Research prototype — not production, not mainnet, no token, no custody.
The protocol state is a Gödel cell graph. Every value, formula and rule is a cell with a coordinate (like a spreadsheet address), a displayed value, and — inside — a formula and references to the cells it depends on:
cell = coordinate + value + formula + dependencies + provenance + unit + hash
The code reads cells by coordinate and does not re-literalise numbers. A price move is one
supersession of an oracle cell; every derived cell (liquidation ladder, buffer, margin
derivatives, solvency, control score, payout, dust) re-evaluates from it. There is one
content_root, one history_root, one law_root, and one
append-only event ledger across every runtime.
The client gives the protocol a wallet (including BTC), or a BTC key from which the protocol derives its own keys, or access to BTC/USDT. The protocol then manages the position on their behalf. The point is increasing BTC — the protocol becomes the owner of the position, alongside its own (admin) BTC, "because how else".
When a user is liquidated, the margin they would lose does not leave the protocol:
the user lost it, not us. The admin injects his own BTC into the margin and takes over the
position. Injecting up to the full exposure (e.g. all 0.75 BTC) makes the margin meet the
exposure — leverage ≤ 1, fully collateralised — the unburnable zone: a routine drawdown
can no longer liquidate it, so the protocol simply waits for the right price to close. This is
the backstop (godel_backstop, laws L58–L59): the admin reserve is the only source of
takeover BTC, and if it runs short the insurance fund covers the remainder — a deficit is never
minted from nothing. Once the price reaches the close target, the position closes and the P&L
is realised.
economics (margin/exposure/leverage), liquidation ladder, Markov risk chain, base units, protocol mass, chain topology, wallet scopes, decision policy (L03 gate), solvency, margin derivatives, margin-oracle reconciliation, 5-price cone, settlement write gate, payout bounds, dust policy, control score — all merged into one collision-free universe graph.
Margin and exposure are source cells opened from a requested leverage; leverage = S/M
is derived. A top-up supersedes the margin (the position actually grows); a reinvest buys BTC at
the ask and adds it to margin. The solvency and mass user-claims follow total_btc × price.
Numeric invariants are checked on the live graph (godel_laws) and hash to a single
law_root. Code-hygiene properties (float scan, hash determinism) are enforced by module
scanning and canonical tests. Structural boundaries (separation of concerns) are enforced by
structural tests, not boolean tautologies.
| law | name | class | description |
|---|---|---|---|
| L01 | AppendOnlyLedger | graph | No insert-renumber: new entities append to end of branch; formulas are immutable, values mutable in-place only |
| L02 | CellGodelIdReference | declared | Cell Gödel ID is the only true reference coordinate; row names are human labels only, not reference targets |
| L03 | MarkovRiskSeparation | declared | Markov risk visible != alert trigger. High risk score can be shown for audit but cannot auto-trigger red-watch/pause/close without separate alert-policy gate |
| L04 | ProjectionSeparation | declared | Public projection != policy action. What is shown on the visor is not a command to act |
| L05 | DescriptorPolicySeparation | declared | Descriptor policy text != active protocol policy. A compiled policy candidate must pass promotion gate before becoming active |
| L06 | CompilerNotCustody | declared | Descriptor policy compiler != custody. Compiling a policy text does not create custody or signing capability |
| L07 | ObservationNotAccounting | declared | Node observation != protocol accounting. Mempool seen != confirmation; single observation != balance truth |
| L08 | ConfirmationNotSettlement | declared | Confirmed != settlement. Confirmation policy met != balance delta; balance delta checked != accounting settlement; settlement evidence != final state write |
| L09 | ReadinessGuard | declared | Ready to design != ready to touch money. All 12 WalletDeveloperChecklist gates must pass before any wallet/custody implementation |
| L10 | InternalVsExternalPayout | graph | Internal usdtX ideal != external payout amount. External payout must pass route quote → exchange fee → network fee → withdrawal fee → slippage guard → base-unit rounding → reserve reconciliation → receipt |
| L11 | ExpectationLaw | declared | Expected values authorize actions; actual receipts update state. Delta between expected/actual is recorded, not ignored |
| L12 | BaseUnitLaw | graph | Decimal math is analysis; base units are settlement truth. No fractional satoshi or token base unit may enter state. Amounts floor, costs ceil, receipts exact-or-reject |
| L13 | H100H101H333R_Conservation | graph | H100: EFFECTIVE_IN = USER_CLAIM + PROTOCOL_MASS_DELTA; H101: product(bid_factor, ask_factor) = 1 with precision guard; H333R: floor(total/3) × 3 + remainder = total; no sat lost |
| L14 | WalletClaimNotSettlement | declared | Wallet/signing/DLC/oracle claim != settlement state. A claim of readiness/signature/attestation is not accounting truth |
| L15 | PSBTPartialSignatureNotReceipt | declared | PSBT partial signature != receipt. Draft != broadcast; partial != finalized; broadcast txid != confirmed receipt; confirmed != accounting settlement |
| L16 | FROSTSignatureNotMarketTruth | declared | FROST signature != market truth. A threshold signature proves signer agreement, not price validity or market consensus |
| L17 | DLCOracleNotPriceFeed | declared | DLC oracle event != continuous price feed. Oracle attestation is a single event, not a streaming price oracle |
| L18 | CandidateNotActiveTruth | declared | Candidate != active truth. Candidate cells, draft policies, proposed changes are not protocol state until promoted through gates |
| L19 | MathToFinanceToMachine | declared | Mathematical form → financial interpretation → machine/code constraint → receipt-gated state. Each layer gates the next; no skip from math to state |
| L20 | NetworkCommandSeparation | declared | Network command intent != network execution. Dispatch authorization != settlement; command receipt evidence != final accounting write |
| L21 | PrecisionInvariance | code | No float pollution anywhere in the math stack. All arithmetic is Decimal or integer; float → immediate rejection at canonical boundary |
| L22 | HashRootDeterminism | code | Same inputs → same root every time. Deterministic hashing ensures auditability; no non-deterministic sources (time/random/network) |
| L23 | StateTransitionProof | declared | Every state write requires evidence. No state changes without: intent → proof → receipt → delta → settlement evidence → state write gate |
| L24 | MassConservation | declared | USER_CLAIM_X + PROTOCOL_MASS_X = EFFECTIVE_IN_X for all entry events. Protocol mass is tracked separately from user claims and is not withdrawable |
| L25 | DustPolicyBoundary | graph | BTC dust swept only when spend_cost + reserve < utxo_value. Dust sweep is separate from margin accounting; trapped dust ≠ spendable dust |
| L26 | FeeAwarePricing | declared | Liquidation price calculation includes fees. H101 symmetry preserved: int arithmetic prevents 99/101 × 101/99 ≠ 1 precision error |
| L27 | GovernanceTraceability | declared | Every parameter change has governance proof. ParameterUpdate records old/new values, hashes, reason, governance proof; no silent parameter mutations |
| L28 | CrossLayerIntegrity | declared | No module contradicts another. Cross-layer harmony: wallet gate doesn't bypass indexer; FROST gate doesn't bypass PSBT; visor doesn't bypass alert policy |
| L29 | QuantumConservation | declared | Base-unit arithmetic never loses sats/tokens. All splits, fees, roundings track remainders; total = sum(parts) + remainder; rounding_deltas are recorded, not discarded |
| L30 | ProtocolMassBoundary | graph | Protocol mass is visible but NOT user-withdrawable. H_MASS_RATIO = MASS / max(CLAIMS, epsilon); mass grows from fees/yield/dust/tail; mass shrinks from bad_debt/losses only |
| L31 | BufferSingleSource | declared | Margin-derivative buffer equals the position buffer; two cells never describe one physical quantity with two values |
| L32 | SharedNamesAgree | graph | Cells sharing a NAME must agree in value — two truths under one name is a database split-brain |
| L33 | UsdtxInternalUnit | graph | usdtX is an internal calculation unit, not an issued token |
| L34 | SettlementWriteGate | graph | A settlement write is allowed only from a final receipt |
| L35 | DepositConservation | graph | Deposit splits exactly into margin + remainder; the fee is internal to the margin spend, not a third outflow |
| L36 | SlippageBound | graph | Execution slippage stays within a policy bound; an anomaly signals a broken route or oracle |
| L37 | PremiumBound | graph | Perp mark/index premium stays within a policy bound |
| L39 | AccountHealthy | graph | Cross-margin account health factor >= 1 (soft trigger: fires during drawdown while the backstop holds) |
| L40 | InsuranceNonNegative | graph | Insurance balance never goes negative; a deficit beyond the fund fails loudly instead of minting |
| L41 | WbtcPeg | graph | BTC locked == wBTC minted (1:1 bridge peg) |
| L42 | BorrowWithinLtv | graph | Borrow stays within the collateral's LTV cap |
| L43 | BookUncrossed | graph | Order book stays un-crossed: best bid < best ask |
| L44 | AnchorConsistent | graph | An anchored state carries a txid + block + script root; a claim of anchoring without an anchor is a self-error |
| L45 | YieldAccrual | graph | Accrued yield == balance x rate x elapsed days; deterministic and never negative |
| L46 | YieldPoolConservation | graph | Outstanding yield never exceeds the yield pool — no minting |
| L47 | YieldLevelConsistent | graph | User level always matches the balance/volume thresholds |
| L48 | GovernanceWeight | graph | Vote weight <= stake per voter; support <= total stake; passed requires quorum |
| L49 | UserEquity | graph | Per-user equity == collateral + position x (price - entry) |
| L50 | AggregateEquity | graph | Aggregate equity matches the sum of per-user equity — no off-ledger accounts |
| L51 | SocialisedLossBound | graph | Total negative equity is absorbable by insurance capacity |
| L52 | VerifierRoots | graph | The verifier commitment binds content + history roots; a tampered root changes the commitment |
| L54 | AllocatorConservation | graph | Allocator total == free + sum(venue allocation) — no money created |
| L55 | AllocatorDiversification | graph | No venue allocation exceeds its cap fraction of the treasury |
| L56 | AllocatorCapacity | graph | Each venue allocation stays within that venue's capacity |
| L57 | FeeBound | graph | Fees collected never decrease and never exceed the taker rate |
| L58 | BackstopReserve | graph | Admin backstop never injects more BTC than it holds |
| L59 | BackstopCoverage | graph | Liquidation deficit fully covered: admin + insurance == required; no uncovered remainder silently minted |
| L60 | KeyRefsAreHashes | graph | Key cells hold sha256 references, never raw secrets |
| L61 | InterestBound | graph | Borrow rate within [0, max]; supply rate <= borrow rate |
| L62 | OpenInterestConsistent | graph | Open-interest sides non-negative; total == long + short |
| L63 | OrderStateMachine | graph | Conditional orders hold valid statuses and positive triggers |
| L64 | LiquidatorCovered | graph | Liquidator insurance coverage never trails its deficit |
| L65 | RiskBound | graph | Portfolio VaR within budget; no client above the concentration cap |
| L66 | LedgerBalanced | graph | Double-entry ledger nets to zero — every debit has a credit |
| L67 | PositionConservation | graph | Sum of user positions equals the source total; a direct position mint without a counterparty breaks this |
| L68 | BtcAccumulates | graph | Protocol BTC holdings never decrease without an explicit withdrawal — the protocol's north star is growing BTC |
| L69 | BackstopThreshold | graph | Backstop injection executes only when M of N admins approve; a single admin cannot unilaterally drain the reserve |
| L70 | PositionAuthorised | declared | Superseded by L78: the protocol's own BTC is now receipt-bounded (margin <= init + top-ups + reinvest); the old ledger proxy was vacuous |
| L71 | UserLevelConsistent | graph | Each user's recorded ladder level cell matches the live classification recomputed from the current price |
| L72 | ExecutionConservation | graph | For every executed route plan the withdrawal leg conserves: pending + paid_out == planned_withdraw and buffer >= pending |
| L73 | PayoutStateConsistency | graph | Payout states are known; settled implies tx_ref; requested implies no tx_ref yet |
| L74 | MoneyMarketLedger | graph | Pool ledger agrees: assets == cash + debt; lender shares and borrower debts sum to their totals |
| L75 | VaultLockStateValid | graph | Vault states are from the state machine; active implies UTXO evidence |
| L77 | LiquidationConservation | graph | Liquidated plan: recovery + buffer_used + bad_debt == debt_at_liq; remaining owed debt == bad debt |
| L78 | ProtocolOwnBtcBound | graph | The protocol's own BTC (margin) is receipt-bounded: margin <= init + top-up receipts + reinvest; un-receipted growth is a mint |
| L76 | DLCSettlementConservation | graph | Attested/settled DLC: client_payout + counterparty_payout == total_value |
One BTC block = one tick. The node observes a block (height/hash/time), feeds a fresh price oracle, advances the Markov risk chain (visible, not an actor), and the policy table picks the action. It also performs the position lifecycle (top-up, reinvest, exit), persists the whole database + event ledger, and publishes a keyed sealed projection (structure + content root public, values hidden).