DA-04 · LESSON 09

Failure, rotation, and migration

KEY DEFINITIONS

Terms used in this lesson

Guardian: A Ducat policy-checking signer that can authorize or reject defined protocol transactions.
DKG: Distributed key generation: participants create shares of a group key without one party learning the complete secret.
Validator: Software or a participant that independently checks state transitions under a system's rules. The exact role depends on the protocol being discussed.
Oracle: A system that reports outside information, such as a market price, for use by a protocol.
Vault: A set of Bitcoin outputs and spending rules that holds collateral and represents the current loan state.

The v1 custody design treats lost Guardians and rotations as a new DKG plus funds migration rather than reconstructing shares centrally.

35 min Difficulty 4/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · ducat vaultA Ducat action moves one Bitcoin-anchored vault state to a successorSelect any state to inspect its exact role.

RELATIONSHIP MAPInputs, rule, and outputs

01
PREDECESSORCurrent vault outpoint
The current Bitcoin output anchors collateral and identifies the state being spent.
02
REQUESTFailure, rotation, and migration
The Failure, rotation, and migration workflow proposes one exact action and successor state.
03
POLICYProfile, oracle, signatures
Applicable policy, price evidence, authorization, and transaction shape are checked.
04
BITCOIN SPENDScript-valid transaction
Bitcoin miners and nodes can include only a transaction that satisfies Bitcoin rules.
05
SUCCESSORNew outpoint and state
Ducat validators reconstruct debt, collateral, token, and account changes from the confirmed transaction.

Rule shown: Bitcoin checks the spend; Ducat components independently reconstruct and validate the additional protocol state.

STAGE 1 OF 5PREDECESSOR: Current vault outpoint

The current Bitcoin output anchors collateral and identifies the state being spent.

Governing relationship: Bitcoin checks the spend; Ducat components independently reconstruct and validate the additional protocol state. Complete path: 1. PREDECESSOR, Current vault outpoint. The current Bitcoin output anchors collateral and identifies the state being spent. 2. REQUEST, Failure, rotation, and migration. The Failure, rotation, and migration workflow proposes one exact action and successor state. 3. POLICY, Profile, oracle, signatures. Applicable policy, price evidence, authorization, and transaction shape are checked. 4. BITCOIN SPEND, Script-valid transaction. Bitcoin miners and nodes can include only a transaction that satisfies Bitcoin rules. 5. SUCCESSOR, New outpoint and state. Ducat validators reconstruct debt, collateral, token, and account changes from the confirmed transaction.

1. State transitionWhat exists, what changes, and what results

BEFORE

Use a 3-of-4 old group with one unavailable participant and a new DKG key beta. Required practice uses different keys and topology.

MECHANISM

Monitoring and governance determine whether quorum loss, suspected compromise, or planned replacement requires migration.

AFTER

Client, validator, and profile activation waits for key agreement plus complete migration or explicit dual-version support. Required practice uses a separate server-executed…

Text equivalent: Starting from Use a 3-of-4 old group with one unavailable participant and a new DKG key beta. Required practice uses different keys and topology. The mechanism begins when Monitoring and governance determine whether quorum loss, suspected compromise, or planned replacement requires migration. The resulting lesson is Client, validator, and profile activation waits for key agreement plus complete migration or explicit dual-version support. Required practice uses a separate server-executed vector.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 4

Detect an unavailable or compromised group

Monitoring and governance determine whether quorum loss, suspected compromise, or planned replacement requires migration.

Complete path: 1. Detect an unavailable or compromised group: Monitoring and governance determine whether quorum loss, suspected compromise, or planned replacement requires migration. 2. Run a fresh DKG: The new participant set creates a distinct group public key and sealed share packages. 3. Authorize migration with the old policy: If the old quorum remains available, it signs action-specific transactions moving controlled funds or successor states to commitments using the new key. 4. Update every dependent profile: Clients, validators, oracle-linked scripts, and operations must agree on the activation boundary and preserve old-vault spendability.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The worked case executes the named inputs and checks in the displayed order. Clients, validators, oracle-linked scripts, and operations must agree on the activation boundary and preserve old-vault spendability.

CHANGED CONDITION

A missing, malformed, stale, unauthorized, or inconsistent required input stops at its first named boundary. Existing outputs commit existing keys or scripts. Funds or state generally need an authorized Bitcoin migration path.

Important distinction: Guardian rotation is a configuration edit because Bitcoin outputs follow the newest key automatically. Existing outputs commit existing keys or scripts. Funds or state generally need an authorized Bitcoin migration path.

Text equivalent: The accepted path is enforced by The worked case executes the named inputs and checks in the displayed order. Clients, validators, oracle-linked scripts, and operations must agree on the activation boundary and preserve old-vault spendability. If the required condition changes, A missing, malformed, stale, unauthorized, or inconsistent required input stops at its first named boundary. Existing outputs commit existing keys or scripts. Funds or state generally need an authorized Bitcoin migration path.

Loading lesson visuals...

Learn the idea

Rotation replaces an active Guardian group or key. A new DKG creates a new group key, but existing Bitcoin outputs still commit to old spending paths. Activation is safe only after affected outputs are migrated or the new deployment explicitly supports both old and new commitments.

GUIDED EXPLANATION1/4 ideas inspected

Detect an unavailable or compromised group

Monitoring and governance determine whether quorum loss, suspected compromise, or planned replacement requires migration.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Guardian rotation is a configuration edit because Bitcoin outputs follow the newest key automatically.”

Existing outputs commit existing keys or scripts. Funds or state generally need an authorized Bitcoin migration path.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.