The technology
Hash functions, all the way down.
Every chain says "quantum-safe roadmap." This one made a harder choice: the entire money path — wallet signatures, validator votes, channel payments — rests on one assumption: that hash functions resist preimage attacks. That is the most conservative, longest-studied assumption in cryptography, and the one a quantum computer dents least. No elliptic curves to break. No lattice bets where funds live.
Why now
The threat model, stated plainly
Every major chain's funds sit behind ECDSA or EdDSA
A cryptographically-relevant quantum computer breaks those curves — and with them, custody on effectively every production chain. Migration plans exist; migrated money mostly doesn't. HashKinetics never takes the dependency: there is no ECDSA anywhere money moves or votes are cast.
Harvest-now, decrypt-later is already happening
Encrypted traffic recorded today gets opened the day the curve falls. For payment metadata that means retroactive surveillance of everything agents ever bought. Our note encryption uses ML-KEM-768 — and by design, a KEM break could only leak old metadata, never move funds.
Pillar 1
The keychain: one family of primitives, four layers
A single certified hierarchy, from a stateless root that can sign effectively forever down to hash-chain micropayments that cost one preimage each. A leaf count is literally a cryptographic transaction budget — running out of signatures is a designed, enforced event, not an accident.
| Root · SLH-DSA-192s | Stateless FIPS 205 anchor (~2⁶⁴ signatures — no exhaustion). Certifies operational trees; signs rotation certificates. Permanent identity. |
| Operational · LMS/HSS | Stateful trees (RFC 8554) that sign votes and transactions. ~32.7K one-time leaves per tree; leaf index doubles as the account nonce, enforced by consensus — reuse is structurally impossible, and equivocation is slashable evidence of key compromise. |
| Spend · WOTS / Lamport | One-time signatures on the spend path — verified both natively and inside the STARK circuit for shielded spends. |
| Channels · PayWord | Hash-chain micropayments: each machine-speed API call costs one 32-byte preimage — no signature, no chain round-trip — and one transaction settles the whole session. |
Pillar 2
Consensus: hash-based BFT with keys that retire themselves
Every vote is a hash signature
BFT on a vendored, signature-generic Malachite core — with LMS/HSS replacing the usual Ed25519 for every proposal and vote. ~1.4–2 s blocks, measured. Most "post-quantum" chains protect wallets and leave consensus classical; break the validators and you own the chain anyway. Here the consensus layer holds to the same standard as custody.
Exhaustion is a lifecycle, not a failure
When an operational tree runs low, the validator issues a rotation certificate signed by its stateless root; the network applies it mid-chain with zero downtime. Proven live 45+ times — including three full revivals of a validator that spent every leaf. Reserve-then-sign persistence guarantees a crash can never reuse a leaf.
The chain ID is the genesis hash
hashkinetics-1-4e4ea68d derives from the genesis file's SHA-256, and nodes refuse to peer across genesis. Verifying-key hashes for the proof system are pinned in genesis too — a node refuses to start if the proof system doesn't match.
Halt over lie
A validator out of signatures stops signing — full stop. The chain has demonstrated this in production: it halted at height 10,848 rather than reuse one leaf, and recovered through the designed rotation path six hours later. The receipt is public.
100 micro, burned, from block 1 — no activation height
The fee policy lives in genesis.json next to the validator set and the pinned verifying keys; the chain id is derived from that file, so a validator cannot run a different fee schedule without being on a different network. Charged before the payload, refunded in full on refusal, burned on success; the cumulative burn is part of the state commitment. Testnet-1 burns 100% — the mainnet validator share is a plan, labeled as such.
History lives on disk, not in RAM
A node keeps only the newest 512 decided heights in memory; older blocks are served to syncing peers from its block log, re-checked against their commit certificates before they leave. A restart resumes at the chain height without rehydrating history — voting within seconds — and hk_chainInfo.history tells you exactly which heights a node can serve. Memory does not grow with the chain.
A network is its genesis bytes
Four independent key generations (fresh stateful trees — never restarted from a reset counter on another chain), one genesis assembled from the public halves with the fee policy and the faucet treasury bound in, byte-identical on every host by digest, a simultaneous start. Rehearsed on one machine first (34/34 checks on the released binary), then run on the fleet on 2026-09-02 — procedure and record ↗.
Pillar 3
MandateTree: spending authority as a consensus object
The core product idea. An organization's budget is a tree the chain itself enforces — not a policy in an app, not a row in someone's database.
| Drip allowances | Budget accrues per-second into a capped buffer — no midnight resets to game, no "spend it all at 00:01." |
| Whole-chain enforcement | Children may oversubscribe a parent on purpose, but every spend must clear the entire ancestor chain — a leaf's own headroom is never enough on its own. |
| Cascade revocation | Revoke any node and its whole subtree is dead next block — one transaction to shut down a compromised department of agents. |
| Attenuation only | Child certificates can only shrink authority — rates, per-tx caps, expiry. No privilege escalation by construction. |
| Receipts | Every refusal is a signed, queryable receipt: insufficient buffer at depth 1 from leaf is the chain talking, and it's auditable forever. |
Pillar 4
The shielded pool: private by default, accountable by choice
Balances nobody can read — budgets still enforced
Funds live as hash-committed notes; spends are STARK proofs verified by every validator; recipients are ML-KEM-768 stealth addresses discovered by trial decapsulation. And the MandateTree still binds: the chain refuses overspends against balances it cannot see — the combination no other production system has.
One proof per block, whatever the load
All shielded spends in a block verify as a single constant-size aggregate (~1.24 MB, measured). Validators verify on CPU; GPUs are for people making payments (~1.2 s per spend proof on a consumer card), never required for validating.
One payment, one package, zero surveillance
Under lawful process, a holder produces a one-time disclosure package for a single payment — verifiable offline, opening nothing else in the pool (demonstrated: one payment opened, zero others). Epoch-scoped viewing keys bound the blast radius of any compelled disclosure.
No master view key. Structurally.
There is no skeleton key in this design — not held by us, not by a committee, not escrowed. Disclosure is always holder-produced, single-audience, and scoped. A backdoor you promise not to use is still a backdoor; we removed the shelf it would sit on.
The honest matrix
What breaks what — including us
| ECDSA / EdDSA falls | Custody on effectively every other production chain is exposed. HashKinetics: unaffected — the dependency doesn't exist here. |
| ML-KEM-768 falls | Old shielded metadata (amounts, counterparties of recorded traffic) could leak. Funds cannot move — spend authority never touches lattices. |
| STARK soundness bug | Worst case: undetected inflation inside the pool. Mitigations: independent audits before mainnet, value caps at launch, and a proof system pinned in genesis so any fix is an explicit, visible upgrade. |
| SHAKE-256 / SHA-2 falls | Every blockchain, certificate authority, and password system on Earth fails with us. This is the assumption the industry already bets civilization on — we just refuse to add weaker ones on top. |
The edge
Compatibility shell: meet the agent economy where it is
Settlement is sovereign and post-quantum; the edge speaks the standards agents already use — x402-style payment facilitation, AP2 mandates, MCP pay-per-tool-call metering, and ERC-8004 agent identity. Reference flow in the repo: a paid MCP search_docs tool metered at $0.005/query through a PayWord channel under a mandate.
Read the papers
The design in full — invariants, circuits, key lifecycle, and the honesty ledger of what is measured versus planned.