S I G I LA chain that makes state divergence explicit — and every official binary carries verifiable build provenance.
Testnet at a glance- Network: sigil-g0 — experimental, resettable testnet.
- Code lineage: a new experimental chain built on the Flux compiler-as-platform; sister network to Quillon Graph (not a rename of it, not a fork of its chain).
- Model: account-based state over a DAG.
- Consensus: DagKnight braid ordering; each block carries dual-lane proof-of-work (BLAKE-family) × a Wesolowski verifiable-delay function.
- Live cadence: accelerated laboratory mode, currently ~6 blocks/s. Possible mainnet cadence: ~5 s, not finalized. Finality: no formal finality proof yet — braid ordering is simulation-gated, not a theorem.
- Live decentralization (the honest version): right now this is a single-producer testnet — 1 block producer (the operator's node), 1 independent operator, minimal peers. Production is permissioned and the operator can reset or rewrite the chain. External miners submit dual-lane shares to that one producer; they do not independently produce or order blocks today. A permissionless multi-producer mesh is the next milestone. Do not mistake this for a decentralized network yet.
- Current release: sigil-top v7.0.4 (Linux x86_64 + Windows x64), source tag v7.0.4 — each binary ships with a require-both SQIsign-L5 + Ed25519 provenance proof, published builder keys, and a one-command verifier.
- Supply: testnet-only 21M schedule, already fully emitted under accelerated economics; all balances reset before any mainnet.
- Allocation: none by design — no premine, no team/treasury/founder allocation; coins come only from mining. But because production is single-operator (above), the operator has necessarily controlled most of the emitted supply. The treasury (where unbound mining routes) and the 1.2% commons quorum are operator-held today.
- Audits: none yet. The novel cryptography (the fold, the hybrid provenance composition) is experimental and under open review.
- License: MIT OR Apache-2.0.
- Mainnet: the testnet resets before any mainnet; mainnet parameters are TBD.
What is actually exercised right now- [LIVE] wallet state + the four header commitments (the wallet root is populated).
- [EMPTY / UNEXERCISED] DEX, event-log and contract state — on sigil-g0 today their roots are the canonical empty root: the modules exist and commit a root every block, but carry no live state yet.
- [EXPERIMENTAL] the fold construction (unpublished soundness reduction).
- [LOG-ONLY] peer-sync authentication (verify-before-sync handshake, not yet enforcing).
- [PLANNED] permissionless multi-producer production; the trustless VDF modulus; block-apply producer-signature enforcement.
Why SIGILMoney is the one thing we're least allowed to get wrong and the one we most take on faith — discretionary supply, settlement through intermediaries, a ledger we're shown instead of one we can check. Bitcoin proved the last part isn't a law of nature. But the chains built on that insight each stopped short:
- Bitcoin established capped, independently verifiable money, but deliberately limits general-purpose programmability; its header commits transactions rather than a dedicated state root, and secp256k1 is not post-quantum.
- Ethereum established general-purpose programmable state and already commits state, transaction and receipt roots in every execution header — but it does not provide a fixed 21M monetary policy, a post-quantum floor on its signatures, or protocol-level provenance for released client binaries.
SIGIL's distinction is the combination neither puts in the protocol:
four domain-separated state roots with fail-closed local enforcement (a node that recomputes a divergent root rejects the transition and exits before accepting or serving the newly computed state),
hybrid post-quantum build provenance on every released binary, and a
time-normalized capped emission. Keep what Bitcoin and Ethereum got right — capped honest money, programmable state — and add what post-quantum cryptography and a self-signing compiler now make possible. (Note: the post-quantum piece today is the release provenance, not the whole chain — wallet and producer signatures are still Ed25519; see "What we are NOT claiming.")
Here is what that buys you:
- 🔐 Every official binary carries verifiable build provenance. Each release carries a hybrid proof — require-both SQIsign Level 5 AND Ed25519 over a canonical record binding the artifact hash, source hash, compiler version and builder wallet. The two signatures are ~356 bytes (smaller than one Dilithium-5 signature, 4,595 B); the serialized .proof bundle itself is larger (~6 KB JSON — keys, metadata, byte arrays). A stripped single-leg bundle is rejected. Honest scope: this proves a specific key attested that artifact X was built from source Y with compiler Z — it does not by itself prove the binary was faithfully produced from that source. Reproducible builds (an independent rebuild yielding the identical hash) are the goal, not yet independently confirmed. You verify the artifact hash + both signatures against pinned builder keys yourself (walkthrough below).
- 📦 Four state roots in every header (wallet / dex / event-log / contract). A node that recomputes a divergent root rejects the transition and exits (code 78) rather than accepting or serving the bad state. State divergence has nowhere to hide.
- ⚙️ A programmable economy, inside the guarantee. A contract VM, a constant-product AMM DEX (x·y=k), on-chain credit (collateralized, experimental), and an experimental Bitcoin SPV deposit verifier (it verifies a Bitcoin SPV proof + PoW finality for deposits; it is not a complete trustless bridge — BTC custody and peg-out are not yet trustless) — each committing to its own state root. (See the exercised-state list above: the DEX/contract modules exist but carry no live state on sigil-g0 yet.)
- 🔎 One constant-size commitment proof for the chain prefix. The fold (Ajtai/SIS lattice commitments, no trusted setup) compresses the chain prefix into 2,568 bytes regardless of length. One check attests the folded chain of per-block commitments back to genesis (header continuity + the committed roots) — not every transaction, every signature, state-transition validity, or the DAG ordering. Full fold verification is 280–342 ms at the 100k-block benchmark. The 3-µs tip check is a different, cheaper operation: it recomputes the exact BLAKE3 tip fingerprint a native node commits and compares it — an incremental check against an already-verified fold state, not a re-verification of the fold itself.
- 💻 One binary does everything, on a potato. sigil-top (Linux x86_64 + Windows x64) is a monitoring node, a light client, a dual-lane miner, and a wallet in a single static file. Default mode verifies the live tip fingerprint in ~3 µs with zero blocks downloaded. Opt-in full sync runs at a measured live ~10,800 blocks/s.
- 📡 A measured gossip law, not a guess. Delivery probability D(p,r) = 1 − p^r, validated against 22 seeded simulations (RMS residual 0.4 pp). The shipped redundancy r=3 clears a 99.9% delivery SLA at up to 10% packet loss — the network calculates its provisioning instead of hoping.
- 🕸️ Adversarially gated ordering. The DagKnight braid passed a six-scenario gate before the live producer adopted it: divergence = 0 under 30% drop/reorder/equivocation, a withheld-block attacker, 16/16 ordering permutations agree, tamper suite 5/5 rejected. Simulation evidence, not a theorem — and we label which is which.
- ₿ Bitcoin-familiar economics. 21M cap, 4-year halvings — time-based: block reward = the integral of the emission rate over the block interval, so the schedule is invariant under block cadence, and a compile-time assert proves it sums exactly to the cap. A separate fail-loud operational alarm halts the node if realized supply drifts ±2% from the deterministic target (an alarm — the protocol does not "tolerate" that drift; it's a tripwire against emission bugs).
The plan: testnet now, mainnet when it earns itWe are on testnet
on purpose. The claims above — hybrid-PQ provenance, a constant-size commitment proof, structural agreement — are exactly the kind that should be attacked by strangers before anything of value depends on them. The road to a production mainnet is public and gated on closing a short, named list of hardening items (block-apply producer-signature enforcement, the trustless VDF modulus, peer-sync ingress authentication, and a permissionless multi-producer mesh), each tracked with file:line status in an open backlog. When they close and the chain has soaked, mainnet follows. Until then: break it, and tell us how.
Break it — specific missionsConcrete things to try, in rough order of effort:
- Verify a binary — recompute the artifact BLAKE3, run the one-command verifier, and compare the builder key fingerprints to the pinned ones (walkthrough below). Tell us if anything doesn't line up.
- Run a node and compare roots — sync, then diff your four state roots against a peer's at the same height. A mismatch that does not halt the node is a finding.
- Corrupt local state and confirm fail-closed — tamper with your local DB and verify the node rejects the transition and exits (78) instead of serving it.
- Mine for 30 minutes on a bound wallet and confirm rewards + the 1.2% commons split land as claimed. (Remember: you're submitting shares to the single producer, not producing blocks.)
- Attack peer-sync auth — the verify-before-sync handshake is in log-only mode; try to feed a follower blocks it should refuse, and tell us what it accepts.
- Test partition recovery — split a small local mesh, produce on both sides, rejoin, and report how (or whether) ordering reconciles.
- Submit fold test vectors — feed the fold verifier crafted inputs and look for a proof it accepts that it shouldn't.
Reporting: non-sensitive findings → GitHub issues (repo below).
Security-sensitive findings → do NOT open a public issue: use GitHub private vulnerability reporting on the repo, or email
bitknight.dipper688@passmail.net (ask for a PGP key if you want to encrypt).
Try it (5 minutes)# live network feed
curl https://sigilgraph.fluxapp.xyz/sigil-status.json
# download manifest (BLAKE3 content-addressed, Linux + Windows)
https://sigilgraph.fluxapp.xyz/downloads/sigil-top-latest.json
# then run it — TUI opens as a light monitor; [M] to mine, [L] to bind a wallet
./sigil-top
(this is the point of the whole project):
# the current release + its require-both hybrid proof:
wget https://sigilgraph.fluxapp.xyz/downloads/sigil-top-v7.0.4-linux-x64
wget https://sigilgraph.fluxapp.xyz/downloads/sigil-top-v7.0.4-linux-x64.proof
# 1. recompute BLAKE3 of the binary — it must equal the manifest + the proof artifact_hash:
b3sum sigil-top-v7.0.4-linux-x64
# => 413807bd55ccbf4b7fe0acc19879b52d57e2c32cb49bd9e8ff6879163135314a
# 2. run the real verifier — checks the artifact BLAKE3 + BOTH signatures:
fluxc verify-proof sigil-top-v7.0.4-linux-x64 sigil-top-v7.0.4-linux-x64.proof
# → "✓ Verified provenance proof"
# 3. CRITICAL — pin identity. A self-consistent proof with swapped keys is still a
# forgery, so compare the proof's builder keys to the fingerprints PINNED here:
# SQIsign L5 pubkey blake3: 02b8b38c5f168758757a5f81a33c257f16e482c313aec08c0b5bbc3afac57e09
# Ed25519 pubkey blake3: 6e0128278d97d793546d76da2bb6d69d053e4308d2d4680962953280fd72c563
# (full keys + fingerprints: https://sigilgraph.fluxapp.xyz/downloads/sigil-builder-keys.json)
(The two signatures are ~356 bytes; the .proof file itself is ~6 KB of JSON — keys, metadata, byte arrays. "356 bytes" refers to the signatures, not the download.)
MiningDual-lane: a hash-power lane (BLAKE3-family PoW) × a verifiable-delay lane (Wesolowski VDF) — a valid share carries both. CPU is fine; a GPU build is available for the hash lane.
Important: external miners submit dual-lane
shares to the operator's single producer; they do not independently produce or order blocks today (see decentralization note).
Ownership-proven wallets (you sign a domain-separated challenge to bind the wallet — the wallet IS the public key,
no KYC) earn to themselves; unbound mining routes to the operator treasury. 1.2% of every reward routes to a commons pool under an M-of-N quorum (operator-held today).
What we are NOT claimingThe honesty section is load-bearing — the whitepaper carries a boxed security disclosure and a public hardening backlog with file:line status. The short version:
- This is not a post-quantum chain yet. The PQ piece is the hybrid release provenance. Wallet transactions and producer authentication use Ed25519 today; a post-quantum signature floor across consensus and wallets is planned, not shipped.
- RPC money routes ARE authenticated (per-wallet ed25519 signature + nonce). The residual risk is deeper, and named: block-apply does not yet enforce the producer's signature (verifier written + height-gated, dormant); the live VDF modulus is not yet the trustless one (drop-in built, height-gated cutover pending); peer-sync ingress auth is mid-rollout (a real ed25519 verify-before-sync handshake with channel binding, in log-only mode). Do not route real value through SIGIL. It's a testnet; it will be reset.
- The multi-million-tx/s figures in our docs are state-transition wind-tunnel numbers, not network TPS, and are labeled as such everywhere.
- The fold construction is ours and unpublished; its soundness reduction (Ajtai/SIS) is a target, not a published proof. Cryptanalysis is explicitly invited — that's half the reason this post exists.
Links
FAQIs there a token sale / premine / airdrop? No sale, no genesis allocation, no airdrop. But be clear-eyed: this is a single-producer accelerated testnet, so the operator has controlled most of the emitted supply, and every balance is wiped before mainnet. Nothing here is an investment.
Is SIGIL decentralized? Not yet. One producer, one operator, permissioned production. Permissionless multi-producer is the next milestone; the honest current state is in "Testnet at a glance."
Why testnet first? Because a provenance chain earns a mainnet by surviving public attack, not by launching one. Testnet-first is the maturation path, in the open, until the named hardening items close and the chain has soaked.
Windows? Yes — native x64 build in the same manifest, with its own require-both provenance proof (verified with the same fluxc verify-proof command).
Hardware? The light monitor runs on anything. Full sync + mining: any modern CPU. The whole design brief is "hold the chain to account on a potato."
— bitknight
