The honesty ledger
Receipts, not promises.
House rule since day one: nothing is claimed until it has run, and the worst days get published with the best ones. This page is the ledger — dated, in order, with the exact hashes and the steps to check them. If an entry says measured, there is a log behind it. If something is still a plan, we say "plan."
Clean-slate design — and a live 4-validator BFT chain the same night
Architecture locked in the morning (pure hash-based signatures, shielded-by-default, consensus-enforced mandates, sovereign L1 on vendored Malachite). By night, a 4-validator chain was committing blocks. No months of stealth: the chain existed on day one.
Consensus refused an overspend — and went fully hash-based
The reference storyline ran as real on-chain transactions: an org funded a MandateTree, agents spent within budget, and a rogue agent's overspend came back rejected: mandate: insufficient buffer at depth 1 from leaf — from the state machine, not an app. The same day, every consensus vote switched to LMS/HSS hash signatures under SLH-DSA roots, and a validator rotated its signing key mid-chain with zero downtime.
Shielded pool live: real STARKs, stealth payroll, scoped disclosure
Shield → hidden spend → stealth payment discovered by ML-KEM trial-decapsulation ("BOB DISCOVERED $2") → a one-time disclosure package verified offline, opening exactly one payment and zero others → a block's shielded spends verified by every validator as one constant-size 1.24 MB aggregate proof → and the budget storyline re-run over balances no validator can see.
The whole chain went public
Node, consensus, circuits, join kit — MIT/Apache, with the vendored consensus engine and pinned dependencies. From this point on, every claim on this site is checkable against code anyone can build.
274 tx/s measured — and the staging testnet went live
The storm harness pushed a 4-validator lab chain to 274 tx/s sustained with 1,024-transaction blocks (capacity sheet in the repo). That evening, staging-1 launched on real cloud infrastructure — genesis fingerprint 557f2ea6…62a22, chain ID derived from it, public RPC and explorer from day one.
A validator spent all 32,768 signatures — the chain stopped rather than lie
At height 10,848 a validator's one-time-signature tree ran out — HSS gives ~32.7K signatures, at ~3 per height that's ~10.9K blocks, and it died on schedule. The node refused to reuse a single leaf and the chain halted (2 of 4 votes < ⅔). Six hours later it was back: a rotation certificate signed by the stateless SLH-DSA root swapped in a fresh operational key, publicly visible on the explorer as epoch 2. Exactly what the yellowpaper promises — proven the hard way. Automatic threshold rotation shipped within a day (v0.10.5, 2026-08-28) and ran unattended that night.
All three validators rotated their keys overnight — nobody was awake
First night with threshold rotation live: each voter crossed its leaf threshold and issued, committed, and applied its own root-signed rotation certificate, mid-consensus, unattended. The same window shipped the genesis gate: nodes now refuse to peer with anything on a different genesis — an imposter chain cannot even connect.
Exhaustion is now routine: dead validator → root cert → voting again
The same validator has now been revived from full key exhaustion three times — each recovery via the designed path (peers carry the exhausted validator's root-signed certificate), each faster than the last. A liveness blip, never a safety event. The same day, an independent observer node began re-verifying the entire chain from genesis.
Catch-up verification went parallel: 2 → 71 blocks/min
Full re-verification (every hash-based vote envelope, every STARK, every commit certificate) was throughput-bound at ~2 blocks/min. v0.10.8 parallelized it — 35× faster, now outrunning the chain — and v0.10.9 made sync spend zero signer leaves. A killed voter is back at tip in minutes.
A stranger's machine re-verified our entire history — and matched
An observer that joined via the public kit (genesis verified before boot) re-executed and re-verified every block from genesis — ~76,000 of them — through 45+ key-rotation epochs, three validator revivals, and three binary upgrades. At tip, stranger and founding fleet reported the identical full state commitment:
Signer leaves spent syncing: zero. This is the claim that matters — not "trust our fleet," but anyone who replays the chain lands on the same hash.
v0.10.9 released — the whole arc, tagged and reproducible
The full fleet runs v0.10.9; the release notes tell the halt, the rotations, the parallel sync, and the observer receipt in one place. Everything above is now a git checkout away.
Usage sprint → fees are law → testnet-1 launched from a ceremony genesis
In one day: permissionless accounts + a public faucet + a Windows wallet (v0.11), search-anything explorer (v0.11.2), a flat protocol fee that is charged, refunded on refusal, and burned (v0.12) — and then staging-1 was retired at height 107,182 and testnet-1 launched from a genesis ceremony: fresh hash-based keys for all four seats, the fee bound into the genesis from block 1, the faucet treasury allocated at genesis, node memory bounded (history served from disk), and a wallet that pays shielded through the public prover (v0.13.0).
A validator that had burned its tree to zero healed itself
The morning's wedge (a rotation certificate issued but never committed left the guards blocking while the seat burned its fresh tree) reproduced within ten hours on the old binary. The fix (R9: guards hold ten minutes, then re-issue replaces) rolled onto that node one voter at a time; its first tick found the guard clear, pushed an epoch-5 certificate to its peers, and within a minute it was signing again — no human in the loop. Cadence went from a crawl back to ~26 blocks/min the moment its signer lived.
Shield → stealth pay with a memo → unshield → disclose, from a Windows executable
The v0.13.0 wallet drove the whole shielded flow on the live network through the public prover: a shield (block 1,650), a shielded payment to a stealth address with a memo, a partial unshield with change, a one-time disclosure verified offline. Fee-aware from the first click: max = balance − fee, local refusal of what the chain would refuse. Guide with screenshots: /wallet.
All four seats rotated their keys, unattended, within eleven blocks — zero blocks missed
Fresh trees started together with identical budgets, so they crossed the 20% threshold together: rotation certificates landed at heights 11,584, 11,588, 11,594 and 11,595 — one per seat — while the chain kept committing at ~19 blocks a minute. The same evidence is also a finding: correlated rotation means a rotation-path bug would hit every seat in the same minute, so per-seat threshold jitter is now a plan item (R12).
The Android wallet shipped — same Rust core, same files, signed with a persistent key
Two days after the community was asked, HashKinetics Wallet for Android v0.2.0 is a release: the desktop wallet's library cross-compiled for the phone (UniFFI bindings, no hand-written JNI), gated end to end on a local chain — create → faucet → send → shield → scan → unshield → pay shielded with a memo → disclose → seal → lock → unlock — with the byte-compatibility receipt that the CLI opens the phone's sealed files and accepts a payment from them. The APK is built by CI and signed with a release key that lives only in a repository secret; the signer's certificate digest is published beside the file hash, so an upgrade is verifiable and a look-alike is not.
Every consensus signature cost ~450 ms. We had blamed the disk. He measured the CPU.
A seated external validator (Eddy) reproduced on the v0.18.1 sources what his seat had been showing since it joined: 447.7 ms median, 787 ms p95 per hash-based signature — enough to eat the 2 s propose timeout on a modest CPU. Our first diagnosis, storage latency, was wrong and was corrected the same day. Two bugs: the vendored signature crate rejected the node's authentication-path cache on every call (a length bug in its HMAC check), and the expanded key was rebuilt per signature. v0.18.2 fixes both — 179 µs per signature on the release build — with signatures byte-identical to before, the on-disk signer state unchanged, and the one rule a hash-based signer must keep (never reuse a one-time leaf) guarded and tested exactly as before. Unpaced, a lab chain then ran at 9 blocks a second, so the same release paces blocks to a 1 s minimum. No consensus rule, no deadline; his name is on the release. Rolled to the four founding seats the same evening (17:57–18:07 UTC, one at a time, chain never paused): their heights measure 1.0 s — the minimum, exactly — and Eddy had upgraded his own seat within thirty minutes of the notice.
Height 190,000: the pool stops being single-asset, with a deadline every seat met
v0.19.0 was the first release with a hard activation height: every node had to run it before 190,000, announced ten hours ahead with the hour posted every few hours. All seven seats were on it by 06:57 UTC; the height passed at about 08:47 UTC with the certificate shape unchanged and no seat lost. From there a shield of any registered, pool-eligible asset opens that asset's own pool — own tree, own nullifiers, own conservation total — while the circuit, the proving keys, the note format and the wallets stayed exactly as they were.
20 USDC left Sepolia and arrived as USDC.sep; 5 went back — every hop a public receipt
The first cross-chain loop, on testnets: a vault contract on Ethereum Sepolia locked 20 Circle test USDC naming a testnet-1 account; after Ethereum finalized the block (19 minutes — all of it Ethereum's finality), the bridge service minted 20 USDC.sep to that account. The account then burned 5 with a Sepolia address as the destination, and 90 seconds later the vault released 5 USDC to it under the attestor's signature. Afterwards the vault holds 15 = supply 20 − burned 5, which the service re-checks every ten minutes. Two hours later the other direction: 4 of an HK-issued test asset burned on testnet-1 became 4 wHKT.sep on Sepolia within a minute (a HashKinetics commit is final, so nothing to wait for), and 1 burned back on Sepolia was re-minted on testnet-1 after Ethereum's finality. At 16:42 UTC the first person outside the team — an external seat operator — bridged 5 USDC from the page, unprompted, forty minutes after it went live; and that evening bridged USDC was shielded: 2 USDC.sep into its own pool, 0.5 paid to a stealth address with zero transparent trace, 1 unshielded. Trust label, said first: on this side every balance moves under hash-based keys; on the Ethereum side the vault trusts one ECDSA attestor key today (1-of-1, founder-run) — the bridge is exactly as safe as that key. Deposit ids checked by consensus and a committee of operators are the next two steps, in that order.
R16 — the consensus signer's state write is durable (v0.19.4)
An external researcher reported that the signer's state file was renamed into place without an fsync of the directory — a power loss in that window could bring a validator back on an already-spent one-time leaf. Fixed the same day in hk-node v0.19.4: the directory entry is fsynced and restart resumes upwards. No reuse was observed on the network; one reuse would not have been enough to forge, repeated reuse would.
Node Keys on sale — nodes.hashkinetics.org
A Node Key is an ERC-721 node licence and does not entitle the holder to any token. One key = the right to register and operate one node at mainnet — not equity, no payout promised. On Ethereum mainnet, ladder fixed in the contract, proceeds to the issuer's Safe, pushed in the same mint once at least 0.1 ETH is waiting, source verified; no independent review yet (self-reviewed and tested; no independent review is booked yet; up to 1 ETH for a confirmed bug report).
R17 — the mandate tree is single-asset by construction (v0.19.6, consensus rule at height 1,872,500)
A sub-mandate could draw on the funder's balance in an asset the mandate never named — no cross-asset mandate was ever on testnet-1, test units only. Since hk-node v0.19.6 a child mandate carries its parent's asset, and a mandate spend, channel open or mandated unshield in any other asset is refused — a consensus rule, activated at height 1,872,500 on 2026-10-06 evening (named 14:02 UTC that day; a first number, 1,844,000, passed unrolled — v0.19.5 was built and never released). The four founding seats rolled to v0.19.6 on 2026-10-06 14:38–15:11 UTC, one seat at a time, every seat's leaf counter monotone across the restart, each seat's state commitment matching the public chain at a common height, the chain never paused; blocks 1,872,499 / 1,872,500 / 1,872,501 / 1,872,600 each certified, tip 1,905,591 at 2026-10-07 08:36 UTC, when no external seat had upgraded yet. Reported privately by Alboy on 2026-10-06 — nine findings fixed the same day.
R18 — a PayWord settlement is bounded before any link is hashed (v0.19.8, consensus rule at height 2,038,500)
One channel settle naming step ≈ 4.29 × 10⁹ made every validator hash ≈ 4.29 billion SHAKE-256 links at commit — 30–90 CPU-minutes on an e2-standard-2 class host — and the refusal was free, so the same bytes could ride every block. Nothing like it was ever on testnet-1, test units only. Since hk-node v0.19.8 a ChannelSettle may advance a channel by at most 2^16 = 65,536 links past its highest settled step and a ChannelOpen may name at most 2^17 = 131,072 steps, both refused before any link is hashed — a consensus rule, activated at height 2,038,500 on 2026-10-09 (named 05:44 UTC that day at tip 2,029,968; a first number, 2,007,000 — carried by v0.19.7, built 2026-10-08 and never released — passed at ≈ 21:20 UTC on 2026-10-08 with every seat still on v0.19.6, so no node ever applied it and it was renamed by patch). Client-side and without a height, the mempool refuses both shapes at admission, hk_submitBundle takes only proof-less pool transactions, and a proposer carries at most 2^17 settlement links per block. The four founding seats rolled to v0.19.8 on 2026-10-09 from 05:58 UTC, one seat at a time (the gateway last, up since ≈ 06:25 UTC), every seat's leaf counter monotone across the restart and each seat proven voting before the next; the chain continuous through the height: blocks 2,038,499 / 2,038,500 / 2,038,501 / 2,038,600 each certified, tip 2,161,432 at 2026-10-11 06:01 UTC (122,932 past the height); the external seats had not yet upgraded at that stamp. Reported privately by secwatch-hunt on 2026-10-04, confirmed against v0.19.6 on 2026-10-08 and fixed the same day.
ERC-20 HKN on Base, the pre-mainnet form of HKN, on sale — sale.hashkinetics.org
On sale since 2026-10-19 10:45 UTC: 10,000,000 HKN at $0.10 each, paid in USDC or USDT on Base, first come first served, $100 minimum per purchase, no cap per buyer, no end date (it runs until every HKN for it is bought or the issuer's Safe ends it); no KYC at purchase; purchases are final, no refunds. Each purchase is one transaction: 90 % of what is paid goes to the issuer's Safe, 10 % to the Liquidity Vault (which adds to the official Uniswap v3 HKN/USDC pool on Base, only while the sale is open), and the HKN arrives in the purchase transaction. The ERC-20 converts 1:1 into native HKN at mainnet through the burn portal, with no deadline; identity verification (KYC) at mainnet gates that conversion. 210,000,000 ERC-20 HKN were minted once on Base: 10,000,000 for the sale, 1,000,000 in the Liquidity Vault, 199,000,000 in a 48-hour timelock. The contracts' source is published and verified (Basescan, Blockscout, Sourcify); they were reviewed in independent rounds by an AI system in October 2026, at the issuer's request, and by the issuer's own review — the review reports are not published, and no audit report by a human firm exists on them. The core chain is not independently audited yet; an audit engagement with CertiK began on 2 September 2026 and no report exists. You may lose all of the money you put in. The ERC-20 has no use until mainnet other than the 1:1 bridge. Mainnet may be delayed. Do not buy if you are on a sanctions list or in a sanctioned country. The sale refuses wallets the Chainalysis sanctions oracle lists (addresses under US sanctions).
RZ-1 — a malformed consensus signature is refused, never a panic (v0.19.9, client-only, no height)
An empty, truncated or mistyped LMS/HSS signature on a vote carrying a real validator's address made the verifier panic, so the seat stopped voting while its process kept serving RPC; two founding seats quiet at once would have put testnet-1 below quorum. No funds, no forgery: a well-formed but wrong signature was always refused. The reporter proved the panics against the code and inferred the rest from reading; we confirmed the chain of events in code and did not execute the network step against a live seat. Since hk-node v0.19.9 the vendored parser is total, the wire decoder and the verifier refuse any consensus signature that is not exactly 9,140 bytes before parsing, and a panic boundary maps any panic to "invalid". Still open and said so: the consensus task is not yet restarted automatically if some other panic reaches it. The four founding seats rolled to v0.19.9 on 2026-10-23 08:21–08:58 UTC, one seat at a time (the gateway last), every seat's leaf counter monotone across the restart and each seat proven voting before the next; the GitHub release was published at 10:55:21 UTC the same day. Reported privately by Reza on 2026-10-14; acknowledged 2026-10-21, a week late, our fault.
Our worst days are load-bearing
Every incident above — the halt, the wedges, the exhaustions — became a shipped, tagged fix within days, and stayed in the public record. A chain that has only ever seen good days is a chain whose recovery story is fiction. Ours is measured.
Demo-gated claims only
Numbers on this site are measured on real runs or are explicit arithmetic on measured constants, and are labeled as such. Roadmap items are labeled plans. Mainnet follows independent audits — not the other way around.
Reproduce THE RECEIPT yourself — on the chain that is running now
One Linux box. You verify everything — every vote, every proof, every certificate — and trust nothing. THE RECEIPT above (457799f2…cb1443) is staging-1's state commitment: an archived chain, reproducible from its retained block log on request. On testnet-1 the same test is simpler — your node's app_hash at any height must equal what the fleet reports at that height.
# join testnet-1 as a verifying observer git clone https://github.com/hashkinetics/hashkinetics && cd hashkinetics # follow networks/testnet-1/README.md — verify the genesis fingerprint first: sha256sum networks/testnet-1/genesis.json # → 4e4ea68d…971c7 # then compare your tip to the fleet's: curl -s -X POST http://127.0.0.1:26000 -d '{"method":"hk_chainInfo"}' # yours curl -s -X POST https://rpc.hashkinetics.org -d '{"method":"hk_chainInfo"}' # theirs — same height ⇒ same app_hash, or you caught us