NorthStar sessions are single-tenant by design. Each session is its own isolated execution context, with its own slot cadence, its own fee schedule, and atomic settle-back to Solana. Rollup-as-a-service products give you a shared chain you operate on; NorthStar gives you your own chain on demand, then takes it back.
When a session closes, the Portal program treats the commit of all delegated accounts as one multi-write operation. Either every account's final ER state lands on L1, or nothing changes. See settle-back guarantees and the security model.
The agent-sandbox primitive: an autonomous agent (AI or deterministic) runs inside a session that has hard limits on which accounts it can touch, how long it can run, and how much it can spend on fees. If any limit is reached, the session terminates and accounts settle back. No surprise bills, no escaped writes, no rollback drama.
Devnet is live today (current page is documentation against devnet). Q2 2026 is the tentative rollout timeline for Mainnet.
If the program ships a delegate_to_portal hook on its writable accounts — yes. If not (e.g. Jupiter, Raydium), the program itself can't be delegated, but you can still use NorthStar to separate the agent's reasoning (in the session, against delegation-aware programs) from external execution (on L1, via standard composability). See the Mach Sandbox architecture for the canonical example.
A session is a rollup — but a single-tenant, ephemeral one. It's a private execution context that exists for the session's TTL, then ceases to exist. The closer mental model is "rent a private chain for an hour" rather than "deploy on a chain that lives forever."
The mature platform's capability is sub-perceptual confirmation (think milliseconds). Today's deployed devnet path measures higher because the validator's slot duration defaults to 50ms. Per-session slot duration overrides + an SDK helper for TPU-direct submission are tracked in the pipeline. See Real-time confirmation for the architecture.
Session accounts force-undelegate; final ER state settles to L1. The session PDA stays on chain (Portal doesn't currently expose CloseSession to free it). If you re-open at the same grid_id, you'll need a different grid_id or a fresh owner keypair (the per-owner fee_vault is shared, and Portal's current OpenSession doesn't reuse it).
Each session opens with a FeeStructure parameter — pick the fee level, pick the fee token, pick the operator's revenue split. See Programmable Economics for the schema.
Issues + bug reports: github.com/mirrorworld-universe.
Architecture questions: this docs site.
Roadmap visibility: the public Linear project linked above.
Last updated
