The verifier doesn’t trust the template. It re-derives it.
Veldra v2.0.0 ships the Invariant Shield: 22 canonical re-derivation checks (Phase 1) plus mempool ground truth (Phase 2). Layered on top of the existing 59-code v1 policy gateway and 61-key TOML config baseline.
v2.0.0 wired, on origin, CI green. Independent consensus re-derivation runs. Mempool ground truth runs. The launch claim that the system catches consistent template-manager tampering at the verifier layer in production requires the production observation cycle to complete first. Until then, public messaging distinguishes “wired and tested in CI” from “validated against real mainnet templates over a multi-week observation window.”
Reason codes
Every disagreement gets a name. The reason-code surface is the contract: what the verifier emits when it rejects a template, on the metric stream and the log line, with a canonical source you can grep.
Defects that produce an immediately invalid block. Re-derived from raw block bytes.
CoinbaseValueCoinbaseHeightMerkleRootWitnessCommitmentMismatchTxCountDefects that produce orphan-likely or downstream-invalid blocks.
TemplateWeightSigopsCoinbaseSigopsWitnessCommitmentMissingCoinbaseBip34Wires after the v2.0.0 production observation cycle completes cleanly.
CoinbaseScriptLengthCoinbaseOutputCountWeightExceedsMaxSigopsExceedMaxNonCoinbaseNullPrevoutHeaderVersionLowDuplicateTxCross-references the template's non-coinbase txids against an independent bitcoind mempool view. Rejects when the unknown-tx ratio exceeds tolerance_pct.
Canonical source: rg-consensus::ConsensusViolation::ALL_CODES
Configuration
61 baseline TOML keys plus 8 new under [policy.mempool] in v2.0.0. All 8 optional with defaults — older configs continue to load unchanged.
All 8 new keys optional with defaults so older configs continue to load unchanged.
Telemetry
Four new Prometheus streams in v2.0.0 for Phase 2. Existing exports unchanged.
Existing exports unchanged. Prometheus / Grafana / CSV / NDJSON observability per current site.
rg-consensus facade
The narrow public API of the consensus engine. Five re-derivation entry points and five accessors over rust-bitcoin — the entire Class D / Class S surface.
rg-consensus is a separable facade wrapping rust-bitcoin behind a narrow boundary.
re_derive_coinbase_value()re_derive_template_weight()re_derive_merkle_root()re_derive_witness_commitment()count_sigops()template_txidsparse_blocktotal_sigopscoinbase_sigopsbip34_heightPhase-2 fail-stale state machine
What happens when the operator’s bitcoind RPC poll fails. Three states, named transitions, no template drops.
Mempool-view state machine: the verifier transitions through three states based on age, then degrades cleanly without dropping templates.
max_stale_secs = 60 · sample_unknown_cap = 10Threat model · ceilings · caveats
What’s in scope, what’s structurally out of scope, and what the 4% mempool-tolerance window can and cannot do.
ReserveGrid OS v2.0.0 with Phase 1 plus Phase 2 catches T1, T2, T3. T4 and T5 are explicitly out of scope.
any template whose declared fields pass operator thresholds, even if underlying bytes are fabricated
tampering whose declared values and raw bytes are internally consistent by construction
tampering operating within the configured tolerance window, or while bitcoind itself is compromised
- 01The 4% tolerance window in Phase 2 absorbs benign mempool divergence (legitimate propagation latency between operator’s bitcoind and the network).
- 02Tuning down toward 2.0 narrows the window but cannot reach zero without producing false positives on real templates.
- 03Phase 2 trusts the operator’s bitcoind by definition. If that bitcoind is itself compromised, Class M is blind.
Adoption modes
Three deployment shapes — Shadow (warn-only · free), Observe (license · no enforcement), Inline (license · fail-closed). The bitcoind prerequisite is named upfront.
Run the gateway behind your existing path with verdict = warn-only. Zero share-flow change.
Self-hosted Docker stack plus license key. Mainnet bitcoind required (or use rg-feed-server).
Fail-closed enforcement. Gateway in the share path.
Observe and inline both require operator-side bitcoind: synced, resourced, RPC reachable, env-var or [policy.mempool] rpc_* credentials wired.
Operators who want observe or inline mode get a license key from their veldra.org account (Sign In).
Observe and inline both require operator-side bitcoind: synced, resourced, RPC reachable, env-var or [policy.mempool] rpc_* credentials wired.
Veldra vs SRI
The single named product comparison. Stratum Reference Implementation is the canonical proof the SV2 protocol is implementable. Veldra is built for pool operators who need verification, not just connectivity.
The Stratum Reference Implementation (SRI) is the canonical proof that the SV2 protocol is implementable. Veldra is built for pool operators who need verification, not just connectivity.
DATUM and other miner-side template protocols are ecosystem context. Veldra’s verification layer is independent of which miner-side protocol the pool runs.
Roadmap
v2.0.0 → Phase 1.5 → v3.x. No calendar dates — the milestones are gated on the production observation cycle, not the wall clock.
Invariant Shield Phase 1 plus Phase 2 mempool ground truth.
Seven Tier 3 belt-and-suspenders invariants wire after the v2.0.0 production observation cycle completes cleanly.
Selfish mining detection. Per-tx detail mode plus the four Phase 2 metrics shipped in v2.0.0 set up the data shape for time-series detection of templates whose unknown-tx sets cluster temporally with structurally coherent fingerprints. v3.x design begins from the shipped Phase 2 surface — no protocol change required, no migration cost beyond enabling per-tx detail in operator policy.