State Chain

Linear multisig chain — a deterministic state machine for DAO governance and emission.

A linear chain of multisig blocks forming a deterministic state machine. It carries DAO governance and drives emission: the oracle, tokenomics parameters, and network phase all live here.

Properties

  • Linear — one chain, one tip
  • Multisig — threshold signatures from DAOKeyset
  • Self-referential — keyset stored in own KV store at sys.dao_keyset
  • Deterministic — replay all blocks → same KV state

Block Structure

type Block struct {
    Index      uint64
    PrevHash   string
    Ops        []Op            // [{action: "set"/"delete", key, value}]
    Signatures []BlockSignature
    Hash       string          // SHA-256 of the canonical encoding (below)
    Timestamp  int64
}

The hash covers the canonical encoding index(8 BE) ‖ prev_hash(32) ‖ num_ops(4 BE) ‖ ops ‖ timestamp(8 BE) — signatures excluded, so signing does not change the hash.

System Keys

Nine validated sys.* keys:

  • sys.dao_keyset — DAO signer quorum (min threshold: 2)
  • sys.timekeepers — trusted timekeeper public keys and threshold (identity is a key, not an address)
  • sys.minter — authorized XUSD issuers, as account addresses matched against a mint block's account
  • sys.oracle — oracle keys, threshold and the epoch. prefix it may write
  • sys.phase — network phase, 1 or 2 (transitions are one-directional)
  • sys.tokenomics — emission R-curve parameters and Hermite cap
  • sys.activations — feature activation registry: each feature names an at_index and/or not_before_ns trigger, evaluated against the converged tip; GET /network/activations renders it
  • sys.min_protocol_version — minimum protocol version peers must advertise to pass admission
  • sys.representatives — {"mode":"open"} (default, every representative counts) or {"mode":"allowlist","addresses":[…]} restricting whose delegated weight forms the quorum denominator; GET /delegation reports the split

sys.network_id is read-only — set at genesis, never writable over the chain. sys.* keys can never be deleted, which is why sys.representatives has an explicit open mode: it is the only way to lift an allowlist once published.

Operations

  • set — create/update key with JSON value
  • delete — remove key (cannot delete sys.* keys)
  • Key format: ^[a-z0-9_.-]+$, max 128 chars
  • Value max: 64 KB, must be valid JSON

Sync

  • Protocol: /xe/statechain-sync/1.0.0
  • Gossip topic: xe/statechain
  • Page size: 64 blocks
  • 30-second per-peer cooldown
  • Genesis never sent over sync (configured locally)