Radix Week in Review: A Post-Quantum Signature Lands in the New Engine

The week in brief

• The new Hyperscale virtual machine gained ML-DSA-65, a signature scheme designed to survive quantum computers; 33 minutes later the consensus layer could sign and verify with it.
• It is the third scheme a Radix account can use, and an account can adopt it without changing its address.
• Most of the week's 206 commits changed what holding a key entitles you to: a key signs you in, and a badge opens the guarded parts of an account.
• The DAO's transition council broke a 34-day silence: the Foundation has approved the operating agreement and paid the second grant instalment, so nothing waits on the Foundation now.
• The DAO's site now records a fingerprint of each governance document on the ledger, so any member can check their own copy is the one that was voted on.
• All 24 of those documents are still drafts, and nobody has called the first vote.

At 02:45 UTC on Sunday the new virtual machine registered ML-DSA-65 among the signature schemes a Radix account may use, and half an hour later the consensus layer could sign and verify transactions with it.

A signature scheme is the mathematics that lets you prove you authorised something without revealing your key. The ones in use today, including the two Radix accepts, rest on a problem that a large quantum computer would be good at solving. ML-DSA rests on a different one, based on lattices, that quantum computers are not known to break; the United States standards body published it as FIPS 204, and the 65 names the middle of its three parameter sets.

Babylon accepts two schemes today: Ed25519, and the secp256k1 it inherited from Olympia, the first version of Radix. This makes a third. It matters that an account can switch without moving, and it can, because the mechanism that changes an account's rules leaves the key that originally named it alone. Governance could retire the older schemes if a quantum computer ever looked close, and the developer's sketch of how to do that safely was to let a legacy account change its rules and do nothing else, so the only remaining move is the safe one.

The channel immediately compared it to a NEAR announcement from the same week. The lead developer played it down: post-quantum work belongs to no milestone because it cuts across all of them, and signing a transaction is the easy part. The hard part is the consensus layer's own signing and verification, which pulls in zero-knowledge proofs and hash-based schemes. One consequence is worth marking for anyone holding an old account: addresses may change at the upgrade whatever scheme they use, because the sharded design gives an account and its vaults a single shared prefix, where today they scatter across the shard space and every transaction touching them drags in extra shards.

A key gets you in; a badge opens the safe

Sixty-three commits landed in the virtual machine this week and 143 in the consensus layer around it, and nearly all of the first group answer one question: what makes a call allowed?

Most of this industry answers that the signature is the authority, so signing with the right key opens every door in the account. Radix has never quite worked that way. It treats permission as a thing you hold: an account holds a badge and presents it inside the transaction, where the rest of the network can watch it do so. A commit on Wednesday states the new rule in a line: a signature signs you in and nothing more; guarded methods take badges.

The pieces arrived in order. On Tuesday the engine learned to express an authority rule as a threshold over identities, such as two of these three or any one of those, and to mint an account's identity as evidence later calls must present. On Wednesday an account's stored rule became the thing that governs who may act on it, so the key that first named the account no longer decides. Two more landed the same day: a recovery arrangement with three roles and a timed proposal, so a lost key costs the owner time rather than the account; and a rule making simple possession of a badge a third way to prove you may act. Stake pools were given owner badges at the start, and the operator interface now refuses anyone who cannot show one. The same idea underpins ROLA, which is how a wallet proves who holds it to a website without a transaction.

The consensus layer spent the same days demanding paperwork at every seam: a shared verdict binds a transaction's payer before anything is charged; a shard refuses a payer the transaction never bound to it; effects do not settle until every participating shard presents its certificate; and a node that lacks code a step depends on waits until it has fetched it.

Thirty-four days, then an update

On Wednesday a long-standing member of the main channel counted the days since the transition council had last told the community anything, and asked the question the council's own name invites: can the people it is accountable to understand the current state, the risks and the next steps without chasing it? The argument ran for two days and was the most-read thing in the ecosystem that week. One side held that five volunteers doing legal work in their evenings owe nobody a weekly report, and that shaming them is how you ensure nobody stands for the next council. The other held that a role with accountability in its title carries a minimum. Both sides argued in good faith about a real gap, and in the meantime two people outside the council, Timan and Daffy, published more about the DAO's machinery in a week than the council had in a month.

The council posted on Thursday. The Foundation has validated the proposed operating agreement and agrees it fits the goal of handing over the assets it holds; the second instalment of the setup grant has arrived, so the council can pay its expenses; and nothing now waits on the Foundation. Counsel expected to file the formal application within days. The charter is close to final, a vote will ratify it at a deliberately high threshold, and at least seven people intend to stand for the seven permanent seats.

Twenty-four documents, none in force

The machinery for checking those documents shipped on Friday. When a proposal activates a governance document, the DAO's site publishes it as a PDF and the proposal records the document's SHA-256 fingerprint on the ledger; the site then republishes that fingerprint. A member can hash their own copy and confirm it matches the file the DAO actually voted on. Superseded fingerprints are kept on purpose, so someone holding an old version learns that their copy is genuine but out of date rather than unrecognised, and nobody types a fingerprint by hand: the publishing process downloads the PDF, hashes it and cross-checks the result.

Twenty-four documents sit there across ten categories, and every one reads pending. Nothing is in force, and nobody has called the first vote, which is the ratification of the charter. The verification page tells the same story on the ledger: the governance contract, the master badge, the owner badge and the governance package are all live and linked, XRD is the resource that carries voting power, and the DAO has yet to deploy any of its five treasury accounts.

The smaller work continued around it. The framework tightened its election rules against edge cases and added a compensation regime for contributors with requests, renewals and challenges. Majority Judgment, in which every voter grades every candidate and the best median grade wins, became the default election method. The on-chain addresses moved into the charter itself, so they change only when the charter changes. The governance repository still sits under a personal account and is due to move to the DAO's own organisation, and radixdao.org now stands as the interim official venue.

The week on the ledger

Read from the Radix Gateway as the ledger stood at midday on 16 August 2026, epoch 335,465, against the same reading a week earlier.

Stake up 22 million XRD, and for the first time in this series no fee changes at all were queued on the ledger.

Concentration watch

Eight validators held a third of all staked XRD, unchanged, and 15 held half.

This week on the wiki

Radix governance for how the charter, the council and the contract fit together, and hyperscale-rs for the engine work underneath the signature scheme.

What to watch

• The first vote being called, which would be ratification of the charter and the first thing the governance contract has ever processed.
• The formal incorporation application, which counsel expected to file within days.
• Whether the governance repository moves off a personal account and onto the DAO's own.

Corrections

Nothing this week.

Next: whether anyone calls the first vote, and whether the incorporation application actually goes in.

Radix Week in Review series, Issue #8: ← Previous: Issue #7, Aug 3–9, 2026 · Next: Issue #9, Aug 17–23, 2026 → · All recaps · Subscribe

Previously: The Rust rebuild finished its first milestone, the execution engine that sits on top of it became public code, and Scrypto survives the change.