Opened 09-06-2026 by Winnode, last activity 4mo ago
Proposal file:
Link to the proposal added in this PR (e.g., /proposals/your-proposal-name.md)
Briefly describe the proposal and the value it delivers to the Canton ecosystem (2–3 sentences).
/proposals/(Add anything the Tech & Ops Committee should pay attention to.)
2 automated messages from bots hidden. Show bot messages
Showing 1 to 1 of 1, oldest first.
Thanks for the review and the note on the champion requirement — understood.
A quick summary for any Node Deployment & Operations SIG member who might be open to championing this:
COOT is an Apache-2.0, vendor-neutral operations + observability toolkit for Canton validator / participant / SV nodes — exporter, curated dashboards, an alerting rule library, backup/restore automation, tested DR runbooks, and Helm packaging. It is a pure public good (no proprietary product), scoped to a single objective.
It is not description-only: a runnable Milestone-1 prototype already exists at https://github.com/Winnode/coot (one-command Prometheus + Alertmanager + Grafana + a read-only Canton exporter). WinNode operates validator infrastructure across 28+ networks and runs live Canton infrastructure today.
@stas-sbi @isegall-da — given your work in node operations, would either of you (or another Committee member) be willing to champion this, or point me to the right person? Happy to walk through the prototype or adjust scope/milestones to fit ecosystem priorities. Thank you!
Author: WinNode — Canton Network validator & infrastructure operator Status: Draft Created: 2026-06-09 Label: node-deployment-operations Champion: Seeking Champion from the Node Deployment & Operations SIG. Candidate reviewers in that SIG include operators well placed to evaluate this work — e.g. Andrew Pohl (Liquify), Caleb Bolden / Marijus Kasperavicius (Blockdaemon), Jeremy Alons (Cumberland), Lucas Naundorf (FCS), Stanislav German-Evtushenko (SBI Security Solutions), Vinh Nguyễn (Five North), and Zhe Li (Gateway.FM). See Notes for Reviewers.
The Canton Validator Operations & Observability Toolkit (COOT) is an open-source, vendor-neutral operations stack for anyone running a Canton validator, participant, or super-validator (SV) node. It packages the operational concerns every node operator currently rebuilds in isolation — metrics collection, curated dashboards, alerting, backup/restore automation, pruning, and disaster-recovery runbooks — into a single, reproducible, documented toolkit released under Apache-2.0.
Canton is scaling rapidly as institutional participants (e.g. tokenization and settlement platforms built on Canton/Daml) onboard. Each new node operator today reinvents the same observability and operations layer: writing Prometheus scrape configs, building Grafana dashboards from scratch, guessing alert thresholds, and assembling backup and recovery procedures with no shared reference. COOT removes this duplicated effort and raises the operational reliability baseline of the whole network.
WinNode operates production validator infrastructure across 28+ networks and runs live Canton infrastructure today. This proposal turns that hands-on operational experience into a reusable public good for every Canton operator.
This proposal requests 240,000 CC across three milestones over a 9-week period (3–3–3 structure).
This is not a description-only proposal. A working prototype of the Milestone 1 surface already exists and is runnable today:
| Evidence | What it demonstrates |
|---|---|
One-command observability stack (docker compose up) | Prometheus + Alertmanager + Grafana + a Canton metrics exporter, wired and provisioned-as-code |
canton_exporter (Python) | Read-only exporter surfacing derived signals (ledger-API reachability, participant DB size and growth rate, metrics-endpoint reachability) as Prometheus metrics |
| Alerting rule library | Documented Prometheus rules with rationale for node-unreachable, ledger-API-down, runaway DB growth, and exporter-stall conditions |
| "Canton Node Health" Grafana dashboard | Provisioned-as-code dashboard populated from exporter metrics |
healthcheck.py, backup.sh, restore.sh | Operational-readiness report and consistent backup + checksum-verified restore (Milestone 2 preview) |
| Helm chart skeleton | Intended Kubernetes packaging shape (Milestone 3 preview) |
The prototype is intentionally read-only and additive: it only consumes endpoints a Canton node already exposes and never modifies node binaries, the protocol, ledger state, reward logic, or traffic accounting. The funded milestones harden and broaden this prototype into production-grade tooling with full validator/SV coverage, tested DR, and Kubernetes packaging. (The public repository URL will be added here on submission.)
Problem: Point solutions exist, but no cohesive, maintained, end-to-end operations standard does. There are individual community Grafana dashboards (e.g. the public "Canton Validator Monitoring" dashboard) and official Splice/Digital Asset backup and disaster-recovery documentation. What is missing is a single, version-pinned toolkit that ties these fragments together — exporter, curated dashboards, an alerting rule library, backup/restore automation, pruning, tested DR runbooks, and Kubernetes packaging — maintained against successive Canton/Splice releases. Today each operator stitches these pieces together independently and re-derives alert thresholds and recovery procedures from scratch. This duplicated effort raises the barrier to running a reliable node, produces inconsistent operational quality across the network, and increases the risk of outages, data loss, and missed protocol upgrades as the validator set grows.
Outcome: A single, well-documented, reproducible toolkit that a new operator can deploy to get production-grade observability and operational tooling for a Canton validator/participant/SV node in hours instead of weeks — improving the reliability and resilience baseline of the entire Canton Network.
This proposal has a single objective: deliver shared, open-source operations and observability tooling for Canton node operators. It deliberately excludes wallet, dApp, or protocol-layer work, which are separate concerns addressed by other proposals.
COOT operates entirely at the node-operations layer. It does not modify the Canton protocol, the participant/sequencer/mediator binaries, or any ledger semantics. It consumes the metrics, health endpoints, and administrative APIs that Canton nodes already expose, and packages operational best practices around them.
Components:
Operational approach: All artifacts are version-pinned to documented Canton/Splice releases, validated against DevNet and a live node, and published with reproducible build/run instructions. The toolkit is modular — operators can adopt only the dashboards, only the alerting, or the full stack.
COOT aligns with Canton's priority area of node deployment and operations and supports global synchronizer scaling by making it cheaper and safer to run reliable nodes as the validator/SV set grows. It reinforces the network's decentralization goals: lowering the operational barrier to running a node increases the number of independent, well-run operators.
Relevant standards/components consumed (read-only, no modification):
COOT does not participate in consensus, reward distribution, traffic accounting, or any protocol-level logic.
COOT introduces no protocol changes and modifies no node binaries. It is additive operational tooling, version-pinned to upstream Canton/Splice releases.
No backward compatibility impact.
COOT deliberately builds on what already exists rather than reinventing it. The relevant prior art and how COOT extends it:
| Existing prior art | What it covers | What COOT adds |
|---|---|---|
| Public community Grafana dashboards (e.g. "Canton Validator Monitoring") | Visualization of node metrics in a single dashboard | A maintained, version-pinned dashboard library spanning validator/participant/sequencer/mediator and SV/multi-synchronizer views, provisioned as code — plus the missing alerting, automation, and DR layers around it |
| Official Splice / Digital Asset backup & disaster-recovery docs | Written procedures for backup and restore | Executable, idempotent backup/restore automation with checksum-verified restore, a pass/fail readiness CLI, and tested DR runbooks derived from those procedures |
| Built-in Canton node metrics endpoints | Raw Prometheus metrics | A derived-metrics exporter for operational signals not exposed directly (ledger lag, DB growth, pruning backlog, traffic-balance trends) |
| Per-operator private ops stacks | Each operator's own glue | One cohesive, open, reusable bundle (Compose + Helm) maintained against successive Canton/Splice releases |
Where an existing community dashboard is suitable, COOT references and incorporates it rather than duplicating it. The proposal's value is the cohesive, maintained, end-to-end toolkit — exporter + dashboards + alerting + automation + DR + packaging, kept current across releases — which no single existing artifact provides today.
While milestone acceptance is tied to concrete open-source deliverables (public repos, Helm chart, dashboards, runbooks, working DevNet/live-node demonstration), the following ecosystem-health signals are tracked alongside delivery:
The portion of the ecosystem that benefits is high: every Canton node operator has these operational needs, and the toolkit is directly reusable by all of them.
Each milestone is approximately 3 weeks of engineering effort, balanced across implementation, validation against a live node, and documentation.
The Tech & Ops Committee will evaluate completion based on:
Acceptance is based on value to the ecosystem (reusable, adopted operations tooling that raises the network's reliability baseline), not solely on artifact delivery.
Total Funding Request: 240,000 CC
Total projected duration: 9 weeks (3–3–3 structure).
The project duration is under 6 months. Should the timeline extend beyond 6 months due to Committee-requested scope changes, remaining milestones will be renegotiated to account for USD/CC price volatility.
Upon release, WinNode will collaborate with the Foundation on:
COOT is released under Apache-2.0 and operated as a permanent public good.
Canton adoption is accelerating with institutional participants onboarding tokenization and settlement workloads. Network resilience depends directly on the operational quality of its validators and super-validators. Today every operator rebuilds the same observability and operations layer from scratch, producing inconsistent reliability and unnecessary risk.
Roughly 100% of Canton node operators face these operational needs, and COOT is directly reusable by all of them. By turning a leading multi-network operator's real production experience into shared open-source tooling, this proposal raises the reliability and resilience baseline of the entire network and lowers the barrier to running a well-operated node — directly strengthening Canton's decentralization and scaling goals.
The right approach is shared, open operational tooling rather than another per-operator private stack. Most ecosystem operators already use Prometheus/Grafana/Alertmanager and Kubernetes; COOT builds on these standard, widely-adopted tools rather than introducing a novel framework, so it composes with operators' existing stacks instead of replacing them.
This proposal deliberately extends and observes existing components (Canton/Splice node topology, CIP-0104 cost fields, the synchronizer upgrade process) rather than forking or modifying them — all artifacts are additive and version-pinned. WinNode is uniquely positioned to deliver this credibly, operating validator infrastructure across 28+ networks and running live Canton nodes today.
Alternatives considered:
An open-source, vendor-neutral toolkit that builds on existing prior art is the approach that maximizes shared ecosystem value.
Rebuilt from the recorded board moves (complete history). get_dev_fund_lifecycle(number) gives the same in the MCP.