Six questions operators ask. In order.
The other surfaces of this site organize by IA — the architecture, the failure history, the trust layers. This page organizes by what skeptical operators actually want to know — answered tightly, in the order they get asked.
What does it actually do?
L1 (gateway) verifies the SV2 surface; L2 (Shield) re-derives every declared template field and cross-checks an independent mempool. One binary.
What does it tell me when something’s wrong?
Named reason codes on the metric stream and the log line — gateway codes plus 22 v2_invariant_*. Find one, copy it, search the docs. No silent drops.
Defects that produce an immediately invalid block. Re-derived from raw block bytes.
CoinbaseValueCoinbaseHeightMerkleRootWitnessCommitmentMismatchTxCountDefects that produce orphan-likely or downstream-invalid blocks.
TemplateWeightSigopsCoinbaseSigopsWitnessCommitmentMissingCoinbaseBip34Wires after the v2.0.0 production observation cycle completes cleanly.
CoinbaseScriptLengthCoinbaseOutputCountWeightExceedsMaxSigopsExceedMaxNonCoinbaseNullPrevoutHeaderVersionLowDuplicateTxCross-references the template's non-coinbase txids against an independent bitcoind mempool view. Rejects when the unknown-tx ratio exceeds tolerance_pct.
Canonical source: rg-consensus::ConsensusViolation::ALL_CODES
How do I configure it?
61 baseline TOML keys plus 8 new under [policy.mempool]. Hot-reloadable across reload tiers.
All 8 new keys optional with defaults so older configs continue to load unchanged.
What does it cost? What’s the license?
Three adoption modes: Shadow (free, warn-only), Observe (license, no enforcement), Inline (license, fail-closed).
Run the gateway behind your existing path with verdict = warn-only. Zero share-flow change.
Self-hosted Docker stack plus license key. Mainnet bitcoind required (or use rg-feed-server).
Fail-closed enforcement. Gateway in the share path.
Observe and inline both require operator-side bitcoind: synced, resourced, RPC reachable, env-var or [policy.mempool] rpc_* credentials wired.
Why not run an existing pool gateway?
Side-by-side feature matrix vs the Stratum Reference Implementation pool — the only single comparable named in our research. The other surfaces (in-house Core forks, demand-broker proxies, do-nothing) are operational decisions, not products.
The Stratum Reference Implementation (SRI) is the canonical proof that the SV2 protocol is implementable. Veldra is built for pool operators who need verification, not just connectivity.
DATUM and other miner-side template protocols are ecosystem context. Veldra’s verification layer is independent of which miner-side protocol the pool runs.
What’s WIRED today, and what’s still planned?
v2.0.0 wires Phase 1 (Tier 1 + Tier 2 invariants — 10 codes) and Phase 2 (Class M mempool ground truth) in the same release. Phase 1.5 adds the 7 Tier 3 belt-and-suspenders invariants after the production observation cycle. v3.x is a design sketch — selfish-mining detection.
Invariant Shield Phase 1 plus Phase 2 mempool ground truth.
Seven Tier 3 belt-and-suspenders invariants wire after the v2.0.0 production observation cycle completes cleanly.
Selfish mining detection. Per-tx detail mode plus the four Phase 2 metrics shipped in v2.0.0 set up the data shape for time-series detection of templates whose unknown-tx sets cluster temporally with structurally coherent fingerprints. v3.x design begins from the shipped Phase 2 surface — no protocol change required, no migration cost beyond enabling per-tx detail in operator policy.