-byte seed
 quantus wallet from-seed --name raw_wallet --seed <64-hex-chars>
@@ -595,6 +601,12 @@ quantus exercise --skip wormhole
 
 # Reproduce a fuzz failure from its seed; emit the report as JSON
 quantus exercise --seed 12345 --json
+
+# Runtime upgrade smoke (fast-governance node only). Mutually exclusive:
+#   --self-upgrade  re-installs the current on-chain :code (no WASM file; no post-upgrade re-run)
+#   --upgrade-wasm  installs a candidate WASM, then re-runs the other phases against it
+quantus exercise --phases upgrade --self-upgrade
+quantus exercise --phases upgrade --upgrade-wasm path/to/runtime.wasm
 ```
 
 Key flags:
@@ -608,7 +620,9 @@ Key flags:
 | `--phases <LIST>` / `--skip <LIST>` | all | Comma-separated phases to run / skip. |
 | `--seed <N>` | random | Reproducible fuzz seed. |
 | `--fuzz-iterations <N>` | `25` | Number of fuzz iterations. |
-| `--upgrade-wasm <PATH>` | — | Enable the runtime-upgrade phase with the given WASM (fast-governance node only). |
+| `--upgrade-wasm <PATH>` | — | Enable the runtime-upgrade phase with the given WASM (fast-governance node only). Re-runs other phases after a successful upgrade. |
+| `--self-upgrade` | off | No-WASM upgrade smoke test: authorize/apply the current on-chain runtime blob via tech-referenda (fast-governance node only). Conflicts with `--upgrade-wasm`. Does not re-run other phases (runtime unchanged). Not the same as `quantus update` (CLI binary self-update). |
+| `--upgrade-timeout-secs <N>` | `900` | How long to wait for the upgrade referendum / code write. |
 | `--fail-fast` | off | Stop at the first failed step. |
 | `--json` | off | Emit the final report as JSON. |
 
@@ -889,7 +903,7 @@ For more details, see `quantus multisig --help` and explore subcommands with `--
 ## 🏗️ Architecture
 
 ### Quantum-Safe Cryptography
-- **Dilithium (ML-DSA-87)**: Post-quantum digital signatures
+- **Dilithium (ML-DSA)**: Post-quantum digital signatures — default **ML-DSA-65** (`--scheme ml-dsa-65`), with **ML-DSA-87** available (`--scheme ml-dsa-87`). Each scheme has its own default HD path (`…/1'` vs `…/0'`) so the same mnemonic does not collide across schemes.
 - **Secure Storage**: AES-256-GCM + Argon2 encryption for wallet files
 - **Future-Proof**: Ready for ML-KEM key encapsulation
 
@@ -964,7 +978,7 @@ The project includes a script to regenerate SubXT types and metadata when the bl
 1. **Updates metadata**: Downloads the latest chain metadata to `src/quantus_metadata.scale`
 2. **Generates types**: Creates type-safe Rust code in `src/chain/quantus_subxt.rs`
 3. **Formats code**: Automatically formats the generated code with `cargo fmt`
-4. **Prompts compatibility update**: Reminds you to update the supported runtime/transaction pair in `src/config/mod.rs`
+4. **Prompts compatibility update**: Reminds you to add the new runtime/transaction pair to the allowlist in `src/config/mod.rs` (newer unlisted specs warn rather than hard-fail)
 
 **When to use:**
 - After updating the Quantus runtime
@@ -1005,4 +1019,4 @@ After regeneration, re-run:
 quantus compatibility-check --node-url <node>
 ```
 
-The checked-in compatibility gate now requires both the runtime `spec_version` and `transaction_version` to match a supported pair.
+The compatibility gate accepts exact `spec_version` / `transaction_version` pairs listed in `src/config/mod.rs`. A Quantus node whose `spec_version` is **newer** than the highest listed pair connects with a warning (extrinsics may still fail if the runtime has moved on). Wrong `specName` values and older/unknown pairs outside the table are still rejected.

src/chain/client.rs

@@ -140,8 +140,8 @@ impl QuantusClient {
 		// Create SubXT client using the configured RPC client
 		let client = OnlineClient::<ChainConfig>::from_rpc_client(rpc_client).await?;
 
-		// Reject nodes that do not identify as a supported Quantus runtime before the
-		// client can be used to encode or sign transactions.
+		// Reject non-Quantus / older-unsupported runtimes before encode/sign. Newer-than-table
+		// Quantus specs are allowed with a warning (see validate_runtime_identity).
 		if enforce_runtime_identity {
 			use jsonrpsee::core::client::ClientT;
 			let runtime_version: serde_json::Value = ws_client

src/cli/exercise/scenarios/reads.rs

@@ -26,6 +26,13 @@ async fn runtime_version(ctx: &ExerciseCtx, post_upgrade: bool) -> Result<String
 	if compatible {
 		return Ok(format!("spec {spec} / tx {tx}, compatible with CLI bindings"));
 	}
+	if crate::config::is_newer_unlisted_runtime(spec) {
+		return Ok(format!(
+			"spec {spec} / tx {tx}: newer than this CLI's tested list (up to {}); \
+			 proceeding, but some commands may not work",
+			crate::config::max_compatible_spec_version()
+		));
+	}
 	if post_upgrade {
 		if crate::config::COMPATIBLE_RUNTIMES.iter().any(|r| r.transaction_version == tx) {
 			return Ok(format!(

src/cli/mod.rs

@@ -667,6 +667,14 @@ async fn handle_compatibility_check(node_url: &str) -> crate::error::Result<()>
 			crate::config::EXPECTED_RUNTIME_SPEC_NAME
 		);
 		log_print!("   • All other CLI commands will refuse to talk to this node");
+	} else if crate::config::is_newer_unlisted_runtime(spec_version) {
+		log_print!(
+			"⚠️  NEWER RUNTIME - Spec {} is ahead of this CLI's tested list (up to {})",
+			spec_version.to_string().bright_yellow(),
+			crate::config::max_compatible_spec_version()
+		);
+		log_print!("   • Commands are allowed, but some may not work correctly");
+		log_print!("   • Consider updating the CLI when a release for this runtime is available");
 	} else {
 		log_error!("❌ INCOMPATIBLE - This CLI version may not work with the connected node");
 		log_print!("   • The runtime version pair is not in this CLI's supported list");