Elect new IC/GuestOS revision (commit 7360f8f)

Release Notes for release-2026-09-03_04-41-base (7360f8f35bda2e4754bb7f2258d6852feec268e8) This release is based on changes since release-2026-08-27_05-01-base (e9fd136f3fed6cb44625379e056ad63789d52d2c).

Please note that some commits may be excluded from this release if they're not relevant, or not modifying the GuestOS image. Additionally, descriptions of some changes might have been slightly modified to fit the release notes format.

To see a full list of commits added since last release, compare the revisions on GitHub.

Features:

• c14df8a5b Core Protocol: Enable flexible HTTP outcalls and (optionally) pay-as-you-go pricing (#11399)
• 2469fc76d Core Protocol: Add subnet_metrics management canister endpoint (#11032)
• f70741a6c Core Protocol: Support flexible outcalls and pay-as-you-go pricing in pocket-ic (#11245)
• f692a77f9 Core Protocol(subnet-spiltting): deliver Splitting batch to DSM (#11213)
• bc62af0ff Core Protocol(subnet-splitting): preemptively load the post-split DKG transcripts in the key manager (#11205)
• 5e2b68aa6 Node: New SEV checks (#11421)
• 82b4893ea Node: add sender match condition (#11364)

Bugfixes:

• 880b1f521 Core Protocol(execution): Recompute the subnet available memory before draining subnet queues (#11402)
• e120aa14e Core Protocol: Adjust the response execution prepayment to the Wasm execution mode (#11414)
• e86b5d1ec Core Protocol: charge the ingress induction debit before install_code applies its Wasm state changes (#11398)
• 11f08eb7c Core Protocol: Return CanisterReject on (non-)replicated HTTPS outcall out-of-cycles error (#11393)
• a32d604f9 Core Protocol: Insert HTTP outcalls pay-as-you-go refunds into the refund pool (#11045)
• 56ac2978a Core Protocol: Use the same registry version in CatchUpPackageParam and verification (#11358)
• 98ed17c50 Core Protocol(validator): ensure CUPs' registry versions are increasing (#11340)
• 7360f8f35 Node(guestos): allow systemd-resolved to connect to networkd's resolve-hook socket (#11413)

Chores:

• 2f984b407 Core Protocol(replay): remove unused RestoreFromBackup2Cmd struct (#11377)
• 1e3614fb5 Core Protocol: Remove prefetching memory tracker (#11295)
• 2d67f335c Core Protocol: Remove temporary metric (#11293)
• d9fd141cb Core Protocol: Add the RequestId to VetKdArgs (#11333)
• 5a0c6ee38 Core Protocol: Rename config (#11289)
• e01214738 Node: Great simplification of SEV key exchange (#11354)
• 507868454 Node: Update Base Image Refs [2026-09-01-0142] (#11385)
• 2e9c52e3f Node: Update Base Image Refs [2026-08-27-1119] (#11350)

Refactoring:

• c2cebaff7 Core Protocol: Hold the whole consumed-cycles total in SubnetMetrics (#11335)

Tests:

Documentation:

Full list of changes (including the ones that are not relevant to GuestOS) can be found on GitHub.

IC-OS Verification

To build and verify the IC-OS GuestOS disk image, after installing curl if necessary (sudo apt install curl), run:

# From https://github.com/dfinity/ic#verifying-releases
curl -fsSL https://raw.githubusercontent.com/dfinity/ic/7360f8f35bda2e4754bb7f2258d6852feec268e8/ci/scripts/repro-check | python3 - -c 7360f8f35bda2e4754bb7f2258d6852feec268e8 --guestos

The two SHA256 sums printed above from a) the downloaded CDN image and b) the locally built image, must be identical, and must match the SHA256 from the payload of the NNS proposal.

While not required for this NNS proposal, as we are only electing a new GuestOS version here, you have the option to verify the build reproducibility of the HostOS by passing --hostos to the script above instead of --guestos, or the SetupOS by passing --setupos.