DA-07 · LESSON 09

Audit and evidence

KEY DEFINITIONS

Terms used in this lesson

Guardian: A Ducat policy-checking signer that can authorize or reject defined protocol transactions.
DKG: Distributed key generation: participants create shares of a group key without one party learning the complete secret.
Validator: Software or a participant that independently checks state transitions under a system's rules. The exact role depends on the protocol being discussed.

Tests, conformance vectors, attestation receipts, reproducible builds, live rehearsals, and external review support different security claims.

35 min Difficulty 5/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · ducat vaultA Ducat action moves one Bitcoin-anchored vault state to a successorSelect any state to inspect its exact role.

RELATIONSHIP MAPInputs, rule, and outputs

01
PREDECESSORCurrent vault outpoint
The current Bitcoin output anchors collateral and identifies the state being spent.
02
REQUESTAudit and evidence
The Audit and evidence workflow proposes one exact action and successor state.
03
POLICYProfile, oracle, signatures
Applicable policy, price evidence, authorization, and transaction shape are checked.
04
BITCOIN SPENDScript-valid transaction
Bitcoin miners and nodes can include only a transaction that satisfies Bitcoin rules.
05
SUCCESSORNew outpoint and state
Ducat validators reconstruct debt, collateral, token, and account changes from the confirmed transaction.

Rule shown: Bitcoin checks the spend; Ducat components independently reconstruct and validate the additional protocol state.

STAGE 1 OF 5PREDECESSOR: Current vault outpoint

The current Bitcoin output anchors collateral and identifies the state being spent.

Governing relationship: Bitcoin checks the spend; Ducat components independently reconstruct and validate the additional protocol state. Complete path: 1. PREDECESSOR, Current vault outpoint. The current Bitcoin output anchors collateral and identifies the state being spent. 2. REQUEST, Audit and evidence. The Audit and evidence workflow proposes one exact action and successor state. 3. POLICY, Profile, oracle, signatures. Applicable policy, price evidence, authorization, and transaction shape are checked. 4. BITCOIN SPEND, Script-valid transaction. Bitcoin miners and nodes can include only a transaction that satisfies Bitcoin rules. 5. SUCCESSOR, New outpoint and state. Ducat validators reconstruct debt, collateral, token, and account changes from the confirmed transaction.

1. State transitionWhat exists, what changes, and what results

BEFORE

Available evidence is one passing new-DKG unit test at commit d6f29a15b032 and one test-environment signing demonstration. No mixed-version matrix, old-key migration test, co…

MECHANISM

Define exactly what behavior, environment, version, and threat the evidence is meant to support.

AFTER

The evidence supports implemented and selected test claims only. It cannot support production-safe, deployed, independently operated, or recoverable under every failure.

Text equivalent: Starting from Available evidence is one passing new-DKG unit test at commit d6f29a15b032 and one test-environment signing demonstration. No mixed-version matrix, old-key migration test, complete-quorum-loss case, reproducible deploye… The mechanism begins when Define exactly what behavior, environment, version, and threat the evidence is meant to support. The resulting lesson is The evidence supports implemented and selected test claims only. It cannot support production-safe, deployed, independently operated, or recoverable under every failure.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 4

State the claim first

Define exactly what behavior, environment, version, and threat the evidence is meant to support.

Complete path: 1. State the claim first: Define exactly what behavior, environment, version, and threat the evidence is meant to support. 2. Match evidence type: Choose tests, vectors, formal or manual review, runtime observation, attestation, or rehearsal appropriate to that claim. 3. Pin scope and negatives: Record what files, commits, configurations, components, and exclusions were covered and which failures were not tested. 4. Resolve conflicts: Quarantine a claim when code, tests, audit findings, deployed artifact, or public description disagree.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The worked case executes the named inputs and checks in the displayed order. Quarantine a claim when code, tests, audit findings, deployed artifact, or public description disagree.

CHANGED CONDITION

A missing, malformed, stale, unauthorized, or inconsistent required input stops at its first named boundary. An audit covers a named scope and revision. Later changes, excluded components, configuration, operations, and deployment remain separate evidence.

Important distinction: An audit badge proves every current deployment is secure. An audit covers a named scope and revision. Later changes, excluded components, configuration, operations, and deployment remain separate evidence.

Text equivalent: The accepted path is enforced by The worked case executes the named inputs and checks in the displayed order. Quarantine a claim when code, tests, audit findings, deployed artifact, or public description disagree. If the required condition changes, A missing, malformed, stale, unauthorized, or inconsistent required input stops at its first named boundary. An audit covers a named scope and revision. Later changes, excluded components, configuration, operations, and deployment remain separate evidence.

Loading lesson visuals...

Learn the idea

Evidence answers a specific claim, version, environment, and threat. A unit test checks one isolated behavior. An integration test checks components together. A conformance vector gives independent implementations the same input and expected result. A reproducible build links source to matching artifact bytes. An attestation identifies a measured running workload. A rehearsal tests an operational procedure. An external audit reviews a named scope and records findings. None substitutes for all the others.

GUIDED EXPLANATION1/4 ideas inspected

State the claim first

Define exactly what behavior, environment, version, and threat the evidence is meant to support.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“An audit badge proves every current deployment is secure.”

An audit covers a named scope and revision. Later changes, excluded components, configuration, operations, and deployment remain separate evidence.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.