Status and Roadmap

What is built, what is next, and the condition each stage is gated on rather than the quarter it is promised in — devnet today, no mainnet, no user funds.

Where things stand, 21 September 2026


Network	A public Solana devnet chain. No mainnet. No public endpoint. No user funds.
Programs on Solana devnet	Settlement, data availability, forced-inclusion inbox, dispute game, bridge portal, sequencer bond
Challenge window	48 hours of wall-clock time, 172,800 seconds, since ADR-0016 was amended on 22 September 2026; the 432,000-slot count it was stored as remains the dispute game's budget. Deployed on the current chain the same day: its settlement program was upgraded at slot 502,261,356 and verified byte-for-byte against the cluster, and its admin moved the record to seconds — roots 1 to 292 keep the slot rule they were stamped under, root 293 onward counts seconds. The coin chain 9232 followed the same day: its own settlement program upgraded at slot 502,262,063, roots 1 to 12 keeping the slot rule and root 13 onward counting seconds — there the slot figure is only the dispute budget, since that chain has no game
Air gap	One hour on the devnet portal; 24 hours by the mainnet design
Sequencer	Single operator, bonded, signing receipts, drained by forced inclusion every block; since 20 September the bond program judges the chain-naming receipt layout and each bond is bound to the one chain it backs
Disputes	The dispute program's enforcer is the settlement program's dispute authority on the current chain, so a verdict enforces
Proof binding (ADR-0021)	Partly built and inert: the node and settlement halves are in; the on-chain one-step half is designed — its record/consume design was pre-audited on 21 September, amended, and held for a human sign-off — and not built
Bridge	SOL deposits credited end to end; withdrawals proven and paid out of the vault seven times, four on the retired beta chain and three on gamma, as of 21 September, all to team addresses; every root on the current chain is final
Settlement, 22 September	Settling on both chains. The current chain’s first block after the window change, 293, stalled for part of the morning for a reason unrelated to the window: the data-availability feed named the payer that initialized it as its only poster, and the node had signed with a separate settle key since the payer split of 19 September, so each publish failed as NotThePoster. The fix chosen was a poster setter signed by the feed’s admin: the data-availability program was upgraded at slot 502,313,640, the poster moved to the settle key at slot 502,313,819, and block 293 settled in one transaction at slot 502,313,859, the first root stamped in seconds. Roots 1 to 292 keep the slot rule; the coin chain, whose poster is its own payer, was unaffected throughout
Verification	The watchtower runs as one command and has been drilled against a poisoned provider. Nobody outside the operator runs one
Audits	None
Native coin	SULI runs on Solieum's own devnet chains, half of every fee burned; nothing issued on a network of value, and no governance token issued

What "done" means here

Every stage below is gated on a condition, not a date. A date is a promise about a calendar; a condition is a promise about the system. Where an item is built and not deployed, or computed and not charged, this document says so rather than rounding it up.

Stage: proofs cover what runs

Wider one-step classes. The covered classes today are the ones the bridge and the fee path need. Everything else is opaque in a dispute, and each block's own defence record says which steps were opaque rather than leaving it to be discovered.
The SBF interpreter. Built as a crate with a virtual machine, a memory page tree, a Merkle commitment over the instruction stream and a one-step verify entry point. Wired to nothing. It is the named end state for arbitrary instruction classes, and it currently covers registers, control flow and aligned eight-byte memory access; division, 32-bit arithmetic and syscalls fault by design rather than being guessed.
The program set committed to the chain. Today nothing published says which programs an operator registered, so a verifier must be told out of band by the party it is checking. The current chain registers none, so this bites the first chain that does.
The step count bound into the root record. A challenger who names a larger step count than the block has can drive the game to a position no witness covers. The node plays anyway and says so; the program should refuse a claim of the wrong length.
Batch contradiction slashable on chain. Equivocation between two receipts already costs the bond. A receipt the published batch does not honour is provable but not yet punishable, and the step tree now makes the one-position inclusion proof it needs possible.
Condition to close the stage: a disputed step through an arbitrary program is resolvable on Solana rather than deferred.

Stage: somebody else is watching

Verifiers run by parties other than the operator, against endpoints disjoint from the operator's.
A one-command verifier image, which exists, plus the reason to run one, which does not yet.
Condition: independent verifiers running continuously, before Stage 1 is claimed anywhere.

Stage: the economics stop being a subsidy

Rent reclamation for finalized roots and sealed batches: built, gated by tests, not deployed.
A composed fee: computed, charged by nothing, and publishable only with a disclosed price.
A priority-fee auction, in SOL.
Condition: a block's settlement cost is covered by the block, or the subsidy is disclosed with its size.

Stage: the bridge is ready for money

SPL token credits on the Layer 2. Today a token deposit only emits an event.
Per-asset deposit caps, withdrawal velocity limits per window, and a large-withdrawal tier that lengthens the payout delay.
The 24-hour air gap in place of the devnet hour.
Condition: a first-time anomaly cannot drain the vault in one shot.

Stage: the keys stop being one key

Upgrade authority on a multisig with a published threshold, behind a timelock longer than the whole exit, window plus air gap, so any upgrade can be seen and exited before it takes effect.
Guardian separate from the upgrade authority, with its powers stated as narrowly as they are implemented.
Reproducible builds verified from a clean checkout, with the verification command published.
Condition: no single key can change the code that holds funds.

Stage: audited

Two sequential audits, plus a proof-system specialist.
A bug bounty sized to value at risk.
Condition: both audits closed and the findings published, before mainnet.

Stage: mainnet

Gated on every stage above, not on a quarter.

Later, and deliberately unscheduled

A staked sequencer set. Rotating, then bonded with slashing for provable equivocation. It decides ordering only. Finality stays with Solana, and there will be no validator set of Solieum's own deciding state.
Validity proofs as a second gate. A validity proof settles correctness at commit time, which is what makes short withdrawals possible without weakening the guarantee. The catch is that a soundness bug in a prover is silent and total, so the plan is a second, independently implemented prover alongside the fraud proof, with withdrawals gating on agreement and disagreement halting rather than picking a winner. Only this removes the window.
Per-market lanes, each with a published ordering rule.

The honest summary

Solieum today is a working optimistic rollup on a test network, with the parts that are usually deferred, forced inclusion, a dispute game whose verdicts enforce, a bond behind the sequencer's promises, a bridge that pays against proofs, already built and exercised. What it does not have is an audit, an outside verifier, a multisig, or a single user's money at risk.

That is a real position and it is stated as one. If this paper reads as less exciting than the version it replaces, that is the intended difference: the previous version claimed a million transactions per second and a mainnet beta in the third quarter of 2025. Neither was true, and a document that overstates what is built makes the parts that are built harder to believe.

This revision

This paper was rewritten on 11 September 2026 against the protocol's own decision records and its measured output, and updated on 22 September 2026 for the native coin SULI, the bond program's chain binding, the pre-audit of the ADR-0021 one-step design, the withdrawal-leaf design of ADR-0023, and the current chain's finality. Fabricated performance figures, packages, endpoints, explorers and reading lists were removed. The proof-of-stake validator set described in earlier versions was never part of the design and is gone. Every remaining number is either a measurement with its source named, or a named constant.