Node Operations

Core responsibilities

Your node:

• Executes contracts deterministically in the VM.
• Pulls context from Bitcoin (commitments, anchor transactions, block height).
• Stores and serves contract history, state, and events.
• Rejects invalid or divergent payloads.
• Publishes a state root at every Bitcoin block.

Bounded execution

The VM enforces limits by default to keep verification safe:

• 100k instructions per call: one budget shared across nested cross-contract calls
• 1024 stack depth
• 64 call depth
• 64 KB persistent storage per contract
• 64 KB max payload size, enforced identically at REST intake and gRPC

Verification model

Verification is local. You don't trust peers for results. You replay payloads against Bitcoin commitments. If the outcome doesn't match, you reject.

This design removes consensus entirely:

• No Proof-of-Work.
• No leader election.
• No need for network-wide votes.

Invalid payloads just fail replay everywhere. Anchor binding is checked twice: once at intake, and again at confirmation where it's consensus-critical: a mismatched envelope is deterministically invalid on every honest node, with no execution.

Reorg safety

Settlement follows Bitcoin, including its reorganizations. Your node keeps undo logs and a block journal covering the last 144 blocks (about one day):

• Shallow reorg: state rolls back automatically via undo logs, then the new branch replays.
• Deep divergence: the node re-derives state from the confirmed-call log.

No operator action is required in either case.

Sync and peering

Nodes exchange histories and payloads to stay in sync: pending payloads via gossip, state via Merkle-based diffing over gRPC. You can cap peer count with peer_limit. If a peer diverges from Bitcoin-anchored truth, replay exposes it automatically; state roots make the comparison one HTTP call.

Gossip is hardened against abuse: nodes track already-seen payloads to stop replay storms, rate-limit inbound traffic, and cap send concurrency.

Private endpoints

Two endpoint groups are operator-only, protected by the api_token bearer token:

• GET /calls/{contract_id}: the paginated confirmed-call log.
• POST /admin/clear_halt: clears a consensus halt after operator investigation.

With no token configured, these endpoints stay locked.

Monitoring

• GET /health: liveness.
• GET /node_status: node state summary.
• GET /v2/state_root: compare against peers to confirm you're in consensus.
• Logs (RUST_LOG=info and up) plus local storage give you a complete audit trail.