Bridge withdrawal runtime
A withdrawal execution trace for the new bridge runtime, sequencer authorization, journal persistence, Hoon kernel seams, and the default-branch-ahead-of-release state.
The latest public build release contains the bridge withdrawal execution commit, so receipts can cite a matching commit/build pair while still preserving sequencer authorization, proposal, and journal provenance.
true
33ba97b1e206dd89b15c61b72b7802caf2136c18
bridge-withdrawals-spec
crates/bridge/docs/bridge-withdrawals.md
canonical-bridge-withdrawal-spec
End-to-end withdrawal protocol and implementation status.
Defines Base burn ingestion, kernel pending/commit effects, proposal assembly, sequencer authorization, confirmation, and journal persistence.
bridge-runtime
crates/bridge/src/withdrawal/runtime.rs
rust-runtime-source
Runtime loop orchestration for withdrawal activation, assembly, signing, and submission.
Spawns activation restore, assembly, signing, and submission loops after activation readiness is proven.
bridge-sequencer-crate
crates/nockchain-bridge-sequencer/src/main.rs
sequencer-binary-source
Dedicated Nockchain API node hosted withdrawal sequencer service.
New sequencer crate owns withdrawal ordering, authorization, in-flight state, and confirmation polling from the colocated public API.
base-burn
User burns wrapped NOCK through Nock.sol::burn and MessageInbox.notifyBurn records the burn-side initiation.
Base tx hash, log index, lock root, amount, Base block hash, and bridge contract addresses.
kernel-pending
Base observer feeds the burn batch into the kernel, which emits base-block-withdrawals-pending and requires an explicit commit ack.
as_of Base hash, base_event_id, pending request count, and base-block-withdrawals-committed ack.
proposal-built
Runtime selects bridge-owned notes, pokes create-withdrawal-tx, and persists the exact withdrawal-proposal-built envelope.
withdrawal id, epoch, snapshot height/block id, proposal hash, transaction name, selected input note commitments.
sequencer-authorized
Peer canonicalization is not submit-ready; the sequencer authorizes one fully signed proposal and owns in-flight ordering.
commit certificate, signer set, authorized transaction name, sequencer journal object id, and in-flight state.
confirmed-settlement
Sequencer observes confirmed inclusion from the public API and the kernel later reconciles counterpart identity, destination, and amount bounds.
confirmed height, confirmed block id, tx acceptance vs confirmation distinction, and kernel reconciliation status.
bridge-architecture
crates/bridge/docs/architecture.md
scoped-runtime-architecture
Bridge component map and deposit/withdrawal runtime boundaries.
Documents contracts, Hoon kernel, Rust observers, gRPC interfaces, signing/posting loops, and withdrawal effect handling.
withdrawal-submission
crates/bridge/src/withdrawal/submission.rs
rust-submission-source
Sequencer-owned authorization/submission/confirmation lifecycle.
Submission is downstream of sequencer authorization and must not be treated as consensus finality until confirmation is observed.
wallet-tx-builder-fixture
crates/wallet-tx-builder/tests/fixtures/withdrawal_tx_fixtures.jam
tx-builder-fixture
Fixture coverage for bridge-owned withdrawal transaction construction.
Withdrawal transaction fixtures anchor planner/fee/signature behavior that settlement evidence should cite.
hoon-bridge-kernel
hoon/apps/bridge/bridge.hoon
deterministic-kernel-source
Hoon bridge state machine that reconciles withdrawal settlement with kernel state.
Kernel seams include pending withdrawal requests, proposal-building causes, signing causes, and settlement reconciliation.
nockchain-bridge-sequencer
designated Nockchain API node
requires --bind-public-grpc-addr for the colocated public Nockchain API, withdrawal sequencer listens on private gRPC port + 100, public Nockchain client endpoint is derived from the public gRPC bind address, Base confirmed-height watcher must initialize before sequencer RPC serves
--base-ws-url, --base-confirmation-depth, --withdrawal-handoff-window-blocks, --withdrawal-retry-after-base-blocks, --authorized-submit-retry-after-base-blocks, --sequencer-config-path, --sequencer-journal-object-store-endpoint, --sequencer-journal-object-store-bucket, --sequencer-journal-object-store-region, --sequencer-journal-object-store-prefix, --sequencer-journal-id, --sequencer-journal-object-store-access-key-id, --sequencer-journal-object-store-secret-access-key
WITHDRAWAL_SEQUENCER_JOURNAL_SIGNING_KEY, WITHDRAWAL_SEQUENCER_JOURNAL_OBJECT_STORE_ENDPOINT, WITHDRAWAL_SEQUENCER_JOURNAL_OBJECT_STORE_BUCKET, WITHDRAWAL_SEQUENCER_JOURNAL_OBJECT_STORE_REGION, WITHDRAWAL_SEQUENCER_JOURNAL_OBJECT_STORE_PREFIX, WITHDRAWAL_SEQUENCER_JOURNAL_ID, WITHDRAWAL_SEQUENCER_JOURNAL_OBJECT_STORE_ACCESS_KEY_ID, WITHDRAWAL_SEQUENCER_JOURNAL_OBJECT_STORE_SECRET_ACCESS_KEY
tx-accepted is diagnostic; confirmed inclusion requires get_transaction_block plus confirmation depth. The sequencer confirmation loop reads the colocated public Nockchain API and records confirmation before clearing in-flight state. Kernel reconciliation is a second check after confirmed Nockchain settlement, not the first owner of block inclusion.
authorized
The sequencer accepted a fully signed submit-ready proposal, not merely a peer-chosen candidate.
authorized transaction name, proposal hash, witness/signature completeness, journal event id.
mempoolAccepted
The public API reports transaction acceptance, which is diagnostic but not block inclusion.
tx-accepted result, raw tx id, observed-at, API endpoint.
confirmed
The authorized raw transaction was observed in a block with configured confirmation depth.
confirmed height, block id, tip height, confirmation depth, journal event id.
registered
Withdrawal nonce and identity are known to the sequencer ordering frontier.
withdrawal id, withdrawal_nonce, registered-at source, sequencer endpoint.
prepared
A local proposal was built but has not become peer-canonical.
epoch, proposal hash, transaction name, snapshot height, selected input notes.
peerCanonical
A threshold commit certificate fixes the proposal hash for the withdrawal epoch.
commit certificate, signer set, proposal hash, epoch, withdrawal id.
submitted
A local submit RPC was attempted after authorization; this is advisory until mempool or block evidence is observed.
submitted raw tx id, submit attempt time, public API endpoint, journal event id.
kernelReconciled
Kernel settlement reconciliation matched counterpart identity, destination, and amount bounds.
kernel reconciliation status, counterpart identity, destination equality, amount bound check.