pixel-chain-story

Path to a respected L1 / bridge / sovereignty regime

Stance: keep the honest lab frame and build until the frame is obsolete.
Respect is not requested in copy. It is earned when a skeptical engineer can clone, break, and still find the invariants holding.

This document is the north star. ROADMAP.md is the checklist. Normative behavior is whatever SPEC.md + CI enforce.

0. How respect is earned (non-negotiable)

Skeptic move	Our answer
“Cute metaphor”	Point at `bun run test:all` + SPEC invariants
“Vapor bridge”	Point at a non-stub foreign verifier + frozen fixture
“Not an L1”	Point at multi-host tip extension, stall recovery, headers sync
“Sovereignty theater”	Point at ≥7 live diverse providers failing cloud-majority sets on the wire
“QR marketing”	Point at OTS leaf enforcement + live `PIX-ML-DSA-65` (`bun run test:mldsa`) + `QUANTUM.md`
“Optical scam”	Point at real camera capture + two-device Kindling that fails remote

Public voice rule: claim only what the highest passing gate allows. Vocabulary (Kindling, Worldlight, PoLS) stays — claims escalate with gates.

Guide: art guided by science it need not name (One.Creed.guide). Light verbs compress the physics of being; they do not excuse missing invariants.

Never: hide gaps behind thesis strings. Thesis strings describe intent; gates prove delivery.

1. Where we are (Gates A–C, E, F lab)

Runnable, tested, and framed as a lab prototype with real crypto:

UTXO ledger + PoLS sequential tip + multi-process accept + stall skip (Gate C)
Merkle-window PIX-HASH-OTS-128 (one-time leaves; weak verifier fail-closed)
One API, SISO model, Access invite-only, Kindling simulated channel
Worldlight + lock feeder (local USDC rail / wire attestor)
ULAVerifier keccak-OTS twin (IS_STUB=false) + CosmWasm twin + custody inversion (Gate E)
Headers-first sync, balance merkle proofs, signed hello scoring, docs/BENCH.md (Gate F lab)
OTS leaf single-use at consensus + electable-bound lottery + 4-node lab mesh
Diversity policy code; enforced when ≥7 providers registered
CI: crypto + protocol selftests + Foundry + lint + build

Allowed claim: “Executable post-quantum-class UTXO lab; multi-host tip extension; ULA verify + phone-capable light path (lab).”
Forbidden claim: “Production L1 / production bridge / AWS-proof network / BFT mainnet.”

2. The regime we are building (destination)

Pillar	Done means
L1	Independent hosts extend one tip; stalled sequencers recoverable; light clients sync headers; published benches
Bridge	Lock on A → verify on B with real crypto; no stub `lightProofValid`; testnet value moved end-to-end
Sovereignty	Live ≥7-provider set; diversity enforced on join; no required CDN/API hostname for ledger use
Custody / Kindling	Personal Source + two-device optical (or proven proximity) path; SMS still never spends
Crypto	Critical. Versioned schemes; ML-DSA-65 shipped; production default ML-DSA; OTS retained for constrained devices

Invention stays (INVENT.md). Uptake bridges stay optional.

3. Gates (build in order — skip = lose respect)

Each gate has evidence (repo artifact) and claim unlock. Do not advertise the next claim early.

Gate B — Network that doesn’t flake

Build

Two-machine (or two-VPS) init / node / join demo — docs/demos/two-node.md + bun run test:net
Persistent peer book; reconnect with backoff; get_pixels / pixels hole-fill + /sync join
Tip stall detection (warn + catch-up). Skip/replace = Gate C (shipped)
OTS single-use at ledger + lab leader lottery with electable bound in light proof
4-node lab mesh — bun run test:four-node + docs/DEVNET.md

Evidence: docs/demos/two-node.md + bun run test:net + test:four-node
Claim unlock: “Multi-host Pixel network (prototype tip extension).” — not fault-tolerant consensus yet.

Gate C — Consensus that survives fault

Build

Explicit fork-choice / tip rules in SPEC (§4.1 — prefer lower skip, depth-1 replace)
Sequencer timeout + skip replacement (skipCount in light proof; bun run test:fault)
Reorg depth policy depth 1 (replaceTipIfBetter)

Evidence: SPEC §4.1 + bun run test:fault
Claim unlock: “Fault-tolerant PoLS (lab).” Still not “BFT mainnet.”

Gate D — Quantum security (critical priority — parallel with B)

Build

signPixel / verifyPixel scheme surface
PIX-ML-DSA-65 (NIST FIPS-204 via @noble/post-quantum) on tx + PoLS
PIX-HASH-OTS-128 retained (one-time leaves)
Freeze public test vectors file in CI (src/lib/pixel/vectors/quantum-v1.json + test:vectors)
Wallet/node persist scheme + ML-DSA secret / OTS nextLeaf
Default PIXEL_SIG_SCHEME / DEFAULT_SCHEME=PIX-ML-DSA-65 for new genesis

Evidence: bun run test:mldsa + bun run test:vectors green; QUANTUM.md
Claim unlock: “Crypto-agile PQ signatures — ML-DSA-65 default birth, hash-OTS retained.”

Gate E — Bridge that verifies

Build

Replace ULAVerifier stub with real verify of frozen ULA fixture (PIX-HASH-OTS-128-KECCAK)
Foundry tests + CosmWasm twin (contracts/cosmwasm/ula-verifier)
Relayer: anvil PixelUsdcLock Locked → LockFeeder.feed → shineIn (bun run test:ula-relayer)
Custody inversion law: foreign = receipt, Pixel = vault (BRIDGE_CUSTODY_AXIOM, test:bridge-custody)
Native ULAs under ML-DSA sequencers + keccak-OTS twin projection (test:ula-mldsa)
Lab off-chain ML-DSA commit gate (ULAOffchainMldsaGate.sol) — not full on-chain Dilithium
Public testnet tx links (Sepolia or equiv.) — still open
Full on-chain ML-DSA verify (zk/precompile research) — open

Evidence: green Foundry + docs/BRIDGE-STATUS.md + docs/ULA-MLDSA.md (public tx links pending)
Claim unlock (partial): “ULA verify real on EVM/CosmWasm twins (lab); native ML-DSA ULAs; PQ commit gate; local lock→shineIn; foreign verify ≠ vault release.” Full “Testnet ULA bridge” when public links land. Do not claim “on-chain Dilithium.”

Gate F — Light clients & gossip that scale past 3 peers

Build

Headers-first sync (/sync/headers, get_headers / headers, verifyHeaderChain)
Merkle proofs for balances (proveBalance / verifyBalanceProof, pix_getBalanceProof)
Peer keys + basic scoring / eclipse guard (signed hello + peer-score.ts)
Bench harness → docs/BENCH.md via bun run test:bench

Evidence: bun run test:light + docs/BENCH.md from test:bench
Claim unlock: “Phone-capable light client path (lab).” — stateRoot at tip today; per-pixel historical state commits still open.

Gate G — Sovereignty as protocol law on a live set

Build

Provider registry on-wire (not only RPC echo)
join / sequencer admission calls assertSovereignIfLive
Public status page or RPC: live diversity report from real peers
≥7 independent operators (home/colo/minority-cloud mix) — even if friends/pilots

Evidence: live report snapshot + policy rejection demo (cloud-majority join fails)
Claim unlock: “Diversity-enforced sequencer set (pilot network).”

Gate H — Kindling / optical that is not theater

Build

getUserMedia + canvas sample (optical-capture.ts)
Raster round-trip CI (bun run test:optical)
Kindling seals with channel: "optical-capture" when physical captures provided
Two-phone field notes (aim at projector → sample)
Personal Source unlock persists leaf cursor / scheme safely after optical unlock

Evidence: test:optical + kindling optical-capture path green
Claim unlock: “Optical capture path shipped (pilot); presence-bound Kindling when channel=optical-capture.”

Gate I — External scrutiny

Build

Threat model v1.1 frozen; scope for audit (crypto + acceptBlock + ULA) — THREAT-MODEL.md
Audit package + self-review checklist — AUDIT.md status PREPARING
bun run test:audit-scope invariants
External firm engaged; criticals fixed; report link published

Evidence: docs/AUDIT.md (PREPARING until report link)
Claim unlock (now): “Scoped audit package prepared; external review pending.”
Claim unlock (after report + fixes): “Audited components (scoped).” Full “trusted L1” only after broader ops maturity.

Gate J — Regime (public network)

Build

Named public network id; genesis ceremony notes; multiple subnets or checkpointing
SISO mirror mesh actually used when an origin dies (chaos drill)
No required Cloudflare/API for ledger use (explorer may use CDN)

Evidence: public peers, chaos drill writeup, sovereignty report continuous
Claim unlock: “Pixel public pilot / mainnet-candidate.”

4. Workstreams (parallel after Gate B)

Stream	Owner shape	Depends on
Node / consensus	Systems	B → C → F
Crypto	Cryptography	D (can start now)
Bridge / Solidity	Eth + relayer	E (can start stub→real now)
Sovereignty ops	Operators	G (needs B+)
Kindling / mobile	Client	H (needs D for safe keys)
Field access	BD/KS pilots	Access + Kindling invite; never blocks L1

Coders pick a stream via CONTRIBUTING.md. Non-coders: field pilots and provider ops still move Gate G/H.

5. Communication doctrine (so “non-coder toy” never sticks)

Lead with the runnable artifact — CLI, tests, SPEC — then name the invention.
Gate badges in README / pix_protocolInfo.status — e.g. gates: ["A","B"].
Compare carefully — Bitcoin scarcity math and Ethereum sequencer analogies are fine; “we replace X” is not, until the gate for X is green.
Keep metaphors subordinate — Lumen/Kindling explain UX; they do not excuse missing fork-choice.
Invite hostile review — link THREAT-MODEL gaps; reward people who find landmines (we already closed verifyLight).

6. Immediate next actions (this repo)

Commission external Gate I review from AUDIT.md scope; publish report link
Public testnet ULA links (Sepolia) + deepen on-chain ML-DSA beyond commit gate when gas path exists
Opt-in ML-KEM sealed gossip (PIXEL_TRANSPORT_KEM=1, test:kem-wire) — default still plaintext
Continuity merchant handshake (one-button join) + map fee / till-on-origin-dark bookkeeping — agentic booth runners still held
Lab chaos drill + till ledger accrual (test:chaos-drill) — not Gate J public evidence
FieldWitness invent — sphere combination lock: peer indices, distance, opacity ∈ {opaque, translucent, lit}; tip PoLS binds fieldDigest; acceptBlock recomputes and rejects mismatch (bun run test:field, SPEC § FieldWitness). PATH note: invent gate evidence — not a rename of prevHash. Verification, continuity of the scene, custody of the tip.
Keep pix_protocolInfo gates honest as evidence lands

Gate D is in. Gate I package is preparing. Continuity desk can drill origin-dark → till accrue in lab — still a pilot, not a costume. FieldWitness is invent evidence for tip custody as a sphere lock — not simile alone.