# VigiChain ### A post-quantum settlement network with a core small enough to audit **UTXO Labs — version 1.0, 18 August 2026** --- ## Abstract VigiChain is a proof-of-work settlement network in which every signature that moves value is post-quantum, and in which a block is accepted only when mining, money, state and cryptographic posture all agree. The chain is deliberately small: a capability enters consensus only when every node on earth must run it to decide whether a block is valid. Everything else — evidence, identity, provenance, data, escrow conditions, markets — wraps the chain instead of enlarging it. This document describes what is implemented, how it works, and what is not built. The distinction is stated on every claim, because a specification that cannot be told apart from a plan is not a specification. The network runs a public testnet today. Mainnet is locked in the software and stays locked until an independent audit of the current code closes. --- ## 1. The problem Two failures are usually discussed separately, and they are the same failure. The first is arriving. Every signature protecting value on every major chain today rests on the hardness of discrete logarithms over elliptic curves. A cryptographically relevant quantum computer breaks that assumption, and the exposure is not symmetric: an adversary who records the chain now can forge later. Public keys are published the moment a coin moves, so "harvest now, decrypt later" is not speculative for a ledger — it is the default. Migrating a chain whose signature scheme is welded into its consensus rules is not a patch; it is a new network with an old name. The second failure is already here and costs more. Custody breaks. Bridges get drained. A backup that nobody restored turns out not to restore. A provider says the data is there and it is not. Software updates arrive from a channel nobody verified. In each case the loss is not cryptographic — it is that the system offered a *promise* where it should have offered *evidence*, and the difference only becomes visible at the moment the promise fails. VigiChain treats both as one problem: systems that ask to be trusted rather than checked, using cryptography that will not survive the decade. The answer is the same in both directions — demonstrate rather than assert, and demonstrate with primitives that outlive the machine that attacks them. --- ## 2. Design principles **A small core.** One question decides where a capability lives: *does every node have to run this rule to decide whether a block is valid?* If the answer is no, it stays outside consensus. This is not minimalism for its own sake. A core small enough to audit is the only core anyone will ever finish auditing, and an unaudited consensus rule is an unbounded liability that every node is obliged to execute forever. **Evidence over assertion.** The network states limits as loudly as capabilities. A proof layer that implies more than it demonstrates is worse than no proof layer, because it moves trust somewhere the reader cannot see. **Sovereignty.** No dependency on another chain, custodian or gatekeeper for the network to remain true. Own consensus, own addresses, own oracle, own explorer. There is no master key at UTXO Labs and there is not meant to be one: a recovery path that ends at the company that wrote the software is custody with a friendlier name. **Post-quantum as a property, not a feature.** Value moves only under a post-quantum signature. There is no legacy path kept open for convenience, because a legacy path is the path an attacker uses. --- ## 3. Consensus: ABΩ-PQ-PoVW > Proof of work proposes. Alpha protects money. Beta protects state. Omega protects the future. > Validation decides. Proof of work in VigiChain is a proposal mechanism, not an acceptance mechanism. A block that satisfies the hash target has bought the right to be *considered*. Acceptance is a conjunction: ``` BLOCK_VALID = SHA256_POW_VALID (work actually performed against the expected target) AND ALPHA_VALID (money: 21M cap, subsidy schedule, gas accounting, genesis) AND BETA_VALID (state: UTXO set, double spends, signatures, roots) AND OMEGA_VALID (future: versioned PQ envelope, per-transaction scheme) AND VALIDATION_RECEIPT_VALID (validation depth, rotation and integrity) ``` Every term is recomputable by any full node. There are no privileged validators, no shortcuts and no term that another term can override. A block that fails any one of them is not a contested block; it is not a block. ### 3.1 Difficulty, and the honesty of the target A block cannot declare its own difficulty. The expected target is derived from chain state and compared against what the header claims, within the retarget clamp — a rule that exists because the alternative is a miner skipping the work check by lying about how much work was required. Retargeting happens every `POW_RETARGET_WINDOW = 60` blocks, measured across the window's actual elapsed time against the target block interval (60 seconds on mainnet, 30 on testnet), and is clamped to a factor of 4 in either direction so a single window cannot swing the network. A separate rule handles collapse. If `STALL_RESET_MULTIPLE = 20` block-times pass in silence, a block may carry the easiest target. Twenty is Bitcoin's testnet figure: long enough that ordinary variance never reaches it, short enough that a network which lost its miners recovers in minutes rather than days. This rule has already been the source of one real freeze on the public testnet — one validation path accepted a stall-reset target that the ABΩ predicate rejected, and the chain stopped for 32 hours at a single height until the two agreed again. It is documented here because a specification that omits the failures is a brochure. ### 3.2 Fork choice Canonical is the heaviest chain by accumulated proof-of-work, where per-block work is `≈ 2^256/(target+1)`. Reorganisation is by total work, never by block count and never by arrival order. A BFT finality gadget exists in the codebase and is **advisory**: quorum certificates are produced and carried, finality is tracked off-chain, and fork choice is unchanged by them. The guard that would bind finality into fork choice defaults to inert. Stating this precisely matters, because "instant finality" is the claim most often made and least often implemented: the only instant finality path in this system today is the execution layer's re-execution check (§8), not the L1. ### 3.3 The validation receipt Each accepted block carries a receipt describing how deeply it was validated. Validation depth is set by a Fibonacci progression, the order of public checks is rotated by a deterministic sequence, and a quorum-derived factor may **raise** the validation bar but can never lower it or cause an invalid block to be accepted. The asymmetry is the whole design: every mechanism in the receipt can make acceptance stricter, none can make it looser. --- ## 4. Post-quantum cryptography **Signature schemes in consensus today:** | Scheme | Standard | NIST category | |---|---|---| | ML-DSA-65 | FIPS 204 | 3 | | SLH-DSA-SHA2-128s | FIPS 205 | 1 | Algorithms declare their NIST category and security levels filter on it, so a level may not accept a family weaker than the level beneath it. Unknown or future post-quantum formats are rejected until consensus activates them — a signature scheme the network has not been taught is not a permissive default, it is a refusal. The security envelope is **versioned per transaction**, which is what makes `OMEGA_VALID` a consensus term rather than a documentation note: the scheme a transaction was signed under is part of what the network validates, so introducing a new scheme is a coordinated protocol change and never a silent client difference. **Key encapsulation, outside consensus.** Where the system encrypts rather than signs — guardian shares in Sovereign Recovery, the payment rail's envelope — it uses a hybrid construction, X25519 combined with ML-KEM-768. Hybrid is deliberate: it fails only if *both* the classical and the post-quantum component fail, which is the correct posture during a transition nobody can date precisely. **Node identity at rest.** A node's key material is sealed with XChaCha20-Poly1305 under a key derived by Argon2id (RFC 9106), with every public field authenticated so a keystore cannot be edited onto another network. Mainnet refuses a plaintext keystore in both directions — reading one and writing one. The honest limit: an unattended node must be able to read its own passphrase, so this protects backups, snapshots and stolen disks, not an attacker who is already root on a live host. --- ## 5. Ledger and state The chain state is a **UTXO set**, not a table of account balances. Validation stays deterministic and traceable, and the model parallelises later without a consensus change. ### 5.1 Spend policies An output is not necessarily locked to one key. A spend policy composes: - `MlDsaSingle` — one post-quantum signature; - `MlDsaMultisig` — an M-of-N quorum over committed participants, with canonical participant ordering and no duplicates; - `HeightTimelock` — a block-height lock that **wraps** either of the above. Because a timelock wraps an inner policy rather than sitting beside it, real arrangements express directly: a treasury that needs three of five signatures and cannot move before a given height is one policy, not a convention enforced by software off-chain. Two conditional releases already run on this primitive: the execution layer's exit against an inclusion proof, and a treasury spend against its registered policy. What the primitive does **not** yet have is a release condition that is neither a signature nor a height — a condition satisfied by a proof that a service was delivered. That is the missing piece between this ledger and the autonomous economy described in §9, and it is an extension of an audited primitive rather than a new subsystem. --- ## 6. Monetary policy | Property | Value | |---|---| | Maximum supply | 21,000,000 VIGI | | Base unit | vix, 100,000,000 vix = 1 VIGI | | Premint | 0 | | Genesis monetary allocation | 0 | | Initial subsidy | 50 VIGI | | Halving interval | 210,000 blocks | | Target block interval | 60 s mainnet, 30 s testnet | At a 60-second target, a halving arrives roughly every 146 days: the Bitcoin curve compressed, not copied. **The cost of using the network is GAS.** It is work — the effort a transaction imposes on every node that must validate it — and it is paid to the miners and validators who perform that work. It is not a fee levied by an operator, and this document does not call it one. Transaction gas goes entirely to the block producer; it is not burned by default and does not increase supply. ### 6.1 Work-weighted subsidy On mainnet the scheduled subsidy is modulated by the difficulty the block was actually mined against, bounded to `[0.5×, 2.0×]` of the scheduled base. The weighting uses the deterministic *expected* difficulty — identical to the block's validated header target — never hash luck, so miner and validator always compute the same reward. Testnet and devnet keep the flat schedule. The purpose is to pay for security rather than for slots: a block that defended the network against a harder target did more work, and is paid for more work. ### 6.2 The bootstrap ramp The first 1,000,000 VIGI on mainnet are mined at the bootstrap target, deliberately easy, so ordinary hardware takes part in the start on the same terms as anyone else. Difficulty then does not jump: between 1,000,000 and 1,100,000 VIGI it doubles in sixteen steps, each small enough for real hashrate to follow. These are **supply thresholds, not dates and not block numbers**, which means the schedule cannot be gamed by waiting. ### 6.3 The monument blocks Mainnet's first three blocks pay nobody who is alive. Every vix they mine goes to addresses with no private key, so the coins exist, count towards the 21,000,000, are visible to anyone and can never move. - Block 1 locks its entire subsidy. - Block 2 pays 21 VIGI — twenty-one, for the twenty-one million — to an address derived from the Bitcoin genesis hash and the headline inside it, plus 0.801 VIGI to al-Kindi. The remainder is locked. - Block 3 pays 1.404 to Leon Battista Alberti, 1.912 to Alan Turing and 1.916 to Claude Shannon. The remainder is locked. The amounts are birth years, in VIGI. Consensus enforces the exact figures and rejects any monument block that leaves a single vix spendable. This costs the miner of those three blocks, never the supply, and it is a consensus rule rather than a gesture: the network cannot be started without it. --- ## 7. Compatibility without compromise VigiChain exposes an EVM **read** identity — chain id `0x56494754` (1447642964) — so existing tooling can read the chain, and supports binding a secp256k1 (Ethereum) or Bitcoin key to a post-quantum account through a bidirectional proof. That view answers in 18-decimal units: the chain counts in vix (8 decimals), while every EVM wallet renders a native currency with 18 and MetaMask will not add a network that claims otherwise, so the gateway converts rather than let a stranger's first look at the chain be off by ten orders of magnitude. Native surfaces are unchanged and still speak vix. Value transfer is a different matter. Raw secp256k1 and ECDSA value transactions are **rejected by design**. Compatibility is a door for reading and for identity, never a door into consensus, because a chain that accepts one classical signature for value is a classically-secured chain with post-quantum branding. There is no official ERC-20 VIGI and no official wrapped VIGI. VIGI is native only. --- ## 8. The execution layer A post-quantum rollup settles many transactions with one L1 transaction. Balances on it are native VIGI, backed 1:1 by VIGI locked on L1 under an on-chain proof of reserve. Withdrawal is trust-minimised through two paths — a re-execution validity check that gives instant finality on the L2, or an optimistic challenge window with fraud proofs — and a user **escape hatch** to L1 that does not depend on the operator's cooperation. Data availability, the exit covenant and the ordering authority are separate concerns with separate failure modes, and a drop-in seam exists for succinct proofs. The property that matters: a user who is censored or abandoned by the layer's operator can still recover their funds on L1, using only data the L1 already holds. --- ## 9. The layers around the core Ten layers wrap the chain. Each has a public page carrying its real state. Five currently carry events or user-controlled functionality on the public testnet, two have limited public pilots, and three have completed a real-chain cycle but still lack the public participants needed to call them a network. None of these service layers is part of fork choice. **Running.** - **Vigi Witness** — evidence committed to the chain without publishing the thing itself. Nine proof kinds are carried and validated by consensus today: security and integrity proofs, node attestations, software releases, updates bound to a registered release, licence state, critical API-call proofs, wallet and signing risk, document proofs and threat events. Witness proves that something existed, is intact and where it came from. It never decides whether a claim is *true*. - **Vigi Passport** — a verifiable history for a digital object, indexed by subject. Not a civil identity and not centralised KYC. - **Sovereign Recovery** — the recovery phrase split across guardians with a threshold to restore, each share sealed to that guardian's hybrid post-quantum key. Any T of N restore it; any T−1 learn nothing. - **Vigi Provenance and Proof of Process** — typed artefacts, steps and graph seals are published, checked and read back by subject. They prove the recorded derivation is internally consistent; they do not prove that an output is correct. **Limited public-testnet pilots.** - **Vigi Data V2** — a 1 GiB provider is registered and served by Seed-04 over authenticated HTTPS. Encrypted shards have been stored and recovered byte-for-byte through that endpoint. This is one physical provider, not independent-provider redundancy; public Continuity and VPoR remain open. - **Vigi Machine Economy** — a machine-readable `VIGI_DATA/STORAGE` capability is registered and reconstructible from chain events. No public order or escrow payment has settled yet. **Proven against a real chain, not yet public networks.** Vigi Autonomous Escrow has paid one evidence-backed period while leaving the remainder locked, but its policy-locked outputs do not activate on the public testnet until the published height 8,000. Vigi Continuity and Proof of Recovery have exercised custody, degradation and reconstruction against provider daemons; the public pilot has only one physical provider, so it cannot honestly reproduce that redundancy yet. --- ## 10. The network in operation **Peer-to-peer.** Transactions and blocks are validated *before* they are relayed, and the seen-set stores 32-byte content hashes rather than payloads. Rate limiting and bans key on IP rather than IP:port; inbound connections are capped per /24 and /64 subnet; a handshake gate drops data from a peer that has not identified itself; a share of the peer table is reserved for outbound connections; and the broadcast queue is bounded in bytes. Each of these closed a specific denial-of-service path found by external review. Address relay travels inside the existing peer-address messages, and a node's address is always taken from the **socket** and never from the message — a peer can cause its own address to be recorded and never a third party's. **Joining.** A node needs no permission, no invitation and no open inbound port; operators behind NAT peer through a relay that validates nothing and is trusted for nothing. One command provisions a hardened node on a bare host: service account, sandboxed unit, firewall, encrypted keystore and a health timer. **Releases.** The release workflow builds Linux in a digest-pinned container and re-activates the pinned compiler on the dedicated Windows runner, produces hashes and an SBOM, signs both binaries and re-verifies the collected set before publication. That workflow is a gate, not evidence that an old release passed it: a new RC must still be cut from the audited commit, reproduce successfully and carry its own signatures, SBOM and provenance before it can be called verified. --- ## 11. Security posture and honest state Three external audits have been received and remediated. The verdict that governs the project has not changed: **mainnet is NO-GO** until an independent audit of the *current* code closes. Findings from internal audits — including what each defect would have cost and the guard that now prevents it — are published in the repository rather than summarised. The public testnet has been reset twice, each time because a consensus bug made the existing history unverifiable, and each reset is documented with its cause. Some things this network does **not** claim: - It is not final on L1 today. The BFT gadget is advisory (§3.2). - The wrapped-asset layer is built and tested but **disabled**, pending an independent audit of the custody bridge — the highest-risk component in the system. - The institutional payment rail is disabled pending cryptographic, consensus and bank-interoperability review. - The public data pilot has one physical provider; independent storage redundancy, public VPoR and public machine-to-machine settlement are not yet demonstrated. - Testnet VIGI has no economic value, deliberately. --- ## 12. Verify rather than trust Nothing above asks for the benefit of the doubt. The following run against the public gateway. Chain identity and height: ``` curl -s -X POST https://vigichain.org/rpc -H 'content-type: application/json' \ -d '{"jsonrpc":"2.0","method":"vigi_getChainInfo","params":[],"id":1}' ``` EVM read identity, as a wallet sees it: ``` curl -s -X POST https://vigichain.org/rpc -H 'content-type: application/json' \ -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' ``` - Machine-readable chain descriptor: `https://vigichain.org/.well-known/vigi-chain.json` - Layer status, per layer: `https://vigichain.org/layers` - Node releases and signatures: `https://github.com/VestigeIndex/vigichain-node/releases` - Agent reference: `https://vigichain.org/llms-full.txt` A claim in this document that one of those endpoints contradicts is wrong, and the endpoint is right. --- ## 13. Status of this document Version 1.0 describes the code as of 18 August 2026. It is written in English only; the site is fully translated into ten languages and the layer pages carry the same status information in each. The rule this document is maintained under is the rule the rest of the project is maintained under: **the narrative follows the code**. When a layer ships, its section changes after the code lands and the tests pass — not before. © UTXO Labs. VigiChain, VigiWallet, VigiRail, VigiScan, VigiBank and Vigi Passport are UTXO Labs marks.