DALP 3.1: run the platform as your own

Bring your own custody per organization, deploy where no one else can reach, and run the platform with audited admin tools.

DALP 3.0 let you design the asset. DALP 3.1, released on 12 August 2026, lets you run the platform as your own: each organization brings its own vault, the contracts land inside your own boundary, and admins run the long-run operations themselves. This post covers everything shipped since 3.0, including the 3.0.1 through 3.0.11 patch releases, whose changes fold into this entry. Nothing in this window breaks an existing integration; see Compatibility.

Run it as your own

Ownership starts with the keys and the boundary. Organization custody moves the custody provider from a deployment-wide choice to a per-organization one. A bank on a shared deployment brings its own vault, tests the credentials before adopting them, and rotates them from the Console with every secret masked. Air-gapped deployment puts the smart contracts inside the customer's own cluster. An operator-gated job signs with a key only the customer holds, pulls images from a mirrored registry, and trusts object storage behind a private certificate authority.

Operate it with confidence

Running a platform for years means supporting it without guesswork. Platform operations gives admins first-class, audited tools for the long run. They archive and restore organizations, reset a stuck onboarding, invite people with their on-chain roles pre-assigned, and tighten KYC search and uniqueness.

Compatibility

This release carries no breaking changes.

The /api/v1 surface stays frozen: v1 routes keep their request and response shapes, and v1 integrations continue to work unchanged. New capabilities land on v2 as additive routes. Configuration changes are additive too; new keys such as the direct database URL and the custody provider defaults ship with working defaults, so an existing configuration runs unchanged.

Database migrations in this window are additive and guarded, and the migrator applies them on upgrade with no manual steps. New chart components stay opt-in: the connection pooler, the contracts-deploy job, and the private-CA trust for object storage remain disabled until you enable them.

Smaller updates

Index and database:

• The Ledger Index handles every decodable DALP event across contract versions, so older deployments read as completely as new ones.
• The index back-discovers identities minted by unregistered factories and repairs the indexed set to match the chain.
• Token-detail and chart-statistics reads use leaner query paths, and the charts add an opt-in PgBouncer connection pooler with a direct-connection URL for session-pinned work.

Console and display:

• The Console enforces a Content-Security-Policy, rolled out with a dual-header window.
• Currency amounts render exactly below a billion, and the Console marks compact notation as approximate, so a display never overstates a value.
• The register-identity control follows the wallet instead of a resolved identity.
• Uninitialized feature dates show Never or Unknown instead of a placeholder date.
• Kosovo is back in country selectors, total price keeps its decimals on asset details, and dynamic metadata fields show their unit suffix.
• Asset participants are searchable by token symbol, and the issue-claim topic picker offers only the issuer's trusted topics.
• Table search state syncs from the URL, so a shared link opens the same filtered view, and the saved organization theme shows right after relogin.

API and platform behavior:

• v2 email filters match exactly, and the API rejects blank text filters.
• Invitation failures map to catalog errors that name the fix, and invitations expire after 7 days.
• API keys created before scopes existed regain read-write access instead of silently dropping to read-only.
• Error messages interpolate their templates and keep literal route placeholders intact.
• User creation is atomic across its two stages and signals retryability on partial state.
• Token role revoke rechecks the live admin set first, and price feeds apply their actual decimals on submit and backfill.
• Indexed events keep raw participant addresses, and on-chain creation times derive from the block timestamp.
• The default route timeout is 5 minutes, so long create flows stop timing out.

Security hardening:

• Webhook receipt signatures bind to the delivery tuple, the webhook SSRF guard blocks IPv6 special-use ranges, and the charts no longer ship predictable default object-storage credentials.

Reliability hardening, shipped across the 3.0.x patches:

• Transaction pipeline: the signer reissues stranded nonces instead of queueing behind them, wedged lanes recover, pre-broadcast reverts classify as failed, and token creation resumes after a partial deploy.
• Indexer: lost singleton locks recover instead of exiting, deep-history backfill cannot wedge on a slow RPC, and startup survives an unreachable RPC.
• Workflows and delivery: paused dispatch no longer wedges its webhook endpoint queue, the platform reaps orphaned workflows, and reconciliation resubmits carry their input.
• Database: a configurable statement timeout frees hung pooled connections, and checked-out clients survive connection drops.

Operations visibility and documentation:

• Platform-usage metrics ship with an auto-provisioned Grafana dashboard.
• The docs now cover global compliance controls and token-type scope, and the platform one-pager gains a full architecture diagram.