A technical overview · 2026-09-25

Miner-verified privacy and tokens on BSV: where it stands

Three programs, one machine underneath them, five days into a funded run: the proof machine is built and measured, the pool's configuration is chosen on the smallest machine we own, the biggest proof in the plan has run end to end, and a machine-checked definition of BSV script consensus has already found real bugs in two public SDKs. Every number below carries its label; the section at the end says what is not claimed yet.

126.71

bits, the proven soundness bar every pool cell clears [X]

45.7 s

a private spend proved on an 8-GB Mac mini, 1.34 GiB [M]

$18

the largest proof in the plan: 33 million rows on a rented 336 GB machine [M]

104 / 238

issues closed across the three trackers [M]

Every number carries its label: [M] measured on a record, [X] executed on the engine, [X-emit] emitted and priced, [D] derived from measurements, [EST] an estimate. Nothing here is a projection dressed as a fact.

What we are building

Three private programs, one destination: trustless, self-custodial, fully composable finance on a Bitcoin-family chain where the miners do the verifying. Not an indexer that a company runs. Not a committee. Not a sequencer. The chain's own validators check every proof in the script itself, so nothing about a user's money depends on a server staying honest or staying up.

The shielded pool. Private spends on BSV: a note goes into a pool and comes out somewhere else, and the chain can verify the spend was valid without learning who paid whom or how much. Hash-based, so no trusted setup, and post-quantum on every axis the program controls. And you can always leave: reveal the note and exit, with no proof and no permission, at every height, forever.
The token standard. A token whose supply rules are enforced by the miner all the way back to genesis, with no client-side checking and no indexer, and whose classes compose (a token, an AMM, an exchange, a bridge) inside the same enforcement. Its public name comes with its release.
The consensus spec. A machine-checked definition of BSV script consensus in Lean that also runs, with a conformance harness that runs every corpus against the reference node, two public SDKs and our own engine. Against it a contract's script can be proven to do exactly what it claims (that layer is in progress); it is also what will let us say a lock is valid without broadcasting anything.

Why one machine underneath all three: the pool and the token share one prover and one emitted verifier, and the spec is what both are checked against. A result in one program lands in the others the same week.

How the machine works, in one picture

The prover turns a statement ("this spend is valid") into a proof; the verifier is not a program on a server but a Bitcoin script emitted from the same source, so the miners run it. Underneath is a WHIR-style proximity argument over the Goldilocks field (the cubic extension, 2¹⁹² elements), SHA-256 Merkle trees, and a Fiat–Shamir transcript that binds every public input. Soundness is counted as a union of failure terms, one per round and query, and we ship the configuration whose union clears a bar we can prove, not one we hope for.

The ladder of bits. A 256-bit hash gives at most 128 bits against collisions; the union's few terms bring the provable ceiling to 126.71. The pool set 126.71 bits as its own bar, and every configuration measured clears it (the chosen cell prints 129.72 bits under the published theorem). The token's maximum cell prints 126.24 bits under our own, stricter accounting and 129.18 under the published bound, so it clears the bar too; the front cell's 100 bits is an instrument figure, not yet a measured row. The bound behind these numbers is a theorem: a published result (ePrint 2026/2056, Theorem 5.12) with a machine-checked proof, imported into the pool's Lean; the token's import is next. The 128 is the most any 256-bit hash can give.

Four layers of proof sit on top of the machine, and the plan ships all four: the union bound at the chosen configuration (kernel-checked for the pool's plain cell; the hiding-on twin and the token's shipped cell are next), the covenant model with its four pillars as theorems, the whole verifier composed round by round inside ArkLib, and the script semantics that show the emitted verifier computes exactly what the proof says. That last layer is why the consensus spec exists.

Proven, at its scope

Three different things are called "proven" here, and each means something exact. The soundness of the proof system is a theorem: the accounting that says a forged proof passes with probability below 2^-126.71 is checked by the Lean kernel at the configurations that have landed (the pool's cell of record; its hiding-on twin and the token's shipped cell are next), on a published bound with its own machine-checked proof. The spec of consensus is mathematics a computer checks: what the chain accepts is written as Lean definitions and theorems, kernel-checked, no gaps, three standard axioms; and it runs, so it gives a verdict on any script (the block-level rules are a later layer, and a verifier-sized script waits on the evaluator's literal reader, in progress). It is tested against the SV node, on 13,726 entries, and matched every one. That is evidence about the node, not a proof about the node: the node is a C++ program, and no theorem makes it perfect. A contract proven against the spec is the third: a theorem that evaluating a script under the spec's semantics equals the statement the script claims to check. Our own verifier will ship with that theorem: the 2.0 MB script the miner runs, proven to compute exactly the check the mathematics defines. That layer is in progress, and until it lands it is a plan, not a claim.

What landed this week

The biggest proof in the plan ran end to end.

The token's maximum cell, 33 million rows on the cubic field, proved on a 336-GiB cloud machine: 268 GiB at the peak, 14,081 seconds (just under four hours), $18.04, and a union of 126.24 bits under our own accounting, 129.18 under the published bound [X]. The memory levers that made it fit are value-exact: at the three smaller cells where both runs exist, the proof bytes are identical with and without them. A Lean cell in ℚ[√15] brackets the result to two decimals, so the number is not the instrument's opinion.

The pool's configuration is chosen, on the smallest machine we own.

Both candidate rates were proved on a quiet 8-GB Mac mini with the hiding layer on, inside the wallet budget of 60 seconds and 4 GiB: 45.7 s and 1.337 GiB at rate 1/32, 28.1 s and 3.143 GiB at 1/16 [M]. We took 1/32: 14 seconds and 2.7 GiB of margin, and an on-chain lock 9.2 % smaller [X-emit], paid back on every spend forever.

The hiding layer is on the engine, and its price is known.

The layer meant to keep a spend from revealing its note now runs end to end on our engine at both rates, with 56 executed negatives rejecting at each. Its cost on the lock is profiled phase by phase: +271,191 bytes at 1/32, +15.55 % [X-emit], most of it in the first round (the salts and the mask's legs). A mutation census over the statement's 116 constraints (117 mutated cases) has 102 caught by an executed witness on the engine, 10 shown implied by the rest, and 4 load-bearing ones whose witness is still owed [X].

The spec caught real bugs in two public SDKs.

Running 13,726 corpus entries in eight corpora through the reference node, two public SDKs and our own engine, the spec's verdict matched the node on every entry in both columns, consensus and policy [M], and turned up four classes of divergence in our own engine and twenty-two in the two SDKs (plus six behaviours of one SDK's default mode), each recorded with its witness and its citation and reported to the SDKs' maintainers through their security process. Four engine releases this week, three of them carrying fixes the spec found; the four classes still open go into the next release with their witnesses as its tests.

The whole plan audited.

Last night I stopped every window and ran eleven independent fresh-context reviews over the whole plan, one per surface: every stale sentence re-cut, seventeen new issues filed, and the plan's chains of dependencies re-cut so more windows can run at once.

Where each program stands

Program	Closed [M]	The live milestone
The pool	47 of 94	The field landed and the cell is ruled: one issue open (the Lean twin at the chosen cell). Next, the hiding layer's landing.
The token	30 of 97	Decision-ready for the re-base: the maximum cell measured, the front arm decided, the checkpoint table next.
The spec	27 of 47	The full consensus: four issues open, the generator families and the literal reader first.

Counts are the trackers' at the last sweep; the totals include the seventeen issues the audit filed on Thursday night.

Cost, and why it falls

What it costs today. A private spend is proved on an 8-GB Mac mini in 45.7 s [M]: wallet class, no server. The token's largest proof, 33 million rows, needed a rented 336 GB machine for 3.9 hours and cost $18 [M]; the endurance runs that prove a class keeps working hop after hop will take a few hundred dollars of such proofs [D]. On chain, the 2.0 MB lock is priced by the byte like any transaction: cents at today's fee rates [D]. Some of this is expensive and needs big hardware. Three things bring it down, in this order.

Correctness first, then cost. We prove it works at the configuration that will ship, then make it cheap. The memory levers already in the prover are value-exact (the proof bytes identical with and without them, at every cell where both runs exist), the next two are known and not yet built, and every lever is measured behind an anchor and never traded against soundness.
The mathematics. Every bit we claim rests on a proven bound, never a conjecture. This month a published theorem (ePrint 2026/2056, with a machine-checked proof) replaced an unpublished one and put the pool's cell at 129.7 bits under the same proof. The open question that remains, proximity gaps for Reed–Solomon codes between the Johnson radius and capacity, carries a $1M prize from the Ethereum Foundation with a machine-checked leaderboard, and six papers this year. Each proven improvement makes these proofs smaller at the same security. We take it the day it is proven, never before.
The hardware. The 336 GB class is a rental today and a desktop in a few years; the pool's spend already fits an 8-GB machine. We are optimistic about Moore's law, and we do not depend on it: the plan ships on today's hardware.

Funded, and metered. One backer is funding the run. Cloud proving has a ceiling of $2,000 for this stretch; $189.51 of it was spent in the first five days [M], which bought the largest proof in the plan, the rows that chose the pool's configuration, and every tripwire run in between. Every job carries its cap in its source and its cost in the record; two launches this week were errors and are booked as errors ($12.57 for nothing). The next sizable spend is the token's endurance run at the maximum cell, roughly $250 to $400 [D], one proof at a time, after the memory levers, with one rule attached: nothing wasted. The rest of the money goes to machines and to the windows the work runs in (a window is a full engineer's seat that builds, measures, writes the record and checks the next window's claims).

What these become

When the three land they are not three products. They are primitives anyone can build on, and they compose because the miner checks every proof inside the same transaction. Some of what that makes possible:

Private money on a public chain. A wallet that pays anyone without revealing who paid whom or how much, with no operator to trust or to subpoena, and a door that is always open: reveal your note and leave. Payroll, a treasury, a merchant's till.
Tokens whose rules are theorems. A stablecoin whose supply cannot exceed its reserve, a share class whose vesting the miner enforces, a wrapped asset whose mint is tied to a burn on the other chain. The rule lives in the script, so a bug in a wallet or a server cannot break it, and there is no admin key to steal.
Markets with no house. An automated market maker, an order book, a lending pool, each an arm of the same standard, so a trade, a loan and a private settlement can sit in one transaction the miner accepts or rejects whole.
Private tokens. The pool's hiding layer over a token class: a private trade in an asset whose supply is still enforced in the open.
A consensus oracle for everyone. The machine-checked spec is an executable statement of what BSV script accepts. Wallets, SDKs and nodes get tested against it; it has already found divergences in three implementations: two public SDKs and our own engine. It is also how we ship a lock without ever broadcasting a probe.
Proof-carrying transactions in general. The prover and the emitted verifier let the miners check any statement we can prove: a bridge with no committee, an oracle whose answer carries its own proof, a settlement that needs no one's permission. The three programs are the first three uses, not the last.

The proofs are hash-based, so they stand after quantum computers arrive (the note delivery uses a hybrid post-quantum key exchange), and all of it is verified at the miner, so none of it depends on a company staying honest or staying up.

What is next

In the order the dependency graph gives: the pool's spine first (the hiding layer to its landing, then the statement in the AIR, then the verifier welded into the covenant), the token's front fixture and its checkpoint, the spec's families and its evaluator. It is done when it is done, and it opens with its proofs.

The SDK findings, and how they were reported

The spec's differential harness found consensus-affecting divergences between the SV node and two public SDKs (8 classes in go-sdk, 14 in @bsv/sdk), each with a reproducer and the source lines on both sides. On 2026-09-25 they were reported to the maintainers through the repositories' security process as private advisories, at the maintainers' request, and the details stay private until they say otherwise. The public reports follow their disclosure timeline; this page will link them when they are out.

What is not claimed yet

Mainnet. Nothing of these programs is on mainnet yet; the drills come when the machine is ready, on a regtest node first.
Zero-knowledge in the formal sense. The hiding layer runs on the engine and its argument is drafted; its review is next, so this page says "private" and nothing stronger until the review closes.
A public repository. Everything opens when it is done: the code, the records every number here points at, the Lean proofs and the corpus. Until then these are our measurements.
The transparent-in-script primitive as ours. Hash-based proof verification in native BSV script exists elsewhere (rollup and pool projects on regtest and testnet). What is ours is the pool's design and its measured wallet-class prover, the token's miner-enforced supply back to genesis, and the executable spec.

To fund what comes next (compute, machines, more windows): message the author. Every dollar lands on a record.