Opened 12-03-2026 by waynecollier-da, last activity 6mo ago
Proposal file:
Link to the proposal added in this PR (e.g., /proposals/your-proposal-name.md)
Briefly describe the proposal and the value it delivers to the Canton ecosystem (2–3 sentences).
/proposals/(Add anything the Tech & Ops Committee should pay attention to.)
Showing 1 to 6 of 6, oldest first.
**Topology Freeze:** A mechanism to temporarily prevent topology changes on the synchronizer around the time of the upgrade.
**Successor Announcement:** A new topology mapping LsuSequencerSuccessor allowing the existing synchronizer to point securely to its successor.
**Read-Only Mode:** Sequencers on the existing synchronizer will reject new submissions but allow time proofs to facilitate an orderly exit.
**Client-Side Logic:** Validator nodes will manage a Registering state to ingest the genesis topology of the new synchronizer while still connected to the old one.
| Estimated Delivery | Month 2 after announcement of approval of this proposal |
|---|---|
| Focus | Building the foundational data structures and topology transactions. |
Deliverables:
| Estimated Delivery | Month 3 |
|---|---|
| Focus | Connecting the pieces to allow a successful migration under ideal conditions. |
Deliverables:
| Estimated Delivery | Month 4 |
|---|---|
| Focus | Crash recovery, unhappy paths, and security hardening. |
Deliverables:
| Estimated Delivery | Month 6 |
|---|---|
| Focus | MainNet Physical Synchronizer, and at least 90 percent of Validators, successfully upgrade, retaining all history and cryptographic evidence, while halting Daml transactions for less than three minutes. |
Deliverables:
Operational Handover & Ongoing Maintenance
Upon the successful completion of Milestone 4, day-to-day maintenance of the ISS-based BFT repository (including security SLAs, bug fixes, CI/CD pipeline management, and external PR reviews) will seamlessly roll into the purview of Digital Asset’s proposed 2026-Maintenance Grant for Daml Open Source.
| Author | Wayne Collier, Digital Asset |
|---|---|
| Status | Proposal |
| Created | 2026-03-05 |
This proposal requests funding to design, implement, and release "Logical Synchronizer Upgrades" (LSU) for the Canton protocol. This will make it possible for the Global Synchronizer to upgrade from one protocol version to another while continuing to process Daml transactions, with only a few seconds to a few minutes of noticeable downtime.
LSU introduces an abstraction layer distinguishing between a Logical Synchronizer (the persistent identity of the synchronizer) and a Physical Synchronizer (the set of synchronizer nodes running a particular protocol version). This allows for rolling migrations where a new version of a synchronizer spins up alongside the old one. Validators can upgrade to the new version of Canton in advance, at their own pace, and then link seamlessly to the upgraded synchronizer, preserving all transaction history and cryptographic evidence. This approach will also substantially reduce the need for coordination among network participants, with automation and asynchronous activity largely replacing a coordinated joint effort by Super Validator and Validator node operators.
This solution will allow the Global Synchronizer to adopt improved Canton protocol versions even as it continues to scale in size and throughput.
As the Canton Network scales, the requirement to halt transaction processing to perform protocol upgrades becomes increasingly untenable. The current "dump and restore" methodology presents several critical issues:
Downtime: It requires global coordination to stop all activity.
Complexity: The operational burden on node operators to export/import data is high.
Risk: "Hard" migrations introduce opportunities for data corruption or operator error during the manual transition phase.
The objective is to deliver a production-ready implementation of Logical Synchronizer Upgrades in the Canton Open Source repository.
The technical scope includes:
Identity Abstraction: Decoupling the Logical Synchronizer ID (LSId) from the Physical Synchronizer ID (PSId).
Migration Orchestration: Implementing "Killswitch/Tombstone" logic to freeze the old synchronizer and automatically redirect traffic to the successor.
Automated Handover: Enabling Validator nodes to detect the upgrade announcement, pause submission, switch connections, and resume processing on the new protocol version automatically.
Security: Ensure monotonic time across the migration, prevent replay attacks between physical instances, and enforce deduplication of transactions across the physical synchronizers.
Topology Freeze: A mechanism to temporarily prevent topology changes on the synchronizer around the time of the upgrade.
Successor Announcement: A new topology mapping LsuSequencerSuccessor allowing the existing synchronizer to point securely to its successor.
Read-Only Mode: Sequencers on the existing synchronizer will reject new submissions but allow time proofs to facilitate an orderly exit.
Client-Side Logic: Validator nodes will manage a Registering state to ingest the genesis topology of the new synchronizer while still connected to the old one.
Based on the execution plan, the project is divided into four distinct milestones over a 6-month period.
| Estimated Delivery | Month 2 after announcement of approval of this proposal |
|---|---|
| Focus | Building the foundational data structures and topology transactions. |
Deliverables:
| Estimated Delivery | Month 3 |
|---|---|
| Focus | Connecting the pieces to allow a successful migration under ideal conditions. |
Deliverables:
| Estimated Delivery | Month 4 |
|---|---|
| Focus | Crash recovery, unhappy paths, and security hardening. |
Deliverables:
| Estimated Delivery | Month 6 |
|---|---|
| Focus | MainNet Physical Synchronizer, and at least 90 percent of Validators, successfully upgrade, retaining all history and cryptographic evidence, while halting Daml transactions for less than three minutes. |
Deliverables:
Operational Handover & Ongoing Maintenance
Upon the successful completion of Milestone 4, day-to-day maintenance of the ISS-based BFT repository (including security SLAs, bug fixes, CI/CD pipeline management, and external PR reviews) will seamlessly roll into the purview of Digital Asset’s proposed 2026-Maintenance Grant for Daml Open Source.
The Tech & Ops Committee may evaluate the completion of the grant based on the following:
Demonstration: A live or recorded demo showing a Canton network upgrading protocol versions while a load generator runs, showing zero data loss and minimal interruption.
Code Quality: All code merged into the open-source repository with appropriate unit and integration test coverage.
Documentation: Updated operator manuals explaining how to trigger an LSU and how to configure nodes for auto-migration.
Security Audit: Complete and deliver an internal security audit.
Funding Request: 12,000,000 Canton Coin (CC).
Payment Schedule:
| Milestone | Amount (CC) | Trigger |
|---|---|---|
| 1 – Core Primitives & Topology | 2,000,000 | Committee acceptance of deliverables |
| 2 – E2E Happy Path Orchestration | 2,000,000 | Committee acceptance of deliverables |
| 3 – Production Readiness & Release | 2,000,000 | Final release and committee acceptance |
| 4 – Successful upgrade on MainNet | 6,000,000 | Second successful upgrade on MainNet |
Baseline total payment 12,000,000 Canton Coin (CC).
We propose an incentive model that incentivizes early delivery while respecting the Foundation’s need for budget predictability, allowing a bonus payment of up to an additional 20% more than the original project total payment.
| Early Completion | Bonus Percentage | Bonus Amount |
|---|---|---|
| Final delivery 1 month ahead of schedule | 10% | 1,200,000 |
| Final delivery 2 months ahead of schedule | 20% | 2,400,000 |
In case the project delivers its final milestone later than the predicted timeline, the final payment will be reduced each month by 10 percent of the nominal project total for the first four months after the original planned completion date, then holding at 10% of the baseline total, resulting in a final payment of just 10% of the total proposal for the final milestone if delivered more than four months after the original proposed completion date.
As this project is expected to complete within 6 months, the grant is denominated in fixed Canton Coin. We propose that if the project timeline extends beyond 6 months due to requested scope changes by the Committee, the remaining un-minted milestones must be renegotiated to account for any significant USD/CC price volatility.
Upon the release of Logical Synchronizer Upgrades, Digital Asset will collaborate with the Foundation on:
The proposed LSU approach allows the Canton protocol to evolve and fix bugs in the ordering layer without disrupting the application layer. It ensures that Synchronizers can operate as true "commodity" infrastructure—upgradable and maintainable without application developers or end-users needing to be aware of the underlying topology shifts.
By implementing Logical Synchronizer Upgrades (LSU), we lower the barrier to entry for protocol improvements. This ensures that the Canton Network can evolve rapidly without the "fear of upgrade" that plagues many distributed ledger networks. It transforms an upgrade from a high-stakes, manual crisis management event into a routine, automated operational procedure.
The core technical concept proposed in this design is the separation of the Logical Synchronizer (the persistent identity and history of the domain) from the Physical Synchronizer (the infrastructure running a specific protocol version). Currently, the identity of a synchronizer is tied to its physical instantiation. When the protocol changes, the identity changes, forcing applications and Validators to "re-learn" the network topology. This proposal introduces an abstraction layer where:
In the current model, a synchronizer upgrade requires out-of-band coordination between the Super Validators (to agree on a halt time) and every single Validator Node (to prepare for the new connection). This manual coordination is prone to human error and leaves slower Validators stranded. LSU moves this coordination on-chain. The "Successor Announcement" and "Killswitch" topology transactions allow the protocol itself to orchestrate the migration. This ensures that Validators can detect, prepare for, and execute the migration automatically, drastically reducing the support burden on the Foundation and Super Validator operators.
Rebuilt from the recorded board moves (complete history). get_dev_fund_lifecycle(number) gives the same in the MCP.