3
Verification Gates
0
Vendor Dependencies
2ms
Verify + Serve
6,142
Bytes (Chain DApp)
The chain IS the server. Every existing blockchain content-serving architecture re-centralizes the read path. Data is sovereign at the write layer and vendor-dependent at the read layer. The Walker VM closes this gap: the same family metal that signs the transaction also serves the content, with cryptographic verification at every layer.
Ordinals on BTC and BSV are inscribed to a decentralized ledger, then served through Cloudflare-fronted gateways (ordinals.com, ordfs.network, 1satordinals.com). The data is sovereign; the delivery is not. This paper presents the ForgeChain Walker VM — a verify-by-running content server that completes the sovereignty loop by making the read path as sovereign as the write path.
Content is pulled from chain via a self-operated SPV reader, verified through three cryptographic gates, and served directly to the browser as a living application. No CDN. No vendor TLS termination. No corporate middleware.
Bitcoin (BSV) provides a globally replicated, immutable data ledger. 1Sat Ordinals inscribe arbitrary content — HTML, images, applications — into transaction outputs. The content is permanent, censorship-resistant at the write layer, and addressable by transaction ID.
However, reading that content requires a serving layer. The dominant serving architectures are:
| Gateway | Operator | CDN | TLS Termination |
|---|---|---|---|
| ordinals.com | Third party | Cloudflare | Cloudflare |
| ordfs.network | Third party | Cloudflare | Cloudflare |
| 1satordinals.com | Third party | Cloudflare | Cloudflare |
Every read request flows through a corporate intermediary that can:
The result: data written to a decentralized, censorship-resistant ledger is served through a single-vendor chokepoint. The sovereignty guarantee of the write layer is voided at the read layer.
The ForgeChain architecture eliminates vendor dependency across the entire path:
A Rust binary (forge-stamp, ~1.6MB) that:
No cloud signer. No third-party API for key management. The WIF is AES-256-GCM encrypted on disk, decrypted with a local PIN via PBKDF2. The signing happens on family metal.
A sovereign SPV chain consumer that:
No JungleBus. No third-party indexer dependency for family content. The overlay tier guarantees that every family-stamped transaction is resolvable from local disk, even if the P2P network and all public APIs are offline.
A Go binary (go-ordfs-server-teraz) compiled from the open-source ORDFS codebase, re-grounded to source exclusively from Tera-Z and the family overlay:
[::1]:7798 (IPv6 loopback, not exposed to internet)The Walker VM is the novel contribution. It sits between ORDFS and the browser, adding three verification gates that no existing content gateway provides:
dsha256(raw_tx_bytes) === txid. The double-SHA256 hash of the raw transaction bytes must equal the claimed transaction ID. Proves bytes were not modified in transit.
Raw transaction bytes must contain the 1Sat Ordinals envelope marker (OP_FALSE OP_IF PUSH("ord")). Proves the TX carries a real inscription, not an arbitrary OP_RETURN.
sha256(extracted_body) === indexed_body_sha256. The artifact body hash must match the hash recorded in the local index at stamp time. Proves no tampering during decode/decrypt/extract.
All three gates must pass for a verdict of PRESENT. Any failure returns REFUSE with a diagnostic trail.
X-Forgewalk-Verdict: PRESENT
X-Forgewalk-Integrity: PASS
X-Forgewalk-Inscription: PASS
X-Forgewalk-Artifact: PASS
X-Forgewalk-Source-TX: <txid>
X-Forgewalk-Body-SHA256: <hash>
X-Forgewalk-Trail: <full verification trail>The Walker VM serves verified chain content directly to the browser as raw HTML. A self-contained DApp inscribed with content-type text/html renders natively — no wrapper template, no metadata page, no iframe.
The DApp fetches live state through the Walker Spine (/walk/pulse), which aggregates sovereign daemon responses (ForgeCore, TransC, ON-PARR, forge-stamp) into a single same-origin JSON endpoint. No CORS required. No external API calls. The DApp's entire data path runs through the Walker, which runs through ORDFS, which runs through Tera-Z, which runs on family metal.
Layer-by-layer, the ForgeChain stack eliminates every vendor dependency present in the typical ordinals stack:
| Layer | Typical Ordinals Stack | ForgeChain Stack |
|---|---|---|
| Write (sign) | Browser wallet / cloud signer | Rust binary, local WIF, 7-layer auth |
| Write (broadcast) | Third-party API (GorillaPool, TAAL) | ForgeCore HMAC-authenticated POST |
| Index | JungleBus / third-party indexer | Tera-Z sovereign SPV + local overlay |
| Serve | ordfs.network (Cloudflare) | go-ordfs-teraz (loopback, no CDN) |
| Verify | None (trust the gateway) | Walker VM (3-gate verify-by-running) |
| Render | Static inscription content | Self-contained DApp with live data spine |
| TLS | Cloudflare terminates | Self-signed cert on sovereign ULA |
| DNS | Domain → Cloudflare → origin | Sovereign IPv6 ULA (no DNS dependency) |
The Verify row is the gap. No existing ordinals stack verifies content between chain and browser. They all trust the gateway. The Walker VM is the only architecture that cryptographically proves the bytes you see are the bytes that were inscribed.
The ForgeChain stack defends against:
No external gateway in the path. Content is served from family metal. A Cloudflare takedown notice is irrelevant — there is no Cloudflare.
The Walker VM's integrity gate (dsha256) catches any byte modification between chain and browser. A MITM that alters the transaction bytes produces a hash mismatch and a REFUSE verdict.
The inscription gate rejects transactions that lack the 1Sat envelope structure. A raw OP_RETURN claiming to be an inscription fails.
The artifact gate catches modifications during decode/decrypt/extract. A tampered body produces a SHA-256 mismatch and a REFUSE verdict.
The family overlay (txstore) guarantees availability of family-stamped content from local disk. If the P2P network, TAAL, WoC, and all public APIs are down, family content still serves.
The sovereign ULA address space ([sovereign-ula]/48) is self-assigned, not registered with any authority, and not resolvable via DNS. Family nodes reach each other by ULA, not by domain name.
Measured on commodity hardware (Ryzen 7 3700X, 64GB RAM, RTX 2070 SUPER):
| Metric | Value |
|---|---|
| Walker verify + serve (cached TX) | 2ms |
| Walker verify + serve (Tera-Z fetch) | 40ms |
| Inscription decode | < 1ms |
| Three-gate verification | < 1ms |
| Chain Pulse DApp size | 6,142 bytes (HTML) |
| Full PWA size | 110,103 bytes (HTML) |
| Stamp cost (1 artifact) | ~568 sats (~$0.004) |
The following transactions on BSV mainnet demonstrate the architecture:
/walk/pulse spine.All transactions were signed on family metal, broadcast via ForgeCore HMAC-authenticated endpoint, indexed by sovereign Tera-Z, served by sovereign ORDFS, verified by Walker VM, and rendered in a standard browser. No vendor touched the bytes at any point in the path.
TXID: ebbf51de557a526dd9673548d237bb206525ade6974cc9bc9d7add1bdc1ccb8dThis document itself is inscribed on BSV mainnet, retrievable via the Walker VM, verified through all three gates. The paper practices what it describes.
The sovereignty guarantee of a blockchain ledger is only as strong as the weakest link in the read path. Every existing ordinals/inscription serving architecture re-centralizes the read path through CDN vendors, surrendering at delivery what was won at inscription.
The ForgeChain Walker VM closes this gap: the same family metal that signs the transaction also serves the content, with cryptographic verification at every layer.
The chain is not just storage. The chain IS the server.
Sovereign write. Sovereign read. Zero vendor. NODEZEROINSIDE.