At NexTrium, we don't write protocol logic on top of a technology we haven't actually built something real with first. That's the principle behind our validation repo, a series of small, deliberately isolated technical exercises where we pick up each piece of Zivana Protocol's intended stack and ask one question, does this actually work the way we need it to, for what we're about to build?
This piece covers the most consequential of those exercises so far, our validation of Midnight, the privacy-focused blockchain that Zivana's Trust Score primitive is designed to run on.
Why Midnight matters to Zivana
Zivana is built around five primitives, Identity, Trust Score, Covenant, Distribution, and Intelligence, that together let people in Africa's informal economy build a portable, verifiable record of economic trustworthiness without first being forced into the formal systems that have historically excluded them. Trust Score is the primitive responsible for that record itself, a composable reputation calculation that accumulates across every application on the protocol, where the underlying value stays private, but specific facts about it, such as whether it clears a given bar, can be verified by anyone who needs to.
That's a genuinely hard requirement. Most blockchains are transparent by design; every transaction, every balance, every counterparty is visible to anyone who looks. That's a feature for some use cases and a dealbreaker for others. A trader in Lagos shouldn't have to expose their full reputation history to the entire internet just to prove, to one counterparty, that they meet a minimum standing requirement.
Midnight, built by Input Output Global as Cardano's first partner chain, is designed specifically for this. It reached mainnet in March 2026 with serious institutional backing, Google Cloud, Vodafone, and major banks already running validator nodes or piloting confidential settlement use cases. Its core idea, which IOG calls "rational privacy," is that sensitive data, a balance, a counterparty, a reputation score, can stay private by default, while a participant can still prove specific facts about that private data to whoever needs to verify them, without revealing anything else. That's almost exactly the shape of what Trust Score needs.
"Almost exactly" is doing some work in that sentence, though, and that's precisely why we validated it in isolation before building anything real on top of it.
What we actually built
Rather than read documentation and assume it would work, we built a small, complete, working privacy circuit on Midnight, what's called a proof-of-threshold. The idea, a participant proves they have a trust score above a required minimum, without ever revealing what their actual score is. This is close to the smallest real version of Trust Score's core capability that we could build and actually test.
We didn't stop at one threshold. We extended it to support two separate tiers, proving you clear either a 500 point bar or an 800 point bar, your choice, still without revealing your actual score, because Trust Score will eventually need more than one bar to clear, and we wanted to know now, not later, whether that extension was straightforward or would surface hidden complexity.
Both versions work. We deployed them to a real local Midnight environment, generated real cryptographic proofs, and verified them, confirming at every step that the private value never left the machine generating the proof. That's the headline result, the privacy model itself holds up. The thing Zivana needs Midnight to be able to do, it can do.
What it actually took to get there
This is the part of the validation that's arguably more valuable than the headline pass, and it's the part we want to be candid about rather than gloss over.
Midnight is young, genuinely cutting-edge technology, and building on it right now means being an early adopter of tooling that is still maturing. Over the course of this validation, we ran into eight distinct, real technical issues; version mismatches between documentation and the live toolchain, privacy rules in Midnight's contract language that are stricter (and smarter) than they first appear, a wallet synchronization quirk that looked like a bug for the better part of an hour before we proved, with hard data, that it was just a slow but healthy process, and one classic concurrency bug in our own test setup that taught us something we'll carry into how we structure every future validation in this repo.
None of these were dealbreakers. All of them were solvable. But each one represents real engineering time that a team building directly on top of Midnight, without first doing this kind of isolated validation, would have hit unexpectedly in the middle of building actual protocol logic, a far more expensive place to discover them.
That's the whole point of validating in isolation first.
Where things stand
The core privacy mechanism, prove a fact about private data without revealing the data, works, and we've now proven it twice; once with a single threshold, once with two. We're currently extending that same validation to Midnight's public test network, the step before anything touches a live, value bearing environment, and we'll report back on that once it's complete.
For the technically curious, the specific bugs, the exact fixes, the real compiler output, and the full working code are all documented in the open in our validation repository on GitHub. We built this validation precisely so that anyone, on our team or off it, can verify our findings rather than take our word for them.
Why this approach
We could have started writing Trust Score's protocol logic directly against Midnight from day one and discovered these issues as we went. We chose not to, because the cost of discovering a fundamental tooling or design constraint after you've built a few thousand lines of protocol logic on top of a flawed assumption is far higher than discovering it in a two-week isolated exercise designed to find exactly that kind of thing.
That's the discipline behind every folder in our validation repo, proving the primitive works, on its own, before it has to carry the weight of the protocol.
Join us today to build publicly with us.
Official website
Join other contributors
X