DA-01 · LESSON 07

External trust and availability

KEY DEFINITIONS

Terms used in this lesson

Guardian: A Ducat policy-checking signer that can authorize or reject defined protocol transactions.
Oracle: A system that reports outside information, such as a market price, for use by a protocol.
Validator: Software or a participant that independently checks state transitions under a system's rules. The exact role depends on the protocol being discussed.
Preimage: The original secret data whose hash equals a previously committed value.

Guardians, oracles, validators, relays, clients, and operators remain explicit honesty or liveness dependencies even where Bitcoin constrains the final spend.

55 min Difficulty 4/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · ducat vaultA Ducat action moves one Bitcoin-anchored vault state to a successorSelect any state to inspect its exact role.

RELATIONSHIP MAPInputs, rule, and outputs

01
PREDECESSORCurrent vault outpoint
The current Bitcoin output anchors collateral and identifies the state being spent.
02
REQUESTExternal trust and availability
The External trust and availability workflow proposes one exact action and successor state.
03
POLICYProfile, oracle, signatures
Applicable policy, price evidence, authorization, and transaction shape are checked.
04
BITCOIN SPENDScript-valid transaction
Bitcoin miners and nodes can include only a transaction that satisfies Bitcoin rules.
05
SUCCESSORNew outpoint and state
Ducat validators reconstruct debt, collateral, token, and account changes from the confirmed transaction.

Rule shown: Bitcoin checks the spend; Ducat components independently reconstruct and validate the additional protocol state.

STAGE 1 OF 5PREDECESSOR: Current vault outpoint

The current Bitcoin output anchors collateral and identifies the state being spent.

Governing relationship: Bitcoin checks the spend; Ducat components independently reconstruct and validate the additional protocol state. Complete path: 1. PREDECESSOR, Current vault outpoint. The current Bitcoin output anchors collateral and identifies the state being spent. 2. REQUEST, External trust and availability. The External trust and availability workflow proposes one exact action and successor state. 3. POLICY, Profile, oracle, signatures. Applicable policy, price evidence, authorization, and transaction shape are checked. 4. BITCOIN SPEND, Script-valid transaction. Bitcoin miners and nodes can include only a transaction that satisfies Bitcoin rules. 5. SUCCESSOR, New outpoint and state. Ducat validators reconstruct debt, collateral, token, and account changes from the confirmed transaction.

1. State transitionWhat exists, what changes, and what results

BEFORE

Use an illustrative 3-of-5 signer policy that differs from required practice. The captured evidence does not establish that this is the live deployment threshold.

MECHANISM

Ask whether a dishonest actor or colluding threshold can authorize a loss, publish false data, or cause participants to reconstruct incompatible state.

AFTER

A threshold can tolerate some downtime while still having a collusion assumption. Signed data can prove who attested to bytes without proving that the reported market price w…

Text equivalent: Starting from Use an illustrative 3-of-5 signer policy that differs from required practice. The captured evidence does not establish that this is the live deployment threshold. The mechanism begins when Ask whether a dishonest actor or colluding threshold can authorize a loss, publish false data, or cause participants to reconstruct incompatible state. The resulting lesson is A threshold can tolerate some downtime while still having a collusion assumption. Signed data can prove who attested to bytes without proving that the reported market price was true.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 4

Model safety

Ask whether a dishonest actor or colluding threshold can authorize a loss, publish false data, or cause participants to reconstruct incompatible state.

Complete path: 1. Model safety: Ask whether a dishonest actor or colluding threshold can authorize a loss, publish false data, or cause participants to reconstruct incompatible state. 2. Model liveness: Ask whether an unavailable Guardian quorum, oracle, relay set, fee market, or client blocks an otherwise valid action. 3. Model detectability: Signed events, reproducible validation, policy digests, and Bitcoin history can expose some failures without automatically repairing them. 4. Name recovery limits: Retry, alternate relays, fee bumps, key rotation, migration, or governance action each require preplanned authority and compatibility.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The worked case executes the named inputs and checks in the displayed order. Retry, alternate relays, fee bumps, key rotation, migration, or governance action each require preplanned authority and compatibility.

CHANGED CONDITION

A missing, malformed, stale, unauthorized, or inconsistent required input stops at its first named boundary. A required signer, oracle preimage, data path, or fee path can block an on-chain transition even when Bitcoin itself is operating normally.

Important distinction: If funds are locked in Bitcoin, external downtime can only delay the web interface. A required signer, oracle preimage, data path, or fee path can block an on-chain transition even when Bitcoin itself is operating normally.

Text equivalent: The accepted path is enforced by The worked case executes the named inputs and checks in the displayed order. Retry, alternate relays, fee bumps, key rotation, migration, or governance action each require preplanned authority and compatibility. If the required condition changes, A missing, malformed, stale, unauthorized, or inconsistent required input stops at its first named boundary. A required signer, oracle preimage, data path, or fee path can block an on-chain transition even when Bitcoin itself is operating normally.

Loading lesson visuals...

Learn the idea

Honesty means an actor follows the required rule. Liveness means the actor remains available in time. Safety means a failure does not authorize a forbidden loss or inconsistent state. Visibility means evidence exposes what happened, even when it cannot prevent or repair the failure. Ducat can constrain actions with Bitcoin while still depending on Guardians, oracle workflows, relays, clients, validators, and operators.

GUIDED EXPLANATION1/4 ideas inspected

Model safety

Ask whether a dishonest actor or colluding threshold can authorize a loss, publish false data, or cause participants to reconstruct incompatible state.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“If funds are locked in Bitcoin, external downtime can only delay the web interface.”

A required signer, oracle preimage, data path, or fee path can block an on-chain transition even when Bitcoin itself is operating normally.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.