ADR-0002: Proof system: interactive bisection now, validity prover second, never alone

Invalid roots are made unfinalizable by an interactive fraud proof: log₂(steps) bisection rounds narrowing to one instruction, verified in a single Solana transaction. A ZK validity prover is added later as a…

Status: accepted. Dated 2026-08-13.

Status: accepted (2026-08-13) · Prompt: §5 D2, §6 C7

Decision

Invalid roots are made unfinalizable by an interactive fraud proof: log₂(steps) bisection rounds narrowing to one instruction, verified in a single Solana transaction. A ZK validity prover is added later as a second independent gate (multi-prover), not a replacement.

Rejected

• Whole-batch re-execution on L1 — does not fit any per-transaction compute budget; not a design.
• Single validity prover as sole gate — a soundness bug is silent and total.
• Trusted operator only — acceptable to state during Stage 0, unacceptable to design for.

Load-bearing feasibility claim

The one-step verifier fits one Solana transaction (compute + size). This is proven by arithmetic in Step 9 before any mainnet claim ⟨VERIFY against target Agave release⟩.

Reversal trigger

If one-step verification cannot fit L1 budgets for the chosen VM encoding, the execution encoding changes — not the honesty of the window.