Ducat validation, operations, and governance
Operate the protocol and challenge its security story.
Follow these 10 lessons in order, or choose the topic you need. Each lesson combines an explanation, a worked example and practice inside the Guild.
Validator reconstruction
Validators scan Bitcoin blocks, maintain UTXOs and protocol objects, validate UNIT transfers against vault differentials, and serve query APIs.
Open lessonGuardian-validator separation
Validators reconstruct and check state while Guardians control signing; centralizing or confusing these roles changes the threat model.
Open lessonClient workflow
The SDK coordinates validator reads, oracle data, funding selection, PSBT construction, wallet signatures, Guardian requests, and broadcasts.
Open lessonObservability and watchtowers
Health checks cover chain tip, oracle freshness, ladder coverage, commitments, Guardian readiness, vault state, and transaction outcomes.
Open lessonDeployment environments
Regtest, Mutinynet, testnet targets, staging names, and mainnet readiness must be identified by actual configuration and deployed artifact, not labels.
Open lessonUpgrade and compatibility
Protocol versions, taptree layout, oracle event formats, key packages, indexer rules, and client compatibility require coordinated migration.
Open lessonGovernance powers
Experts enumerate who can change configurations, rotate keys, deploy oracle workflows, update clients, pause operations, or migrate funds.
Open lessonThreat-model review
Oracle compromise, Guardian collusion, liveness loss, validator divergence, signing-policy bugs, fee spikes, reorgs, and economic attacks each need explicit mitigations.
Open lessonAudit and evidence
Tests, conformance vectors, attestation receipts, reproducible builds, live rehearsals, and external review support different security claims.
Open lessonPublic claims discipline
Marketing language must be traceable to current evidence and must not promote planned decentralization or undeployed fixes as live behavior.
Open lesson