VigiChain

A post-quantum settlement network with a core small enough to audit

UTXO Labs — version 1.0, 18 August 2026

Abstract

VigiChain is a proof-of-work settlement network in which every signature that moves value is post-quantum, and in which a block is accepted only when mining, money, state and cryptographic posture all agree. The chain is deliberately small: a capability enters consensus only when every node on earth must run it to decide whether a block is valid. Everything else — evidence, identity, provenance, data, escrow conditions, markets — wraps the chain instead of enlarging it.

This document describes what is implemented, how it works, and what is not built. The distinction is stated on every claim, because a specification that cannot be told apart from a plan is not a specification. The network runs a public testnet today. Mainnet is locked in the software and stays locked until an independent audit of the current code closes.

1. The problem

Two failures are usually discussed separately, and they are the same failure.

The first is arriving. Every signature protecting value on every major chain today rests on the hardness of discrete logarithms over elliptic curves. A cryptographically relevant quantum computer breaks that assumption, and the exposure is not symmetric: an adversary who records the chain now can forge later. Public keys are published the moment a coin moves, so "harvest now, decrypt later" is not speculative for a ledger — it is the default. Migrating a chain whose signature scheme is welded into its consensus rules is not a patch; it is a new network with an old name.

The second failure is already here and costs more. Custody breaks. Bridges get drained. A backup that nobody restored turns out not to restore. A provider says the data is there and it is not. Software updates arrive from a channel nobody verified. In each case the loss is not cryptographic — it is that the system offered a promise where it should have offered evidence, and the difference only becomes visible at the moment the promise fails.

VigiChain treats both as one problem: systems that ask to be trusted rather than checked, using cryptography that will not survive the decade. The answer is the same in both directions — demonstrate rather than assert, and demonstrate with primitives that outlive the machine that attacks them.

2. Design principles

A small core. One question decides where a capability lives: does every node have to run this rule to decide whether a block is valid? If the answer is no, it stays outside consensus. This is not minimalism for its own sake. A core small enough to audit is the only core anyone will ever finish auditing, and an unaudited consensus rule is an unbounded liability that every node is obliged to execute forever.

Evidence over assertion. The network states limits as loudly as capabilities. A proof layer that implies more than it demonstrates is worse than no proof layer, because it moves trust somewhere the reader cannot see.

Sovereignty. No dependency on another chain, custodian or gatekeeper for the network to remain true. Own consensus, own addresses, own oracle, own explorer. There is no master key at UTXO Labs and there is not meant to be one: a recovery path that ends at the company that wrote the software is custody with a friendlier name.

Post-quantum as a property, not a feature. Value moves only under a post-quantum signature. There is no legacy path kept open for convenience, because a legacy path is the path an attacker uses.

3. Consensus: ABΩ-PQ-PoVW

Proof of work proposes. Alpha protects money. Beta protects state. Omega protects the future. Validation decides.

Proof of work in VigiChain is a proposal mechanism, not an acceptance mechanism. A block that satisfies the hash target has bought the right to be considered. Acceptance is a conjunction:

BLOCK_VALID =
      SHA256_POW_VALID          (work actually performed against the expected target)
  AND ALPHA_VALID               (money: 21M cap, subsidy schedule, gas accounting, genesis)
  AND BETA_VALID                (state: UTXO set, double spends, signatures, roots)
  AND OMEGA_VALID               (future: versioned PQ envelope, per-transaction scheme)
  AND VALIDATION_RECEIPT_VALID  (validation depth, rotation and integrity)

Every term is recomputable by any full node. There are no privileged validators, no shortcuts and no term that another term can override. A block that fails any one of them is not a contested block; it is not a block.

3.1 Difficulty, and the honesty of the target

A block cannot declare its own difficulty. The expected target is derived from chain state and compared against what the header claims, within the retarget clamp — a rule that exists because the alternative is a miner skipping the work check by lying about how much work was required.

Retargeting happens every POW_RETARGET_WINDOW = 60 blocks, measured across the window's actual elapsed time against the target block interval (60 seconds on mainnet, 30 on testnet), and is clamped to a factor of 4 in either direction so a single window cannot swing the network.

A separate rule handles collapse. If STALL_RESET_MULTIPLE = 20 block-times pass in silence, a block may carry the easiest target. Twenty is Bitcoin's testnet figure: long enough that ordinary variance never reaches it, short enough that a network which lost its miners recovers in minutes rather than days. This rule has already been the source of one real freeze on the public testnet — one validation path accepted a stall-reset target that the ABΩ predicate rejected, and the chain stopped for 32 hours at a single height until the two agreed again. It is documented here because a specification that omits the failures is a brochure.

3.2 Fork choice

Canonical is the heaviest chain by accumulated proof-of-work, where per-block work is ≈ 2^256/(target+1). Reorganisation is by total work, never by block count and never by arrival order.

A BFT finality gadget exists in the codebase and is advisory: quorum certificates are produced and carried, finality is tracked off-chain, and fork choice is unchanged by them. The guard that would bind finality into fork choice defaults to inert. Stating this precisely matters, because "instant finality" is the claim most often made and least often implemented: the only instant finality path in this system today is the execution layer's re-execution check (§8), not the L1.

3.3 The validation receipt

Each accepted block carries a receipt describing how deeply it was validated. Validation depth is set by a Fibonacci progression, the order of public checks is rotated by a deterministic sequence, and a quorum-derived factor may raise the validation bar but can never lower it or cause an invalid block to be accepted. The asymmetry is the whole design: every mechanism in the receipt can make acceptance stricter, none can make it looser.

4. Post-quantum cryptography

Signature schemes in consensus today:

Algorithms declare their NIST category and security levels filter on it, so a level may not accept a family weaker than the level beneath it. Unknown or future post-quantum formats are rejected until consensus activates them — a signature scheme the network has not been taught is not a permissive default, it is a refusal.

The security envelope is versioned per transaction, which is what makes OMEGA_VALID a consensus term rather than a documentation note: the scheme a transaction was signed under is part of what the network validates, so introducing a new scheme is a coordinated protocol change and never a silent client difference.

Key encapsulation, outside consensus. Where the system encrypts rather than signs — guardian shares in Sovereign Recovery, the payment rail's envelope — it uses a hybrid construction, X25519 combined with ML-KEM-768. Hybrid is deliberate: it fails only if both the classical and the post-quantum component fail, which is the correct posture during a transition nobody can date precisely.

Node identity at rest. A node's key material is sealed with XChaCha20-Poly1305 under a key derived by Argon2id (RFC 9106), with every public field authenticated so a keystore cannot be edited onto another network. Mainnet refuses a plaintext keystore in both directions — reading one and writing one. The honest limit: an unattended node must be able to read its own passphrase, so this protects backups, snapshots and stolen disks, not an attacker who is already root on a live host.

5. Ledger and state

The chain state is a UTXO set, not a table of account balances. Validation stays deterministic and traceable, and the model parallelises later without a consensus change.

5.1 Spend policies

An output is not necessarily locked to one key. A spend policy composes:

• MlDsaSingle — one post-quantum signature;
• MlDsaMultisig — an M-of-N quorum over committed participants, with canonical participant ordering and no duplicates;
• HeightTimelock — a block-height lock that wraps either of the above.

Because a timelock wraps an inner policy rather than sitting beside it, real arrangements express directly: a treasury that needs three of five signatures and cannot move before a given height is one policy, not a convention enforced by software off-chain.

Two conditional releases already run on this primitive: the execution layer's exit against an inclusion proof, and a treasury spend against its registered policy.

What the primitive does not yet have is a release condition that is neither a signature nor a height — a condition satisfied by a proof that a service was delivered. That is the missing piece between this ledger and the autonomous economy described in §9, and it is an extension of an audited primitive rather than a new subsystem.

6. Monetary policy

At a 60-second target, a halving arrives roughly every 146 days: the Bitcoin curve compressed, not copied.

The cost of using the network is GAS. It is work — the effort a transaction imposes on every node that must validate it — and it is paid to the miners and validators who perform that work. It is not a fee levied by an operator, and this document does not call it one. Transaction gas goes entirely to the block producer; it is not burned by default and does not increase supply.

6.1 Work-weighted subsidy

On mainnet the scheduled subsidy is modulated by the difficulty the block was actually mined against, bounded to [0.5×, 2.0×] of the scheduled base. The weighting uses the deterministic expected difficulty — identical to the block's validated header target — never hash luck, so miner and validator always compute the same reward. Testnet and devnet keep the flat schedule.

The purpose is to pay for security rather than for slots: a block that defended the network against a harder target did more work, and is paid for more work.

6.2 The bootstrap ramp

The first 1,000,000 VIGI on mainnet are mined at the bootstrap target, deliberately easy, so ordinary hardware takes part in the start on the same terms as anyone else. Difficulty then does not jump: between 1,000,000 and 1,100,000 VIGI it doubles in sixteen steps, each small enough for real hashrate to follow. These are supply thresholds, not dates and not block numbers, which means the schedule cannot be gamed by waiting.

6.3 The monument blocks

Mainnet's first three blocks pay nobody who is alive. Every vix they mine goes to addresses with no private key, so the coins exist, count towards the 21,000,000, are visible to anyone and can never move.

• Block 1 locks its entire subsidy.
• Block 2 pays 21 VIGI — twenty-one, for the twenty-one million — to an address derived from the Bitcoin genesis hash and the headline inside it, plus 0.801 VIGI to al-Kindi. The remainder is locked.
• Block 3 pays 1.404 to Leon Battista Alberti, 1.912 to Alan Turing and 1.916 to Claude Shannon. The remainder is locked.

The amounts are birth years, in VIGI. Consensus enforces the exact figures and rejects any monument block that leaves a single vix spendable. This costs the miner of those three blocks, never the supply, and it is a consensus rule rather than a gesture: the network cannot be started without it.

7. Compatibility without compromise

VigiChain exposes an EVM read identity — chain id 0x56494754 (1447642964), 8 decimals — so existing tooling can read the chain, and supports binding a secp256k1 (Ethereum) or Bitcoin key to a post-quantum account through a bidirectional proof.

Value transfer is a different matter. Raw secp256k1 and ECDSA value transactions are rejected by design. Compatibility is a door for reading and for identity, never a door into consensus, because a chain that accepts one classical signature for value is a classically-secured chain with post-quantum branding.

There is no official ERC-20 VIGI and no official wrapped VIGI. VIGI is native only.

8. The execution layer

A post-quantum rollup settles many transactions with one L1 transaction. Balances on it are native VIGI, backed 1:1 by VIGI locked on L1 under an on-chain proof of reserve.

Withdrawal is trust-minimised through two paths — a re-execution validity check that gives instant finality on the L2, or an optimistic challenge window with fraud proofs — and a user escape hatch to L1 that does not depend on the operator's cooperation. Data availability, the exit covenant and the ordering authority are separate concerns with separate failure modes, and a drop-in seam exists for succinct proofs.

The property that matters: a user who is censored or abandoned by the layer's operator can still recover their funds on L1, using only data the L1 already holds.

9. The layers around the core

Ten layers wrap the chain. Each has a public page carrying its real state; four run, six are a published design with no code behind them, and the pages say so above the fold.

Running.

• Vigi Witness — evidence committed to the chain without publishing the thing itself. Nine proof kinds are carried and validated by consensus today: security and integrity proofs, node attestations, software releases, updates bound to a registered release, licence state, critical API-call proofs, wallet and signing risk, document proofs and threat events. Witness proves that something existed, is intact and where it came from. It never decides whether a claim is true.
• Vigi Passport — a verifiable history for a digital object, indexed by subject. Not a civil identity and not centralised KYC.
• Sovereign Recovery — the recovery phrase split across guardians with a threshold to restore, each share sealed to that guardian's hybrid post-quantum key. Any T of N restore it; any T−1 learn nothing.

Partly built.

• Vigi Autonomous Escrow — the spend-policy primitive of §5.1 is in consensus and audited; the general release condition is not.

Designed, not built. Vigi Provenance and Proof of Process (chaining evidence source → dataset → process → model → execution → output); Vigi Data V2, Vigi Continuity and Proof of Recovery (data off-chain, the chain as the root of integrity, and a periodic demonstration that a resource can actually be reconstructed); and the Vigi Machine Economy, which is the sum of the others and cannot be built before them.

10. The network in operation

Peer-to-peer. Transactions and blocks are validated before they are relayed, and the seen-set stores 32-byte content hashes rather than payloads. Rate limiting and bans key on IP rather than IP:port; inbound connections are capped per /24 and /64 subnet; a handshake gate drops data from a peer that has not identified itself; a share of the peer table is reserved for outbound connections; and the broadcast queue is bounded in bytes. Each of these closed a specific denial-of-service path found by external review.

Address relay travels inside the existing peer-address messages, and a node's address is always taken from the socket and never from the message — a peer can cause its own address to be recorded and never a third party's.

Joining. A node needs no permission, no invitation and no open inbound port; operators behind NAT peer through a relay that validates nothing and is trusted for nothing. One command provisions a hardened node on a bare host: service account, sandboxed unit, firewall, encrypted keystore and a health timer.

Releases. Node binaries are built by CI in a digest-pinned container, signed with a release key whose public half is published, accompanied by an SBOM, and re-verified by a separate job before publication. Integrity here is verified, not trusted: a single sovereign signing key plus reproducible builds, so anyone can rebuild from the audited commit and compare, rather than a committee whose members you would have to trust instead.

11. Security posture and honest state

Three external audits have been received and remediated. The verdict that governs the project has not changed: mainnet is NO-GO until an independent audit of the current code closes.

Findings from internal audits — including what each defect would have cost and the guard that now prevents it — are published in the repository rather than summarised. The public testnet has been reset twice, each time because a consensus bug made the existing history unverifiable, and each reset is documented with its cause.

Some things this network does not claim:

• It is not final on L1 today. The BFT gadget is advisory (§3.2).
• The wrapped-asset layer is built and tested but disabled, pending an independent audit of the custody bridge — the highest-risk component in the system.
• The institutional payment rail is disabled pending cryptographic, consensus and bank-interoperability review.
• Six of the ten layers do not exist as code.
• Testnet VIGI has no economic value, deliberately.

12. Verify rather than trust

Nothing above asks for the benefit of the doubt. The following run against the public gateway.

Chain identity and height:

curl -s -X POST https://vigichain.org/rpc -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"vigi_getChainInfo","params":[],"id":1}'

EVM read identity, as a wallet sees it:

curl -s -X POST https://vigichain.org/rpc -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'

• Machine-readable chain descriptor: https://vigichain.org/.well-known/vigi-chain.json
• Layer status, per layer: https://vigichain.org/layers
• Node releases and signatures: https://github.com/VestigeIndex/vigichain-node/releases
• Agent reference: https://vigichain.org/llms-full.txt

A claim in this document that one of those endpoints contradicts is wrong, and the endpoint is right.

13. Status of this document

Version 1.0 describes the code as of 18 August 2026. It is written in English only; the site is fully translated into ten languages and the layer pages carry the same status information in each.

The rule this document is maintained under is the rule the rest of the project is maintained under: the narrative follows the code. When a layer ships, its section changes after the code lands and the tests pass — not before.

© UTXO Labs. VigiChain, VigiWallet, VigiRail, VigiScan, VigiBank and Vigi Passport are UTXO Labs marks.