The network · testnet-1

Post-quantum BFT, live and joinable.

Four founding voters and seven external operators — eleven seats since 2026-09-12 — run testnet-1 in public: hash-signed consensus, self-rotating keys, shielded traffic, open RPC. Anyone can join as a verifying node with one Linux box — no GPU (validators verify STARKs on CPU), no stake, no permission. Below: what's running, what's measured, and exactly how to join.

Height — live
2s cadence · straight from public RPC
Chain ID
hashkinetics-1-4e4ea68d
derived from the genesis hash
Signer epoch
keys retire themselves — testnet-1 rotated all four seats on 2026-09-03; 50+ epochs on its predecessor
Voting seats — live
hash-based BFT · LMS/HSS votes · SLH-DSA roots · no ECDSA

Live · who is on testnet-1 right now

The roll call, measured

Every kit node bootstraps through the gateway, so the gateway's own peer table is the network's public roll call. Read straight from hk_getPeers and hk_getValidators on the public RPC every 10 seconds — nothing here is typed in by us.

Voting seats
hk_getValidators
External nodes
hk_getPeers
Node versions seen
gateway answers as ≤ v0.15.1 · peers advertise theirs since v0.15.2
Island chains refused
nodes on a different genesis, disconnected at the door since the gateway last started
Provenance: measured live from the gateway's own libp2p peer table; the node masks addresses itself (/24 · /48) and lists a peer only while a connection is open. A node that peers only with other operators is invisible here, and a seat is a seat only when hk_getValidators says so.
JUST WANT TO USE IT?

No terminal needed

The wallet — Windows, or the Android app — creates your account, takes a faucet drip, sends, and pays shielded — every transaction pays the 100-micro protocol fee, burned. Prefer a CLI? The faucet page has the four commands.

The chain, on paper

What's running right now

Networktestnet-1 — public testnet, launched 2026-09-02 from a genesis ceremony (fresh keys, fees from block 1). Its predecessor staging-1 ran 2026-08-27 → 09-02, 107,182 blocks, archived
Chain IDhashkinetics-1-4e4ea68d — derived from the genesis file's SHA-256; nodes refuse to peer across a different genesis
Genesis fingerprint4e4ea68d…971c7 sha256sum genesis.json to check
Protocol fee100 micro per transaction, burned — bound into the genesis from height 1 (no activation heights, no coordinated rolls); test units, no monetary value
ConsensusBFT (vendored Malachite) with LMS/HSS hash-signed votes under SLH-DSA-192s roots — no ECDSA anywhere in the ledger
Validators11 seats since 2026-09-12 ≈ 10:02 UTC: 4 founding voters (fresh keys at the testnet-1 ceremony, voting power 4 each under bootstrap governance) + 7 external operators admitted on the running chain by certificates from the seated roots (the first on 2026-09-05, block 72219; #6 and #7 on 2026-09-06/07, #8 on 2026-09-09, block 209,149, #9 and #10 on 2026-09-11, blocks 303,291 and 319,494 — the tenth a professional operator running PoS infrastructure since 2018 — and #11 on 2026-09-12, block 379,143, all on founding approvals alone; the twelfth will be the first that needs an external co-signature or the bootstrap handover) — power 23, quorum 16, no new genesis for any of them; the live count above is the truth, this sentence is a snapshot. Key rotation is automatic; on staging-1 it ran 50+ epochs including three full-exhaustion revivals and one fully self-healed wedge
Releasenode v0.19.3 (client-only) · consensus v0.19.0 · wallet v0.15.0 · Android v0.3.0 — versioned, immutable, sha256-published; the fleet rolled to v0.13.2 on 2026-09-03, v0.14.0 (validator-set changes on a running chain) and v0.15.0 (issued assets: issuer mint · burn · freeze · pause with supply in the state commitment) on 2026-09-04 — one voter at a time, chain never paused; v0.15.1 (2026-09-05) ships the verifying keys in the join kit, so an external node verifies every proof locally and never depends on our prover; v0.15.2 (2026-09-05) adds the live peer table above (hk_getPeers) and a version tag every node advertises to its peers; v0.16.0 (2026-09-05) packs the block log into 1,024-block segments with optional retention, persists the search index across restarts, and lets every secret file live sealed on disk (hk-node key-seal / account-seal: Argon2id 512 MiB → XChaCha20-Poly1305, strength-checked passphrases, optional key-file second factor) — a sealed seat still votes; the faucet became a hot wallet with a small float refilled from a cold treasury — rolled to all four founding seats 2026-09-05, and since that evening every founding seat boots from a sealed seed and the genesis treasury lives off-fleet; v0.16.1 (2026-09-06) pages the shielded-pool feed (hk_getPoolNotes from/limit) and answers one Merkle path per spend (hk_getPoolPath) so the wallet scans incrementally — rolled 2026-09-06, each seat restarting from its sealed seed; v0.17.0 (2026-09-06) verifies STARKs with a verify-only client instead of building a proving engine at every start — a restart costs seconds, not minutes (rolled 2026-09-06: 54–59 MiB resident per seat, 6–16 s to RPC, was ~6.7 GB and 3–6 min), and every node reports its own resident set in hk_chainInfo.process; v0.18.1 (2026-09-06; v0.18.0 named 200,000 and is withdrawn) is a consensus rule with an activation by height — at height 110,000 every node re-weights the four genesis seats to voting power 4 (bootstrap governance, G1: the founding seats hold more than two-thirds on their own while the network is this young; the weight returns to external seats by SetPower certificate on a dated milestone, and the soak clock starts after that handover) — every node must run v0.18.1 before that height; v0.18.2 (2026-09-08, client-only, no deadline) makes every consensus signature ~2,500× cheaper (179 µs instead of ~450 ms — a cache-validation bug in the vendored hash-signature crate plus a per-call key rebuild, found and measured by an external seat operator), signatures byte-identical, so v0.18.1 and v0.18.2 seats interoperate; it also paces blocks to a 1 s floor — rolled to all four founding seats 2026-09-08 17:57–18:07 UTC (chain never paused): each founding seat's height now measures 1.0 s, and the chain averages ~2 s until the last external seats leave v0.18.1; v0.19.0 (2026-09-09) is a consensus change with an activation by height — every node must run it before height 190,000: one shielded pool per asset (P6) — activated at 190,000 on 2026-09-09 08:47 UTC with all seven seats on v0.19.0, certificates unchanged through the height; the same morning the Sepolia USDC bridge closed its first loop both ways (/bridge), that evening bridged USDC was shielded into its own pool; v0.19.1 (2026-09-09, client-only, no deadline) carries the bridge subcommands and a CLI wallet bound to a real account
Public endpointsRPC https://rpc.hashkinetics.org · prover/vk https://prover.hashkinetics.org · explorer

Measured, not promised

The numbers, with their provenance

Sustained throughput274 tx/s — measured: storm harness, 1,024-tx blocks, 4-validator lab chain (capacity sheet in the repo)
Block time~1.4–2 s — measured, every vote hash-signed
Shielded verification1 proof / block — measured: a constant-size ~1.24 MB aggregate covers every shielded tx in the block
Catch-up verification71 blocks/min — measured on the live testnet (v0.10.8 parallel verify; was 2 blk/min) — a joining node outruns the chain
Restart to tipminutes — measured across the whole fleet on v0.10.9; sync spends zero signer leaves
Crash recoverybyte-identical — measured: kill -9 all validators mid-consensus; restart resumes from the block log, never resyncs from genesis
Effective payments/s183,000/s — arithmetic on measured constants (channel depth × settles/s); 1M/s is the gated target, labeled as such
Liveness honesty: with 3 of 4 voters the chain crawls (~4 blk/min — zero timing margin) and self-heals the moment the fourth returns; an exhausted or dead validator is a liveness blip, never a safety event. Measured on the real fleet, ledgered in the changelog.

The join flow

From clone to verified tip, five steps

Full detail and troubleshooting live in networks/testnet-1/README.md (observers) and docs/VALIDATOR-ONBOARDING.md (voters). The short version:

# 1 · build once (Linux/WSL2, stable Rust)
git clone https://github.com/hashkinetics/hashkinetics && cd hashkinetics/chain
cargo build --release -p hk-node

# 2 · VERIFY the genesis before anything else (sha256sum -c ../networks/testnet-1/CHECKSUMS)
sha256sum ../networks/testnet-1/genesis.json   # must start 4e4ea68d

# 3 · generate your key — it never leaves your machine
./target/release/hk-node keygen ~/hk-node my-moniker
# optional (v0.16.0): seal it on disk — Argon2id 512 MiB, passphrase from HK_KEY_PASSPHRASE[_FILE] or systemd LoadCredential at start
./target/release/hk-node key-seal ~/hk-node

# 4 · the kit: pinned genesis AND the verifying keys, next to your node home
cp ../networks/testnet-1/genesis.json ~/hk-node/genesis.json
cp ../networks/testnet-1/vks.json     ~/hk-node/vks.json
./target/release/hk-node config-gen ~/hk-node --listen /ip4/0.0.0.0/tcp/27000 \
  --peers $(paste -sd, ../networks/testnet-1/PEERS.txt)

# 5 · start — no environment variable, no prover: the node verifies every proof locally
./target/release/hk-node start ~/hk-node
The verifying keys come with the kit (since v0.15.1). vks.json holds the three SP1 verifying keys; at startup the node checks them against the hashes pinned in the genesis and refuses to start on a mismatch — a tampered file is refused, an unverified node is refused (K5), so a node on this genesis can never fork off at the first shielded block. Expected startup lines, in order: verifying keys MATCH the genesis pins source=file SP1 pool verifier wired from the vks file Consensus is ready. Since v0.15.2 your node also advertises its version to its peers, and appears in the roll call above the moment it connects.
Your node is durable. Any restart — including kill -9 — resumes from its block log and snapshot to a byte-identical state commitment; reserve-then-sign persistence means a crash can never reuse a one-time signature leaf. Restart=always is safe; there is no "resync from genesis."

Why your node matters

The soak clock

Mainnet is gated behind a 30-day incident-free public soak, and that clock starts only when at least four external validators hold at least ⅓ of voting power. Every external operator moves the network one step closer to the audit phase — and mainnet launches only after independent audits close. Testnet operators are first in line for the mainnet validator set.

WHAT YOU RUN

One Linux box

4+ cores, 4 GB RAM minimum, 8 GB comfortable (measured on our own seats after the v0.17.0 roll of 2026-09-06: 54–59 MiB resident, 6–16 s from start to an answering RPC — through v0.16.1 it was ~6.7 GB because the node built a proving engine just to verify; every node reports its own footprint in hk_chainInfo.process), 20 GB+ disk, one open TCP port. No GPU, no stake. Your key exhausting is handled by automatic rotation — 50+ times on the predecessor chain, and all four testnet-1 seats on 2026-09-03.

WHAT YOU VERIFY

Everything

Every block: mandate law over hidden balances, one aggregate STARK, hash-signed votes from every peer. Your logs are receipts — your app_hash either matches the fleet or catches us lying.

WHAT'S NEXT

First in line

Testnet operators get priority for the mainnet set: staking, rotation-native ops, and the fee flow — the plan routes 40% of every mainnet fee to validators first (testnet-1 burns 100%). Since v0.14.0 a voting seat is admitted on the running chain by a certificate from more than ⅔ of the current seats — you join as an observer, sync to the tip on our app_hash, and the seat follows without a new genesis.