Now
What is building. What comes next.
A live page tracking what Sunima is actually doing. Recently shipped lists facts with dates and on-chain links. Active development lists what is being built right now, without delivery dates — the project doctrine is announce when shipped, not when promised. Coming next lists committed work that has not started. Updated whenever state changes.
Each item is independently verifiable on Arbitrum Sepolia.
Chain stress test on sunima_8081-1
Stress testing on sunima_8081-1: surfacing anomalies, edge cases, and error paths against the live testnet, in parallel with module-level hardening and preparation for the next phase transition. Specifics released only when each milestone is ready to ship — no module-level disclosure or timeline commitments ahead of delivery. During these runs, the testnet may show occasional elevated latency on RPC endpoints, transient timeouts on the public explorer at scan.sunima.uk, and spikes in mempool depth. Block production and finality remain unaffected. Every anomaly surfaced feeds back into module hardening before the next milestone is unlocked.
Clean regenesis — current chain established
The sovereign testnet was rebuilt in a clean regenesis at genesis time 2026-05-20T01:40:08Z, establishing the current chain-id sunima_8081-1. This is the last full restart — from here the chain advances only through governance upgrades, no further re-genesis. Public RPC at sunima.uk/chain-rpc, REST at sunima.uk/chain-rest, live validator dashboard at sunima.uk/network.
L1 testnet migrated to full Sunima chain — V4.2 operator module live
The sovereign chain transitioned from vanilla Cosmos-SDK to the full Sunima binary in a coordinated re-genesis. The current chain-id sunima_8081-1 was established later, in the clean regenesis on 2026-05-20 (above). Validator set bonded post-migration, joining via the V4.2-1 staking hook (auto-link verified live). The x/operators module ships the V4.2 family end-to-end: bond + probation pool (V4.2-2), 50/50 reward intercept via local distribution replay (V4.2-2b), staking-hook auto-link (V4.2-1), governance ante denylist for probation validators (V4.2-3), and stale-link prune in BeginBlocker (V4.2-4) — all shipped on the testnet binary after internal cold-eye review. A small bootstrap operator group is grandfathered in genesis (probation_end=0, bond=0); subsequent entrants register via MsgRegisterOperator with a 25,000 SUNA bond and serve the configured probation window. The x/courtorder module ships alongside as the Cosmos-native equivalent of the Solidity gateway (intake + disclosure + revocation, passed internal cold-eye review). x/turnstile and x/twomode are in-binary with full test coverage. Genesis: sunima.uk/chain/genesis.json. Stage 5 mainnet remains gated on external audit, the Halo2-KZG privacy layer, the validator decentralisation gate, and the threshold-MPC operator cohort.
Sunima Chain testnet live
Sovereign Cosmos-SDK + CometBFT chain came up in its first bootstrap cohort — the start of Stage 5 — sovereign L1 testnet. This early chain was later rebuilt in the clean regenesis on 2026-05-20 (above) into the current chain-id sunima_8081-1. Validator application form at docs.sunima.uk — setup instructions issued to approved operators directly. Mainnet remains pending external audit and validator decentralisation.
CourtOrderGateway v1.0.0 — first V3 consumer on Arbitrum Sepolia
Auditable disclosure registry implementing the legal-bridged privacy doctrine on top of SunimaTFHEPredicatesV3.verifyAndConsumeConditional. Deployed on Arbitrum Sepolia at 0x01fea626…da039, source verified on Sourcify (match/match). Lifecycle: registerOrder (judge-only) → discloseConditional (anyone, requires two worker signatures bound to the order) → revokeOrder. Internal cold-eye review iter 1 caught a HIGH cross-order replay surface (worker signature did not bind orderId), v1.1 added a gateway-level binding signature with a disjoint domain byte. Full test suite passing, no regressions. Open: the gateway is a testnet primitive only — no real court order has been processed; the off-chain Rust worker v0.3.0 endpoint /conditional_with_order_binding still needs to be added before the end-to-end disclosure flow is functional.
Audit-pass redeploy of six contracts
Five governance and privacy-deposit contracts went through 4 audit iterations (PRION + cold-eye) and 9 confirmed real-bug fixes before clearing the gate with zero findings ≥ MEDIUM. Full forge regression suite passing, no regressions. Six artefacts deployed and source-verified: SunimaGovernance v1.0.1 · PRIONInvariants v1.0.1 · PRIONPatchGateway v1.0.1 · SunimaDefWallet v1.0.2 · SunimaCollectionPool v1.0.2 · DefWalletAdapter v1.0.2.
Whitepaper fee-distribution model finalized (§11.5)
Operator economics published in full in whitepaper v1.6 (§11.5): a 24-month linear ramp from Year 1 to Year 3+, burn 30→50% · validator pool 50→35% (no GPU required) · treasury 20→15% · multi-signal bear-market trigger (volume + organic-traffic + volatility + validator-income floor) · 2x staking APY multiplier for node-runners · slashing three-tier with mercy percent · seven open iteration items tagged with resolution windows · explicit non-changes documented with reasoning. Three external review rounds applied. Model now in operational-validation phase — further iteration deferred until testnet telemetry surfaces real-world signal.
FROST signing quorum reached end-to-end
Signing onboarding flow shipped end-to-end: pre-built binary + single-command setup + background-process supervision. Operators joined via the internal onboarding path and contributed to threshold signing. Cleanup path verified.
FROST cold-storage round-trip verified
Lossless age-encrypted backup tested end-to-end: keygen → age encrypt → delete plaintext → restore → sign → verify. Format is ciphersuite-agnostic. USB bundle ≈10 MB. Validates the cold-backup path for production threshold custody.
Stage 4 privacy-deposit layer live
SunimaDefWallet + SunimaCollectionPool + DefWalletAdapter deployed with guardian + pause + commit-reveal flow. Hub re-wired to the new adapter. Stage 2 vault SunimaVaultElGamal v0.7.1 deployed in parallel with circuit breaker and Predicates v3.
FROST 2-of-3 MPC end-to-end
PoC FROST 2-of-3 across two trust domains, auto-failover under node loss, withdraw transaction on Arbitrum Sepolia accepted the Schnorr signature in _verifySchnorr. Validates the threshold MPC migration path off the single-organizer key.
Stage 3 closed — TFHE Predicates V3 live
SunimaTFHEPredicatesV3 deployed: range-proof + compare + conditional. Sourcify match/match. Passed internal cold-eye review over two rounds. End-to-end encrypted-transfer flow verified the same day.
Architecture v3 finalized
Metro + Fortress architecture committed: matryoshka outer layers (L1–L7), inner metro lines and depot. Depot is the v2 fortress with two rooms (OPS + CORE). Two-way compliance handles. Documented internally and reflected in the public architecture page.
Public channels online
@SunimaLabs on X and the Discord server launched. First thread reached 177 views inside 24 hours. Frame: legal-bridged privacy and binary user choice.
No delivery dates. The doctrine is to announce when shipped, not when promised. Each item is real, scoped work that the team is touching this week.
Halo2-KZG shielded-notes privacy layer
Building the mainnet privacy layer on Halo2-KZG shielded notes — the core that carries balances and transfers privately at the protocol layer. This is the dominant milestone right now. The Stage 1–4 Arbitrum Sepolia contracts proved the primitives and remain as reference. Specifics are announced when each piece ships, not before.
Sovereign-chain hardening on sunima_8081-1
Hardening the sovereign Cosmos-SDK + CometBFT chain under real validator load, with confidential transfers running on Halo2-KZG shielded notes. The mainnet gate sits behind external audit, the operator cohort, and validator decentralisation. No dates — announced on ship.
Audit pipeline as a permanent gate
Every new or modified contract enters the two-gate flow (PRION + Cold-Eye). Calibration data flows back into the PRION knowledge base after each pass — the auditor learns from its own findings and from manual verification.
FROST production wiring
PoC verified end-to-end on 2026-05-01. Production migration moves the predicate signer path from a single ECDSA worker to a 2-of-3 FROST committee across independent trust domains. The cold-storage backup path is already validated.
Admin-key migration to hardware-isolated multisig
Admin and guardian roles consolidate onto a hardware-wallet-backed 2-of-3 Gnosis Safe. Plan committed; physical setup in progress. Reduces concentration of authority over admin slots.
PRION continuous learning
PRION runs continuously, not just at deploy time. The knowledge base ingests new public exploit reports daily (DefiHackLabs, Pashov audits, Sherlock reports, SWC registry, Halborn). Calibration data from each audit iteration feeds back into the index, which holds a large indexed attack-vector corpus and keeps growing.
Operator program scale-up
Operator onboarding is live by application. CPU node program is documented at validator application; setup instructions issued to approved operators directly. Goal: more independent operators across more jurisdictions before any sovereign-chain bootstrap is considered.
In-browser prover throughput
Confidential transfers build their Halo2-KZG proof in the sender's browser. Multi-threaded proving cut a shielded send from 144 s to 19.5 s (7.4×) on the public testnet path; work continues on further reducing that wall-clock. The earlier entry here tracked TFHE worker batching — that engine belongs to the closed Arbitrum Sepolia research stages and is not on the sovereign-chain path.
Items below are committed scope. They have not started yet because something else is in flight. They will move into active development when capacity opens — not when a calendar date arrives.
Sybil-resistance shell for PRION submission gating
Stake-weighted submission gating, two-of-three cross-validator confirmation on high-impact training samples, and anomaly detection on coordinated submission patterns. Closes the open design gaps in the PRION poisoning surface.
External competitive audit pre-mainnet
Code4rena and Trail-of-Bits review on top of the internal cold-eye gate. Continuous Immunefi bounty after launch. Layered on top of internal review, not a substitute.
Threshold disclosure committee hardening
Moving court-order disclosure from a single-signer path to a threshold ElGamal committee across independent operators, so no single party can decrypt and no single party can block a lawful order. This replaces the off-chain TFHE coprocessor pool that earlier drafts listed here: TFHE is not on the sovereign-chain path and will not ship with it. The Stage 1–4 Arbitrum Sepolia contracts that used TFHE proved those primitives and stay published as closed research.
Genesis validator program — testnet onboarding
Onboarding for the first 100 validators via testnet probation. Probation window opens 2026-05-17 and runs until the live testnet (sunima_8081-1) reaches a sustained ≥95% correctness/uptime bar — minimum 5 months, exact close floats with network maturity. Qualifying criteria during probation: ≥98% individual operator uptime on the published hardware floor (16 cores / 32 GB RAM / 1 TB NVMe minimum). Selected operators receive a 5,000 SUNA airdrop locked in self-stake on mainnet launch with a 6-month vesting cliff. Slashing is doubled for airdrop-recipient operators. After the genesis set fills, validator entry becomes permissionless with a 25,000 SUNA minimum self-delegation.
Mainnet target — milestone-gated
Sovereign mainnet launch contingent on (a) external competitive audit complete with all CRITICAL and HIGH findings resolved, (b) genesis validator set across multiple independent operators in distinct jurisdictions, (c) the Halo2-KZG privacy layer production-ready, (d) the threshold ElGamal disclosure committee live across independent operators, (e) FROST threshold-MPC aggregator operational across geographically distributed share holders. No date promise — the gate is artifact readiness, not a calendar. We ship when the gates close, not when the calendar says.
This page is rewritten when state changes. Items move from Coming next to Active development to Recently shipped as work progresses, with the date stamped at ship time. Items that turn out to be wrong or unnecessary get removed with a short note. No silent edits.