How we propose to work on Midnight
The evidence, and nothing beyond it
Three things ran, all on 2026-07-14 or before. Each is stated with where it ran. Two of them ran on a local devnet — a Midnight node, indexer and proof server on one workstation. The third is a sync against Midnight's public testnet. None of the three is a public-network transaction; see the next section.
Drift-verdict circuit
Local devnetA Compact circuit judged a declared identity manifest against observed state, and both verdicts were proven with real zero-knowledge proofs on the devnet chain: converged at block 148, drift at block 156, after the manifest commitment was deployed at block 126. The two verdicts landed in 20.2 and 16.3 seconds.
A deliberately false claim — asserting "converged" over state that had drifted — was refused by the circuit's own assertion in about 230 ms, before any proof was generated and before any transaction was submitted. The observed state stayed a private witness; the chain saw the verdict, not the data.
Local devnet, 2026-07-14. No public-network claim is made.
P/N conservation circuit
Local devnetA second circuit proved the P + N == collateral conservation invariant of Medici's own mechanism with a real zero-knowledge proof. The two leg values stayed private witnesses; only the invariant went on chain. A valid split was accepted at block 1002; an invalid split was refused pre-proof in about 230 ms, with no transaction submitted. Five further accepted probes ran between 17 and 20 seconds each.
Local devnet, 2026-07-14. No public-network claim is made.
Public-testnet wallet sync
PreprodA full wallet sync against Midnight's Preprod public testnet completed on wallet-sdk 1.2.0 — past the dust-replay event where a wallet-layer bug had previously stopped us. The wallet reported itself synced, and its applied indices advanced between checkpoints, so it was following the chain tip rather than stalled. The evidence was captured and committed.
The upstream tracker for that bug (midnight-wallet#436) remains open as of 2026-07-14, so we do not assert it has been fixed — only that the crash no longer reproduces for us.
A sync completed. A transaction did not. See below.
The boundary, stated before anyone has to ask for it
A proposal is easy to skim into a product. This list exists so that it cannot be. Every item below is something a reader might reasonably assume from the section above, and every one of them is false.
- We have never executed a transaction on the public Midnight chain. Not on Preprod, not on mainnet, not once. The funded Preprod transaction is unblocked — the sync above got us to the starting line — but it has not been run. It would be the first funded milestone of this proposal.
- No Midnight adapter exists. There is no adapter code, in any state. The circuits above are spike artifacts that stand on their own; they are not a product integration and nothing has been wired into the convergence loop.
- No integration with Midnight's identity components exists, and none has been designed. Where this proposal describes converging into Passport's rules model or verifying signing-policy state, that is a thing we would build, with Midnight's engineers, against their model — not a thing we have.
- The deployment-substrate plane (Kubernetes) is not built. Neither is secret rotation. Both appear in the shape of the product we describe; neither has been written.
- No DUST cost has been measured. The cost figure in our own model is modelled, not observed. A local devnet cannot price it, and the public-testnet run that would price it has not happened.
- Public-network proof latency is unmeasured. The timings above are local-devnet timings and should not be read as anything else.
What does run today
Two planes of the convergence loop run today, and they run on Canton, not Midnight: the Keycloak/OIDC plane and the Canton rights plane, converging every 60 seconds against live Canton networks in development (dev.medici.loan). That is the whole of it. It runs in a development environment, and we make no operational claim past that boundary.
What a Midnight programme would build
Everything in this section is proposed. None of it has been started, and the verbs below are conditional on purpose. If the work were funded, this is the order we would take it in and the shape it would have.
-
01
Price a probe on the public testnet
The first thing we would do is the thing we have not done: execute a funded probe transaction on Preprod, and measure what it actually costs and how long it actually takes. Until that has run, our DUST figure would stay labelled as a model, and our latency figures would stay labelled local.
-
02
Write a Midnight adapter
The convergence loop already speaks to Canton through a narrow ledger-adapter interface. We would implement that same interface for Midnight — keypairs and wallet addresses in place of parties and user records, circuit-level access in place of a forensic rights read. The circuits above are the evidence that the verify-and-probe half of that interface is expressible in Compact. The adapter itself would be new code.
-
03
Converge into Midnight's identity model, not around it
An agent-identity stack is forming around Midnight. We would treat its components as convergence targets behind the same adapter interface — the way an enterprise identity provider is a target today — rather than build a parallel model of our own. That design would be done with Midnight's engineers against their model, and would not begin before it.
-
04
Extend the loop across the planes that are missing
The convergence loop covers the identity provider and the ledger's rights model. It does not cover the deployment substrate, and it does not rotate secrets. A Midnight programme would be the occasion to close both — which means writing them, not porting them.
-
05
Publish what we learn about the toolchain
The spike produced a developer-experience report — compiler diagnostics, the wallet-layer bug and its upstream tracker, wallet-sync sizing, the absence of a published deployment chart. We would keep producing it, in the open, and hand it upstream. Reporting a bug accurately is worth more to an ecosystem than a tidy story about it.
The counterweight. None of this would be a heavy application: the convergence cycle would be plain HTTP and GraphQL, and only the periodic probe would prove anything. But it would not be free either — syncing a public-network wallet took real memory and hours of wall-clock time when we did it, and a standing probe sidecar would carry an operational cost we have not sized. Sizing it would be part of the work, not a surprise we would hand over afterwards.
The numbers we do not have
Three of these would be settled by the first milestone. We would rather publish the gaps than launder them.
What does a probe cost?
Unknown. The DUST figure we carry is our own model. A local devnet cannot price it — genesis dust swamps the per-operation delta — and the funded run has not happened.
How slow is a public-network proof?
Unknown. Locally, a probe's prove-submit-finalize round trip measured min 16.1 s, mean 20.8 s, max 22.9 s over ten probes — a five-minute cadence would hold with margin. Whether that survives contact with a public network is exactly what has not been tested.
What does a standing sidecar need?
Unknown. Our Preprod sync was memory-hungry and took hours to complete; we have not measured the working set of a sidecar that would keep one warm. Sizing it would be part of the first milestone.
This page is an open proposal. It has no funding attached, no start date, and no commitment behind it. We published it because we would rather show the shape of the work — and the exact edge of what exists — than describe it privately and be understood to have built it.
If it is wrong, or if someone is already doing it, we would like to know.
Nothing here is a solicitation, an offer, or investment advice.