§1Capability matrix#
| Capability | State | Activation | First public testnet |
|---|---|---|---|
| BFT consensus, ECVRF leader election | Implemented | Always on | On |
| Forced evidence inclusion, slashing, jailing | Implemented | Always on | On |
| Transaction V2 with DIRECT, ROOT and SESSION authority | Implemented | Always on | On |
| P-256 session keys and the P256VERIFY precompile | Implemented | Always on | On |
| EIP-1559-style fee market | Implemented | Always on | On |
| EVM, Shanghai semantics with documented deviations | Implemented | Always on | On |
| Sponsored transactions | Implemented | Always on | On |
| Guardian recovery | Implemented | Always on, opt-in per account | On |
.rsc names | Implemented | name_service_activation_height | To be decided |
| Delegation share transfers and vault reads | Implemented | liquid_staking_activation_height | To be decided |
| Orchard shielded transfers | Experimental | Activation height plus an explicit acknowledgment | Off |
| Remote signer over mutual TLS; encrypted keystore | Implemented | Operator choice | Available; open key-custody finding on the remote signer |
| Certified snapshot bootstrap | Implemented | Operator choice | Available |
| Unbiasable threshold randomness beacon | Proposed | No | |
| EVM randomness precompile | Blocked on the beacon | No | |
| Encrypted mempool or other MEV protection | Deferred by decision | No | |
| Hardware-wallet support | Not implemented | No | |
| HSM or KMS validator signing | Not implemented | No |
§2Release gates#
Before a public transparent testnet
- Close or contain the open availability and key-custody findings from the 2026-10-12 internal review.
- Measure sustained load again after the 2026-10-08 liveness fix, on uncontended hardware.
- Run the full native story suite and a mixed fault campaign of at least four hours on the exact public profile.
- Exercise multi-host seed discovery, restart on retained storage, storage-failure recovery, and clock and network behavior.
- Deliver a test alert end to end through the intended notification route.
- Complete the robustness re-review.
Before mainnet or any network that carries value
- Independent external audits of the protocol and, separately, of the shielded cryptography, with their findings fixed.
- Gas and authorization schedules frozen after measurement on the minimum supported validator hardware.
- A reviewed production custody path for validator keys.
- A public genesis ceremony with a published commitment and allocation.
- An adversarial public testnet period and a bug bounty.
§3Known limits today#
- The planning ceiling is 20 TPS sustained until load is measured again.
- Slot duration is a target. Finality time under load is measured, not guaranteed.
- Pending transactions are public and block ordering is a local convention, so front-running is possible.
- Light clients trust the validator set on first contact.
- A withholding proposer can bias the randomness beacon, so contracts cannot read it.
- A snapshot file carries no trust until it is certified against a live peer.
- A protocol change requires a coordinated fresh genesis; there are no in-place migrations.
Sources: Feature reference; public testnet launch procedure; configuration reference; internal security review of 2026-10-12.