Nockchain evidence

Public API provenance

Nockchain Public API Source Trace

Source anchors for the alpha public gRPC binary, public/private endpoint modes, wallet public-client checks, transaction acceptance, block explorer cache behavior, metrics, gRPC-Web, and access-control posture.

Commit
33ba97b1e206
Anchors
13
Capabilities
7
Crates
nockchain-api, nockapp-grpc

Source Anchors

api-readme-contract

file

crates/nockchain-api/README.md

symbols

nockchain-api, NockchainService, NockchainBlockService, GetBlocks, GetTransactionDetails

lineRange

1-93

Defines nockchain-api as alpha Tier 1 authority for public API runtime, deployment guidance, risk posture, cache limits, and PMA quickstart.

The README says public gRPC is enabled by --bind-public-grpc-addr, has no auth/authz/rate limiting, exposes NockchainService and NockchainBlockService, and serves block explorer responses from a heaviest-chain cache.

api-binary-bootstrap

file

crates/nockchain-api/src/main.rs

symbols

NockchainAPIConfig::EnablePublicServer, produce_prover_hot_state, init_with_kernel

lineRange

24-45

Boots the public API binary with the normal Nockchain kernel and prover hot state, enabling the public server only when a bind address is supplied.

The binary parses normal Nockchain CLI flags, maps bind_public_grpc_addr into NockchainAPIConfig, initializes with the Nockchain kernel, and runs the NockApp.

public-grpc-cli-flag

file

crates/nockchain/src/config.rs

symbols

bind_public_grpc_addr, bind_private_grpc_addr, bind_private_grpc_port

lineRange

217-231

Declares the public gRPC bind flag and private gRPC bind controls that decide endpoint exposure mode.

The public API bind is off by default and recommends 127.0.0.1:5555, while private gRPC defaults to port 5555 unless explicitly overridden.

api-config-driver-toggle

file

crates/nockchain/src/lib.rs

symbols

NockchainAPIConfig, deploy_public, grpc_server_driver, private_nockapp

lineRange

147-178,542-557

Toggles public gRPC driver installation while always adding the private NockApp gRPC driver.

NockchainAPIConfig distinguishes EnablePublicServer from DisablePublicServer, and init adds public_nockchain::grpc_server_driver only when deploy_public is true.

public-grpc-driver

file

crates/nockapp-grpc/src/services/public_nockchain/v2/driver.rs

symbols

PublicNockchainEffect, grpc_server_driver, grpc_listener_driver

lineRange

14-90

Connects public gRPC server/listener behavior to NockApp effects, including send-tx effects from wallet/public client flows.

The driver decodes nockchain-grpc send-tx effects and starts a PublicNockchainGrpcServer on the configured socket.

public-service-startup

file

crates/nockapp-grpc/src/services/public_nockchain/v2/server.rs

symbols

PublicNockchainGrpcServer::serve, NockchainServiceServer, NockchainBlockServiceServer, NockchainMetricsService

lineRange

140-212

Starts health, reflection, NockchainService, NockchainBlockService, metrics service, gRPC-Web, CORS, and IP blocklist layers.

The service marks NockchainService serving immediately, block service not-serving until cache seed, installs reflection, API, block explorer, metrics, CORS, gRPC-Web, and blocklist layers.

block-explorer-refresh

file

crates/nockapp-grpc/src/services/public_nockchain/v2/server.rs

symbols

start_heaviest_chain_refresh, start_block_explorer_refresh, initialize

lineRange

263-330

Refreshes heaviest-chain state and initializes the block explorer cache before marking block service as serving.

The refresh worker retries cache initialization, only sets NockchainBlockService serving after initialization succeeds, and treats decode errors as fatal.

transaction-accepted-server

file

crates/nockapp-grpc/src/services/public_nockchain/v2/server.rs

symbols

transaction_accepted, tx-accepted, TransactionAcceptedResponse

lineRange

1408-1524

Serves TransactionAccepted by peeking the kernel's tx-accepted path and returning accepted/error, with metrics for invalid, decode, peek, and NockApp failures.

The method validates tx_id, builds a tx-accepted peek path, decodes Option<Option<bool>>, and returns accepted false when the peek is empty.

block-explorer-get-blocks

file

crates/nockapp-grpc/src/services/public_nockchain/v2/server.rs

symbols

NockchainBlockService, get_blocks, GetBlocksRequest

lineRange

1527-1680

Serves paginated GetBlocks from the block explorer cache and reports current cached height.

GetBlocks requires a page request, clamps client limit to max page size, decodes cursor tokens, reads cache pages, and records latency metrics.

block-explorer-transaction-details

file

crates/nockapp-grpc/src/services/public_nockchain/v2/server.rs

symbols

get_transaction_details, GetTransactionDetailsRequest, TransactionPending

lineRange

1900-2008

Serves transaction details or pending/not-found state through the block explorer cache.

Transaction details resolve tx_id, load details from cache/kernel, return pending when the cache reports TxPending, and keep pending separate from details.

public-api-proto

file

crates/nockapp-grpc-proto/proto/nockchain/public/v2/nockchain.proto

symbols

NockchainService, NockchainBlockService, NockchainMetricsService

lineRange

12-170

Defines the public v2 gRPC service contract for wallet balance/send, tx acceptance, block explorer, transaction details, and metrics.

The proto separates wallet APIs, block explorer APIs, and metrics APIs; transaction responses can be accepted, pending, details, or error depending on method.

public-api-metrics

file

crates/nockapp-grpc/src/services/public_nockchain/v2/metrics.rs

symbols

NockchainGrpcApiMetrics, nockchain_public_grpc.tx_accepted_success, nockchain_public_grpc.block_explorer.seed_ready, nockchain_public_grpc.api_request_blocked

lineRange

6-287

Names the observability contract for public API balance, send, tx-accepted, heaviest-chain, block explorer cache, latency, and request blocking.

Metrics include cache seed readiness, heaviest-chain age, cache span/coverage, refresh/backfill success, endpoint latency, and request-blocked counts.

wallet-public-tx-accepted

file

crates/nockchain-wallet/src/main.rs

symbols

run_transaction_accepted, format_transaction_accepted_markdown

lineRange

1690-1765

Enforces wallet tx-accepted checks through the public client and formats accepted/not-yet-accepted output.

The wallet rejects tx-accepted unless --client public is selected, validates the tx id as base58 hash, queries the public gRPC server, and renders accepted-by-node status.

API Capabilities

public-server-enablement

Public server enablement

A receipt should prove whether public gRPC was actually enabled and which bind address was used.

sourceAnchorIds

api-binary-bootstrap, public-grpc-cli-flag, api-config-driver-toggle

receiptFields

apiEndpoint, apiEndpointMode, publicGrpcEnabled, nockchainBuild

public-endpoint-security-posture

Public endpoint security posture

Public API evidence needs explicit access-control posture because upstream documents no built-in auth, authorization, or rate limiting.

sourceAnchorIds

api-readme-contract, public-service-startup, public-api-metrics

receiptFields

apiEndpoint, accessControlPosture, metricsSnapshot

tx-accepted-not-inclusion

Transaction accepted is not inclusion

accepted=true means the node accepted the transaction request; it does not prove mempool residency, block inclusion, or settlement.

sourceAnchorIds

transaction-accepted-server, wallet-public-tx-accepted, api-readme-contract

receiptFields

txId, acceptedByNode, includedBlock, verificationStatus

block-explorer-cache

Block explorer cache

Explorer responses are cache-backed heaviest-chain views and can be inconclusive during warm-up, backfill, or reorg windows.

sourceAnchorIds

block-explorer-refresh, block-explorer-get-blocks, block-explorer-transaction-details

receiptFields

cacheWarmupState, currentHeight, includedBlock, transactionPending

metrics-and-health

Metrics and health

API receipts should include metrics/health freshness when using hosted or public API evidence.

sourceAnchorIds

public-service-startup, public-api-metrics

receiptFields

metricsSnapshot, healthServingState, heaviestChainFreshness

Receipt Contract

nockchainCommit
nockchainBuild
apiEndpoint
apiEndpointMode
apiSurface
clientMode
grpcService
requestMethod
txId
acceptedByNode
includedBlock
currentHeight
cacheWarmupState
heaviestChainFreshness
metricsSnapshot
accessControlPosture
observedAt
verificationStatus
highlightedField

apiEndpoint

highlightedField

accessControlPosture

highlightedField

cacheWarmupState

interpretationRule

Treat public API docs as Tier 1 scoped authority for API deployment and risk posture, not protocol authority.

interpretationRule

Treat tx-accepted as node acceptance and require block explorer or independent evidence before claiming inclusion.

interpretationRule

Treat cache misses during warm-up/backfill as inconclusive rather than negative proof.

interpretationRule

Record access-control posture for every public or hosted endpoint before accepting API evidence.

interpretationRule

Represent raw transaction and noun data with hashes or summaries, never raw payloads.

Endpoint Modes

highlightedEndpointMode

private-grpc

highlightedEndpointMode

public-grpc

highlightedEndpointMode

hosted-http-manifest

private-grpc

Private local gRPC

endpointShape

http://127.0.0.1:5555

hostedProbePolicy

blocked-private-or-loopback

Use for local fakenet balance and private peeks/pokes when the endpoint is not exposed to public clients.

public-grpc

Public gRPC

endpointShape

https://nockchain-api.zorp.io or controlled host:port

hostedProbePolicy

client-side-or-controlled-proxy

Use for public wallet balance, send-tx, tx-accepted, block explorer, and metrics evidence after recording access controls.

hosted-http-manifest

Hosted HTTP manifest

endpointShape

https://example.com/.well-known/nocksperimental-fakenet.json

hostedProbePolicy

allowed-public-http-only

Use when Nocksperimental fetches a public manifest describing a user's fakenet while keeping direct gRPC probes client-side.

Local Verification

status

source-inspected

inspectedSourceCommit

33ba97b1e206dd89b15c61b72b7802caf2136c18

highlightedCommand

cargo check -p nockchain-api

command

cargo check -p nockchain-api

command

cargo check -p nockapp-grpc

command

cargo test -p nockapp-grpc public_nockchain

command

cargo check -p nockchain-wallet

symbol

NockchainAPIConfig::EnablePublicServer

symbol

NockchainBlockServiceServer

symbol

NockchainMetricsService

symbol

run_transaction_accepted

Forbidden Evidence

forbiddenField

rawTransactionJam

forbiddenField

rawAuthorizedRawTx

forbiddenField

rawNounSlab

forbiddenField

privateGrpcPokePayload

forbiddenField

walletSeedPhrase

forbiddenField

walletPrivateKey

forbiddenField

apiServerPrivateKey

forbiddenField

sequencerJournalSigningKey

highlightedForbidden

rawTransactionJam

highlightedForbidden

rawNounSlab

highlightedForbidden

walletSeedPhrase