Three-Cluster Genesis

What you’ll get here

how the Smart Engines testnet bootstrapped itself from three independent clusters, what a three-member committee does and does not tolerate, and how the network bootstraps itself into existence exactly once.

A single cluster — even a cluster of many validators — is still one administrative domain. If one operator controls the whole thing, “decentralized” is just a word. So the network is built as independent clusters, each running the full three-tier stack, agreeing with each other over a message mesh. The testnet was bootstrapped from three of them, and all three are operated by HSuite today. Three clusters are the genesis bootstrap, not the design: the three tiers are the permanent architecture, and the network is designed to grow beyond three.

🧠 For Normies

Imagine three separate banks that have to agree before any vault opens. If one bank goes offline, the other two can still open the vaults that already exist; if one bank goes rogue, it can’t open anything on its own. That’s the shape of a Smart Engines network at birth.

---

Why three?

Three is the smallest committee in which a threshold of validators can sign while one is offline, and no single validator can sign alone. The threshold t is always at least a strict majority of the committee and never more than its size.

%%{init: {'flowchart':{'htmlLabels':true,'curve':'basis'}}}%%
flowchart LR
    c1["Cluster A<br/>full 3-tier stack"]
    c2["Cluster B<br/>full 3-tier stack"]
    c3["Cluster C<br/>full 3-tier stack"]
    c1 <-->|message mesh| c2
    c2 <-->|message mesh| c3
    c1 <-->|message mesh| c3

🧠 For Normies

“Byzantine fault tolerance” (BFT) is the property that the system keeps working correctly even if some participants are not just down but actively lying. The classic BFT bound tolerates ⌊(n−1)/3⌋ liars, which is zero when n = 3. So three clusters are a starting point that keeps any single validator from acting alone — real Byzantine tolerance grows as the committee grows.

Property	What it means	With three validators
Threshold	How many must agree	t validators, at least a strict majority
Liveness	Stays up under failure	1 validator offline → existing entities keep signing; creating a new entity waits until all three are back
Safety	Can’t be hijacked	1 malicious validator → cannot sign alone; it can stall the creation of new entities

Each cluster is self-contained — it runs its own validator, host and gateway, plus its own database, cache, message broker and IPFS node. The brokers are linked into a full mesh so events flow across clusters.

🧠 For Normies

“Self-contained” means each of the three clusters is a complete copy of the system, not a slice of it. They’re peers, not a primary-and-backups. The mesh is the wiring that lets the three peers gossip and coordinate.

---

What genesis actually does

Genesis runs once per network lifecycle. It turns fresh, empty deployments into a live, mutually-aware network with its own on-chain identity. Each founding validator derives the roster, the threshold and the network for the founding ceremony itself, and refuses to take part in a ceremony that disagrees with what it derived.

1. Leader and per-chain queues. One founding validator leads. Genesis runs as a queue per enabled chain, with retries, and is complete only when every enabled chain is done — Hedera and XRPL today.

2. Treasury and cluster operators. The protocol Treasury is created by a DKG ceremony, as a native multisig with the master key disabled, and the genesis funding wallet funds it once. The Treasury then funds each cluster’s operator account, which is created the same way. From here on, the multisig Treasury pays. See DKG & TSS.

3. Issuers and topics. The issuer accounts for the HSUITE token, the membership NFT and the subscription NFT are created on XRPL, each as a multisig. Genesis opens trust lines but mints zero HSUITE. On Hedera, genesis creates the HCS topics — including the canonical rules topic and the validator registry — with submit keys held by the validator threshold.

4. Membership NFTs. Each cluster operator receives a non-transferable membership NFT on XRPL.

5. Funding-wallet deletion. The final step deletes the genesis funding wallet on chain. It is built, not yet enabled: it is opt-in and has not run on the testnet. See Zero Single-Sig.

🧠 For Normies

Genesis builds the network’s own accounts first — the treasury and each cluster’s operator wallet — and every one of them is a shared multisig from the moment it exists. Then it creates the token issuers and posts the rulebook and the list of validators to a public, append-only log that nobody can secretly edit. After that, you don’t have to trust Smart Engines — you can check it.

Growing past three

In the design, membership grows without an admin allowlist: a new validator stakes HSUITE (10,000,000 HSUITE by default), the existing validators admit it with a decision signed by a quorum of them, and a resharing ceremony gives it a share of every existing key while the on-chain keys stay the same. Joining is not open to the public yet.

🧠 For Normies

Joining later isn’t meant to be special-cased. The same machinery that created the first three clusters is designed to let a fourth or fifth join by staking and running a key-sharing ceremony. That door isn’t open yet.

---

Cross-cluster agreement

Beyond signing, the clusters agree on genesis itself: the founding ceremony runs only over a committee, threshold and network that every founding validator derives for itself, and an entity’s on-chain keys change hands only through a reshare that a quorum of validators has signed off.

stateDiagram-v2
    [*] --> EmptyDeployments: fresh clusters
    EmptyDeployments --> TreasuryLive: Treasury + operators (DKG multisig)
    TreasuryLive --> IssuersAndTopics: XRPL issuers · HCS topics
    IssuersAndTopics --> Live: membership NFTs issued
    Live --> Live: entities created and signed

---

Next steps

The cryptography behind the “born split” keys:

DKG & TSS

Network & TiersThe three apps each cluster runs.

Rules EngineThe rules published to HCS at genesis.

Decentralization ModelWhat the threshold guarantees in practice.

GlossaryTerm definitions.