Node operations

#Core responsibilities

Your node:

• Executes contracts deterministically in the VM.
• Pulls context from Bitcoin (commitments, anchor transactions, block height).
• Stores and serves contract history, state, and events.
• Rejects invalid or divergent payloads.
• Publishes a state root at every Bitcoin block.

#Bounded execution

The VM enforces limits by default to keep verification safe:

• 100k instructions per call: one budget shared across nested cross-contract calls
• 1024 stack depth
• 64 call depth
• 64 KB persistent storage per contract
• 64 KB max payload size, enforced identically at REST intake and gRPC

#Verification model

Verification is local. You don't trust peers for results. You replay payloads against Bitcoin commitments. If the outcome doesn't match, you reject.

This design removes consensus entirely:

• No Proof-of-Work.
• No leader election.
• No need for network-wide votes.

Invalid payloads just fail replay everywhere. Anchor binding is checked twice: once at intake, and again at confirmation where it's consensus-critical: a mismatched envelope is deterministically invalid on every honest node, with no execution.

#Reorg safety

Settlement follows Bitcoin, including its reorganizations. Your node keeps undo logs and a block journal covering the last 144 blocks (about one day):

• Shallow reorg: state rolls back automatically via undo logs, then the new branch replays.
• Deep divergence: the node re-derives state from the confirmed-call log.

No operator action is required in either case.

#Sync and peering

Nodes exchange histories and payloads to stay in sync: pending payloads via gossip, state via Merkle-based diffing over gRPC. You can cap peer count with peer_limit. If a peer diverges from Bitcoin-anchored truth, replay exposes it automatically; state roots make the comparison one HTTP call.

Gossip is hardened against abuse: nodes track already-seen payloads to stop replay storms, rate-limit inbound traffic, and cap send concurrency.

#Private endpoints

Two endpoint groups are operator-only, protected by the api_token bearer token:

• GET /calls/{contract_id}: the paginated confirmed-call log.
• POST /admin/clear_halt: clears a consensus halt after operator investigation.

With no token configured, these endpoints stay locked.

#Monitoring

• GET /health: liveness.
• GET /node_status: node state summary.
• GET /v2/state_root: compare against peers to confirm you're in consensus.
• Logs (RUST_LOG=info and up) plus local storage give you a complete audit trail.