On Mainnet

Read-only follower · production deliberately off

TSUNAGI forges blocks on the Preview testnet. On Cardano mainnet it runs something narrower and colder: a read-only follower — built from verbatim-ported Ouroboros consensus code — that follows and verifies the live chain through the operator's own relay. It produces nothing. That restraint is not a limitation of the code; it is the design.

Following the real chain, byte for byte

The mainnet follower is the Haskell node's consensus client path — handshake, mux, ChainSync, BlockFetch — ported verbatim to Zig and hosted in the TSUNAGI Core executable. It negotiates node-to-node protocol v15, tracks the tip, decodes every block body, follows rollbacks, and reconverges through forks, peering via the operator's own relay. It holds no keys. Forge paths are dormant.

"Verbatim-ported" is a testable claim, not a slogan: a frozen build of the upstream reference (the oracle) runs the same code path, and every repair to the port is gated on byte-parity against it.

2,682 blocks, zero disagreements

For 24 hours the TSUNAGI Core executable and a fresh build of the frozen upstream oracle followed the same live relay side by side — identical seeded cursors, isolated homes, forge off, no keys. Live network conditions included 36 fork events per side, all reconverged.

Canonical heights converged
2,682 / 2,682
Hash mismatches
0
tx decode
byte-equal on all 2,682 blocks
Fork / rollback events
36 each side, all reconverged
TCP sessions
1 unbroken, 24 h, each side
Errors · watchdog alerts
0 · 0

That soak was the closing exhibit of the R-series — a protocol investigation that found and repaired three real transport defects in the port (multi-message SDU handling in BlockFetch and ChainSync, and fragmented-SDU reassembly), each proven with a deterministic reproduction and re-verified against the oracle. 699/699 tests green. On mainnet itself, the operational battery included a 55,518-byte block reassembled from five SDUs and decoded byte-identical to the upstream reference.

Built to run unattended, built to fail closed

Supervisor

Supervised recycles

A supervisor adopts the live follower and recycles it on a schedule. Clean shutdown, cursor recovery, and a 15-second resync are verified end-to-end, not assumed.

Recovery

Cursor-guard recovery

When the saved chain cursor points at an orphaned block, recovery rolls back to a known-good point automatically — a real incident, now fixture-tested.

Truth pipeline

Fail-closed by construction

The pipeline that publishes this site's numbers aborts rather than publish bad data. In its first audited window: 84 cron runs, 11 aborts — every one caused by upstream API flakiness, every one self-healed within 2 runs, zero regressions.

Incidents

Zero node-fault crashes

Every incident in the observation window to date attributed with evidence: tooling or upstream, except one bounded follower design limit — now auto-recovered and pinned by a test fixture.

Seven days, on the clock

The follower was deployed to mainnet on 2026-07-04 and entered a 7-day certification observation window that completes on 2026-07-11. The window is in progress as this page is written; its availability and trend figures finalize only when the calendar does. Every mechanism the window exercises — recycle, recovery, truth-sync — was already verified in isolation beforehand; what the window adds is duration evidence, not hope. Interim measurements from the first 44 hours: zero unplanned exits, zero disconnects, 118 rollbacks all reconverged, ~0.1% of one CPU core, memory slow-climbing but decelerating and deterministically recycle-bounded.

No mainnet blocks. On purpose.

TSUNAGI does not produce blocks on mainnet. The producer code exists and forges daily on Preview, but on the mainnet follower the forge paths are dormant and no forging keys are present. The mainnet readiness certification says so explicitly: it certifies the read-only transport and client stack, and states in plain text that producing is not certified — out of scope, Preview-only, operator-gated.

Mainnet production sits behind a separate certification program (roadmap milestone M9): key-lifecycle rehearsal, block-construction byte-parity against a reference producer, shadow-producing with broadcast disabled, and a documented go/no-go gate — and even completing all of that enables nothing by itself. A wrong block on mainnet is real economic harm; the burden of proof is on the node, at every step. Saying this out loud is the same discipline that publishes the orphan ledger.

From certified follower to node platform

The v1.x roadmap orders the work in three waves, by value and risk — planning, not promises:

Wave A · foundation

De-risk operating what exists

Release eng
Reproducible, versioned, signed builds — you cannot certify or roll back what you cannot reproduce and name.
Service mgmt
Boot-persistent supervision (systemd) replacing the proven-but-mortal shell supervisor; observability with real alerting.
Wave B · durability

Survive time and the real chain

Bounded state
Move authoritative UTxO/ledger state into a durable, size-bounded LMDB store with snapshots — removing the recycle sawtooth. Touches ported code, so every change is gated on re-proven oracle parity.
Era currency
The existential one. A byte-frozen port breaks at a hard fork. A standing upstream-watch and re-port/re-validate pipeline is what separates "a node that worked in 2026" from a node platform. First live data point: the van Rossem intra-era hard fork (Conway PV 10 → 11) — Preview crossed it and the TSUNAGI Preview producer forged blocks under PV 11 without incident; a code audit found no protocol-version gate in the mainnet follower's read path, and it is expected to cross the mainnet enactment unmodified. That is an assessment, not a proof — the enactment itself is the proof, and it will be recorded here either way.
Wave C · expansion

New capability, new risk surface — in that order

Security
Written threat model, key-handling design, supply-chain verification — before any inbound serving or key custody, not after.
Serving
The responder side: serving ChainSync/BlockFetch to downstream peers, hardened against hostile input.
Producer cert
M9, last and gated: prove the node would forge correct mainnet blocks — shadow-produced, never broadcast — before any enablement question is even asked. Enablement is a separate decision, and it is the operator's.
The verbatim-port strategy that made parity provable is in tension with the changes durability requires. The oracle differential harness is what makes that tension safe: every change to ported code is gated on re-proven parity.

Two networks, one standard of proof

On Preview, TSUNAGI proves itself with canonical blocks. On mainnet, it proves itself with agreement — thousands of consecutive blocks where an independent implementation and the reference implementation cannot be told apart at the byte level. Production comes later, if the evidence earns it. The evidence so far is above.