Status and Roadmap

What is built, what is next, and the condition each stage is gated on rather than the quarter it is promised in.

Where things stand, 11 September 2026

What "done" means here

Every stage below is gated on a condition, not a date. A date is a promise about a calendar; a condition is a promise about the system. Where an item is built and not deployed, or computed and not charged, this document says so rather than rounding it up.

Stage: proofs cover what runs

• Wider one-step classes. The covered classes today are the ones the bridge and the fee path need. Everything else is opaque in a dispute, and each block's own defence record says which steps were opaque rather than leaving it to be discovered.
• The SBF interpreter. Built as a crate with a virtual machine, a memory page tree, a Merkle commitment over the instruction stream and a one-step verify entry point. Wired to nothing. It is the named end state for arbitrary instruction classes, and it currently covers registers, control flow and aligned eight-byte memory access; division, 32-bit arithmetic and syscalls fault by design rather than being guessed.
• The program set committed to the chain. Today nothing published says which programs an operator registered, so a verifier must be told out of band by the party it is checking. The current chain registers none, so this bites the first chain that does.
• The step count bound into the root record. A challenger who names a larger step count than the block has can drive the game to a position no witness covers. The node plays anyway and says so; the program should refuse a claim of the wrong length.
• Batch contradiction slashable on chain. Equivocation between two receipts already costs the bond. A receipt the published batch does not honour is provable but not yet punishable, and the step tree now makes the one-position inclusion proof it needs possible.
• Condition to close the stage: a disputed step through an arbitrary program is resolvable on Solana rather than deferred.

Stage: somebody else is watching

• Verifiers run by parties other than the operator, against endpoints disjoint from the operator's.
• A one-command verifier image, which exists, plus the reason to run one, which does not yet.
• Condition: independent verifiers running continuously, before Stage 1 is claimed anywhere.

Stage: the economics stop being a subsidy

• Rent reclamation for finalized roots and sealed batches: built, gated by tests, not deployed.
• A composed fee: computed, charged by nothing, and publishable only with a disclosed price.
• A priority-fee auction, in SOL.
• Condition: a block's settlement cost is covered by the block, or the subsidy is disclosed with its size.

Stage: the bridge is ready for money

• SPL token credits on the Layer 2. Today a token deposit only emits an event.
• Per-asset deposit caps, withdrawal velocity limits per window, and a large-withdrawal tier that lengthens the payout delay.
• The 24-hour air gap in place of the devnet hour.
• Condition: a first-time anomaly cannot drain the vault in one shot.

Stage: the keys stop being one key

• Upgrade authority on a multisig with a published threshold, behind a timelock longer than the whole exit, window plus air gap, so any upgrade can be seen and exited before it takes effect.
• Guardian separate from the upgrade authority, with its powers stated as narrowly as they are implemented.
• Reproducible builds verified from a clean checkout, with the verification command published.
• Condition: no single key can change the code that holds funds.

Stage: audited

• Two sequential audits, plus a proof-system specialist.
• A bug bounty sized to value at risk.
• Condition: both audits closed and the findings published, before mainnet.

Stage: mainnet

Gated on every stage above, not on a quarter.

Later, and deliberately unscheduled

• A staked sequencer set. Rotating, then bonded with slashing for provable equivocation. It decides ordering only. Finality stays with Solana, and there will be no validator set of Solieum's own deciding state.
• Validity proofs as a second gate. A validity proof settles correctness at commit time, which is what makes short withdrawals possible without weakening the guarantee. The catch is that a soundness bug in a prover is silent and total, so the plan is a second, independently implemented prover alongside the fraud proof, with withdrawals gating on agreement and disagreement halting rather than picking a winner. Only this removes the window.
• Per-market lanes, each with a published ordering rule.

The honest summary

Solieum today is a working optimistic rollup on a test network, with the parts that are usually deferred, forced inclusion, a dispute game whose verdicts enforce, a bond behind the sequencer's promises, a bridge that pays against proofs, already built and exercised. What it does not have is an audit, an outside verifier, a multisig, or a single user's money at risk.

That is a real position and it is stated as one. If this paper reads as less exciting than the version it replaces, that is the intended difference: the previous version claimed a million transactions per second and a mainnet beta in the third quarter of 2025. Neither was true, and a document that overstates what is built makes the parts that are built harder to believe.

This revision

This paper was rewritten on 11 September 2026 against the protocol's own decision records and its measured output. Fabricated performance figures, packages, endpoints, explorers and reading lists were removed. The proof-of-stake validator set described in earlier versions was never part of the design and is gone. Every remaining number is either a measurement with its source named, or a named constant.