The network · testnet-1
Post-quantum BFT, live and joinable.
Four founding voters and seven external operators — eleven seats since 2026-09-12 — run testnet-1 in public: hash-signed consensus, self-rotating keys, shielded traffic, open RPC. Anyone can join as a verifying node with one Linux box — no GPU (validators verify STARKs on CPU), no stake, no permission. Below: what's running, what's measured, and exactly how to join.
Height — live
…
≈1.4 s blocks (measured 2026-10-02 → 10-06) · read every 10 s from the public RPC
Chain ID
hashkinetics-1-4e4ea68d
derived from the genesis hash
Signer epoch
…
keys retire themselves — testnet-1 rotated all four seats on 2026-09-03; 50+ epochs on its predecessor
Voting seats — live
…
hash-based BFT · LMS/HSS votes · SLH-DSA roots · no ECDSA
Live · who is on testnet-1 right now
The roll call, measured
Every kit node bootstraps through the gateway, so the gateway's own peer table is the network's public roll call. Read straight from hk_getPeers and hk_getValidators on the public RPC every 10 seconds — nothing here is typed in by us.
Voting seats
…
hk_getValidators
External nodes
…
hk_getPeers
Node versions seen
…
gateway answers as … · peers advertise theirs since v0.15.2
Island chains refused
…
nodes on a different genesis, disconnected at the door since the gateway last started
Provenance: measured live from the gateway's own libp2p peer table; the node masks addresses itself (/24 · /48) and lists a peer only while a connection is open. A node that peers only with other operators is invisible here, and a seat is a seat only when hk_getValidators says so.
JUST WANT TO USE IT?
No terminal needed
The wallet — Windows, or the Android app — creates your account, takes a faucet drip, sends, and pays shielded — every transaction pays the 100-micro protocol fee, burned. Prefer a CLI? The faucet page has the four commands.
The chain, on paper
What's running right now
| Network | testnet-1 — public testnet, launched 2026-09-02 from a genesis ceremony (fresh keys, fees from block 1). Its predecessor staging-1 ran 2026-08-27 → 09-02, 107,182 blocks, archived |
| Chain ID | hashkinetics-1-4e4ea68d — derived from the genesis file's SHA-256; nodes refuse to peer across a different genesis |
| Genesis fingerprint | 4e4ea68d…971c7 — sha256sum genesis.json to check |
| Protocol fee | 100 micro per transaction, burned — bound into the genesis from height 1 (no activation heights, no coordinated rolls); test units, no monetary value |
| Consensus | BFT (vendored Malachite) with LMS/HSS hash-signed votes under SLH-DSA-192s roots — no ECDSA anywhere in the ledger |
| Validators | 11 seats since 2026-09-12 ≈ 10:02 UTC: 4 founding voters (fresh keys at the testnet-1 ceremony, voting power 4 each under bootstrap governance) + 7 external operators admitted on the running chain by certificates from the seated roots (the first on 2026-09-05, block 72219; #6 and #7 on 2026-09-06/07, #8 on 2026-09-09, block 209,149, #9 and #10 on 2026-09-11, blocks 303,291 and 319,494 — the tenth a professional operator running PoS infrastructure since 2018 — and #11 on 2026-09-12, block 379,143, all on founding approvals alone; from the twelfth every certificate carries an external co-signature by policy (the thirteenth is the first the rule forces) unless the bootstrap handover comes first) — power 23, quorum 16, no new genesis for any of them; the live count above is the truth, this sentence is a snapshot. Key rotation is automatic; on staging-1 it ran 50+ epochs including three full-exhaustion revivals and one fully self-healed wedge |
| Release | node v0.19.9 (security, client-only) · consensus v0.19.0 + R17 + R18 · wallet v0.15.0 · Android v0.3.0 — versioned, immutable, sha256-published; the fleet rolled to v0.13.2 on 2026-09-03, v0.14.0 (validator-set changes on a running chain) and v0.15.0 (issued assets: issuer mint · burn · freeze · pause with supply in the state commitment) on 2026-09-04 — one voter at a time, chain never paused; v0.15.1 (2026-09-05) ships the verifying keys in the join kit, so an external node verifies every proof locally and never depends on our prover; v0.15.2 (2026-09-05) adds the live peer table above (hk_getPeers) and a version tag every node advertises to its peers; v0.16.0 (2026-09-05) packs the block log into 1,024-block segments with optional retention, persists the search index across restarts, and lets every secret file live sealed on disk (hk-node key-seal / account-seal: Argon2id 512 MiB → XChaCha20-Poly1305, strength-checked passphrases, optional key-file second factor) — a sealed seat still votes; the faucet became a hot wallet with a small float refilled from a cold treasury — rolled to all four founding seats 2026-09-05, and since that evening every founding seat boots from a sealed seed and the genesis treasury lives off-fleet; v0.16.1 (2026-09-06) pages the shielded-pool feed (hk_getPoolNotes from/limit) and answers one Merkle path per spend (hk_getPoolPath) so the wallet scans incrementally — rolled 2026-09-06, each seat restarting from its sealed seed; v0.17.0 (2026-09-06) verifies STARKs with a verify-only client instead of building a proving engine at every start — a restart costs seconds, not minutes (rolled 2026-09-06: 54–59 MiB resident per seat, 6–16 s to RPC, was ~6.7 GB and 3–6 min), and every node reports its own resident set in hk_chainInfo.process; v0.18.1 (2026-09-06; v0.18.0 named 200,000 and is withdrawn) is a consensus rule with an activation by height — at height 110,000 every node re-weights the four genesis seats to voting power 4 (bootstrap governance, G1: the founding seats hold more than two-thirds on their own while the network is this young; the weight returns to external seats by SetPower certificate on a dated milestone) — every node must run v0.18.1 before that height; v0.18.2 (2026-09-08, client-only, no deadline) makes every consensus signature ~2,500× cheaper (179 µs instead of ~450 ms — a cache-validation bug in the vendored hash-signature crate plus a per-call key rebuild, found and measured by an external seat operator), signatures byte-identical, so v0.18.1 and v0.18.2 seats interoperate; it also paces blocks to a 1 s floor — rolled to all four founding seats 2026-09-08 17:57–18:07 UTC (chain never paused): each founding seat's height measured 1.0 s from then on, and the chain ran ~3 s/block until the last external seats left v0.18.1 (≈1.41 s measured 2026-10-02 → 2026-10-06 — the Block time row below); v0.19.0 (2026-09-09) is a consensus change with an activation by height — every node must run it before height 190,000: one shielded pool per asset (P6) — activated at 190,000 on 2026-09-09 08:47 UTC with all seven seats on v0.19.0, certificates unchanged through the height; the same morning the Sepolia USDC bridge closed its first loop both ways (/bridge), that evening bridged USDC was shielded into its own pool; v0.19.1 (2026-09-09, client-only, no deadline) carries the bridge subcommands and a CLI wallet bound to a real account; v0.19.4 (2026-09-22, security — the consensus signer's state write is durable) rolled to the founding seats on 2026-09-23 (14:38–14:52 UTC, gateway first, every seat's leaf counter monotone across the restart); v0.19.6 (2026-10-06, security, and a consensus rule with an activation by height) — from an external report that morning (nine findings: 1 High, 2 Medium, 6 Low, all confirmed in code and fixed in-house the same day; reported by Alboy, an independent security researcher): R17 — the mandate tree is single-asset by construction — a child mandate carries its parent's asset, and a mandate spend, channel open or mandated unshield in any other asset is refused (before, a sub-mandate could draw on the funder's balance in an asset the mandate never named; no cross-asset mandate was ever on testnet-1, test units only) — activated at height 1,872,500 on 2026-10-06 evening (named 14:02 UTC that day; a first number, 1,844,000, was named earlier and passed unrolled — v0.19.5 was built and never released — then renamed by patch before any node applied it); client-side and without a height, v0.19.6 also verifies every transaction's envelope at mempool admission, bounds a seat's voting power in set-change certificates (2^32; the set total saturates), fsyncs the directory on every atomic file write on node and wallets (one shared helper), keys the faucet cooldown on the proxy's forwarded address and handles IPv6, pages pool RPCs under the lock, runs root-signature verification for hk_submitRotation / hk_submitSetChange off the validator-set lock (cheap refusals first, two in flight) and adds hk_chainInfo.activations {mandate_asset_from, rotation_v2_from}; in the binary but inactive: chain-bound v2 rotation certificates, their height named by a later patch once every seat is on v0.19.6; still open and said so: the R16 node-evidence floor. The four founding seats rolled to v0.19.6 on 2026-10-06 14:38–15:11 UTC, one seat at a time, every seat's leaf counter monotone across the restart, each seat's state commitment matching the public chain at a common height, the chain never paused; blocks 1,872,499 / 1,872,500 / 1,872,501 / 1,872,600 each certified, tip 1,905,591 at 2026-10-07 08:36 UTC (33,091 past the height), the public RPC answering node_version v0.19.6 and activations {"mandate_asset_from":1872500,"rotation_v2_from":null}; as of 2026-10-07 08:36 UTC no external seat had upgraded yet (the gateway sees v0.19.4 ×6, v0.19.0, v0.19.1, v0.19.3) — 11 seats, power 23, quorum 16 unchanged; v0.19.8 (2026-10-09, security, and a consensus rule with an activation by height) — from an external report received 2026-10-04 (reported by secwatch-hunt), confirmed against v0.19.6 on 2026-10-08 and fixed the same day: R18 — a PayWord settlement is bounded before any link is hashed — a ChannelSettle may advance a channel by at most 2^16 = 65,536 links past its highest settled step and a ChannelOpen may name at most 2^17 = 131,072 steps, both refused before any link is hashed (before, one settle at step ≈ 4.29 × 10⁹ made every validator hash ≈ 4.29 billion SHAKE-256 links at commit — 30–90 CPU-minutes on an e2-standard-2 class host — and the refusal was free, so the same bytes could ride every block; nothing like it was ever on testnet-1, test units only) — activated at height 2,038,500 on 2026-10-09 (named 05:44 UTC that day at tip 2,029,968; a first number, 2,007,000 — carried by v0.19.7, built 2026-10-08 and never released — passed at ≈ 21:20 UTC on 2026-10-08 with every seat still on v0.19.6, so no node ever applied it and it was renamed by patch); client-side and without a height, the mempool refuses both shapes at admission, hk_submitBundle takes only proof-less pool transactions, and a proposer carries at most 2^17 settlement links per block; hk_chainInfo.activations gains payword_cap_from. The four founding seats rolled to v0.19.8 on 2026-10-09 from 05:58 UTC, one seat at a time (the gateway last, up since ≈ 06:25 UTC), every seat's leaf counter monotone across the restart and each seat proven voting before the next; the chain continuous through the height — blocks 2,038,499 / 2,038,500 / 2,038,501 / 2,038,600 each certified, tip 2,161,432 at 2026-10-11 06:01 UTC (122,932 past the height), the public RPC answering node_version v0.19.8 and activations {"mandate_asset_from":1872500,"payword_cap_from":2038500,"rotation_v2_from":null}; as of 2026-10-11 06:01 UTC the external seats had not yet upgraded; v0.19.9 (2026-10-23, security, client-only — no consensus rule, no height, but every node restarts on it once) is the current release — RZ-1, from an external report received 2026-10-14 (reported by Reza, an independent security researcher; acknowledged 2026-10-21, a week late, our fault): a malformed consensus signature is refused, never a panic — before it, an empty, truncated or mistyped LMS/HSS signature on a vote carrying a real validator's address made the verifier panic, so the seat stopped voting while its process kept serving RPC (two founding seats quiet at once would have put testnet-1 below quorum; no funds, no forgery: a well-formed but wrong signature was always refused); the vendored parser is now total, the wire decoder and the verifier refuse any consensus signature that is not exactly 9,140 bytes before parsing, and a panic boundary maps any panic to "invalid"; still open and said so: the consensus task is not yet restarted automatically if some other panic reaches it. The four founding seats rolled to v0.19.9 on 2026-10-23 08:21–08:58 UTC, one seat at a time (the gateway last), every seat's leaf counter monotone across the restart and each seat proven voting before the next; the public RPC answers node_version v0.19.9 with the activations unchanged; as of 2026-11-03 17:02 UTC the gateway's public peers run v0.19.9 ×1, v0.19.8 ×3 and v0.19.1 ×1 (the EXTERNAL rows of the roll call above) — 11 seats, power 23, quorum 16 unchanged; external seats are asked to follow |
| Public endpoints | RPC https://rpc.hashkinetics.org · prover/vk https://prover.hashkinetics.org · explorer |
Measured, not promised
The numbers, with their provenance
| Sustained throughput | 274 tx/s — measured: storm harness, 1,024-tx blocks, 4-validator lab chain (capacity sheet in the repo) |
| Block time | ≈1.41 s — measured 2026-10-02 → 2026-10-06 from two heights and a clock, every vote hash-signed |
| Shielded verification | 1 proof / block — measured: a constant-size ~1.24 MB aggregate covers every shielded tx in the block |
| Catch-up verification | 71 blocks/min — measured on the live testnet (v0.10.8 parallel verify; was 2 blk/min) — a joining node outruns the chain |
| Restart to tip | seconds — measured on the 2026-09-06 fleet roll: 6–16 s from start to an answering RPC, voting within seconds (R10 v2 since v0.13.0 resumes at the chain height without rehydrating history; was minutes on v0.10.9); sync spends zero signer leaves |
| Crash recovery | byte-identical — measured: kill -9 all validators mid-consensus; restart resumes from the block log, never resyncs from genesis |
| Effective payments/s | 183,000/s — arithmetic on measured constants (channel depth × settles/s); 1M/s is the gated target, labeled as such |
Liveness honesty: on staging-1 (four equal seats, 2026-08-31) the chain crawled on 3 of 4 voters (~4 blk/min — zero timing margin) and self-healed the moment the fourth returned; on testnet-1 (11 seats, the founders 16 of 23 under bootstrap governance) one founding seat down costs nothing and two down stop the chain — they did, for 54 minutes on 2026-09-14, and it resumed the moment the first returned (docs/INCIDENTS.md #13). An exhausted or dead validator is a liveness blip, not a safety event. Measured on the real fleet, ledgered in the changelog.
The join flow
From clone to verified tip, five steps
Full detail and troubleshooting live in networks/testnet-1/README.md (observers) and docs/VALIDATOR-ONBOARDING.md (voters). The short version:
# 1 · build once (Linux/WSL2, stable Rust) git clone https://github.com/hashkinetics/hashkinetics && cd hashkinetics/chain cargo build --release -p hk-node # 2 · VERIFY the genesis before anything else (sha256sum -c ../networks/testnet-1/CHECKSUMS) sha256sum ../networks/testnet-1/genesis.json # must start 4e4ea68d # 3 · generate your key — it never leaves your machine ./target/release/hk-node keygen ~/hk-node my-moniker # optional (v0.16.0): seal it on disk — Argon2id 512 MiB, passphrase from HK_KEY_PASSPHRASE[_FILE] or systemd LoadCredential at start ./target/release/hk-node key-seal ~/hk-node # 4 · the kit: pinned genesis AND the verifying keys, next to your node home cp ../networks/testnet-1/genesis.json ~/hk-node/genesis.json cp ../networks/testnet-1/vks.json ~/hk-node/vks.json ./target/release/hk-node config-gen ~/hk-node --listen /ip4/0.0.0.0/tcp/27000 \ --peers $(paste -sd, ../networks/testnet-1/PEERS.txt) # 5 · start — no environment variable, no prover: the node verifies every proof locally ./target/release/hk-node start ~/hk-node
The verifying keys come with the kit (since v0.15.1). vks.json holds the three SP1 verifying keys; at startup the node checks them against the hashes pinned in the genesis and refuses to start on a mismatch — a tampered file is refused, an unverified node is refused (K5), so a node on this genesis can never fork off at the first shielded block. Expected startup lines, in order: verifying keys MATCH the genesis pins source=file → SP1 pool verifier wired from the vks file → Consensus is ready. Since v0.15.2 your node also advertises its version to its peers, and appears in the roll call above the moment it connects.
Your node is durable. Any restart — including kill -9 — resumes from its block log and snapshot to a byte-identical state commitment; reserve-then-sign persistence guards against a crash reusing a one-time leaf — durable since v0.19.4 (the directory entry is fsynced too; restart resumes upwards); since v0.19.6 (2026-10-06) every atomic file write on the node and the wallets fsyncs its directory through one shared helper, and the same release carries consensus rule R17 — the mandate tree is single-asset by construction — active on testnet-1 since height 1,872,500; v0.19.8 (2026-10-09) carries consensus rule R18 — a PayWord settlement is bounded before any link is hashed — active since height 2,038,500; v0.19.9 (2026-10-23, security, client-only): a malformed consensus signature is refused, never a panic, and every node restarts on it once; external seats are asked to follow. Restart=always is safe; there is no "resync from genesis."
Why your node matters
The soak clock
Mainnet is gated behind independent audits and a 30-day incident-free public soak. Every external operator moves the network one step closer to the audit phase — and mainnet launches only after independent audits close. Running a testnet node gives no right or expectation to a mainnet seat; seats are admitted by certificate of the current set. Mainnet targeted December 2026 (plan) — after the independent audits' critical findings are closed and re-reviewed, and a 30-day incident-free public soak; it launches with value caps.
WHAT YOU RUN
One Linux box
4+ cores, 4 GB RAM minimum, 8 GB comfortable (measured on the public RPC node on 2026-10-06: 698 MiB resident after 12.9 days up; every node reports its own footprint in hk_chainInfo.process), one open TCP port. No GPU, no stake. Your key exhausting is handled by automatic rotation — 50+ times on the predecessor chain, and all four testnet-1 seats on 2026-09-03.
WHAT YOU VERIFY
Everything
Every block: mandate law over hidden balances, one aggregate STARK, hash-signed votes from every peer. Your logs are receipts — your app_hash either matches the fleet or catches us lying.
WHAT'S NEXT
How seats are admitted
Running a testnet node gives no right or expectation to a mainnet seat; seats are admitted by certificate of the current set. Fee routing is a plan, labelled as such, and promises no return to anyone. Since v0.14.0 a voting seat is admitted on the running chain by a certificate from more than ⅔ of the current seats — you join as an observer, sync to the tip on our app_hash, and the seat follows without a new genesis.