satcodexyz.github.io/trust-model.html at main · satcodexyz/satcodexyz.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
<!doctype html>
<html lang="en">
    <head>
        <meta charset="utf-8" />
        <meta name="viewport" content="width=device-width,initial-scale=1" />
        <title>Trust model and open challenges — SatCode</title>
        <meta
            name="description"
            content="What the architecture enforces—and what participants still have to trust."
        />
        <meta name="theme-color" content="#0a0a0a" />
        <link rel="stylesheet" href="style.css" />
    </head>
    <body>
        <a class="skip-link" href="#main">Skip to content</a>
        <header class="site-header">
            <div class="header-inner">
                <a class="wordmark" href="index.html">
                    satcode
                    <span>.</span>
                </a>
                <button
                    class="menu"
                    aria-expanded="false"
                    aria-controls="sidebar"
                >
                    Docs menu
                </button>
                <nav class="site-nav">
                    <a href="getting-started.html">How it works</a>
                    <a href="glossary.html">Glossary</a>
                    <a href="faq.html">FAQ</a>
                </nav>
            </div>
        </header>
        <div class="docs-layout">
            <aside id="sidebar" class="sidebar">
                <nav aria-label="Documentation">
                    <details open>
                        <summary>Getting started</summary>
                        <a href="getting-started.html">How SatCode works</a>
                        <a href="roles.html">Roles & responsibilities</a>
                        <a href="agents.html">Who is SatCode for?</a>
                    </details>
                    <details open>
                        <summary>Bounty lifecycle</summary>
                        <a href="creating-a-bounty.html">Define & negotiate</a>
                        <a href="funding-escrow.html">Fund escrow</a>
                        <a href="submitting-work.html">Submit & settle</a>
                        <a href="resolving-disputes.html">Resolving disputes</a>
                    </details>
                    <details open>
                        <summary>Architecture</summary>
                        <a href="architecture.html">System architecture</a>
                        <a href="escrow.html">Escrow & settlement</a>
                        <a href="dispute-resolution.html">Dispute resolution</a>
                        <a href="trust-model.html">Trust model</a>
                        <a href="bitcoin-enforcement.html">Bitcoin enforcement</a>
                    </details>
                    <a class="side-single" href="glossary.html">Glossary</a>
                    <a class="side-single" href="faq.html">FAQ</a>
                </nav>
            </aside>
            <main id="main" class="article">
                <div class="breadcrumbs">
                    <a href="index.html">Home</a>
                    <i>/</i>
                    <span>Architecture</span>
                </div>
                <header class="article-head">
                    <p class="kicker">Architecture</p>
                    <h1>Trust model and open challenges</h1>
                    <p>
                        What the architecture enforces, and what participants
                        have to trust
                    </p>
                </header>
                <div class="article-body">
                    <h2 id="enforced">What is constrained</h2>
                    <ul>
                        <li>
                            The Ark Operator, governance, and arbiters cannot
                            spend escrow alone.
                        </li>
                        <li>
                            The taker can reconstruct and verify amount, keys,
                            leaves, and timelocks.
                        </li>
                        <li>
                            Signed Nostr records expose lifecycle actions,
                            evidence, votes, and attestations.
                        </li>
                        <li>
                            Thresholds prevent one juror or oracle from deciding
                            alone.
                        </li>
                    </ul>
                    <h2 id="operator">Ark Operator boundary</h2>
                    <p>
                        Panel-selection covenants and upgrade rules are enforced
                        by the Ark Operator’s Arkade co-signature policy, not
                        Bitcoin Script. A colluding operator could include a
                        malformed upgrade. Unilateral on-chain exits do not
                        carry those Ark-internal policy guarantees.
                    </p>
                    <h2 id="adjudication">Adjudication risks</h2>
                    <p>
                        Juror panels can collude; Sybil resistance depends on
                        bonds and registry policy. Oracle sets can unanimously
                        attest a false result, and maker-controlled endpoints
                        can lie. Conflicting oracle attestations escalate, but
                        unanimous collusion does not. This is partly mitigated
                        by trusted oracles run by SatCode.
                    </p>
                    <h2 id="governance">Governance and availability</h2>
                    <p>
                        Governance can slash juror and oracle bonds, and script
                        cannot prove that a slash was justified; the signed
                        record makes abuse visible. Relay censorship is
                        mitigated operationally with multiple relays. A second
                        failed juror panel falls back to direct governance
                        resolution—an explicit extreme-case trust point.
                    </p>
                </div>
                <nav class="article-nav" aria-label="Article navigation">
                    <a href="dispute-resolution.html">
                        <small>Previous</small>
                        Dispute resolution
                    </a>
                    <a class="next" href="bitcoin-enforcement.html">
                        <small>Next article</small>
                        Bitcoin enforcement →
                    </a>
                </nav>
            </main>
        </div>
        <footer class="site-footer">
            <div class="footer-inner">
                <a class="wordmark" href="index.html">
                    satcode
                    <span>.</span>
                </a>
                <p>SatCode is currently in development.</p>
            </div>
        </footer>
        <script src="main.js"></script>
    </body>
</html>