Ducat validation, operations, and governance

Operate the protocol and challenge its security story.

Follow these 10 lessons in order, or choose the topic you need. Each lesson combines an explanation, a worked example and practice inside the Guild.

1. Validator reconstruction

   Validators scan Bitcoin blocks, maintain UTXOs and protocol objects, validate UNIT transfers against vault differentials, and serve query APIs.

   35 minutes · Open lesson

2. Guardian-validator separation

   Validators reconstruct and check state while Guardians control signing; centralizing or confusing these roles changes the threat model.

   45 minutes · Open lesson

3. Client workflow

   The SDK coordinates validator reads, oracle data, funding selection, PSBT construction, wallet signatures, Guardian requests, and broadcasts.

   55 minutes · Open lesson

4. Observability and watchtowers

   Health checks cover chain tip, oracle freshness, ladder coverage, commitments, Guardian readiness, vault state, and transaction outcomes.

   65 minutes · Open lesson

5. Deployment environments

   Regtest, Mutinynet, testnet targets, staging names, and mainnet readiness must be identified by actual configuration and deployed artifact, not labels.

   35 minutes · Open lesson

6. Upgrade and compatibility

   Protocol versions, taptree layout, oracle event formats, key packages, indexer rules, and client compatibility require coordinated migration.

   45 minutes · Open lesson

7. Governance powers

   Experts enumerate who can change configurations, rotate keys, deploy oracle workflows, update clients, pause operations, or migrate funds.

   55 minutes · Open lesson

8. Threat-model review

   Oracle compromise, Guardian collusion, liveness loss, validator divergence, signing-policy bugs, fee spikes, reorgs, and economic attacks each need explicit mitigations.

   65 minutes · Open lesson

9. Audit and evidence

   Tests, conformance vectors, attestation receipts, reproducible builds, live rehearsals, and external review support different security claims.

   35 minutes · Open lesson

10. Public claims discipline

    Marketing language must be traceable to current evidence and must not promote planned decentralization or undeployed fixes as live behavior.

    45 minutes · Open lesson