05Roadmap
What has to happen, in order
Stages with exit criteria instead of dates, so progress is something you can verify rather than something we assert.
The order things have to happen in
- 01
Devnet
Live- Six programs deployed on Solana devnet — settlement, data availability, forced inclusion, dispute game, bridge, and the sequencer bond — redeployed on 2026-09-05 as the beta chain, with the 48-hour window, the dispute game's enforcer as dispute authority, and a sparse state tree
- The L2 node publishes every batch and commits every root to devnet, checkable from Solana's public RPC
- A deposit credited on the L2 in the next block on both chains, and on the beta chain two withdrawals proven against final roots and paid out by the vault on Solana; the beta bridge's air-gap guardian is a key the operator's cannot be
- A restarted node rebuilds byte-identical roots and receipts from published data alone
- 02
Testnet
In progress- Public RPC endpoint live and documented
- Withdrawals proven end to end on devnet (deposits are credited there already)
- SDK quickstart runs from a clean machine
- 03
Mainnet beta
Planned- External audits complete and published
- Upgrade-key multisig composition and timelock published
- Withdrawal limits and circuit breakers in place
- 04
Fast exits, team-fronted
Planned- A float we put up ourselves, its size and its remaining headroom readable on-chain
- It refuses at the point of use when the float is exhausted, rather than queueing silently
- The canonical exit stays available and unchanged — taking the fast one is a choice, never the default
- Described as our balance sheet advancing you money, not as the network settling faster
- 05
Proofs enforcing
Planned- Fraud proofs gate finalisation in production
- Independent challengers running outside the team
- Permissionless exit exercised by an unaffiliated user
- 06
Fast exits, underwritten
Planned- A liquidity provider fills exits against roots still inside the window, at a published spread
- One fill reclaimed end to end from the finalised root by a provider with no relationship to the team
- Presented as its own trust domain — the provider's risk, not a shorter challenge window
- 07
Staked sequencer set
Planned- Rotating sequencer set with signed hand-offs; receipts verifiable against the advertised identity
- Sequencers bonded in stake and slashed for provable equivocation
- Ordering decentralised; finality stays with Solana — no validator set of our own decides state
- 08
Reduced trust
Planned- Upgrade timelock exceeds the withdrawal window
- Proposing opened beyond the founding operator
- Emergency powers narrowed and time-boxed
- 09
Ephemeral lanes
Planned- A decision record first: what may be handed to a fast sequencer, what a user reclaims if it stops mid-session, and whether the forced-inclusion queue still reaches an account while it is handed over
- The lane's trust statement published beside it, not after: for the length of a session the fraud proof and the published data do not cover that sequencer, so the protection is the hand-off's own exit rather than the dispute game
- Never called secured by Solana for the duration of a session, because for that duration it is not
Two stages here are about the exit experience rather than about trust, and they are not the same stage twice. Fast exits, team-fronted is our own balance sheet advancing you money against a root still inside its window: it removes the wait and adds no evidence, because the party telling you the chain is honest is the party running it. It is capped by what we can afford and it says so at the point of use. Fast exits, underwritten is a stranger taking that risk at a price they set, which is why it comes after proofs enforce — an operator's word prices worse than a proof anyone can check, and a spread nobody will quote is information. Neither stage shortens the challenge window. It stays 48 hours plus the 24-hour air gap — about three days, and seven on the devnet chain that predates that decision — and it stays the thing both of them are relying on.
◆Chain generations
Three chains so far
Each devnet chain is a genesis, and a genesis is an identity: the hash covers the parameters and the L1 program ids, so changing what an account leaf commits to is a new chain rather than an upgrade. This is the record of which chain carried what.
| Chain | Initialized | State commitment | Window | What it introduced | Now |
|---|---|---|---|---|---|
| alphasolieum-testnet-alpha · chain 7788 · genesis 2PU6Fj3c… | 2026-09-02 | 1 · sorted state tree | 7 days (ADR-0003) | Settlement, DA, forced inclusion, the dispute game and the bridge on devnet for the first time | stopped |
| betasolieum-testnet-beta · chain 7789 · genesis AtxMy5BY… | 2026-09-05 | 1 · sparse state tree | 48 h (ADR-0016) | The 48-hour window, the sparse tree, the enforcer as settlement authority, the air-gap guardian, the sequencer bond, fees kept from block 100, the first paid withdrawals | stopped 2026-09-12 |
| gammasolieum-testnet-gamma · chain 7790 · genesis HURAAxUv… | 2026-09-11 | 2 · account data by page-tree root | 48 h (ADR-0016) | Account data committed by root so a slice proves without the account; a commitment version in genesis that a mismatched node refuses; its own sequencer key; the vault solvency check | current |
The commitment version is what made gamma necessary. The beta chain's leaves hash account data inline; the current node hashes a page-tree root over it instead, so no node that speaks one can replay a chain written under the other. Beta ran its last day on a pinned binary and stopped on 2026-09-12 with every root final and nothing owed. The next such change will be a fourth chain, and the genesis now records the version so the node says which side it is on rather than computing a root that silently differs.
◆Readiness
Explorer readiness
The explorer is part of the node: every node serves its own on its RPC port. That is what makes it trustworthy — it reads the chain it is serving, not a copy — and it is also why there is no public one yet.
- 01
Served by every node
Live- Blocks, transactions, accounts, receipts, settlement, the bridge and the forced-inclusion queue, all read from the node's own state
- Registered programs listed with their size and SHA-256, and marked as registered rather than on-chain, because on this chain a program is a file the node was started with and not an account
- Whether the chain's genesis commits that program set (ADR-0019, 2026-09-13). A chain that commits it refuses to start under any other set. A chain that commits none, which is every local example chain that registers programs, runs only under an explicit --uncommitted-programs flag, and its banner and programs page say so: the chain's identity does not determine its behaviour. Gamma commits no programs and starts none
- Per-block timing — admission, receipt, execution, root committed — kept beside the chain data and restored across restarts
- Gamma on port 8895; beta had 8896 until it stopped on 2026-09-12
- 02
Reachable without running a node
In progress- A public endpoint, which arrives with the public testnet
- The same pages, read from a node the team runs, with the caveat stated on the page that a hosted explorer is a copy of the chain and a local node is the chain
- 03
Program verification and review
Live- A program's page takes a wallet-signed statement that rebuilding a named commit reproduces the exact file the node loaded, with the project's website, repository and social links, and says whether a wallet other than the operator's has made one that matches
- A token's page takes its name, symbol, logo and links, signed by the mint's current authority and by no one else
- A node started with admin wallets holds both until an admin approves that exact submission, from an admin console that runs apart from the explorer and is never exposed publicly; a key that cannot sign is refused when the node starts
- Gamma has run with the owner's wallet as its admin since 2026-09-15. It takes token-info submissions for review; program statements are not turned on there yet, so none of its programs is attested
- 04
Program code visible on the chain
Planned- The set of programs a chain executes committed in its genesis, so a verifier learns it from the chain and not from the operator — ADR-0019, built in the node on 2026-09-13 and live on no chain yet: it takes a new genesis, and gamma's predates it
- An EVM-style view of a program's code and its hash, which depends on the above: today the hash the explorer shows is of a file, and the chain does not attest to it
- 05
Retired chains still readable
Planned- Alpha's and beta's history browsable after their nodes have stopped
- Today that takes the archived data directory and a binary from before the commitment change, run by hand; a chain that has stopped has no explorer
◆Readiness
Bridge readiness
The bridge releases funds only against proofs — no signer set does — and each stage below is something that has been exercised on devnet or has not. The bar the site holds itself to is the one it has not met: an exit by someone with no relationship to the team.
- 01
Deposits
Live- Lamports locked in a program-owned vault, enqueued on the inbox by the portal's relay, credited on the L2 in the next block — on all three devnet chains
- 02
Withdrawals
Live- On beta, two withdrawals proven against final roots and paid by the vault on Solana, on 2026-09-07 and 2026-09-10; two more proven and paid on 2026-09-12, the same morning, 6,000,000 lamports between them. On gamma, the first withdrawal, 1,900,000 lamports, proven at 13:08 IST on 2026-09-12 and paid an hour later at the first attempt, the payout sent on the cluster's own clock rather than the wall clock, the vault landing on its rent floor plus the 100,000 lamports nobody claimed
- Every one of them a team address — see the stage below
- 03
Air gap and guardian
Live- A guardian on its own key, not the operator's, on beta and gamma; it can deny a settlement root and nothing else (ADR-0015)
- 3,600 s on devnet so the drill is observable; 86,400 s recommended for mainnet, which puts a full exit at about three days
- 04
Vault solvency
Live- The node refuses a withdrawal the vault cannot honour: what Solana still owes to earlier exits, plus this one, must fit inside what the vault can pay above its rent floor, or the exit is refused at admission with nothing debited (ADR-0013 D2). Live on gamma since 2026-09-12, when a 500,000-lamport exit asked for against 100,000 of headroom was refused and the chain did not move; after that day's payout the guard re-derived its ceiling from the new balance with nothing telling it to, reading 100,000 payable against nothing outstanding. Never on beta, whose pinned binary predates it
- The reason it exists: every devnet chain mints its genesis supply on the L2 with nothing behind it on Solana, so a withdrawal larger than what was deposited fails at payout. Beta's vault was found 1,000,000 lamports short of its two committed exits on 2026-09-11 and topped up; the check would have said so at commit time
- 05
An exit by someone unaffiliated
Planned- A withdrawal initiated, proven and paid by a party with no relationship to the team, in a drill anyone can watch
- Until then every payout on this page is the team paying itself, and the page says so
- 06
Token deposits
Planned- SPL token deposits credited on the L2; not credited yet
- 07
Fast exits
Planned- Team-fronted, then underwritten — stages 04 and 06 of the main roadmap, and a different trust model from the canonical exit rather than a shorter window
Why conditions instead of dates
A date is a claim about the future made with today's information; it decays the moment it is published. A condition is checkable forever: either three independent challengers have each won a dispute on mainnet, or they have not. Dates also create the wrong incentive — a team racing a quarter it announced will ship the checkbox, not the property. The previous version of this roadmap had quarters on it. They passed. This one cannot go stale the same way.
What could set this back
A roadmap that only lists progress is advertising. These are the known ways the sequence above slips, and what each would mean.
The proof system takes longer than planned
It is the hardest component and the industry's graveyard of quiet deferrals. If it slips, the network stays Stage 0 longer — visibly, on the security page — rather than shipping a proof system that exists but does not enforce.
Audit findings force redesign
The point of an external audit is to be wrong in private before being wrong in public. Material findings will delay mainnet and be published with the fixes, including any we accept as residual risk.
Solana base-layer changes
Settlement programs and the one-step verifier depend on L1 limits that change across releases. Each upgrade re-runs the feasibility arithmetic; a breaking change could force parameter or design revisions.
Pressure to decentralise the sequencer early
A staked sequencer set before proofs enforce is decentralisation theatre: it spreads the power to order transactions while leaving the operator's word as the only thing standing behind state. It is sequenced after proofs on purpose, and the order will not be swapped for optics.
Nobody shows up to verify
Stage 1 requires challengers outside the team. If funding independent verifiers fails to attract them, the stage is not claimed — the roadmap waits on the fact, not the intention.
Nobody underwrites the fast exit
A provider fronting an exit is betting that a root inside its window will finalise honestly, and it prices that bet. If the spread is wide enough that nobody uses it, or no provider takes the risk at all, then the window is not the backstop behind the exit — it is the exit, for everyone. That is the honest failure mode, and it is the one that decides whether the window is a property users tolerate or a reason they never arrive. Shortening the window to 48 hours (ADR-0016) narrows the gap but does not close it, and it was done against the dispute game's own arithmetic rather than to look faster — a distinction worth holding, because trading the guarantee for the appearance of speed is the one response that would not be honest.
The team-fronted float becomes the thing people trust
Advancing our own money is the fastest way to make the exit feel solved, and that is exactly what makes it dangerous. A float that is always there stops reading as our balance sheet and starts reading as the network's, and by the time it is exhausted or withdrawn, users will have built on an assumption we never made. Two things keep it honest: it refuses at the point of use rather than queueing, so its limit is visible on a normal day and not only on the worst one; and it is a bridge to a stage where someone unrelated to us takes the risk, not a substitute for it. If that later stage never arrives, the correct move is to say the fast exit is ours and stays ours — not to keep quiet and let it be mistaken for a property of the chain.
Building something the base layer can't hold?
Tell us the workload. If Solieum is the wrong answer for it, we would rather say so early than have you find out at launch.