DA-07 · LESSON 02

Guardian-validator separation

KEY DEFINITIONS

Terms used in this lesson

Guardian: A Ducat policy-checking signer that can authorize or reject defined protocol transactions.
Validator: Software or a participant that independently checks state transitions under a system's rules. The exact role depends on the protocol being discussed.
Vault: A set of Bitcoin outputs and spending rules that holds collateral and represents the current loan state.
UNIT: Ducat’s dollar-pegged stablecoin, the asset a borrower can create against bitcoin collateral.
API: Application programming interface: a defined way for one program to request data or actions from another.
BTC: The common market ticker for bitcoin.
Collateral: An asset pledged against a debt; it can be used to cover the debt if agreed conditions are breached.

Validators reconstruct and check state while Guardians control signing; centralizing or confusing these roles changes the threat model.

45 min Difficulty 5/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · ducat vaultA Ducat action moves one Bitcoin-anchored vault state to a successorSelect any state to inspect its exact role.

RELATIONSHIP MAPInputs, rule, and outputs

01
PREDECESSORCurrent vault outpoint
The current Bitcoin output anchors collateral and identifies the state being spent.
02
REQUESTGuardian-validator separation
The Guardian-validator separation workflow proposes one exact action and successor state.
03
POLICYProfile, oracle, signatures
Applicable policy, price evidence, authorization, and transaction shape are checked.
04
BITCOIN SPENDScript-valid transaction
Bitcoin miners and nodes can include only a transaction that satisfies Bitcoin rules.
05
SUCCESSORNew outpoint and state
Ducat validators reconstruct debt, collateral, token, and account changes from the confirmed transaction.

Rule shown: Bitcoin checks the spend; Ducat components independently reconstruct and validate the additional protocol state.

STAGE 1 OF 5PREDECESSOR: Current vault outpoint

The current Bitcoin output anchors collateral and identifies the state being spent.

Governing relationship: Bitcoin checks the spend; Ducat components independently reconstruct and validate the additional protocol state. Complete path: 1. PREDECESSOR, Current vault outpoint. The current Bitcoin output anchors collateral and identifies the state being spent. 2. REQUEST, Guardian-validator separation. The Guardian-validator separation workflow proposes one exact action and successor state. 3. POLICY, Profile, oracle, signatures. Applicable policy, price evidence, authorization, and transaction shape are checked. 4. BITCOIN SPEND, Script-valid transaction. Bitcoin miners and nodes can include only a transaction that satisfies Bitcoin rules. 5. SUCCESSOR, New outpoint and state. Ducat validators reconstruct debt, collateral, token, and account changes from the confirmed transaction.

1. State transitionWhat exists, what changes, and what results

BEFORE

Vault V holds 1 BTC, owes 40,000 UNIT, and uses a displayed 1.5 minimum ratio at a $100,000 BTC price. A request tries to withdraw 0.7 BTC, leaving 0.3 BTC worth $30,000.

MECHANISM

They derive current vaults, accounts, reserves, and UNIT state from the selected Bitcoin chain.

AFTER

Guardian and validator can evaluate related policy, but at different times and with different powers. Neither can rewrite a confirmed Bitcoin output.

Text equivalent: Starting from Vault V holds 1 BTC, owes 40,000 UNIT, and uses a displayed 1.5 minimum ratio at a $100,000 BTC price. A request tries to withdraw 0.7 BTC, leaving 0.3 BTC worth $30,000. The mechanism begins when They derive current vaults, accounts, reserves, and UNIT state from the selected Bitcoin chain. The resulting lesson is Guardian and validator can evaluate related policy, but at different times and with different powers. Neither can rewrite a confirmed Bitcoin output.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 4

Let validators observe

They derive current vaults, accounts, reserves, and UNIT state from the selected Bitcoin chain.

Complete path: 1. Let validators observe: They derive current vaults, accounts, reserves, and UNIT state from the selected Bitcoin chain. 2. Let Guardians authorize: They independently validate a request before producing the required signature or threshold share. 3. Compare decisions: Guardian pre-signing policy and validator post-chain reconstruction should implement compatible rules but operate at different times and powers. 4. Model centralization: One operator controlling both can censor construction, signing, state APIs, and public interpretation even if Bitcoin remains independently verifiable.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The worked case executes the named inputs and checks in the displayed order. One operator controlling both can censor construction, signing, state APIs, and public interpretation even if Bitcoin remains independently verifiable.

CHANGED CONDITION

A missing, malformed, stale, unauthorized, or inconsistent required input stops at its first named boundary. One controls authorization before broadcast; the other reconstructs and serves state from chain history. Their failure powers differ.

Important distinction: Because Guardian and validator run the same rules, their roles are interchangeable. One controls authorization before broadcast; the other reconstructs and serves state from chain history. Their failure powers differ.

Text equivalent: The accepted path is enforced by The worked case executes the named inputs and checks in the displayed order. One operator controlling both can censor construction, signing, state APIs, and public interpretation even if Bitcoin remains independently verifiable. If the required condition changes, A missing, malformed, stale, unauthorized, or inconsistent required input stops at its first named boundary. One controls authorization before broadcast; the other reconstructs and serves state from chain history. Their failure powers differ.

Loading lesson visuals...

Learn the idea

A Guardian checks a proposed transaction before broadcast and controls whether its required signature is produced. A validator reads confirmed Bitcoin transactions afterward and decides whether they form valid Ducat state. Authorization is permission to attempt a spend; reconstruction is the later interpretation of a confirmed spend. Combining both services under one operator increases censorship, outage, and information-control risk even though Bitcoin remains independently verifiable.

GUIDED EXPLANATION1/4 ideas inspected

Let validators observe

They derive current vaults, accounts, reserves, and UNIT state from the selected Bitcoin chain.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Because Guardian and validator run the same rules, their roles are interchangeable.”

One controls authorization before broadcast; the other reconstructs and serves state from chain history. Their failure powers differ.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.