From e87d9f4def673a641732c034347f7ec28002954c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 12 Jun 2026 17:59:51 +0000 Subject: [PATCH 01/15] docs: add PULSE recurrent unilateral-exit protocol design Protocol design for standing unilateral exit from open-membership pool contracts (recursive covenants anyone can spend cooperatively), where the current N-of-N CHECKSIG exit variant cannot work because membership is dynamic and unbounded. Core mechanism: every cooperative state transition (pulse) pre-signs an exit lattice paying out all members under a sign-once ephemeral epoch key, so the exit leaf becomes a constant-size single-key script. Stale states die by chain-extension dominance; passive members are protected by operator continuity attestations, data-availability commitments, and a federation-held equivocation bond. Includes ELI5, interactivity matrix, full ceremony spec, 13-finding attack appendix, proposed compiler surface (future work; gated zones untouched), and CTV/APO/CSFS upgrade path. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 388 +++++++++++++++++++++++++++++++++++ 1 file changed, 388 insertions(+) create mode 100644 docs/recurrent-exit-pulse.md diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md new file mode 100644 index 0000000..335819b --- /dev/null +++ b/docs/recurrent-exit-pulse.md @@ -0,0 +1,388 @@ +# PULSE — Recurrent Unilateral Exit for Emulator-Enforced Pools + +**Pooled Unilateral-exit via Lattice State Epochs.** + +A protocol for giving open-membership pool contracts on Arkade a *standing* unilateral +exit, enforced by recurrent state updates between the transacting parties. This document +is a design specification: it defines the protocol lifecycle, the trust model, the +attack analysis that shaped it, and the compiler surface that would standardize it. It +proposes no code changes; the compiler-facing sections are future work. + +Cross-references: [`options.md`](./options.md) (two-tapleaf model, exit/renew options), +[`bonds.md`](./bonds.md) (pool covenants and today's exit asymmetry), +[`arkade-primitives-spec.md`](./arkade-primitives-spec.md) (recursive covenants, +emulated introspection). + +--- + +## 1. ELI5 + +The pool is a **group piggy bank held at a bank** (the Arkade Operator). + +- Every time anyone deposits, withdraws, or trades, the people doing *that* transaction + sit down with the bank and **rewrite the fire-escape plan**: a stack of pre-signed + cheques that says exactly who gets what if the bank ever disappears. Anyone can take + those cheques to the blockchain and cash them — no bank needed. +- The pens used to sign the cheques are **destroyed immediately after signing** + (ephemeral keys), so nobody can ever write a *different* set of cheques for that + version of the piggy bank. +- The bank also publishes a **notarized balance snapshot of everyone** — not just the + people transacting — every single time, and posts a **security deposit**. Getting + caught signing two contradictory documents is mathematical proof of cheating and + forfeits the deposit. +- You never have to show up when other people transact. Your escape cheque is kept + current by whoever *is* in the room, and a **watchdog service** can cash it for you + if the bank goes dark. +- Periodically (the **heartbeat**), the whole arrangement is refreshed on the actual + blockchain, like renewing a lease. That is the "recurrent" rhythm: many off-chain + **pulses** between on-chain heartbeats. + +--- + +## 2. Motivation: the gap in today's exit compilation + +Every non-internal Arkade function compiles to two tapleaves: + +1. **Cooperative leaf** — user signatures plus introspection opcodes (`tx.outputs`, + asset groups, recursive covenants via `new Self(...)`), terminating in + ` OP_CHECKSIG`. Introspection is *emulated*: the Operator + validates the transition off-chain and refuses to co-sign invalid ones. On L1, the + only thing consensus enforces on this path is the signature set. +2. **Exit leaf** — pure Bitcoin Script: an **N-of-N CHECKSIG chain over every pubkey + named in the constructor and function parameters**, plus + ` OP_CHECKSEQUENCEVERIFY`. + +This works for closed contracts with a fixed cast. It **collapses for open-membership +pools** — recursive covenants that anyone can spend cooperatively (AMMs, lending pools, +the repayment pool in `bonds.md`): + +- Membership is dynamic and unbounded, so the N-of-N exit leaf names either the wrong + parties or nobody. +- Today, pool exits are only *transient by construction*: a cooperative redemption + phase drains funds to per-holder single-sig VTXOs, each of which has a clean exit. + That guarantee exists only while the Operator cooperates. +- **A passive pool member — someone whose balance hasn't changed in weeks — has no + standing unilateral exit at all.** + +PULSE closes this gap. + +## 3. Design principles + +1. **Transactor-borne interactivity.** Exit enforcement is refreshed by *the + transacting parties + the Operator only*. Whoever moves funds pays the coordination + cost; passive members never sign anything after they join. +2. **State-aware data availability.** Every pool state and its exit artifacts are + published and committed on-chain, so anyone — watchtowers, new depositors, third + parties — can verify the latest state and act on it (including broadcasting someone + else's exit). +3. **Finality on state updates, not on new on-chain outputs.** A pool transition is + final when its pulse ceremony completes, decoupled from block production. +4. **Bounded lifetime.** The pool's `renew` expiry forces a recurrent on-chain refresh + (the heartbeat), which resets exit cost and re-protects the full membership. + +## 4. Vocabulary + +| Term | Meaning | +|---|---| +| **Pool VTXO `U_k`** | The pool's virtual UTXO at epoch `k`, holding the aggregate funds | +| **State table `S_k`** | The full balance table at epoch `k`: every member's `(memberPk, balance)` | +| **Pulse** | One off-chain cooperative state transition `S_k → S_{k+1}`, consuming `U_k`, producing `U_{k+1}` | +| **msg.senders `M_k`** | The parties whose balances change in pulse `k` (online by definition; typically 1–2) | +| **Transition tx `T_k`** | The plain, fully-signed, broadcastable transaction implementing pulse `k` | +| **Epoch key `P_k`** | MuSig2 aggregate of *ephemeral, sign-once* keys of `{Operator} ∪ M_k`. Passive members are **never** in the aggregate | +| **Exit lattice `L_k`** | Fully pre-signed splitting tree spending `U_k`'s exit leaf into one slot per member, per `S_k` | +| **Slot** | A lattice leaf output: `SingleSig(memberPk)` with the member's own exit CSV | +| **Continuity attestation `A_k`** | Operator-signed Schnorr over the Merkle root of the *full* table `S_k` | +| **Pulse commitment `h_k`** | `H(h_{k-1} ‖ S_k ‖ txid(T_k) ‖ root(L_k) ‖ A_k)`, co-signed by Operator + threshold of `M_k`, committed in the Operator's next on-chain batch | +| **Heartbeat** | A pulse whose transition tx lands on-chain, re-anchoring the pool tip with a freshly built full lattice | +| **Δ (`exit`)** | The exit leaf's relative timelock — the contest window | +| **`renew`** | The pool's absolute expiry, after which the Operator's sweep path eventually matures | + +## 5. Interactivity requirements + +| Role | Signs | Online when | Notes | +|---|---|---|---| +| **Passive member** | **Nothing after deposit** | Own deposit/withdraw only | Must *retain* exit artifacts (or delegate to a watchtower); interactivity is borne by transactors | +| **msg.senders** | Lattice + transition + `h_k`, in **one ceremony** (two MuSig2 rounds, one network round-trip) | Their own transaction | Typically 1–2 parties | +| **Operator** | Every pulse + attestation + commitment | Always-on | Absence ⇒ freeze ⇒ everyone exits via lattices | +| **Watchtower** | Nothing (lattice is fully pre-signed) | Monitoring only | Can broadcast *anyone's* exit; non-custodial; delegable | +| **Heartbeat participants** | Operator + that pulse's msg.senders only | — | Passive members are **not** needed at heartbeats | +| **Genesis** | Operator only, if the pool starts empty and members join via deposit pulses | — | **No all-hands N-of-N ceremony ever exists** | + +## 6. The exit leaf + +The compiler-visible, standardized artifact. For a `recurrent` pool, the exit variant +emits — instead of the N-of-N CHECKSIG chain: + +``` + OP_CHECKSIG OP_CHECKSEQUENCEVERIFY OP_DROP +``` + +- `` is the epoch key `P_k` for the pool VTXO of that epoch. Constant size, + regardless of membership. +- The **only possible spend** of this leaf is the pre-signed lattice root: the + ephemeral keys behind `P_k` are deleted after signing, making the lattice a + *de-facto covenant*. +- The CSV `Δ` is the **contest window**: transition transactions carry no delay, so + anyone holding a newer signed transition can extend the chain on-chain, consuming + `U_k` and voiding a stale lattice. This *chain-extension dominance* replaces + revocation/punishment for the stale-state case. (It does **not** defend against a + fresh colluding theft — see §9 and finding A5.) + +## 7. Protocol lifecycle + +### 7.0 Genesis (D0) + +1. The Operator posts the per-pool **bond** (§9), sized to at least + `requiredCoverage(initialTVL)`. +2. The pool contract is deployed: an open-membership recursive covenant whose + cooperative path the Operator emulates, with `recurrent` exit mode. +3. Preferred genesis: **start empty**. The first members join via ordinary deposit + pulses, so no all-hands ceremony exists. (If a pre-seeded genesis is used instead, + every genesis member must be online once to co-sign `L_0`.) +4. The Operator publishes `h_0` co-signed per §7.1 step 6 and anchors `U_0` in a batch + transaction. + +### 7.1 Pulse ceremony (D1) — atomic; order is load-bearing + +A pulse either completes fully or is abandoned, leaving the pool on `U_k`, whose +lattice is already valid. + +1. **Propose.** A transition `T_{k+1}` is proposed, changing only the msg.senders' + balances. The Operator emulates the contract's introspection covenant against it. + `S_{k+1} = S_k` with only `M_{k+1}` slots changed. +2. **Attest.** The Operator signs the continuity attestation `A_{k+1}` over the Merkle + root of the *entire* `S_{k+1}` — every member, not just msg.senders. One Schnorr + signature; O(1) on-chain footprint; O(log N) inclusion proofs per member. +3. **Lattice first.** The parties build and MuSig2-sign `L_{k+1}` under + `P_{k+1} = MuSig2(Operator, M_{k+1})`: + - Root spends `U_{k+1}`'s exit leaf; the tree splits into per-member slots + (`SingleSig(memberPk)` + the member's own exit CSV). + - **Dedicated per-claimant anchor outputs** (P2A) on every node; TRUC (v3) + transaction topology; lattice txs are non-RBF — fee bumping is anchor/CPFP only. + - Balances below the 330-sat taproot dust floor are aggregated into a single + **cooperative-only dust slot**. + - If any signer aborts here, the **pulse is abandoned**; no keys are deleted; the + pool stays on `U_k`. + - *Honest cost note:* SIGHASH_ALL means a txid cascade — any change at the root + re-invalidates every descendant, so the **whole O(N)-tx lattice is re-signed each + pulse**. This is O(N) compute/bandwidth for the 2–3 signing parties (batchable in + one network round) but **O(1) interactivity**. The scaling valve is two-tier + sharding: frequent pulses update a small "hot band" sub-pool; the periodic + heartbeat folds it back into the full lattice. +4. **Verification gate.** Each msg.sender verifies, *before releasing anything*: + - (a) its own slot value in `L_{k+1}`; + - (b) **every passive slot equals the `S_k` carry-forward**, Merkle-checked against + `A_{k+1}`; + - (c) the Operator bond still covers the pool's passive TVL (§9); + - (d) **its own lattice branch is in its hands** — *"no lattice in my hands, no + pulse."* Publication to the relay mesh alone is never trusted. +5. **Transition signing.** Only now do Operator + msg.senders sign `T_{k+1}` + (SIGHASH_ALL, nSequence final). +6. **Commit.** `h_{k+1}` is **co-signed by the Operator + a threshold of `M_{k+1}`** + (so the Operator cannot unilaterally author forks) and committed in the Operator's + next on-chain batch transaction. Full artifacts `(S_{k+1}, T_{k+1}, L_{k+1}, + A_{k+1})` go to the relay mesh, content-addressed by `h_{k+1}`. **The next pulse is + invalid until `h_k` is on-chain** — a chained dependency that turns commitment + withholding into a *visible liveness fault* that trips auto-exit (§7.4). +7. **Delete ephemerals** — only after all parties confirm artifact storage. This is + hygiene, *not* a trust anchor: deletion is unprovable; the real guarantee is + equivocation detection (§9). + +**Who signs what:** + +| Artifact | Signers | +|---|---| +| `T_{k+1}` (transition) | Operator + `M_{k+1}` | +| `L_{k+1}` (lattice) | `P_{k+1} = MuSig2(Operator, M_{k+1})`, **before** `T` is signed | +| `A_{k+1}` (full-table attestation) | Operator alone (its honesty is bonded) | +| `h_{k+1}` (commitment) | Operator + threshold of `M_{k+1}` | + +### 7.2 Heartbeat (D2) — there is no cheap operator-only re-anchor + +A forced design finding: re-anchoring `U_k` under a new on-chain output changes its +outpoint, and every pre-signed signature (the transitions *and* the lattice) commits to +the old outpoint under SIGHASH_ALL. Re-signing would require the deleted ephemeral +keys. Therefore, **without `SIGHASH_ANYPREVOUT`, the heartbeat must itself be a +cooperative on-chain pulse**: + +- A full pulse ceremony whose `T` lands on-chain, with a **complete lattice rebuild + over all of `S_k`** under a fresh epoch key. +- It resets virtual-chain depth (unilateral exit cost is bounded by *pulses since the + last heartbeat* plus one lattice branch) and re-protects every current member. +- The Operator cannot heartbeat unilaterally; it can only propose one. Cadence is + quorum- and economics-gated: required frequency rises with pool TVL so that + **at-risk-per-epoch stays ≤ the Operator bond** (§9). + +### 7.3 Unilateral exit walk (D3) + +1. A watchtower (or the member) triggers on any of: a **missed `h_k` commitment**, + `height ≥ renew − Δ − margin`, or a **conflicting published artifact**. +2. Broadcast the chain tip if needed (any unconfirmed transitions since the last + heartbeat), then the **lattice root**, spending `U_k`'s exit leaf after the Δ + contest window. +3. Broadcast the member's **branch path** (log N transactions), CPFP-bumping via the + dedicated anchors. +4. After the slot's own CSV matures, sweep `SingleSig(memberPk)` to a wallet. + +### 7.4 Expiry (D4) and the timelock ordering invariant + +The Operator's renew-sweep must mature strictly after exits can complete: + +``` +sweepDelay ≥ Δ + margin (compiler rejects violations) +``` + +making the window `[renew − Δ − margin, renew + sweepDelay)` **lattice-exclusive**: the +sweep can never consume `U_k` out from under an in-flight exit. `margin` scales with +lattice depth (log N confirmation time) plus a fee-spike buffer. Wallets and +watchtowers auto-exit if the pool has not heartbeat by `renew − Δ − margin`. + +## 8. Invalidation model + +| Threat | Mechanism | Nature | +|---|---|---| +| **Stale lattice broadcast** (old epoch's exit) | Chain-extension dominance: transitions have no CSV, exits wait Δ; any holder of a newer `T` extends the chain and voids the stale lattice | Trustless race the honest side structurally wins | +| **Commitment withholding / forks** | Chained `h_k` dependency + co-signed commitments: a skipped commitment stalls the pool visibly and trips auto-exit; a forked `h_k` carries a contradictory signature | Detection + liveness fallback | +| **Fresh colluding theft** (Operator + all of `M_k`, resurrected keys) | **Not a race** — the theft tx has no CSV and beats the Δ-delayed lattice. Defense is the equivocation proof: the victim holds `L_k` (a `P_k` signature) and the theft tx is a *second* `P_k` signature on a conflicting spend → bond slash (§9) | Economic deterrent | + +Because the equivocation proof requires the victim to *hold* the lattice, **local +retention of `(lattice branch, root(L_k), A_k, h_k inclusion proof)` per epoch is a +security-critical protocol invariant**, not a convenience. A member (or their +watchtower) that discards these has no fraud proof. + +## 9. Bond and enforcement layers + +**Critical separation: the exit never touches the emulator.** The lattice is plain +pre-signed Bitcoin transactions. An emulator shutdown — including the Operator killing +its own attested execution environment — is a **freeze, not a theft**: watchtowers trip +on the missed heartbeat commitment and every member exits on L1 with zero Operator +involvement. The bond exists only as a *deterrent against active collusion-theft* +(§8, row 3), and its enforcement must therefore be independent of the Operator's +infrastructure: + +- **A `checkSigFromStack` punishment leaf would be circular — rejected.** + `checkSigFromStack` is an *emulated* Arkade opcode, not Bitcoin L1 consensus (it is + consensus on Liquid, and proposed for Bitcoin as BIP-348). An Arkade-native bond + slashed via an emulated opcode dies with the emulator: the malicious Operator simply + shuts the instance down. +- **Adopted design: judicial federation bond.** The bond is held by k-of-n entities + *independent of the pool's Operator* (e.g. other Arkade Operators, watchtower + networks). Their only powers are: *pay victims on objective evidence* or *return the + bond to the Operator at expiry*. The evidence is objective and machine-checkable with + no emulator involved: + - two valid signatures under the same epoch key `P_k` on conflicting spends; or + - a continuity attestation `A_j` contradicted by a later published lattice paying a + member less, with no member-signed debit in between. + Federation trust applies to the **deterrent layer only — never to exit**. +- **Rejected alternative, documented honestly:** forced-nonce-reuse key-leak punishment + (make any second `P_k` signature leak the aggregate secret) does **not** work with + plain CHECKSIG: a cheater simply signs with a fresh nonce, and Script cannot pin the + nonce without CSFS. +- **Sizing and client enforcement.** The bond is per-pool and TVL-tracking. Wallets + refuse to participate in pulses of an under-bonded pool (`bond < + requiredCoverage(passiveTVL)`) — client-side policy informed by a bond-reference + field in the ABI (§11). +- **Upgrade path.** BIP-348 CSFS on Bitcoin makes slashing L1-native and the + federation evaporates. See §12 for what CTV/APO additionally close. + +## 10. Attack analysis appendix + +Thirteen adversarial findings shaped this spec. Severity: **CRITICAL** (breaks the +safety claim), **HIGH** (loses funds or bricks exit under a realistic adversary), +**MED** (griefing/liveness/cost). + +| # | Attack | Severity | Resolution in this spec | +|---|---|---|---| +| A1 | **Operator-only heartbeat re-anchor voids all pre-signed exits** — new outpoint ⇒ txid change ⇒ every SIGHASH_ALL signature dead; re-signing needs deleted keys | CRITICAL | Heartbeat is a full cooperative on-chain pulse with complete lattice rebuild (§7.2). No cheap re-anchor construct exists or may be exposed | +| A2 | **Silent-majority gap** — lattice signers are only Operator + `M_k`; nothing structurally forces correct passive slots; for 1-party pulses this degrades to "trust the Operator" | CRITICAL | Continuity attestation `A_k` over the *full* table each epoch + carry-forward verification by every msg.sender (§7.1 step 4b) + cross-epoch fraud proof slashable on the bond (§9) | +| A3 | **"Publish the lattice" is unenforceable** — Operator signs last, can withhold mesh publication or the on-chain commitment selectively | HIGH | "No lattice *in my hands*, no pulse" (local possession gate, §7.1 step 4d); chained `h_k` dependency turns withholding into a visible stall that trips auto-exit (§7.1 step 6, §7.3) | +| A4 | **MuSig2 N-of-N brittleness** — one signer aborts mid-ceremony ⇒ epoch key can never sign again ⇒ if the lattice were incomplete, the exit leaf is permanently unspendable | HIGH | Lattice signed *before* the transition (§7.1 order); abort ⇒ pulse abandoned on still-protected `U_k`; passive members excluded from the aggregate (minimal signer set) | +| A5 | **Theft beats the race** — a colluding theft tx has no CSV; the lattice waits Δ; the defender is structurally slower | HIGH | Stated honestly: chain-extension dominance only kills *stale* lattices; anti-theft is the equivocation proof + bond (§8, §9), not a race | +| A6 | **Anchor pinning on shared lattice nodes** — occupying a shared internal node's anchor grief-blocks every member exiting through it | HIGH | Dedicated per-claimant anchors; TRUC topology; minimized shared-anchor surface in the lattice template (§7.1 step 3); heartbeat-SLA compensation from the bond | +| A7 | **Partial-lattice broadcast griefing** — broadcasting the root but no branches forces the pool into exit mode | MED | Monotonically harmless: the tree is fully pre-signed; any member pushes their own branch with CPFP; delays only, priced to the griefer via fees | +| A8 | **"Deletion attestations" are unfalsifiable** — you cannot prove a key was deleted | HIGH | Deletion demoted to hygiene; the trust anchor is equivocation detection, which requires **mandatory artifact retention** (§8); a resurrected key that signs anything new creates the fraud proof | +| A9 | **Renew-sweep races in-flight exits** — sweep maturity near `renew` can consume `U_k` under a maturing lattice | HIGH | Compiler-enforced ordering invariant `sweepDelay ≥ Δ + margin` creating a lattice-exclusive window (§7.4) | +| A10 | **Bond circularity & sizing** — emulated slashing dies with the emulator; fixed bonds get out-run by TVL | HIGH | Judicial federation bond, evidence-based, emulator-independent (§9); TVL-tracking sizing with client-side refusal; heartbeat cadence caps at-risk-per-epoch ≤ bond | +| A11 | **O(N) lattice re-sign cascade** — SIGHASH_ALL invalidates all descendants on any root change; "incremental subtree reuse" does not survive the txid cascade | MED→HIGH | Costed honestly (§7.1 step 3): O(N) compute for 2–3 parties, O(1) interactivity; two-tier hot-band sharding as the scaling valve; APO named as the real fix (§12) | +| A12 | **Depositor verification is not enough** — verifying your slot at deposit does not protect later epochs you never sign | MED | Deposit completes only with branch + attestation + bond-coverage check in hand; continued protection explicitly requires a watchtower (§5, §8) | +| A13 | **Off-chain `h_k` equivocation** — Operator shows different chains to different parties while committing one hash on-chain | MED | `h_k` must be co-signed by Operator + threshold of `M_k` (§7.1 step 6): a fork necessarily carries someone's contradictory signature | + +## 11. Compiler surface (future work — gated zones) + +Changes touch `src/parser/grammar.pest`, `src/models/mod.rs`, and +`src/compiler/mod.rs`, all of which are supervised zones; this section is a proposal +only. + +- **Options grammar**: a new `recurrent` flag alongside the existing canonical form: + + ``` + options { + server = server; + exit = exit; // Δ, the contest window (int constructor param) + renew = renew; // absolute refresh deadline (int constructor param) + recurrent = true; // pool exit mode: PULSE instead of N-of-N + } + ``` + +- **Exit variant emission**: for `recurrent` contracts, the `serverVariant=false` + tapleaf emits + + ``` + OP_CHECKSIG OP_CHECKSEQUENCEVERIFY OP_DROP + ``` + + instead of the N-of-N CHECKSIG chain. `` is a placeholder in the emitted + ASM (same convention as ``), bound per epoch by the SDK ceremony. + +- **ABI**: a new requirement type `recurrentExit` on the exit variant, carrying the + lattice template: slot script (`SingleSig()` + exit CSV — the existing + pattern), tree arity, dedicated-anchor policy, dust policy (330-sat floor, + cooperative-only dust slot), continuity-attestation format, and a bond reference for + client-side coverage checks. + +- **Timelock invariant**: the compiler rejects configurations where the operator sweep + could mature inside the exit window (`sweepDelay < exit + margin`), per §7.4. + +- **Explicitly absent**: any "operator-only re-anchor" construct (A1). + +Everything else — ceremony ordering, artifact retention, watchtower triggers, TRUC +packaging, bond-coverage refusal — is SDK/ceremony policy, not compiler surface. + +## 12. Open problems and the covenant upgrade path + +Stated honestly: PULSE is the strongest construction available *without* new Bitcoin +consensus features, and these are its residual gaps. + +1. **Passive carry-forward is attestation-bonded, not consensus-enforced.** A passive, + watchtower-less member who retains nothing degrades to bonded-Operator trust. + **CTV (BIP-119)** would let the covenant *consensus-enforce* slot carry-forward + across epochs, closing A2 cryptographically. +2. **Heartbeats need a quorum.** Because re-anchoring invalidates SIGHASH_ALL + signatures, every heartbeat is a ceremony. **APO (BIP-118 / + `SIGHASH_ANYPREVOUT`)** would let pre-signed lattices float across re-anchors, + enabling operator-free heartbeats and true incremental (O(log N)) lattice updates + (closing A1 and A11). +3. **The defender is slower than the thief.** The theft path has no CSV; the lattice + waits Δ. Only the bond deters collusion; if `theft value > bond`, collusion of the + Operator + all of `M_k` is profitable. Heartbeat cadence must cap at-risk-per-epoch + accordingly. APO-style zero-delay defensive paths would close this structurally. +4. **Bond slashing is federated until CSFS.** **BIP-348 (`OP_CHECKSIGFROMSTACK`)** on + Bitcoin L1 makes the equivocation proof consensus-verifiable inside the bond's + punishment leaf, removing the judicial federation entirely. +5. **Key deletion is unprovable** — inherent; no covenant fixes it. The design + therefore never relies on it (§8, A8). + +### Trust statement + +> PULSE converts open-membership pool custody from **trusted-Operator** to +> **bonded-Operator + equivocation detection**, contingent on member liveness +> (watchtowers) and retained exit artifacts. The **exit guarantee is +> emulator-independent**: pure pre-signed L1 transactions — Operator or emulator +> shutdown means freeze, never theft. The **theft deterrent** is economic: a +> federation-held bond slashed on objective equivocation evidence, with federation +> trust confined to the deterrent layer until BIP-348 makes slashing L1-native. +> Active members in recent epochs get 1-honest-of-(msg.senders ∪ Operator) plus the +> bond. Passive, watchtower-less members degrade to bonded-Operator trust. +> Covenant-grade trustlessness requires CTV/APO — §12 names exactly which residual +> gap each one closes. From cf5ae183634856bfb2f405ccc09f43b011b160f5 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 12 Jun 2026 18:33:29 +0000 Subject: [PATCH 02/15] docs: reframe PULSE upgrade path around GSR, no-covenant-fork baseline Drop CTV/APO/CSFS soft-fork framing: the no-fork design is the terminal state with its operating disciplines stated as permanent (federated bond, quorum-gated heartbeats, attestation-bonded carry-forward, k-of-n multi-Operator attestation co-signing as today-deployable hardening). The only contemplated consensus change is the Great Script Restoration, with a per-gap annex mapping each residual gap to restored-opcode constructions (sighash reconstruction covenants, floating claims, hash-based one-time signature slashing). Also replace account-model jargon: msg.senders -> transacting parties throughout; expand P2A/RBF/CPFP/TVL on first use. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 155 ++++++++++++++++++++++++----------- 1 file changed, 106 insertions(+), 49 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index 335819b..c3c12ad 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -87,7 +87,7 @@ PULSE closes this gap. | **Pool VTXO `U_k`** | The pool's virtual UTXO at epoch `k`, holding the aggregate funds | | **State table `S_k`** | The full balance table at epoch `k`: every member's `(memberPk, balance)` | | **Pulse** | One off-chain cooperative state transition `S_k → S_{k+1}`, consuming `U_k`, producing `U_{k+1}` | -| **msg.senders `M_k`** | The parties whose balances change in pulse `k` (online by definition; typically 1–2) | +| **Transacting parties `M_k`** | The parties whose balances change in pulse `k` — whoever is depositing, withdrawing, or trading (online by definition; typically 1–2) | | **Transition tx `T_k`** | The plain, fully-signed, broadcastable transaction implementing pulse `k` | | **Epoch key `P_k`** | MuSig2 aggregate of *ephemeral, sign-once* keys of `{Operator} ∪ M_k`. Passive members are **never** in the aggregate | | **Exit lattice `L_k`** | Fully pre-signed splitting tree spending `U_k`'s exit leaf into one slot per member, per `S_k` | @@ -103,10 +103,10 @@ PULSE closes this gap. | Role | Signs | Online when | Notes | |---|---|---|---| | **Passive member** | **Nothing after deposit** | Own deposit/withdraw only | Must *retain* exit artifacts (or delegate to a watchtower); interactivity is borne by transactors | -| **msg.senders** | Lattice + transition + `h_k`, in **one ceremony** (two MuSig2 rounds, one network round-trip) | Their own transaction | Typically 1–2 parties | +| **Transacting parties** | Lattice + transition + `h_k`, in **one ceremony** (two MuSig2 rounds, one network round-trip) | Their own transaction | Typically 1–2 parties | | **Operator** | Every pulse + attestation + commitment | Always-on | Absence ⇒ freeze ⇒ everyone exits via lattices | | **Watchtower** | Nothing (lattice is fully pre-signed) | Monitoring only | Can broadcast *anyone's* exit; non-custodial; delegable | -| **Heartbeat participants** | Operator + that pulse's msg.senders only | — | Passive members are **not** needed at heartbeats | +| **Heartbeat participants** | Operator + that pulse's transacting parties only | — | Passive members are **not** needed at heartbeats | | **Genesis** | Operator only, if the pool starts empty and members join via deposit pulses | — | **No all-hands N-of-N ceremony ever exists** | ## 6. The exit leaf @@ -134,7 +134,7 @@ emits — instead of the N-of-N CHECKSIG chain: ### 7.0 Genesis (D0) 1. The Operator posts the per-pool **bond** (§9), sized to at least - `requiredCoverage(initialTVL)`. + `requiredCoverage(initialTVL)` (TVL = the pool's total value locked). 2. The pool contract is deployed: an open-membership recursive covenant whose cooperative path the Operator emulates, with `recurrent` exit mode. 3. Preferred genesis: **start empty**. The first members join via ordinary deposit @@ -148,18 +148,20 @@ emits — instead of the N-of-N CHECKSIG chain: A pulse either completes fully or is abandoned, leaving the pool on `U_k`, whose lattice is already valid. -1. **Propose.** A transition `T_{k+1}` is proposed, changing only the msg.senders' - balances. The Operator emulates the contract's introspection covenant against it. - `S_{k+1} = S_k` with only `M_{k+1}` slots changed. +1. **Propose.** A transition `T_{k+1}` is proposed, changing only the transacting + parties' balances. The Operator emulates the contract's introspection covenant + against it. `S_{k+1} = S_k` with only `M_{k+1}` slots changed. 2. **Attest.** The Operator signs the continuity attestation `A_{k+1}` over the Merkle - root of the *entire* `S_{k+1}` — every member, not just msg.senders. One Schnorr + root of the *entire* `S_{k+1}` — every member, not just the transacting parties. + One Schnorr signature; O(1) on-chain footprint; O(log N) inclusion proofs per member. 3. **Lattice first.** The parties build and MuSig2-sign `L_{k+1}` under `P_{k+1} = MuSig2(Operator, M_{k+1})`: - Root spends `U_{k+1}`'s exit leaf; the tree splits into per-member slots (`SingleSig(memberPk)` + the member's own exit CSV). - - **Dedicated per-claimant anchor outputs** (P2A) on every node; TRUC (v3) - transaction topology; lattice txs are non-RBF — fee bumping is anchor/CPFP only. + - **Dedicated per-claimant anchor outputs** (pay-to-anchor, P2A) on every node; + TRUC ("v3") transaction topology; lattice txs opt out of replace-by-fee — fee + bumping is anchors + child-pays-for-parent (CPFP) only. - Balances below the 330-sat taproot dust floor are aggregated into a single **cooperative-only dust slot**. - If any signer aborts here, the **pulse is abandoned**; no keys are deleted; the @@ -177,8 +179,8 @@ lattice is already valid. - (c) the Operator bond still covers the pool's passive TVL (§9); - (d) **its own lattice branch is in its hands** — *"no lattice in my hands, no pulse."* Publication to the relay mesh alone is never trusted. -5. **Transition signing.** Only now do Operator + msg.senders sign `T_{k+1}` - (SIGHASH_ALL, nSequence final). +5. **Transition signing.** Only now do the Operator + transacting parties sign + `T_{k+1}` (SIGHASH_ALL, nSequence final). 6. **Commit.** `h_{k+1}` is **co-signed by the Operator + a threshold of `M_{k+1}`** (so the Operator cannot unilaterally author forks) and committed in the Operator's next on-chain batch transaction. Full artifacts `(S_{k+1}, T_{k+1}, L_{k+1}, @@ -203,8 +205,8 @@ lattice is already valid. A forced design finding: re-anchoring `U_k` under a new on-chain output changes its outpoint, and every pre-signed signature (the transitions *and* the lattice) commits to the old outpoint under SIGHASH_ALL. Re-signing would require the deleted ephemeral -keys. Therefore, **without `SIGHASH_ANYPREVOUT`, the heartbeat must itself be a -cooperative on-chain pulse**: +keys. Therefore, **absent any consensus change that lets signatures float across +outpoints (§12.2), the heartbeat must itself be a cooperative on-chain pulse**: - A full pulse ceremony whose `T` lands on-chain, with a **complete lattice rebuild over all of `S_k`** under a fresh epoch key. @@ -263,7 +265,7 @@ infrastructure: - **A `checkSigFromStack` punishment leaf would be circular — rejected.** `checkSigFromStack` is an *emulated* Arkade opcode, not Bitcoin L1 consensus (it is - consensus on Liquid, and proposed for Bitcoin as BIP-348). An Arkade-native bond + consensus on Liquid, not on Bitcoin). An Arkade-native bond slashed via an emulated opcode dies with the emulator: the malicious Operator simply shuts the instance down. - **Adopted design: judicial federation bond.** The bond is held by k-of-n entities @@ -277,14 +279,18 @@ infrastructure: Federation trust applies to the **deterrent layer only — never to exit**. - **Rejected alternative, documented honestly:** forced-nonce-reuse key-leak punishment (make any second `P_k` signature leak the aggregate secret) does **not** work with - plain CHECKSIG: a cheater simply signs with a fresh nonce, and Script cannot pin the - nonce without CSFS. + plain CHECKSIG: a cheater simply signs with a fresh nonce, and Script cannot pin + the nonce. - **Sizing and client enforcement.** The bond is per-pool and TVL-tracking. Wallets refuse to participate in pulses of an under-bonded pool (`bond < requiredCoverage(passiveTVL)`) — client-side policy informed by a bond-reference field in the ABI (§11). -- **Upgrade path.** BIP-348 CSFS on Bitcoin makes slashing L1-native and the - federation evaporates. See §12 for what CTV/APO additionally close. +- **Permanence.** Under the working assumption that no covenant soft fork ever + activates on Bitcoin, the federation is a permanent fixture of the deterrent layer — + and is engineered to be acceptable as one: evidence-only powers, k-of-n diversity, + never in the exit path. The only contemplated consensus change that would retire it + is the Great Script Restoration (§12.2), whose restored opcodes make the + equivocation proof verifiable in Script directly. ## 10. Attack analysis appendix @@ -294,7 +300,7 @@ safety claim), **HIGH** (loses funds or bricks exit under a realistic adversary) | # | Attack | Severity | Resolution in this spec | |---|---|---|---| -| A1 | **Operator-only heartbeat re-anchor voids all pre-signed exits** — new outpoint ⇒ txid change ⇒ every SIGHASH_ALL signature dead; re-signing needs deleted keys | CRITICAL | Heartbeat is a full cooperative on-chain pulse with complete lattice rebuild (§7.2). No cheap re-anchor construct exists or may be exposed | +| A1 | **Operator-only heartbeat re-anchor voids all pre-signed exits** — new outpoint ⇒ txid change ⇒ every SIGHASH_ALL signature dead; re-signing needs deleted keys | CRITICAL | Heartbeat is a full cooperative on-chain pulse with complete lattice rebuild (§7.2). No cheap re-anchor construct exists or may be exposed (floating claims under GSR would relax this — §12.2) | | A2 | **Silent-majority gap** — lattice signers are only Operator + `M_k`; nothing structurally forces correct passive slots; for 1-party pulses this degrades to "trust the Operator" | CRITICAL | Continuity attestation `A_k` over the *full* table each epoch + carry-forward verification by every msg.sender (§7.1 step 4b) + cross-epoch fraud proof slashable on the bond (§9) | | A3 | **"Publish the lattice" is unenforceable** — Operator signs last, can withhold mesh publication or the on-chain commitment selectively | HIGH | "No lattice *in my hands*, no pulse" (local possession gate, §7.1 step 4d); chained `h_k` dependency turns withholding into a visible stall that trips auto-exit (§7.1 step 6, §7.3) | | A4 | **MuSig2 N-of-N brittleness** — one signer aborts mid-ceremony ⇒ epoch key can never sign again ⇒ if the lattice were incomplete, the exit leaf is permanently unspendable | HIGH | Lattice signed *before* the transition (§7.1 order); abort ⇒ pulse abandoned on still-protected `U_k`; passive members excluded from the aggregate (minimal signer set) | @@ -304,7 +310,7 @@ safety claim), **HIGH** (loses funds or bricks exit under a realistic adversary) | A8 | **"Deletion attestations" are unfalsifiable** — you cannot prove a key was deleted | HIGH | Deletion demoted to hygiene; the trust anchor is equivocation detection, which requires **mandatory artifact retention** (§8); a resurrected key that signs anything new creates the fraud proof | | A9 | **Renew-sweep races in-flight exits** — sweep maturity near `renew` can consume `U_k` under a maturing lattice | HIGH | Compiler-enforced ordering invariant `sweepDelay ≥ Δ + margin` creating a lattice-exclusive window (§7.4) | | A10 | **Bond circularity & sizing** — emulated slashing dies with the emulator; fixed bonds get out-run by TVL | HIGH | Judicial federation bond, evidence-based, emulator-independent (§9); TVL-tracking sizing with client-side refusal; heartbeat cadence caps at-risk-per-epoch ≤ bond | -| A11 | **O(N) lattice re-sign cascade** — SIGHASH_ALL invalidates all descendants on any root change; "incremental subtree reuse" does not survive the txid cascade | MED→HIGH | Costed honestly (§7.1 step 3): O(N) compute for 2–3 parties, O(1) interactivity; two-tier hot-band sharding as the scaling valve; APO named as the real fix (§12) | +| A11 | **O(N) lattice re-sign cascade** — SIGHASH_ALL invalidates all descendants on any root change; "incremental subtree reuse" does not survive the txid cascade | MED→HIGH | Costed honestly (§7.1 step 3): O(N) compute for 2–3 parties, O(1) interactivity; two-tier hot-band sharding as the scaling valve; GSR floating-claim constructions named as the real fix (§12.2) | | A12 | **Depositor verification is not enough** — verifying your slot at deposit does not protect later epochs you never sign | MED | Deposit completes only with branch + attestation + bond-coverage check in hand; continued protection explicitly requires a watchtower (§5, §8) | | A13 | **Off-chain `h_k` equivocation** — Operator shows different chains to different parties while committing one hash on-chain | MED | `h_k` must be co-signed by Operator + threshold of `M_k` (§7.1 step 6): a fork necessarily carries someone's contradictory signature | @@ -349,29 +355,79 @@ only. Everything else — ceremony ordering, artifact retention, watchtower triggers, TRUC packaging, bond-coverage refusal — is SDK/ceremony policy, not compiler surface. -## 12. Open problems and the covenant upgrade path - -Stated honestly: PULSE is the strongest construction available *without* new Bitcoin -consensus features, and these are its residual gaps. - -1. **Passive carry-forward is attestation-bonded, not consensus-enforced.** A passive, - watchtower-less member who retains nothing degrades to bonded-Operator trust. - **CTV (BIP-119)** would let the covenant *consensus-enforce* slot carry-forward - across epochs, closing A2 cryptographically. -2. **Heartbeats need a quorum.** Because re-anchoring invalidates SIGHASH_ALL - signatures, every heartbeat is a ceremony. **APO (BIP-118 / - `SIGHASH_ANYPREVOUT`)** would let pre-signed lattices float across re-anchors, - enabling operator-free heartbeats and true incremental (O(log N)) lattice updates - (closing A1 and A11). -3. **The defender is slower than the thief.** The theft path has no CSV; the lattice - waits Δ. Only the bond deters collusion; if `theft value > bond`, collusion of the - Operator + all of `M_k` is profitable. Heartbeat cadence must cap at-risk-per-epoch - accordingly. APO-style zero-delay defensive paths would close this structurally. -4. **Bond slashing is federated until CSFS.** **BIP-348 (`OP_CHECKSIGFROMSTACK`)** on - Bitcoin L1 makes the equivocation proof consensus-verifiable inside the bond's - punishment leaf, removing the judicial federation entirely. -5. **Key deletion is unprovable** — inherent; no covenant fixes it. The design - therefore never relies on it (§8, A8). +## 12. The no-fork endgame, and the GSR annex + +Working assumption: **no covenant soft fork ever activates on Bitcoin.** PULSE is +designed to be the terminal construction under that assumption, not a stopgap. The +only consensus change this document contemplates at all is the **Great Script +Restoration (GSR)** — re-enabling the Script opcodes disabled in 2010 — treated here +as an annex, not a dependency. + +### 12.1 Baseline: permanent operating characteristics + +These are not "open problems awaiting a fork"; they are the operating envelope, each +with its compensating discipline: + +1. **Passive carry-forward stays attestation-bonded.** A passive, watchtower-less + member who retains nothing degrades to bonded-Operator trust. Discipline: the + watchtower market (non-custodial; anyone can run one) plus mandatory artifact + retention (§8). Hardening available today, no fork required: **k-of-n + multi-Operator co-signing of the continuity attestation `A_k`** — lying about a + passive balance then requires collusion across independent Operators, not just + one. +2. **Heartbeats stay quorum-gated ceremonies.** Re-anchoring invalidates SIGHASH_ALL + signatures, so every heartbeat is a full pulse. Discipline: heartbeat cadence is a + protocol parameter enforced client-side; pools that cannot sustain their cadence + should not grow. +3. **The defender stays slower than the thief.** The theft path has no CSV; the + lattice waits Δ. Only the bond deters collusion: if `theft value > bond`, collusion + of the Operator + all transacting parties of an epoch is profitable. Discipline: + heartbeat cadence and client-side bond checks cap at-risk-per-epoch ≤ bond — + wallets refuse pulses that would breach it (§9). +4. **Bond slashing stays federated.** Evidence-only powers, k-of-n diversity, never in + the exit path (§9). This is the deterrent layer's permanent shape. +5. **Key deletion stays unprovable** — inherent; no consensus change fixes it. The + design therefore never relies on it (§8, A8). + +### 12.2 The GSR annex (the only fork contemplated) + +The Great Script Restoration proposes re-enabling the opcodes disabled in 2010 — +concatenation, substrings, bit operations, multiplication/division — under a *varops +budget* that bounds worst-case validation cost the way the existing sigops budget +bounds signature checks. It is not a "covenant soft fork" by name. But restored +concatenation **is a covenant in effect**, through two well-understood constructions: + +- **Sighash reconstruction.** Script assembles the spending transaction's signature + hash from stack elements (concatenation + SHA256) and verifies it with a fixed-key + `OP_CHECKSIG` — constraining the spending transaction field by field. Transaction-id + reflection extends this to introspecting the current outpoint. +- **Hash-based one-time signatures.** Their verification is pure hashing and + concatenation, so Script can verify signatures over *arbitrary data* with no new + signature-check opcode. + +Under GSR, each baseline characteristic upgrades: + +1. **Carry-forward becomes consensus-enforced** (closes A2 cryptographically). The + exit leaf becomes a real covenant: "this output may only be spent to the + distribution Merkle-committed by `h_k`," with each member's slot proven by a log-N + Merkle path verified in Script. The pre-signed lattice becomes an optimization for + cheap exits — no longer the safety net. +2. **Heartbeats no longer need the quorum** (closes A1 and A11). Exit claims built on + sighash reconstruction can choose *not* to commit to the prevout transaction id, so + they float across re-anchors without re-signing. The Operator can re-anchor + unilaterally; incremental O(log N) state updates follow. +3. **The theft path disappears structurally** (closes the A5 asymmetry). A covenant + exit leaf has no epoch key to collude with: there is nothing the Operator and the + transacting parties can co-sign that pays anywhere other than the committed + distribution. +4. **Slashing becomes L1-native and the federation evaporates** (closes the §9 + residue). Epoch authorizations double as hash-based one-time signatures; producing + two conflicting one-time signatures under one epoch authorization is verifiable in + the bond's punishment leaf with nothing but hashing. The equivocation proof stops + needing judges. + +All four verifications are hash-dominated (Merkle paths, one-time-signature chains) +and sized for a budgeted Script model. ### Trust statement @@ -381,8 +437,9 @@ consensus features, and these are its residual gaps. > emulator-independent**: pure pre-signed L1 transactions — Operator or emulator > shutdown means freeze, never theft. The **theft deterrent** is economic: a > federation-held bond slashed on objective equivocation evidence, with federation -> trust confined to the deterrent layer until BIP-348 makes slashing L1-native. -> Active members in recent epochs get 1-honest-of-(msg.senders ∪ Operator) plus the -> bond. Passive, watchtower-less members degrade to bonded-Operator trust. -> Covenant-grade trustlessness requires CTV/APO — §12 names exactly which residual -> gap each one closes. +> trust confined to the deterrent layer — permanently, under the no-fork assumption. +> Active members in recent epochs get 1-honest-of-(transacting parties ∪ Operator) +> plus the bond. Passive, watchtower-less members degrade to bonded-Operator trust. +> Covenant-grade trustlessness is reachable only through the GSR annex (§12.2); +> absent any fork, this bonded-Operator-plus-equivocation-detection model is the end +> state, and the design is engineered to be livable as exactly that. From fa48fb76a881181bab0b293e9358077ffeb6c704 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 16:10:52 +0000 Subject: [PATCH 03/15] docs: add PULSE recourse ladder + conservation-halt finality rule Answer the standing question of what recourse a pool member has when the pre-signed exit lattice does not pay them what they are owed. - New section 8a (Recourse): the governing invariant (no unsigned correct lattice exists), a failure-mode table tagged position-recoverable / compensation-only / liveness-halt / unbacked-loss, the five-rung recourse ladder, and the honest verdict that the detect-before-consumed race loses to an active thief (Delta CSV on the exit vs no CSV on the consuming transition) and only rescues the dark/stalled-operator case. - New rule 7.1a (public finality predicate): conservation + consistency are recomputable from committed public data; on failure conforming software treats the pulse as non-final and auto-exits on the prior epoch. This closes the buggy-honest conservation hole (loss with no slashable evidence) with no covenant. - Reframe the Delta contest window as also a dispute window (bond earmark + client refuse-policy; explicitly not an on-chain freeze). - Name the sub-dust cooperative-only slot as a permanent recourse gap (12.1 item 6) and state plainly that worst-case passive recourse is bonded compensation, not coin recovery. - Appendix findings A14 (buggy-honest conservation) and A15 (sub-dust). - Cleanup: remaining msg.sender -> transacting party. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 132 +++++++++++++++++++++++++++++++++-- 1 file changed, 126 insertions(+), 6 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index c3c12ad..626e37e 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -172,7 +172,7 @@ lattice is already valid. one network round) but **O(1) interactivity**. The scaling valve is two-tier sharding: frequent pulses update a small "hot band" sub-pool; the periodic heartbeat folds it back into the full lattice. -4. **Verification gate.** Each msg.sender verifies, *before releasing anything*: +4. **Verification gate.** Each transacting party verifies, *before releasing anything*: - (a) its own slot value in `L_{k+1}`; - (b) **every passive slot equals the `S_k` carry-forward**, Merkle-checked against `A_{k+1}`; @@ -200,6 +200,30 @@ lattice is already valid. | `A_{k+1}` (full-table attestation) | Operator alone (its honesty is bonded) | | `h_{k+1}` (commitment) | Operator + threshold of `M_{k+1}` | +### 7.1a Public finality predicate (conservation + consistency) + +The verification gate (step 4) is a *veto*, but only the transacting parties run it. +There is a second check that **anyone** can run — passive members, watchtowers, new +depositors, third parties — from data the on-chain commitment `h_k` already binds, with +no signing role required. It is the safety net for everyone the gate does not cover, and +it is what catches an *honest-but-buggy* pulse (one with no lie to slash on). + +A pulse `k` is **final only if** both hold, recomputed from the published `S_k`, +`root(L_k)`, and the on-chain `value(U_k)`: + +1. **Conservation** — `Σ(leaf values of L_k) + dust slot + Σ(path fees) == value(U_k)`. +2. **Consistency** — `root(L_k)` reproduces exactly the per-member slot set implied by + `S_k`, and the `S_k` root matches the one attested in `A_k`. + +If either fails — or the pre-image data needed to check them is withheld (which is +itself the §7.1 step 6 / A3 stall) — **conforming wallets and watchtowers MUST treat +pulse `k` as non-final and auto-exit on epoch `k−1`**, the last epoch that passed both +checks (genesis `h_0` is checked at deposit). This converts a malformed or +over-allocating lattice from a *silent loss* into a *liveness halt*, and it does so +without any covenant: the data is public and the arithmetic is objective. The only +residual is a counterparty who already treated pulse `k` as final off-chain before +checking — so external settlement must gate finality on this same predicate. + ### 7.2 Heartbeat (D2) — there is no cheap operator-only re-anchor A forced design finding: re-anchoring `U_k` under a new on-chain output changes its @@ -251,7 +275,90 @@ watchtowers auto-exit if the pool has not heartbeat by `renew − Δ − margin` Because the equivocation proof requires the victim to *hold* the lattice, **local retention of `(lattice branch, root(L_k), A_k, h_k inclusion proof)` per epoch is a security-critical protocol invariant**, not a convenience. A member (or their -watchtower) that discards these has no fraud proof. +watchtower) that discards these has no fraud proof — though because the lattice is +non-custodial, *any* surviving copy (the relay mesh, an archival watchtower) lets +anyone reconstruct and broadcast on the victim's behalf, so the data only needs to +exist *somewhere*, not necessarily with the victim. + +**The contest window Δ is also a dispute window.** No published evidence can freeze +`U_k` on-chain — there is no covenant to freeze it. But a standardized, machine-checkable +evidence bundle (`A_j` plus the contradicting `L_k` or forked `h_k`) does two things +during Δ: it makes the federation *earmark* the bond (blocking its expiry-return while a +live contradiction stands), and it flips every conforming client's accept-policy to +*refuse new pulses* on that pool. Since the next pulse is invalid until `h_k` is on-chain +and honest co-signers will not co-sign a disputed tip, a credible dispute **halts state +progression** — the closest no-covenant analogue to a freeze. It stops the attacker +finding fresh victims; it does not, by itself, claw back the specific contested coins. + +## 8a. Recourse: when the count doesn't check out + +This is the user-facing companion to §8. The governing fact, stated sharply because +every line depends on it: + +> A user can only ever broadcast a lattice that was **actually signed**. No honest +> "correct" lattice exists unless it was ceremonially produced. So *recovering your +> position* is possible only by falling back to a previously-signed, still-spendable +> lattice. If none exists, the ceiling is **economic compensation from the bond**, and +> the floor is **unbacked loss**. + +### Failure modes and where each lands + +| Failure | What it is | Tag (determining condition) | +|---|---|---| +| **Wrong amount** | your slot pays less than your balance | Active signer: **POSITION-RECOVERABLE** (veto at the gate). Passive: **COMPENSATION-ONLY** via `A_k` contradiction, unless you win the race below | +| **Missing slot** | you are in `A_k` but absent from `L_k` (= wrong amount, slot 0) | Same as wrong amount; the fraud proof is the cleanest (Merkle inclusion in `A_k` vs absence in `root(L_k)`); doubles as a conservation alarm | +| **Conservation failure — malicious** | `Σ(slots) > value(U_k)`, a theft structured as a race among victims | **LIVENESS-HALT** (§7.1a predicate; the inflated `A_k` also contradicts on-chain `value(U_k)`) → compensation residue | +| **Conservation failure — buggy-honest** | ceremony bug; `A_k` matches the buggy lattice, so *no lie, no conflicting signature* | Without §7.1a: **UNBACKED-LOSS** (no slashable evidence). With §7.1a: **LIVENESS-HALT** at `k−1`. This is why §7.1a is a first-class rule | +| **Missing / invalid branch** | signatures don't verify, or you never received a branch | Invalid sig, active: **POSITION-RECOVERABLE** (veto). Passive: **COMPENSATION-ONLY** if `A_k`+inclusion retained or mesh-recoverable; **UNBACKED** only if the data is *globally* lost | +| **Stale-but-correct** | your `L_k` is correct but `U_k` was already consumed by a newer (bad) transition | **COMPENSATION-ONLY** in the realistic case; POSITION-RECOVERABLE only inside the race below, which you usually lose | +| **Commitment fork** | Operator double-allocates `U_k` across two off-chain histories | **COMPENSATION-ONLY** (co-signed conflicting `h_k`) + **LIVENESS-HALT** for any observer of both | +| **Sub-dust** | balance below the 330-sat floor, aggregated into the cooperative-only dust slot | **UNBACKED-LOSS**, bounded ≤ dust floor — a *permanent* no-unilateral-exit gap (see §12.1) | + +### The recourse ladder (strongest → weakest) + +1. **Prevention — the gate is a veto.** If you are transacting in the pulse, you refuse + to sign; because the lattice is signed before the transition, `U_k` is never consumed + and the pool stays on the still-valid `L_k`. Full recourse — but only for the parties + **online and signing that pulse**. Everyone else is downstream, and the rest of this + ladder exists solely to serve them. +2. **Public conservation/consistency halt (§7.1a).** Anyone can recompute conservation + and consistency from committed public data; on failure, pulse `k` is non-final and + conforming software exits on `k−1`. Converts buggy-honest and over-allocating lattices + from silent loss into a liveness halt, with no fork. +3. **Detect-before-consumed exit via the last-good epoch.** Hold a correct `L_{k−1}`, + detect the bad pulse, broadcast `L_{k−1}` before the bad transition confirms. **Honest + verdict: this loses the race to an active thief and works only against a dark or + stalled Operator** (see below). It is a freeze remedy, not a theft defense. +4. **Equivocation fraud proof → bond compensation.** Two conflicting `P_k` signatures, or + `A_j` contradicted by a later lattice with no member-signed debit. The federation pays + victims — **money, not position**, capped at the bond. +5. **Residual unbacked loss.** What actually falls here: buggy-honest conservation *absent + rule §7.1a*; a branch whose data is *globally* lost; sub-dust balances (structurally no + exit); and the over-the-bond portion of any theft (`loss > bond`). + +### Why the detect-before-consumed race favors the thief, not the victim + +Your exit spends ` OP_CHECKSIG <Δ> OP_CSV`: the relative timelock means the lattice +root cannot be mined until **Δ blocks after `U_k` confirmed**. The attacker's consuming +transition carries **no CSV** (`nSequence` final, by design — §6, §8 row 3): it is +spendable immediately and confirms in the next block. So a colluding Operator consumes +`U_k` roughly Δ blocks before your exit is even valid, and your correct `L_k` becomes +un-broadcastable (its input is spent). Chain-extension dominance is a race the honest +side wins **only when the honest side holds the newer transition**; when the *thief* +holds the newer (bad) state, the same Δ that gives honest holders a contest window is a +head start handed to the attacker. The race therefore rescues only the **dark/stalled- +Operator** case (nobody broadcasts the consuming transition; your `L_k` matures +unopposed — this is the "freeze, not theft" case §9 is genuinely good at). Against active +theft it fails, and recourse falls to rung 4 — exactly the asymmetry the A5 finding +exists to prevent anyone from forgetting. + +> **Bottom line.** For an active, online party the gate is a true veto. For a passive +> member shorted by an *actively-colluding* Operator, recourse terminates at **bonded +> compensation, not coin recovery** — because you cannot broadcast a correct lattice that +> was never signed. That is the structural price of pooling funds in one shared UTXO +> without a covenant; the protocol's job is to shrink the set of cases that reach it +> (rules §7.1a, the full-table attestation, mesh archival, TVL-tracking bond) and to make +> the compensation actually cover the loss. ## 9. Bond and enforcement layers @@ -294,14 +401,15 @@ infrastructure: ## 10. Attack analysis appendix -Thirteen adversarial findings shaped this spec. Severity: **CRITICAL** (breaks the -safety claim), **HIGH** (loses funds or bricks exit under a realistic adversary), -**MED** (griefing/liveness/cost). +Fifteen adversarial findings shaped this spec — A1–A13 from the protocol red-team, +A14–A15 from the recourse analysis (§8a). Severity: **CRITICAL** (breaks the safety +claim), **HIGH** (loses funds or bricks exit under a realistic adversary), **MED** +(griefing/liveness/cost). | # | Attack | Severity | Resolution in this spec | |---|---|---|---| | A1 | **Operator-only heartbeat re-anchor voids all pre-signed exits** — new outpoint ⇒ txid change ⇒ every SIGHASH_ALL signature dead; re-signing needs deleted keys | CRITICAL | Heartbeat is a full cooperative on-chain pulse with complete lattice rebuild (§7.2). No cheap re-anchor construct exists or may be exposed (floating claims under GSR would relax this — §12.2) | -| A2 | **Silent-majority gap** — lattice signers are only Operator + `M_k`; nothing structurally forces correct passive slots; for 1-party pulses this degrades to "trust the Operator" | CRITICAL | Continuity attestation `A_k` over the *full* table each epoch + carry-forward verification by every msg.sender (§7.1 step 4b) + cross-epoch fraud proof slashable on the bond (§9) | +| A2 | **Silent-majority gap** — lattice signers are only Operator + `M_k`; nothing structurally forces correct passive slots; for 1-party pulses this degrades to "trust the Operator" | CRITICAL | Continuity attestation `A_k` over the *full* table each epoch + carry-forward verification by every transacting party (§7.1 step 4b) + cross-epoch fraud proof slashable on the bond (§9) | | A3 | **"Publish the lattice" is unenforceable** — Operator signs last, can withhold mesh publication or the on-chain commitment selectively | HIGH | "No lattice *in my hands*, no pulse" (local possession gate, §7.1 step 4d); chained `h_k` dependency turns withholding into a visible stall that trips auto-exit (§7.1 step 6, §7.3) | | A4 | **MuSig2 N-of-N brittleness** — one signer aborts mid-ceremony ⇒ epoch key can never sign again ⇒ if the lattice were incomplete, the exit leaf is permanently unspendable | HIGH | Lattice signed *before* the transition (§7.1 order); abort ⇒ pulse abandoned on still-protected `U_k`; passive members excluded from the aggregate (minimal signer set) | | A5 | **Theft beats the race** — a colluding theft tx has no CSV; the lattice waits Δ; the defender is structurally slower | HIGH | Stated honestly: chain-extension dominance only kills *stale* lattices; anti-theft is the equivocation proof + bond (§8, §9), not a race | @@ -313,6 +421,8 @@ safety claim), **HIGH** (loses funds or bricks exit under a realistic adversary) | A11 | **O(N) lattice re-sign cascade** — SIGHASH_ALL invalidates all descendants on any root change; "incremental subtree reuse" does not survive the txid cascade | MED→HIGH | Costed honestly (§7.1 step 3): O(N) compute for 2–3 parties, O(1) interactivity; two-tier hot-band sharding as the scaling valve; GSR floating-claim constructions named as the real fix (§12.2) | | A12 | **Depositor verification is not enough** — verifying your slot at deposit does not protect later epochs you never sign | MED | Deposit completes only with branch + attestation + bond-coverage check in hand; continued protection explicitly requires a watchtower (§5, §8) | | A13 | **Off-chain `h_k` equivocation** — Operator shows different chains to different parties while committing one hash on-chain | MED | `h_k` must be co-signed by Operator + threshold of `M_k` (§7.1 step 6): a fork necessarily carries someone's contradictory signature | +| A14 | **Buggy-honest conservation failure** — a ceremony bug makes `Σ(slots) ≠ value(U_k)` while `A_k` matches the buggy lattice, so there is no lie and no slashable evidence → silent unbacked loss | HIGH | Public finality predicate (§7.1a): conservation + consistency are recomputable from committed data; failure makes pulse `k` non-final and forces auto-exit on `k−1`, converting silent loss into a liveness halt with no fork | +| A15 | **Sub-dust no-exit** — balances below the 330-sat floor sit in a cooperative-only dust slot with no unilateral exit | MED | Named as a permanent, bounded recourse gap (§8a, §12.1 item 6); mitigated by client below-floor warnings and attesting the dust aggregate so over-debit is compensation-provable | ## 11. Compiler surface (future work — gated zones) @@ -388,6 +498,16 @@ with its compensating discipline: the exit path (§9). This is the deterrent layer's permanent shape. 5. **Key deletion stays unprovable** — inherent; no consensus change fixes it. The design therefore never relies on it (§8, A8). +6. **Sub-dust balances have no unilateral exit.** Balances below the 330-sat floor are + aggregated into a cooperative-only dust slot (§7.1.3), which by construction needs + Operator cooperation to spend. Discipline: clients warn a member when their balance + crosses below the unilateral-exit floor so they can consolidate while the Operator is + live; the dust aggregate is attested in `A_k` so over-debiting it is at least + compensation-provable. The structural floor itself is permanent absent a fork. + +Worst-case for a passive member shorted by an actively-colluding Operator, recourse is +the bond (compensation), not coin recovery (§8a) — the bond is therefore a *cap on +compensable loss*, which is what items 3 and 6 are disciplined around. ### 12.2 The GSR annex (the only fork contemplated) From 3b6c2d869aa29529896733f67f4e8d8b00f8f69a Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 20:18:26 +0000 Subject: [PATCH 04/15] docs: add PULSE security model + dialectical review Add section 13 answering the three questions the design is pressed on, and retire the trustless-amount overclaim. - Two security models, not one: the exit MECHANISM is 1-of-N (Ark-grade, any one honest data-holder broadcasts the pre-signed non-custodial lattice); the exit AMOUNT is bonded, not a clean 1-of-N -- the set whose honesty protects a passive balance is {Operator + transacting parties}, which excludes the victim and can be as small as two. The victim is not a required signer of the transition that can rob them; the carry-forward check that would prevent it is policy-enforced, not incentive-compatible. - The trilemma: cannot have non-interactive passive members + no covenant + trustless amount-safety; PULSE takes the first two and bonds the third. - Halt analysis: the Operator can halt all epoch creation (freeze + mass exit, not theft); a single party halts only its own pulse; objective fraud evidence halts via dispute (must be machine-checkable or it is a DoS). - Operator centrality: P_k always includes the Operator, so it is a mandatory exit-creator and sole liveness bottleneck; k-of-n federated Operator is the recommended no-fork hardening, but it widens the trusted set without escaping the trilemma. - Feasibility: the lattice is structurally an Ark VTXO tree, buildable today (clArk; P2A since Core 28.0; TRUC/ephemeral anchors merged); the binding constraint is per-pulse whole-tree re-signing (A11), realistic for low/moderate pulse rate. - Trust statement rewritten to lead with trustless-mechanism / bonded-amount and the trilemma. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 144 +++++++++++++++++++++++++++++++---- 1 file changed, 130 insertions(+), 14 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index 626e37e..c327ab8 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -354,7 +354,8 @@ exists to prevent anyone from forgetting. > **Bottom line.** For an active, online party the gate is a true veto. For a passive > member shorted by an *actively-colluding* Operator, recourse terminates at **bonded -> compensation, not coin recovery** — because you cannot broadcast a correct lattice that +> compensation, not coin recovery** (this is the *amount* security model of §13.1) — +> because you cannot broadcast a correct lattice that > was never signed. That is the structural price of pooling funds in one shared UTXO > without a covenant; the protocol's job is to shrink the set of cases that reach it > (rules §7.1a, the full-table attestation, mesh archival, TVL-tracking bond) and to make @@ -549,17 +550,132 @@ Under GSR, each baseline characteristic upgrades: All four verifications are hash-dominated (Merkle paths, one-time-signature chains) and sized for a budgeted Script model. -### Trust statement - -> PULSE converts open-membership pool custody from **trusted-Operator** to -> **bonded-Operator + equivocation detection**, contingent on member liveness -> (watchtowers) and retained exit artifacts. The **exit guarantee is -> emulator-independent**: pure pre-signed L1 transactions — Operator or emulator -> shutdown means freeze, never theft. The **theft deterrent** is economic: a -> federation-held bond slashed on objective equivocation evidence, with federation -> trust confined to the deterrent layer — permanently, under the no-fork assumption. -> Active members in recent epochs get 1-honest-of-(transacting parties ∪ Operator) -> plus the bond. Passive, watchtower-less members degrade to bonded-Operator trust. -> Covenant-grade trustlessness is reachable only through the GSR annex (§12.2); -> absent any fork, this bonded-Operator-plus-equivocation-detection model is the end +## 13. Security model and dialectical review + +This section answers the three questions the design is most often pressed on — *is this +1-of-N? can anyone halt epoch creation? is the Operator always the exit-creator?* — and +states the one thing the rest of the document must not overclaim. + +### 13.1 Two security models, not one + +PULSE has **two distinct security properties with two distinct trust models**, and +conflating them is the central error to avoid: + +| Property | Model | Honest assumption | +|---|---|---| +| **Exit mechanism** (can I get *out*?) | **1-of-N** — Ark-grade | The lattice is fully pre-signed and non-custodial; *any one* honest data-holder in `{you, your watchtowers, mesh archivers}` can broadcast it. You yourself suffice (1-of-1 in the Ark sense). Against a non-racing Operator, exit always completes. | +| **Exit amount** (is the *number* in my slot right?) | **Bonded — not a clean 1-of-N** | The set whose honesty protects a passive member's balance in a pulse is `{Operator ∪ M_k}` — the Operator plus whoever is transacting. One honest member of that set refuses the bad pulse at the gate (§7.1 step 4b). But that set **excludes the victim** and can be **as small as two**. Below "1 honest in that set," safety degrades to *bonded compensation* (§9), an economic layer, not a cryptographic one. | + +**Why the amount model is weaker than the systems PULSE resembles.** In a statechain or +a coinpool, every signer is checking *their own* balance and updates are N-of-N, so any +one refusal blocks — a true 1-of-N where the honest party is *defending their own funds*. +In Ark, the VTXO owner is 1-of-1 over *their own* coins. In PULSE, **the victim is not a +required signer of the transition that can rob them**: the honest party who could save a +passive member is a *disinterested third party* (some other transacting party running +the §7.1 step 4b carry-forward check), not the victim. That carry-forward check is +therefore **policy-enforced, not incentive-compatible** — a transacting party has no +economic stake in a stranger's passive slot, so the check holds only because conforming +software performs it, and it is not a Nash equilibrium. This is the honest game-theoretic +floor, and it is why "1-of-N" must always be qualified as *"1-of-N for the mechanism, +bonded for the amount."* + +### 13.2 The trilemma + +The amount model is not weak by oversight; it is the corner the design chose. You cannot +have all three of: + +- **(a) non-interactive passive members** — they sign nothing while idle (the entire + open-membership selling point); +- **(b) no covenant** — the working assumption (§12); +- **(c) trustless safety of a passive member's *amount*** — cryptographic, not bonded. + +PULSE takes **(a) + (b)** and pays by relaxing **(c)** to bonded compensation. A real +covenant (the GSR annex, §12.2) buys **(a) + (c)** by dropping (b). Forcing the victim to +co-sign every pulse that touches the pool buys **(b) + (c)** by dropping (a) — but that is +just a coinpool, and it destroys the passive/open-membership property. The trilemma *is* +the design, stated honestly; it is not a defect to be patched. + +### 13.3 Dialectical summary + +| Thesis | Antithesis | Synthesis | +|---|---|---| +| Pre-signed lattices give passive members a standing unilateral exit with no covenant | The lattice is signed only by `{Operator + transacting parties}`, never the victim — a unilateral exit to an amount *someone else wrote* | **Self-custody of the exit mechanism, delegated (bonded) custody of the exit amount** | +| Recurrent pulses keep the exit fresh | Recurrence puts the Operator in every pulse — perpetual operator dependency | Liveness of *progress* is operator-gated; liveness of *exit* is operator-free (you hold the last lattice) | +| Bond + equivocation proof deters theft | Economic security ≠ cryptographic; above the bond theft is +EV; and the preventing check has no incentive behind it | A cryptographically-enforced *mechanism* around an economically-enforced *amount* — a hybrid, not trustless | + +### 13.4 Can anyone halt epoch creation? + +Three vectors — two bounded, one intentional: + +1. **The Operator can halt *all* epoch creation unilaterally** (it is a mandatory signer + of every pulse). This is a real censorship/liveness power, but it is **bounded to + "freeze + force mass exit," not theft**: a frozen pool just means everyone leaves on + the last lattice. It is the same shape as Ark's operator-liveness assumption, with a + wider blast radius (one Operator freezes the whole pool's progress at once). +2. **Any single transacting party can halt *their own* pulse** by aborting the MuSig2 + round (N-of-N: one missing nonce or partial stalls it — A4). This blocks only pulses + that party is in; it cannot censor others transacting with the Operator. Bounded + griefing. +3. **Anyone with *objective* fraud evidence can halt epoch creation via the dispute + artifact** (§8a) — this is intentional (the social freeze). Critical caveat: conforming + clients must halt only on **machine-checkable** evidence; halting on unverified + disputes turns "cry wolf" into a free pool-wide DoS. + +### 13.5 Is the Operator always the exit-creator? (and the federation fix) + +**Yes.** `P_k` always includes the Operator, so **no valid exit lattice can be produced +without it** — the Operator is a mandatory co-signer *of the safety net itself*. This does +not brick exit of *existing* funds (you still hold the last lattice), but it means there +is **no operator-free way to mint a new exit distribution**, the Operator is the **sole +liveness bottleneck** for progress, and its collusion with a small `M_k` is the only theft +path. + +The highest-leverage no-fork improvement is to make **"the Operator" a k-of-n +federation** rather than a single party. This simultaneously (i) removes the single +liveness bottleneck (§13.4 #1), (ii) raises the theft-collusion threshold from +"Operator + M_k" to "k operators + M_k," and (iii) strengthens the continuity attestation +(§12.1 item 1). **Honest ceiling:** federation does *not* make the victim a signer, so it +widens and diversifies the trusted set but does **not** convert §13.1's amount model into +a clean 1-of-N over the membership, and does not escape the trilemma (§13.2). It is the +best available no-fork hardening, recommended as the baseline operator construction — not +a way out of the corner. + +### 13.6 Feasibility: the lattice is an Ark tree + +The "exit lattice" is **structurally an Ark VTXO tree**, which is deployed and +covenant-free — so the construction is buildable on Bitcoin today with no soft fork: + +- **The tree:** a Taproot root spending the shared UTXO, internal branches splitting + value, `SingleSig + CSV` leaves — signed N-of-N via MuSig2 with the Operator included. + Covenant-less Ark ("clArk") establishes that all-of-all pre-signing emulates a covenant + with **no introspection opcode and no fork**. PULSE's epoch-key-then-delete is the same + statechain/Ark technique (with the unprovable-deletion caveat, A8). +- **The fee plumbing:** dedicated per-leaf anchors via **P2A** (standard since Bitcoin + Core 28.0), **TRUC/v3** relay, and ephemeral anchors — all merged. §7.1.3's "dedicated + anchors + TRUC" is real, not aspirational. +- **The binding constraint:** the SIGHASH_ALL txid cascade (A11) forces re-signing the + **whole O(N) tree every pulse**, versus Ark's once-per-*round*. This is realistic for + low-to-moderate pulse frequency; a high-throughput pool needs the two-tier hot-band + sharding (§7.1 step 3). MuSig2 for the epoch key is a two-round ceremony over the small + online `M_k` — passive members are correctly excluded from it. + +**Verdict:** no Bitcoin-Script or transaction-structure reason the lattice cannot be +built as described. Feasibility is bounded by *signing throughput*, not consensus rules. +("Lattice" is the splitting-tree nomenclature here — a radix/Merkle tree — unrelated to +lattice *cryptography*.) + +## Trust statement + +> PULSE has **two security models, not one.** The **exit mechanism is 1-of-N** and +> emulator-independent — pure pre-signed L1 transactions, any one honest data-holder can +> broadcast, Operator or emulator shutdown means *freeze, never theft*. The **exit amount +> is bonded, not trustless**: a passive member's balance is protected cryptographically +> only by the honesty of `{Operator ∪ the transacting parties}` of a pulse — a set that +> excludes the victim and can be as small as two — and below that by a federation-held +> bond slashed on objective equivocation evidence. This split is the **trilemma** (§13.2): +> with non-interactive passive members and no covenant, amount-safety *must* be bonded +> rather than trustless. The recommended no-fork hardening is a **k-of-n federated +> Operator** (§13.5), which widens the trusted set without escaping the trilemma. +> Covenant-grade trustlessness of the amount is reachable only through the GSR annex +> (§12.2); absent any fork, this **trustless-mechanism / bonded-amount** model is the end > state, and the design is engineered to be livable as exactly that. From 69fd826ee0bd059ea5befe058dbdd961f7d6d774 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 20:24:39 +0000 Subject: [PATCH 05/15] =?UTF-8?q?docs:=20address=20Arkana=20review=20?= =?UTF-8?q?=E2=80=94=20fix=20xref,=20define=20bond/threshold=20params?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Spec-completeness fixes from the automated PR review (commit 4): - F7: replace nonexistent §7.1.3 cross-reference with §7.1 step 3 in both §12.1 item 6 and §13.6. - F12: §13.1 table — 'as small as two' now notes that if both collude the honest count in the set is zero, closing the skimmer ambiguity. - F13: §13.4 item 3 — point machine-checkable dispute evidence at the two types defined in §9 and the §8a bundle, and flag wire serialization as an SDK/ABI open item (§11). - F14: §13.5 — add federation threshold guidance (k >= 2 independent operators for safety, n-k+1 for liveness; 1-of-n is weaker than a single Operator). - F1: §7.1 step 6 — define the commit co-signing threshold t (t>=1; higher t is more fork-resistant at higher interactivity cost). - F4: §9 — define requiredCoverage as an at-risk-per-epoch floor (not total TVL), tied to heartbeat cadence and the +EV-above-bond residual of §12.1 item 3. - F15: §13.6 — note P2A relay requires peers on Core >=28.0. All are specification-completeness clarifications; no protocol claims changed. Doc-only; cargo fmt and tests unaffected. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 45 ++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 12 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index c327ab8..483daee 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -181,9 +181,11 @@ lattice is already valid. pulse."* Publication to the relay mesh alone is never trusted. 5. **Transition signing.** Only now do the Operator + transacting parties sign `T_{k+1}` (SIGHASH_ALL, nSequence final). -6. **Commit.** `h_{k+1}` is **co-signed by the Operator + a threshold of `M_{k+1}`** - (so the Operator cannot unilaterally author forks) and committed in the Operator's - next on-chain batch transaction. Full artifacts `(S_{k+1}, T_{k+1}, L_{k+1}, +6. **Commit.** `h_{k+1}` is **co-signed by the Operator + a threshold `t` of `M_{k+1}`** + so the Operator cannot unilaterally author forks (`t ≥ 1`; a fork then requires `t` + contradicting signatures, so higher `t` is more fork-resistant at the cost of more + required online co-signers — `t = 1` minimal, `t = |M_{k+1}|` maximal). It is + committed in the Operator's next on-chain batch transaction. Full artifacts `(S_{k+1}, T_{k+1}, L_{k+1}, A_{k+1})` go to the relay mesh, content-addressed by `h_{k+1}`. **The next pulse is invalid until `h_k` is on-chain** — a chained dependency that turns commitment withholding into a *visible liveness fault* that trips auto-exit (§7.4). @@ -391,8 +393,14 @@ infrastructure: the nonce. - **Sizing and client enforcement.** The bond is per-pool and TVL-tracking. Wallets refuse to participate in pulses of an under-bonded pool (`bond < - requiredCoverage(passiveTVL)`) — client-side policy informed by a bond-reference - field in the ABI (§11). + requiredCoverage(...)`) — client-side policy informed by a bond-reference field in the + ABI (§11). **`requiredCoverage` is an at-risk-*per-epoch* floor, not total TVL:** the + most that can be stolen before the next heartbeat is the passive value a single + collusion can short, so full deterrence needs `bond ≥` (passive value at risk between + heartbeats). Heartbeat cadence is the lever that keeps this affordable — frequent + heartbeats shrink the at-risk window, so the bond covers per-epoch exposure rather than + the whole pool. Below full coverage, the residual is exactly the +EV-above-bond risk of + §12.1 item 3: a capital-efficiency-vs-coverage policy choice, not a free parameter. - **Permanence.** Under the working assumption that no covenant soft fork ever activates on Bitcoin, the federation is a permanent fixture of the deterrent layer — and is engineered to be acceptable as one: evidence-only powers, k-of-n diversity, @@ -500,7 +508,7 @@ with its compensating discipline: 5. **Key deletion stays unprovable** — inherent; no consensus change fixes it. The design therefore never relies on it (§8, A8). 6. **Sub-dust balances have no unilateral exit.** Balances below the 330-sat floor are - aggregated into a cooperative-only dust slot (§7.1.3), which by construction needs + aggregated into a cooperative-only dust slot (§7.1 step 3), which by construction needs Operator cooperation to spend. Discipline: clients warn a member when their balance crosses below the unilateral-exit floor so they can consolidate while the Operator is live; the dust aggregate is attested in `A_k` so over-debiting it is at least @@ -564,7 +572,7 @@ conflating them is the central error to avoid: | Property | Model | Honest assumption | |---|---|---| | **Exit mechanism** (can I get *out*?) | **1-of-N** — Ark-grade | The lattice is fully pre-signed and non-custodial; *any one* honest data-holder in `{you, your watchtowers, mesh archivers}` can broadcast it. You yourself suffice (1-of-1 in the Ark sense). Against a non-racing Operator, exit always completes. | -| **Exit amount** (is the *number* in my slot right?) | **Bonded — not a clean 1-of-N** | The set whose honesty protects a passive member's balance in a pulse is `{Operator ∪ M_k}` — the Operator plus whoever is transacting. One honest member of that set refuses the bad pulse at the gate (§7.1 step 4b). But that set **excludes the victim** and can be **as small as two**. Below "1 honest in that set," safety degrades to *bonded compensation* (§9), an economic layer, not a cryptographic one. | +| **Exit amount** (is the *number* in my slot right?) | **Bonded — not a clean 1-of-N** | The set whose honesty protects a passive member's balance in a pulse is `{Operator ∪ M_k}` — the Operator plus whoever is transacting. One honest member of that set refuses the bad pulse at the gate (§7.1 step 4b). But that set **excludes the victim** and can be **as small as two** (Operator + one transacting party — and if both collude, the honest count in it is zero). Below "1 honest in that set," safety degrades to *bonded compensation* (§9), an economic layer, not a cryptographic one. | **Why the amount model is weaker than the systems PULSE resembles.** In a statechain or a coinpool, every signer is checking *their own* balance and updates are N-of-N, so any @@ -619,7 +627,11 @@ Three vectors — two bounded, one intentional: 3. **Anyone with *objective* fraud evidence can halt epoch creation via the dispute artifact** (§8a) — this is intentional (the social freeze). Critical caveat: conforming clients must halt only on **machine-checkable** evidence; halting on unverified - disputes turns "cry wolf" into a free pool-wide DoS. + disputes turns "cry wolf" into a free pool-wide DoS. The admissible evidence is the + two types defined in §9 (two conflicting `P_k` signatures, or an `A_j` contradicted by + a later lattice) packaged as the §8a bundle; their exact wire serialization is an open + item for the SDK/ABI (§11) — two implementations that disagree on the format would + split the social layer, so the format must be fixed there, not left to convention. ### 13.5 Is the Operator always the exit-creator? (and the federation fix) @@ -638,7 +650,13 @@ liveness bottleneck (§13.4 #1), (ii) raises the theft-collusion threshold from widens and diversifies the trusted set but does **not** convert §13.1's amount model into a clean 1-of-N over the membership, and does not escape the trilemma (§13.2). It is the best available no-fork hardening, recommended as the baseline operator construction — not -a way out of the corner. +a way out of the corner. Threshold guidance: pick `k` and `n` so that compromising `k` +independently-run operators is strictly harder than compromising one (`k ≥ 2`), while +`n − k + 1` honest-and-live operators still suffice to advance and attest — `k` high +enough for safety, `n − k` slack high enough for liveness. A `1-of-n` federation is +*weaker* than a single Operator (any one node enables collusion); `n-of-n` is maximally +safe but liveness-fragile. The bond and attestation parameters (§9, §12.1 item 1) are +sized against the same `k`. ### 13.6 Feasibility: the lattice is an Ark tree @@ -650,9 +668,12 @@ covenant-free — so the construction is buildable on Bitcoin today with no soft Covenant-less Ark ("clArk") establishes that all-of-all pre-signing emulates a covenant with **no introspection opcode and no fork**. PULSE's epoch-key-then-delete is the same statechain/Ark technique (with the unprovable-deletion caveat, A8). -- **The fee plumbing:** dedicated per-leaf anchors via **P2A** (standard since Bitcoin - Core 28.0), **TRUC/v3** relay, and ephemeral anchors — all merged. §7.1.3's "dedicated - anchors + TRUC" is real, not aspirational. +- **The fee plumbing:** dedicated per-leaf anchors via **P2A** (standard relay since + Bitcoin Core 28.0), **TRUC/v3** relay, and ephemeral anchors — all merged. §7.1 step + 3's "dedicated anchors + TRUC" is real, not aspirational. Implementer caveat: a + P2A-bearing lattice transaction only propagates across peers on Core ≥28.0 (or + equivalent relay policy), and a lattice that does not propagate is a failed exit — so + wallets should broadcast through P2A-aware relay rather than assume universal support. - **The binding constraint:** the SIGHASH_ALL txid cascade (A11) forces re-signing the **whole O(N) tree every pulse**, versus Ark's once-per-*round*. This is realistic for low-to-moderate pulse frequency; a high-throughput pool needs the two-tier hot-band From c5468ec1a706babffb2fc6dac8e928c945e92d4a Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 20:27:52 +0000 Subject: [PATCH 06/15] =?UTF-8?q?docs:=20address=20Arkana=20commit-5=20rev?= =?UTF-8?q?iew=20=E2=80=94=20federation=20math=20+=20ABI=20field?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Make the federation threshold constraint explicit: n >= 2k-1, so that after k-1 compromises the remaining n-k+1 honest operators still meet the k-of-n signing threshold (prior wording was only true under that unstated constraint). - Add the dispute-evidence bundle format to the §11 recurrentExit ABI field list so implementers fix it there and conforming clients agree on what a valid halt trigger is. Doc-only; cargo fmt and tests unaffected. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index 483daee..a4d7304 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -463,8 +463,10 @@ only. - **ABI**: a new requirement type `recurrentExit` on the exit variant, carrying the lattice template: slot script (`SingleSig()` + exit CSV — the existing pattern), tree arity, dedicated-anchor policy, dust policy (330-sat floor, - cooperative-only dust slot), continuity-attestation format, and a bond reference for - client-side coverage checks. + cooperative-only dust slot), continuity-attestation format, the dispute-evidence + bundle format (§13.4 — fixing it here is what keeps conforming clients from splitting + on what counts as a valid halt trigger), and a bond reference for client-side coverage + checks. - **Timelock invariant**: the compiler rejects configurations where the operator sweep could mature inside the exit window (`sweepDelay < exit + margin`), per §7.4. @@ -651,12 +653,12 @@ widens and diversifies the trusted set but does **not** convert §13.1's amount a clean 1-of-N over the membership, and does not escape the trilemma (§13.2). It is the best available no-fork hardening, recommended as the baseline operator construction — not a way out of the corner. Threshold guidance: pick `k` and `n` so that compromising `k` -independently-run operators is strictly harder than compromising one (`k ≥ 2`), while -`n − k + 1` honest-and-live operators still suffice to advance and attest — `k` high -enough for safety, `n − k` slack high enough for liveness. A `1-of-n` federation is -*weaker* than a single Operator (any one node enables collusion); `n-of-n` is maximally -safe but liveness-fragile. The bond and attestation parameters (§9, §12.1 item 1) are -sized against the same `k`. +independently-run operators is strictly harder than compromising one (`k ≥ 2`), and set +`n ≥ 2k − 1` so that even after `k − 1` compromises (safety margin intact) the remaining +`n − k + 1` honest operators still meet the `k`-of-`n` threshold needed to advance and +attest. A `1-of-n` federation is *weaker* than a single Operator (any one node enables +collusion); `n-of-n` is maximally safe but liveness-fragile. The bond and attestation +parameters (§9, §12.1 item 1) are sized against the same `k`. ### 13.6 Feasibility: the lattice is an Ark tree From 448cc396e4b4609d705c08586041bb39627eef61 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 20:51:29 +0000 Subject: [PATCH 07/15] docs: add a no-math plain-language walkthrough to PULSE intro MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The piggy-bank ELI5 was too thin for a non-technical reader who wants to actually understand the mechanism. Restructure §1 into two explainers: - §1.1 keeps the existing 30-second piggy-bank version. - §1.2 adds a fuller plain-language walkthrough (no math, no crypto) — the clerk-not-a-bank operator, exit tickets that need no permission to cash, destroyed signing tools, the public headcount that protects absent members, the cash deposit + referee, the watchdog, and — stated plainly — the one honest catch (you can always leave; the amount is bonded, not cryptographically guaranteed, when you're not in the room). No section renumbering (no other section references §1). Doc-only. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 62 +++++++++++++++++++++++++++++++++++- 1 file changed, 61 insertions(+), 1 deletion(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index a4d7304..dd3b1f6 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -15,7 +15,9 @@ emulated introspection). --- -## 1. ELI5 +## 1. Plain-language explainers + +### 1.1 The 30-second version The pool is a **group piggy bank held at a bank** (the Arkade Operator). @@ -37,6 +39,64 @@ The pool is a **group piggy bank held at a bank** (the Arkade Operator). blockchain, like renewing a lease. That is the "recurrent" rhythm: many off-chain **pulses** between on-chain heartbeats. +### 1.2 The plain-language walkthrough (no math, no cryptography) + +Picture a **shared money jar** that a group uses together — to trade, lend, or pool +funds. Normally, putting money in a shared jar means trusting whoever holds it. PULSE is +a set of rules that lets you put money in the jar **and still take your own share out at +any time, by yourself, even if the jar-keeper vanishes or turns dishonest.** Here is how, +without any math. + +- **The jar-keeper is a clerk, not a bank.** Someone (the Operator) runs the jar, but + never holds your money in a way they could walk off with. Their job is to keep the + books and coordinate — like the clerk in a shared safe-deposit room. They can refuse to + *do new business*, but they cannot *take what is already yours*. + +- **Every change comes with fresh "exit tickets."** Each time anyone makes a move — a + deposit, a withdrawal, a trade — the few people involved in *that* move re-issue a + complete set of **exit tickets**: one per member, each saying "this person is owed + exactly this much." The tickets are already signed and final. Anyone can walk a ticket + to the public ledger and cash it out — no permission, no clerk needed. If the clerk + disappears tomorrow, everyone just cashes their latest ticket and goes home. + +- **Old tickets can't be reused.** The moment a new set of tickets is signed, the tools + used to sign that batch are destroyed. So nobody — not even the clerk — can quietly + write a *second, different* set for the same moment. There is exactly one valid set, + and you hold your copy. + +- **A public headcount protects the people not in the room.** You don't have to show up + every time others transact. So how do you know *your* ticket still says the right number + when you weren't watching? Each time, the clerk publishes a **signed headcount** — a + public, stamped list of what *every* member is owed, not just the people doing the deal. + Anyone in the world can check that the new tickets match that list and that the totals + add up. If they don't, honest software everywhere refuses the change and the group falls + back to the last good set of tickets. A mistake can't quietly slip through; it gets + caught and rewound. + +- **If the clerk lies, they lose a cash deposit.** Before running the jar, the Operator + puts up a **security deposit** held by an independent referee group. If the Operator is + ever caught doing the one forbidden thing — signing two contradictory documents about + the same money — that is black-and-white proof of cheating, and the deposit is paid to + the victim. Cheating isn't just hard; it's expensive and self-incriminating. + +- **A watchdog can stand guard for you.** Because the tickets work without you lifting a + finger, you can run (or hire) a **watchdog** that watches the ledger and cashes your + ticket automatically the moment anything looks wrong — the clerk going silent, a + deadline approaching, or two conflicting documents showing up. + +- **The one honest catch.** When you are *not* in the room, the amount on *your* ticket is + filled in by the people who are — checked by the public headcount and backed by the + deposit, but not personally signed by you. So your ability to *leave* is rock-solid and + needs nobody's permission; the *number* on your ticket is normally right (everyone can + check the math) and, if someone manages to cheat it, the deposit pays you back. It is + *"you can always get out, and you're financially covered if the amount is wrong"* — not + *"the amount is impossible to get wrong."* That distinction is the whole trade-off. + +- **Why "recurrent."** Tickets don't last forever. Every so often the whole arrangement is + renewed on the public ledger, like resigning a lease, which keeps everyone's tickets + fresh and cheap to cash. The practical upshot: don't go *completely* dark forever — + check in now and then (or let your watchdog do it), and your money stays yours. + --- ## 2. Motivation: the gap in today's exit compilation From 512d059d4ced2326f7fc90ee7601e9ceabcf61c3 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 21:00:19 +0000 Subject: [PATCH 08/15] docs: clarify bond enforcement; purge Ark/clArk; fix walkthrough nit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - §9: spell out how the bond is actually enforced — on-chain UTXO funded by the Operator, locked in a k-of-n referee multisig. Bitcoin Script enforces only the multisig, NOT the fraud logic: no opcode can verify Schnorr-equivocation or a signature-over-stack-message (needs CSFS), and the nonce-reuse leak can't be forced without a covenant. Referees verify the objective public evidence off-chain and co-sign the payout; trust = >=1 honest referee. Pure-Script slashing needs the §12.2 opcodes. - Terminology: replace remaining standalone Ark/clArk references with Arkade (heading + body of §13.6, §13.1 table/compare, §13.4 row). - Apply Arkana commit-7 nit: the §1.2 'old tickets' bullet no longer overstates cryptographic impossibility — a colluding clerk+room CAN produce a second set, but it is self-incriminating and triggers the bond. Doc-only; cargo fmt and tests unaffected. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 43 ++++++++++++++++++++++++++---------- 1 file changed, 31 insertions(+), 12 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index dd3b1f6..b12029f 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -59,10 +59,12 @@ without any math. to the public ledger and cash it out — no permission, no clerk needed. If the clerk disappears tomorrow, everyone just cashes their latest ticket and goes home. -- **Old tickets can't be reused.** The moment a new set of tickets is signed, the tools - used to sign that batch are destroyed. So nobody — not even the clerk — can quietly - write a *second, different* set for the same moment. There is exactly one valid set, - and you hold your copy. +- **Old tickets can't be quietly rewritten.** The moment a new set of tickets is signed, + the tools used to sign that batch are destroyed — so a *second, different* set for the + same moment can't normally be made behind your back. In the one case it still could (the + clerk teaming up with *everyone* who was in the room), doing it leaves a + self-incriminating paper trail that triggers the cash deposit below. Either way, one set + counts, and you hold your copy. - **A public headcount protects the people not in the room.** You don't have to show up every time others transact. So how do you know *your* ticket still says the right number @@ -447,6 +449,22 @@ infrastructure: - a continuity attestation `A_j` contradicted by a later published lattice paying a member less, with no member-signed debit in between. Federation trust applies to the **deterrent layer only — never to exit**. +- **How the slashing actually executes — and why it is *not* pure Bitcoin Script.** The + bond is an on-chain UTXO the **Operator funds** and locks into a `k`-of-`n` multisig + with the referees. **Bitcoin Script enforces only that multisig — not the fraud logic.** + No current opcode can evaluate the evidence on-chain: Script cannot test whether two + Schnorr signatures share a key and conflict, nor verify a signature against a message + placed on the stack (that needs `OP_CHECKSIGFROMSTACK`, which Bitcoin lacks), and the + Lightning-style nonce-reuse key-leak cannot be forced without pinning the nonce (a + covenant). So the referees check the *objective, public* evidence off-chain and co-sign + the payout to the victim (or the return to the Operator at expiry). The trust added is + precisely **≥1 honest referee in the `k`-of-`n` set** who honors objective evidence and + does not collude to steal or deny — reputationally exposed (anyone can recompute the same + evidence) but not Script-enforced. Pure-Script slashing — *"reveal two conflicting + signatures, take the bond"* — becomes possible only with the new opcodes of §12.2 + (`OP_CHECKSIGFROMSTACK`, or `OP_CAT`-verifiable hash-based one-time signatures whose + reuse leaks a preimage that sweeps the bond); until then, the multisig-plus-referees + construction is the honest mechanism. - **Rejected alternative, documented honestly:** forced-nonce-reuse key-leak punishment (make any second `P_k` signature leak the aggregate secret) does **not** work with plain CHECKSIG: a cheater simply signs with a fresh nonce, and Script cannot pin @@ -633,13 +651,13 @@ conflating them is the central error to avoid: | Property | Model | Honest assumption | |---|---|---| -| **Exit mechanism** (can I get *out*?) | **1-of-N** — Ark-grade | The lattice is fully pre-signed and non-custodial; *any one* honest data-holder in `{you, your watchtowers, mesh archivers}` can broadcast it. You yourself suffice (1-of-1 in the Ark sense). Against a non-racing Operator, exit always completes. | +| **Exit mechanism** (can I get *out*?) | **1-of-N** — the strongest tier | The lattice is fully pre-signed and non-custodial; *any one* honest data-holder in `{you, your watchtowers, mesh archivers}` can broadcast it. You yourself suffice (1-of-1). Against a non-racing Operator, exit always completes. | | **Exit amount** (is the *number* in my slot right?) | **Bonded — not a clean 1-of-N** | The set whose honesty protects a passive member's balance in a pulse is `{Operator ∪ M_k}` — the Operator plus whoever is transacting. One honest member of that set refuses the bad pulse at the gate (§7.1 step 4b). But that set **excludes the victim** and can be **as small as two** (Operator + one transacting party — and if both collude, the honest count in it is zero). Below "1 honest in that set," safety degrades to *bonded compensation* (§9), an economic layer, not a cryptographic one. | **Why the amount model is weaker than the systems PULSE resembles.** In a statechain or a coinpool, every signer is checking *their own* balance and updates are N-of-N, so any one refusal blocks — a true 1-of-N where the honest party is *defending their own funds*. -In Ark, the VTXO owner is 1-of-1 over *their own* coins. In PULSE, **the victim is not a +In Arkade, a VTXO owner is 1-of-1 over *their own* coins. In PULSE, **the victim is not a required signer of the transition that can rob them**: the honest party who could save a passive member is a *disinterested third party* (some other transacting party running the §7.1 step 4b carry-forward check), not the victim. That carry-forward check is @@ -680,7 +698,7 @@ Three vectors — two bounded, one intentional: 1. **The Operator can halt *all* epoch creation unilaterally** (it is a mandatory signer of every pulse). This is a real censorship/liveness power, but it is **bounded to "freeze + force mass exit," not theft**: a frozen pool just means everyone leaves on - the last lattice. It is the same shape as Ark's operator-liveness assumption, with a + the last lattice. It is the same shape as Arkade's normal operator-liveness assumption, with a wider blast radius (one Operator freezes the whole pool's progress at once). 2. **Any single transacting party can halt *their own* pulse** by aborting the MuSig2 round (N-of-N: one missing nonce or partial stalls it — A4). This blocks only pulses @@ -720,16 +738,17 @@ attest. A `1-of-n` federation is *weaker* than a single Operator (any one node e collusion); `n-of-n` is maximally safe but liveness-fragile. The bond and attestation parameters (§9, §12.1 item 1) are sized against the same `k`. -### 13.6 Feasibility: the lattice is an Ark tree +### 13.6 Feasibility: the lattice is an Arkade VTXO tree -The "exit lattice" is **structurally an Ark VTXO tree**, which is deployed and +The "exit lattice" is **structurally an Arkade VTXO tree**, which is deployed and covenant-free — so the construction is buildable on Bitcoin today with no soft fork: - **The tree:** a Taproot root spending the shared UTXO, internal branches splitting value, `SingleSig + CSV` leaves — signed N-of-N via MuSig2 with the Operator included. - Covenant-less Ark ("clArk") establishes that all-of-all pre-signing emulates a covenant + Arkade is itself covenant-free — its VTXO trees are pre-signed and operator-cosigned + with no covenant opcode — establishing that all-of-all pre-signing emulates a covenant with **no introspection opcode and no fork**. PULSE's epoch-key-then-delete is the same - statechain/Ark technique (with the unprovable-deletion caveat, A8). + sign-once-then-delete key technique (with the unprovable-deletion caveat, A8). - **The fee plumbing:** dedicated per-leaf anchors via **P2A** (standard relay since Bitcoin Core 28.0), **TRUC/v3** relay, and ephemeral anchors — all merged. §7.1 step 3's "dedicated anchors + TRUC" is real, not aspirational. Implementer caveat: a @@ -737,7 +756,7 @@ covenant-free — so the construction is buildable on Bitcoin today with no soft equivalent relay policy), and a lattice that does not propagate is a failed exit — so wallets should broadcast through P2A-aware relay rather than assume universal support. - **The binding constraint:** the SIGHASH_ALL txid cascade (A11) forces re-signing the - **whole O(N) tree every pulse**, versus Ark's once-per-*round*. This is realistic for + **whole O(N) tree every pulse**, versus Arkade's once-per-*batch*. This is realistic for low-to-moderate pulse frequency; a high-throughput pool needs the two-tier hot-band sharding (§7.1 step 3). MuSig2 for the epoch key is a two-round ceremony over the small online `M_k` — passive members are correctly excluded from it. From 3b758f9182c5a2ebbcbdd1018b0c64dc4372036a Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 22:00:09 +0000 Subject: [PATCH 09/15] =?UTF-8?q?docs:=20note=20threshold-MPC=20realizatio?= =?UTF-8?q?n=20of=20the=20federated=20operator=20(=C2=A713.5)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Append a paragraph to §13.5: the recommended k-of-n federated operator is best instantiated as a threshold-MPC signing network producing the Operator's share of P_k/A_k/h_k while the transacting parties stay the always-required co-signers (Schnorr/Taproot-capable MPC is a drop-in; no Bitcoin-side change). Upgrades operator-collusion resistance, lets the network enforce the verification-gate policy before co-signing (mitigating A2), raises key-resurrection (A8) to threshold collusion, and partly subsumes the §9 referee federation via identifiable abort. Limits stated plainly: cooperative path only (exit stays pre-signed and MPC-independent), does not make the victim a signer so it does not escape the §13.2 trilemma, and imports an external network's liveness/security/economic assumptions. Described generically (2PC-MPC named once as the concrete instance), per the doc's no-external-attribution convention. Doc-only; cargo fmt and tests unaffected. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index b12029f..a2224b8 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -738,6 +738,31 @@ attest. A `1-of-n` federation is *weaker* than a single Operator (any one node e collusion); `n-of-n` is maximally safe but liveness-fragile. The bond and attestation parameters (§9, §12.1 item 1) are sized against the same `k`. +**Realizing the federation as a threshold-MPC operator.** The strongest instantiation of +this federation is not a hand-rolled multisig but a **threshold-MPC signing network** that +acts as the Operator's side of every signature. A non-collusive scheme (the kind where the +network can sign *only* together with the user, and the network side is itself an MPC +across hundreds–thousands of nodes with identifiable abort — e.g. 2PC-MPC) is a clean +drop-in: because such schemes now produce **Schnorr/Taproot-compatible** signatures, the +network simply produces the Operator's share of `P_k`, `A_k`, and `h_k`, while the +transacting parties `M_k` remain the always-required co-signers — no change to the Bitcoin +side of the design. This upgrades three named weaknesses at once: operator-collusion theft +now requires breaking the MPC threshold rather than bribing one party; the network can +**enforce the verification-gate policy *before* it co-signs** — refusing its share for any +pulse that violates passive carry-forward or conservation — which turns A2's +policy-but-not-incentive-compatible client check into something an honest threshold +actually enforces; and key-resurrection (A8) now needs threshold collusion. Identifiable +abort also lets the network's own staking punish misbehavior, partly subsuming the §9 +referee federation for the operator-collusion case. **The same honest ceiling still +binds, and two limits are specific to this realization:** the MPC sits on the +**cooperative path only** — the exit must stay pre-signed and MPC-independent, so that the +lattice broadcasts even if the MPC network is gone (never put MPC liveness in the custody +path); and it does **not** make the victim a signer, so amount-safety merely moves from +"trust one Operator" to "trust the MPC threshold" — quantitatively far stronger, but still +committee trust, not cryptographic self-custody, and so it does not escape the trilemma +(§13.2). It also imports that network's own liveness, security, and economic assumptions — +a real external dependency weighed against PULSE's "buildable on Arkade" baseline. + ### 13.6 Feasibility: the lattice is an Arkade VTXO tree The "exit lattice" is **structurally an Arkade VTXO tree**, which is deployed and From a5b389721bb6dbc43580510e812cd0caa732ab38 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 22:07:19 +0000 Subject: [PATCH 10/15] =?UTF-8?q?docs:=20add=20table=20of=20contents;=20no?= =?UTF-8?q?te=20MPC=20Sybil-resistance=20caveat=20(=C2=A713.5)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add a Table of contents after the cross-references block, with GitHub-anchored links to every section and subsection (anchors generated programmatically so the em-dash/arrow double-hyphen cases are correct). - §13.5: add the honest caveat that 'collusion requires breaking the MPC threshold' only holds if nodes are genuinely independent — which cannot be proven cryptographically (same class as A8 key-deletion and §9 federation non-collusion). It rests on staking/slashing sized above stealable value, identifiable abort, and real stake distribution; if those fail the threshold collapses to the single-Operator-collusion case of §8, but no worse (exit stays MPC-independent). Wallets should gate the 'MPC-secured' label on a stake-distribution bound, like refusing an under-bonded pool. Doc-only; cargo fmt and tests unaffected. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 53 ++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index a2224b8..10aa3f5 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -13,6 +13,43 @@ Cross-references: [`options.md`](./options.md) (two-tapleaf model, exit/renew op [`arkade-primitives-spec.md`](./arkade-primitives-spec.md) (recursive covenants, emulated introspection). +## Table of contents + +- [1. Plain-language explainers](#1-plain-language-explainers) + - [1.1 The 30-second version](#11-the-30-second-version) + - [1.2 The plain-language walkthrough (no math, no cryptography)](#12-the-plain-language-walkthrough-no-math-no-cryptography) +- [2. Motivation: the gap in today's exit compilation](#2-motivation-the-gap-in-todays-exit-compilation) +- [3. Design principles](#3-design-principles) +- [4. Vocabulary](#4-vocabulary) +- [5. Interactivity requirements](#5-interactivity-requirements) +- [6. The exit leaf](#6-the-exit-leaf) +- [7. Protocol lifecycle](#7-protocol-lifecycle) + - [7.0 Genesis (D0)](#70-genesis-d0) + - [7.1 Pulse ceremony (D1) — atomic; order is load-bearing](#71-pulse-ceremony-d1--atomic-order-is-load-bearing) + - [7.1a Public finality predicate (conservation + consistency)](#71a-public-finality-predicate-conservation--consistency) + - [7.2 Heartbeat (D2) — there is no cheap operator-only re-anchor](#72-heartbeat-d2--there-is-no-cheap-operator-only-re-anchor) + - [7.3 Unilateral exit walk (D3)](#73-unilateral-exit-walk-d3) + - [7.4 Expiry (D4) and the timelock ordering invariant](#74-expiry-d4-and-the-timelock-ordering-invariant) +- [8. Invalidation model](#8-invalidation-model) +- [8a. Recourse: when the count doesn't check out](#8a-recourse-when-the-count-doesnt-check-out) + - [Failure modes and where each lands](#failure-modes-and-where-each-lands) + - [The recourse ladder (strongest → weakest)](#the-recourse-ladder-strongest--weakest) + - [Why the detect-before-consumed race favors the thief, not the victim](#why-the-detect-before-consumed-race-favors-the-thief-not-the-victim) +- [9. Bond and enforcement layers](#9-bond-and-enforcement-layers) +- [10. Attack analysis appendix](#10-attack-analysis-appendix) +- [11. Compiler surface (future work — gated zones)](#11-compiler-surface-future-work--gated-zones) +- [12. The no-fork endgame, and the GSR annex](#12-the-no-fork-endgame-and-the-gsr-annex) + - [12.1 Baseline: permanent operating characteristics](#121-baseline-permanent-operating-characteristics) + - [12.2 The GSR annex (the only fork contemplated)](#122-the-gsr-annex-the-only-fork-contemplated) +- [13. Security model and dialectical review](#13-security-model-and-dialectical-review) + - [13.1 Two security models, not one](#131-two-security-models-not-one) + - [13.2 The trilemma](#132-the-trilemma) + - [13.3 Dialectical summary](#133-dialectical-summary) + - [13.4 Can anyone halt epoch creation?](#134-can-anyone-halt-epoch-creation) + - [13.5 Is the Operator always the exit-creator? (and the federation fix)](#135-is-the-operator-always-the-exit-creator-and-the-federation-fix) + - [13.6 Feasibility: the lattice is an Arkade VTXO tree](#136-feasibility-the-lattice-is-an-arkade-vtxo-tree) +- [Trust statement](#trust-statement) + --- ## 1. Plain-language explainers @@ -763,6 +800,22 @@ committee trust, not cryptographic self-custody, and so it does not escape the t (§13.2). It also imports that network's own liveness, security, and economic assumptions — a real external dependency weighed against PULSE's "buildable on Arkade" baseline. +**The threshold benefit is only as real as the network's Sybil resistance.** "Collusion +now requires breaking the MPC threshold" holds *only if the nodes are genuinely +independent* — and node independence **cannot be proven cryptographically**; it is the +same unprovable real-world property as key deletion (A8) and federation non-collusion +(§9). It rests entirely on economics and social structure: per-node staking with slashing +sized **above the stealable value** (the MPC analogue of `requiredCoverage`, §12.1 item 3), +identifiable abort (which punishes a *defector* but not a *colluding majority*), and +genuine stake distribution. If those fail — the "nodes" are one entity behind a façade, or +a staked majority colludes — the threshold collapses back to the single-Operator-collusion +case of §8 (row 3), **but no worse**: exit stays MPC-independent and the bonded-amount +model already assumes that collusion is possible, so a fake threshold degrades PULSE to its +existing floor, never beneath it. Wallets should therefore gate the "MPC-secured" label on +a measured stake-distribution bound (e.g. a Nakamoto-coefficient floor), the same way they +refuse an under-bonded pool (§9) — the benefit is quantitative and economic, never a +cryptographic guarantee of independence. + ### 13.6 Feasibility: the lattice is an Arkade VTXO tree The "exit lattice" is **structurally an Arkade VTXO tree**, which is deployed and From b995fc7b43c8c2a9d94a64cf0130f8f909271a57 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 22:41:48 +0000 Subject: [PATCH 11/15] =?UTF-8?q?docs:=20add=20=C2=A79.1=20=E2=80=94=20TEE?= =?UTF-8?q?-constrained,=20bonded,=20conflict-free=20referees?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Canonicalize the bond-enforcement hardening discussed on the PR: - Attested (TEE) referee keys that only co-sign rule-following payouts addressed to {victim, operator} — 'can only halt or pay, not steal' — with honest caveats (TEEs are defense-in-depth not a sovereign root; k-of-n across diverse vendors; the output constraint is enforced by the enclave, not Script, absent a covenant). - Bonded referees (fidelity bonds) so collusion is -EV; kept independent of the operator/threshold-MPC set to avoid correlated collusion. - Operator may be in the k-of-n for the RETURN path only, never the SLASHING path (conflict of interest); bond split into pay-victim (operator excluded) vs return-to-operator (operator + timelock). - Blast radius: full referee/TEE compromise steals the bond or denies a claim (deterrent evaporates) but never the pool (exit lattices are independent) — degrades the amount-deterrent, not the exit. Hardens the trusted layer; not a trilemma escape. Add the §9.1 TOC entry; all anchor links re-verified. Doc-only. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index 10aa3f5..b56bb31 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -36,6 +36,7 @@ emulated introspection). - [The recourse ladder (strongest → weakest)](#the-recourse-ladder-strongest--weakest) - [Why the detect-before-consumed race favors the thief, not the victim](#why-the-detect-before-consumed-race-favors-the-thief-not-the-victim) - [9. Bond and enforcement layers](#9-bond-and-enforcement-layers) + - [9.1 Hardening the referees (TEE-constrained, bonded, conflict-free)](#91-hardening-the-referees-tee-constrained-bonded-conflict-free) - [10. Attack analysis appendix](#10-attack-analysis-appendix) - [11. Compiler surface (future work — gated zones)](#11-compiler-surface-future-work--gated-zones) - [12. The no-fork endgame, and the GSR annex](#12-the-no-fork-endgame-and-the-gsr-annex) @@ -523,6 +524,44 @@ infrastructure: is the Great Script Restoration (§12.2), whose restored opcodes make the equivocation proof verifiable in Script directly. +### 9.1 Hardening the referees (TEE-constrained, bonded, conflict-free) + +The federation's job is *halt-or-pay-per-evidence*, never *spend freely* — but a +`k`-of-`n` multisig is free to send anywhere, so absent a covenant the "only halt, not +steal" property must be supplied off-chain. Three hardenings, stackable, none of which +escapes the trilemma: + +- **Attested execution (TEE) constrains the referee key.** If each referee's signing key + lives in a TEE running *attested* adjudication code, the key will only co-sign a payout + that matches the objective public evidence and is addressed to `{victim, operator}` — + so a referee **cannot use its key to steal the bond, only to follow the rules or + refuse**. This reduces the trust from "the referee is honest" to "the enclave is unbroken + *and* the attested code is correct." Caveats stated plainly: TEEs are *defense-in-depth, + not a sovereign root of trust* — enclaves have a long history of microarchitectural + breaks — so use `k`-of-`n` **across diverse TEE vendors** (an attacker must break `k` + enclaves of mixed make), and accept the added hardware-vendor trust. The output + constraint to `{victim, operator}` is enforced by the enclave, not by Script (Script + cannot constrain a multisig's outputs without a covenant). +- **Bonded referees (skin in the game).** Referees post their own (fidelity) bonds, so a + referee that co-signs an unbacked payout or refuses a valid claim — both objectively + detectable — is itself slashable. This makes referee collusion −EV, the same logic as + the operator bond. Keep the referee set **independent of the Operator / threshold-MPC + set (§13.5)**; reusing one staked set for both roles correlates operator-collusion with + referee-collusion. +- **The Operator may sit in the `k`-of-`n` for the *return* path only, never the + *slashing* path.** Split the bond into two spending conditions: **pay-victim** requires + `k`-of-`n` referees with the **Operator excluded** (otherwise it could block its own + punishment), while **return-to-Operator** at expiry may require the Operator plus a + timelock (wanting one's own bond back is aligned). Putting the Operator in the slashing + quorum is a conflict of interest and is forbidden. + +**Blast radius.** Even if the *entire* referee/TEE layer is compromised, the worst case is +**the bond is stolen or a valid claim is denied — the deterrent evaporates** — but the +**pool funds are untouched**, because the exit lattices are pre-signed and independent of +the bond apparatus: members still sweep their last-good amount. Referee compromise degrades +the *amount-deterrent*, never the *exit*. As everywhere else, this hardens the trusted +layer; only a covenant (§12.2) converts amount-safety into cryptographic self-custody. + ## 10. Attack analysis appendix Fifteen adversarial findings shaped this spec — A1–A13 from the protocol red-team, From a673b5d138c363070cfb7a523de8b30e6d920ec9 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 22:47:07 +0000 Subject: [PATCH 12/15] =?UTF-8?q?docs:=20expand=20referee=20fidelity=20bon?= =?UTF-8?q?ds=20in=20=C2=A79.1=20(Sybil=20vs=20punishment)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deepen the bonded-referee treatment per review discussion: separate the two jobs a referee fidelity bond does. - Sybil resistance (the clean, Bitcoin-native win): time-locked (CLTV, weight ~ amount x duration) or burned bonds make forged independence cost k locked bonds and tie a costly persistent identity to each referee — no slashing machinery needed, no external staking network imported. Sizing chains: Sum(referee bonds to reach k) >= operatorBond >= stealable value. Bonds are time-bounded and must be renewed; the under-bonded-pool client check should verify referee bonds are live and sized too. - Punishment (honestly bounded): slashing referees hits the same Script-can't-verify wall as the operator bond; partial backstops are equivocation self-slashing (one-time/nonce-committed sigs; GSR-gated in general), TEE-attestation-gated bond recovery, and reputation. Keep referees independent of the operator/MPC set. Doc-only; TOC links and hygiene re-verified; fmt and tests pass. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 37 ++++++++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 6 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index b56bb31..47e3671 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -542,12 +542,37 @@ escapes the trilemma: enclaves of mixed make), and accept the added hardware-vendor trust. The output constraint to `{victim, operator}` is enforced by the enclave, not by Script (Script cannot constrain a multisig's outputs without a covenant). -- **Bonded referees (skin in the game).** Referees post their own (fidelity) bonds, so a - referee that co-signs an unbacked payout or refuses a valid claim — both objectively - detectable — is itself slashable. This makes referee collusion −EV, the same logic as - the operator bond. Keep the referee set **independent of the Operator / threshold-MPC - set (§13.5)**; reusing one staked set for both roles correlates operator-collusion with - referee-collusion. +- **Referee fidelity bonds — Sybil resistance first, punishment second.** Each referee + identity is gated by a *publicly verifiable* Bitcoin fidelity bond — time-locked (a CLTV + UTXO whose weight grows with the amount locked and the lock duration) or burned. The bond + does two distinct jobs that must not be conflated: + - **Sybil resistance (the clean, Bitcoin-native win).** A fidelity bond makes forged + independence *expensive*: standing up `k` referees costs `k` locked bonds, and each + bond ties a persistent, costly identity to a referee so reputation accrues to it. This + is exactly the economic backing the `k`-of-`n` independence assumption was missing (the + node-collusion worry of §13.5) — and it needs **no slashing machinery**: the bond only + has to *exist and be provable*. It also keeps the construction Bitcoin-native rather + than importing an external staking network. **Sizing chains cleanly:** corrupting the + quorum must cost more than the operator bond it guards, which is itself + `requiredCoverage` (≥ at-risk-per-epoch), so `Σ(referee bonds to reach k) ≥ + operatorBond ≥ stealable value`. Like the pool's own bond, fidelity bonds are + time-bounded and must be **renewed**; the client check that refuses an under-bonded + pool (§9) should verify the *referee* bonds are live and sized, not only the + Operator's. + - **Punishment (honestly bounded).** Making a referee bond *slashable on misbehavior* + hits the same wall as the operator bond — Bitcoin Script cannot verify "this payout was + unbacked" or "this referee censored a valid claim." Three partial backstops, strongest + first: (i) **equivocation self-slashing** — structure each referee's payout + authorization so that co-signing two conflicting payouts for the same case leaks that + referee's key and anyone sweeps its bond (the one-time/nonce-committed-signature + construction; pure-ish Script for the double-sign case, GSR-gated in general, §12.2); + (ii) **attestation-gated recovery** — a referee reclaims its time-locked bond only + against a TEE attestation that it followed the protocol, so misbehavior forfeits + recovery (the off-chain TEE trust of the bullet above); (iii) **reputation** — for known + bonded entities a public, costly, persistent identity makes getting-caught + business-ending, the suspenders to the on-chain belt. Keep the referee set + **independent of the Operator / threshold-MPC set (§13.5)** so the two collusions do not + correlate. - **The Operator may sit in the `k`-of-`n` for the *return* path only, never the *slashing* path.** Split the bond into two spending conditions: **pay-victim** requires `k`-of-`n` referees with the **Operator excluded** (otherwise it could block its own From 506bbb6c1fcd0110bd0c53870ae3678941c6ab3c Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 28 Jun 2026 22:39:16 +0000 Subject: [PATCH 13/15] docs: signpost attack findings + add Bond/requiredCoverage to vocabulary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Conservative /simplify pass on a docs-only branch (the code lenses don't apply). Three prose-review agents found the doc's density and audience-tier layering are intentional and earned, and that most proposed cuts would degrade it (re-jargonizing the no-math sections, stripping reviewed nuance). Applied only the two additive altitude wins: - Abstract now signposts the fifteen adversarial findings (A1-A15, §10), which were referenced from §6 onward before §10 names them. - §4 Vocabulary gains Bond and requiredCoverage rows (definitions matching §9), so the terms used with forward (§9) pointers in §6-§7 have a single lookup point at the right altitude. Rejected (would degrade): compressing the plain-language tier, the technical bond/MPC/GSR nuance, the standalone trust statement, the §8a race conclusion, and the per-construction §13.5 trilemma codas; §7.1a/§8a/ §9.1 numbering left as-is (defensible, all links resolve). Doc-only; TOC links and hygiene re-verified; fmt and tests pass. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index 47e3671..634c1d2 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -5,8 +5,9 @@ A protocol for giving open-membership pool contracts on Arkade a *standing* unilateral exit, enforced by recurrent state updates between the transacting parties. This document is a design specification: it defines the protocol lifecycle, the trust model, the -attack analysis that shaped it, and the compiler surface that would standardize it. It -proposes no code changes; the compiler-facing sections are future work. +attack analysis — fifteen adversarial findings (A1–A15), detailed in §10 — that shaped +it, and the compiler surface that would standardize it. It proposes no code changes; the +compiler-facing sections are future work. Cross-references: [`options.md`](./options.md) (two-tapleaf model, exit/renew options), [`bonds.md`](./bonds.md) (pool covenants and today's exit asymmetry), @@ -197,6 +198,8 @@ PULSE closes this gap. | **Heartbeat** | A pulse whose transition tx lands on-chain, re-anchoring the pool tip with a freshly built full lattice | | **Δ (`exit`)** | The exit leaf's relative timelock — the contest window | | **`renew`** | The pool's absolute expiry, after which the Operator's sweep path eventually matures | +| **Bond** | The Operator's on-chain security deposit, held by a `k`-of-`n` federation of referees independent of the Operator; pays victims on objective equivocation evidence or returns to the Operator at expiry (§9) | +| **`requiredCoverage`** | The minimum bond size — an at-risk-*per-epoch* floor (the passive value a single collusion could short before the next heartbeat), not total TVL (§9) | ## 5. Interactivity requirements From eeb215839b79e8d30acd0ef9173cc9bbc8cfcd7e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 29 Jun 2026 09:52:13 +0000 Subject: [PATCH 14/15] docs: make FROST-in-TEE operator the primary model; demote the bond MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per design redirection: the capital-intensive TVL-sized bond and the separate k-of-n referee federation are too heavy. Reframe §9 around a FROST-in-TEE Operator as the primary enforcement. - Primary model: a permissionless FROST federation in TEEs (anyone peers in via resharing). Attested enclaves run the pulse-validity policy and refuse to contribute a FROST share to an invalid pulse, so a passive-member- shorting lattice cannot be signed at all — no TVL capital, no separate referee quorum. The protocol reduces to a background framework that generates the recurrent exit lattices as part of normal per-pulse signing. - Honest cost: amount safety now rests on '>= t enclaves hold' (hardware- attestation trust, defense-in-depth, needs diverse membership); with no bond a threshold-break is uncompensated, though exit stays TEE-independent. Fidelity bonds survive only as cheap Sybil-resistance of the membership. - The bonded federation is demoted to an OPTIONAL economic compensation backstop for TEE-skeptics; the existing referee/fidelity-bond analysis is now its detail. - Trust statement updated: exit amount is 'enforced, not trustless' — primary FROST-in-TEE (no capital) vs optional bond; trilemma unchanged (enclave/committee trust, not consensus). TOC + anchors re-verified. Doc-only; fmt and tests pass. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 60 ++++++++++++++++++++++++++++-------- 1 file changed, 48 insertions(+), 12 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index 634c1d2..621aef1 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -37,6 +37,8 @@ emulated introspection). - [The recourse ladder (strongest → weakest)](#the-recourse-ladder-strongest--weakest) - [Why the detect-before-consumed race favors the thief, not the victim](#why-the-detect-before-consumed-race-favors-the-thief-not-the-victim) - [9. Bond and enforcement layers](#9-bond-and-enforcement-layers) + - [Primary model: a FROST-in-TEE operator (no capital bond)](#primary-model-a-frost-in-tee-operator-no-capital-bond) + - [Optional economic backstop: the bonded federation](#optional-economic-backstop-the-bonded-federation) - [9.1 Hardening the referees (TEE-constrained, bonded, conflict-free)](#91-hardening-the-referees-tee-constrained-bonded-conflict-free) - [10. Attack analysis appendix](#10-attack-analysis-appendix) - [11. Compiler surface (future work — gated zones)](#11-compiler-surface-future-work--gated-zones) @@ -472,8 +474,40 @@ exists to prevent anyone from forgetting. pre-signed Bitcoin transactions. An emulator shutdown — including the Operator killing its own attested execution environment — is a **freeze, not a theft**: watchtowers trip on the missed heartbeat commitment and every member exits on L1 with zero Operator -involvement. The bond exists only as a *deterrent against active collusion-theft* -(§8, row 3), and its enforcement must therefore be independent of the Operator's +involvement. What remains to defend is the *amount* a passive member is owed when an active set +colludes (§8, row 3). There are two ways to defend it; the simpler one is now primary. + +### Primary model: a FROST-in-TEE operator (no capital bond) + +Take the Operator to be a **permissionless FROST federation running in TEEs** — anyone can +peer in via threshold resharing, and each node's signing share lives in an attested +enclave. The enclave runs the pulse-validity policy (carry-forward, conservation, correct +passive balances) and **refuses to contribute its FROST share to an invalid pulse**. So a +lattice that shorts a passive member **cannot be signed at all** — strictly stronger than +"it can be signed but you are compensated," and it needs **no TVL-sized capital and no +separate referee quorum**. The protocol then reduces to what it should be: a **framework +that generates the recurrent exit lattices in the background**, as part of the +federation's normal per-pulse signing — members and watchtowers receive their branch +automatically, with no bond ceremony. + +The honest cost: the amount guarantee now rests on "**≥ `t` enclaves hold**" — hardware- +attestation trust rather than economic trust. It is **defense-in-depth, not a sovereign +root** (enclaves get broken), so membership must be *diverse*, so that breaking the FROST +threshold means compromising `t` **independent** operators' hardware, not one entity's. +And with no bond, a successful threshold-break is an **uncompensated** loss rather than a +compensated one — though the exit stays TEE-independent (your last-good lattice is plain +pre-signed Bitcoin), so the freeze/dark case still gets everyone out. Fidelity bonds +survive here only as **cheap Sybil-resistance of the permissionless membership** (so +"anyone can peer" can't become one entity quietly holding `t` shares) — not as capital +sized to TVL. This **swaps the bond's economic trust for the enclave threshold's hardware +trust**; like everything else it does not escape the trilemma (§13.2), it relocates the +third corner. + +### Optional economic backstop: the bonded federation + +For deployments that prefer an economic guarantee over hardware trust — or that want a +*compensation* backstop against a TEE-threshold break — the original bonded model follows. +It is now **optional**, not load-bearing; its enforcement is independent of the Operator's infrastructure: - **A `checkSigFromStack` punishment leaf would be circular — rejected.** @@ -916,13 +950,15 @@ lattice *cryptography*.) > PULSE has **two security models, not one.** The **exit mechanism is 1-of-N** and > emulator-independent — pure pre-signed L1 transactions, any one honest data-holder can > broadcast, Operator or emulator shutdown means *freeze, never theft*. The **exit amount -> is bonded, not trustless**: a passive member's balance is protected cryptographically -> only by the honesty of `{Operator ∪ the transacting parties}` of a pulse — a set that -> excludes the victim and can be as small as two — and below that by a federation-held -> bond slashed on objective equivocation evidence. This split is the **trilemma** (§13.2): -> with non-interactive passive members and no covenant, amount-safety *must* be bonded -> rather than trustless. The recommended no-fork hardening is a **k-of-n federated -> Operator** (§13.5), which widens the trusted set without escaping the trilemma. -> Covenant-grade trustlessness of the amount is reachable only through the GSR annex -> (§12.2); absent any fork, this **trustless-mechanism / bonded-amount** model is the end -> state, and the design is engineered to be livable as exactly that. +> is enforced, not trustless**: a passive member's balance is protected only by the +> honesty of `{Operator ∪ the transacting parties}` of a pulse — a set that excludes the +> victim and can be as small as two. The **primary model** closes that set with a +> **FROST-in-TEE Operator** (§9) whose attested enclaves refuse to sign an invalid pulse, +> so the bad lattice cannot be produced — hardware-attestation trust, no capital; an +> **optional bond** adds an economic *compensation* backstop for those who prefer it to +> hardware trust. Either way the amount rests on enclave-threshold or committee trust, not +> cryptographic self-custody — the **trilemma** (§13.2): with non-interactive passive +> members and no covenant, amount-safety *must* be enforced by a trusted layer rather than +> by consensus. Covenant-grade trustlessness of the amount is reachable only through the +> GSR annex (§12.2); absent any fork, this **trustless-mechanism / enforced-amount** model +> is the end state, and the design is engineered to be livable as exactly that. From 7fc7aea9e520bef633807d04d82d920e7c0d1f33 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 29 Jun 2026 12:08:39 +0000 Subject: [PATCH 15/15] =?UTF-8?q?docs:=20reconcile=20=C2=A713.5=20with=20t?= =?UTF-8?q?he=20=C2=A79=20FROST-in-TEE=20primary=20model?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The §13.5 'threshold-MPC operator' paragraph re-derived what the new §9 primary model now owns. Make §9 canonical and trim §13.5 to a pointer. - Replace the §13.5 'Realizing the federation as a threshold-MPC operator' paragraph with a short pointer to §9's FROST-in-TEE primary model, keeping only the non-duplicative bits: the A2/A8 upgrade, 2PC-MPC as an alternative instantiation of the same role, cooperative-path-only, and the trilemma framing. - Generalize the Sybil-resistance paragraph from MPC-specific to any threshold operator (nodes or enclaves): independence can't be proven cryptographically; diverse membership + staking/fidelity bonds sized above stealable value; 'no worse than the floor'; Nakamoto-coefficient gating. (Applied via scripted splice because the Edit tool's permission stream was erroring; same content.) Doc-only; TOC/anchors/hygiene re-verified; fmt and tests pass. https://claude.ai/code/session_01JcfMHSBs6QWmzEx6Xn51E2 --- docs/recurrent-exit-pulse.md | 70 ++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 40 deletions(-) diff --git a/docs/recurrent-exit-pulse.md b/docs/recurrent-exit-pulse.md index 621aef1..2c204ca 100644 --- a/docs/recurrent-exit-pulse.md +++ b/docs/recurrent-exit-pulse.md @@ -876,46 +876,36 @@ attest. A `1-of-n` federation is *weaker* than a single Operator (any one node e collusion); `n-of-n` is maximally safe but liveness-fragile. The bond and attestation parameters (§9, §12.1 item 1) are sized against the same `k`. -**Realizing the federation as a threshold-MPC operator.** The strongest instantiation of -this federation is not a hand-rolled multisig but a **threshold-MPC signing network** that -acts as the Operator's side of every signature. A non-collusive scheme (the kind where the -network can sign *only* together with the user, and the network side is itself an MPC -across hundreds–thousands of nodes with identifiable abort — e.g. 2PC-MPC) is a clean -drop-in: because such schemes now produce **Schnorr/Taproot-compatible** signatures, the -network simply produces the Operator's share of `P_k`, `A_k`, and `h_k`, while the -transacting parties `M_k` remain the always-required co-signers — no change to the Bitcoin -side of the design. This upgrades three named weaknesses at once: operator-collusion theft -now requires breaking the MPC threshold rather than bribing one party; the network can -**enforce the verification-gate policy *before* it co-signs** — refusing its share for any -pulse that violates passive carry-forward or conservation — which turns A2's -policy-but-not-incentive-compatible client check into something an honest threshold -actually enforces; and key-resurrection (A8) now needs threshold collusion. Identifiable -abort also lets the network's own staking punish misbehavior, partly subsuming the §9 -referee federation for the operator-collusion case. **The same honest ceiling still -binds, and two limits are specific to this realization:** the MPC sits on the -**cooperative path only** — the exit must stay pre-signed and MPC-independent, so that the -lattice broadcasts even if the MPC network is gone (never put MPC liveness in the custody -path); and it does **not** make the victim a signer, so amount-safety merely moves from -"trust one Operator" to "trust the MPC threshold" — quantitatively far stronger, but still -committee trust, not cryptographic self-custody, and so it does not escape the trilemma -(§13.2). It also imports that network's own liveness, security, and economic assumptions — -a real external dependency weighed against PULSE's "buildable on Arkade" baseline. - -**The threshold benefit is only as real as the network's Sybil resistance.** "Collusion -now requires breaking the MPC threshold" holds *only if the nodes are genuinely -independent* — and node independence **cannot be proven cryptographically**; it is the -same unprovable real-world property as key deletion (A8) and federation non-collusion -(§9). It rests entirely on economics and social structure: per-node staking with slashing -sized **above the stealable value** (the MPC analogue of `requiredCoverage`, §12.1 item 3), -identifiable abort (which punishes a *defector* but not a *colluding majority*), and -genuine stake distribution. If those fail — the "nodes" are one entity behind a façade, or -a staked majority colludes — the threshold collapses back to the single-Operator-collusion -case of §8 (row 3), **but no worse**: exit stays MPC-independent and the bonded-amount -model already assumes that collusion is possible, so a fake threshold degrades PULSE to its -existing floor, never beneath it. Wallets should therefore gate the "MPC-secured" label on -a measured stake-distribution bound (e.g. a Nakamoto-coefficient floor), the same way they -refuse an under-bonded pool (§9) — the benefit is quantitative and economic, never a -cryptographic guarantee of independence. +**Realizing the federated Operator.** Its canonical realization is the **FROST-in-TEE +primary model of §9**: a threshold-attested signer that refuses to produce its share for an +invalid pulse, so a passive-member-shorting lattice cannot be signed at all — which also +turns A2's policy-but-not-incentive-compatible client check into something an honest +threshold enforces, and raises key-resurrection (A8) to threshold collusion. A +non-collusive **2PC-MPC** network (user + a hundreds-to-thousands-node MPC with +identifiable abort, producing Schnorr/Taproot-compatible signatures) is an alternative +instantiation of the same role, and its identifiable-abort slashing can subsume the +*optional* referee federation (§9). Both sit on the **cooperative path only** — the exit +stays pre-signed and signer-independent — and neither makes the victim a signer, so neither +escapes the trilemma (§13.2): amount trust moves from "one Operator" to "the threshold," +quantitatively far stronger but still committee/enclave trust, not cryptographic +self-custody. + +**The threshold benefit is only as real as the operator set's Sybil resistance.** +"Collusion now requires breaking the threshold" holds *only if the nodes (or enclaves) are +genuinely independent* — and that independence **cannot be proven cryptographically**; it +is the same unprovable real-world property as key deletion (A8) and federation +non-collusion (§9). It rests on economics and social structure: diverse membership, staking +or fidelity bonds sized **above the stealable value** (the analogue of `requiredCoverage`, +§12.1 item 3), identifiable abort (which punishes a *defector* but not a *colluding +majority*), and genuine distribution — so that breaking the threshold means compromising +`t` *independent* operators (or their enclaves), not one entity's. If those fail — the +"nodes" are one entity behind a façade, or a staked majority colludes — the threshold +collapses back to the single-Operator-collusion case of §8 (row 3), **but no worse**: exit +stays signer-independent and the model already assumes that collusion is possible, so a fake +threshold degrades PULSE to its existing floor, never beneath it. Wallets should therefore +gate the "threshold-secured" label on a measured distribution bound (e.g. a +Nakamoto-coefficient floor), the same way they refuse an under-bonded pool (§9) — the +benefit is quantitative, never a cryptographic guarantee of independence. ### 13.6 Feasibility: the lattice is an Arkade VTXO tree