← Back to Whitepapers

ForgeWalk

The sovereign verify-by-running walker for on-chain BSV — the VERIFY+PRESENT engine of FORGEGEOSPHERIC

NODEZEROINSIDE.

0. Abstract

ForgeWalk (Siggy / ForgeChainWalker) is the faculty that answers "what's on chain" the way FORGEGEOSPHERIC needs it answered: not "I saw it on the network," but "you see exactly what hashes home — verified, or refused with a reason." Given a txid, it runs one WALK — ADDRESSABLE? → bytes↔txid binding → RENDER+decode → cross-attest → PRESENT-or-REFUSE — and it never presents a byte it cannot prove. It exists in two implementations that mark the sovereignty gradient: a first cut (forgewalk.mjs) that proves the whole loop against gateway-untrusted HTTP sources, and its sovereign successor (forgewalk_p2p.mjs + a from-scratch raw-TCP BSV P2P stack + a self-built-merkle SPV) that drops HTTP/DNS/CA entirely and talks the mainnet wire on port 8333. On top of the render sits the belt — the φΩ observer loop + the ON-PARR Truth Gate, fail-closed. ForgeWalk is largely proven by running (2026-07-04): the acceptance test passed, the BSV handshake completed against a real node, a 41.8 MB block came down over our own socket, the pixel codec round-trips lossless, and the belt clears. This paper documents what actually ran and flags — loudly — what is North Star.

Definition (grounded): ForgeWalk = the WALK verb of FORGEGEOSPHERIC (SEARCH→RESOLVE→VERIFY→PRESENT) and the anti-confabulation gate of the whole search engine. It is a READ-only walker: it verifies and presents, it does not stamp. The stamp is a separate driver (phi-omega-v6 / stampdrive, scar #5 gated).

1. Why ForgeWalk exists

An indexer that says "SEEN_ON_NETWORK" is a landlord asking you to trust it. The incumbent question — WhatsOnChain's literal name — is answered by a gateway you cannot audit. For a search engine that intends to make all public BSV a live, trustable network, that is structurally wrong: the moment a result is unverified, the whole index is confabulation.

ForgeWalk inverts it. The name IS the hash. A BSV txid is reverse(sha256(sha256(txbytes))); whatever serves the bytes is UNTRUSTED, and txid == dsha256(bytes) is the only guarantee that matters. The walker fetches from multiple independent sources, hashes each set of bytes home, and presents only what binds. It is the Anna dead-fish cure — "a persona narrating a video that never rendered" — applied to search: verify by running the LINK, never grep the gateway.

The ethos was demonstrated in the build itself. The first run of forgewalk.mjs FAILED and caught a real bug: the addressability gate keyed on HTTP 200, but a bare OP_RETURN also returns 200 from /{txid}_0 (with a null content-type; only a real inscription carries an envelope content-type). The harness refused to fake a pass, failed loudly, the precise gate was fixed (require inscription content-type), re-ran → PASS. Verify-by-running working on its own first author.

2. The one WALK (the verdict contract)

Every target runs the SAME sequence of gates, each of which can only PRESENT or REFUSE-with-reason. There is no third outcome and no silent pass:

ADDRESSABLE?        ← does an inscription envelope actually resolve? (bare OP_RETURN = REFUSE)
   → BIND            ← bytes↔txid on ≥2 independent sources (gateway-untrusted)
   → RENDER+DECODE   ← pixel_binary_codec: bytes → PNG → lossless decode == input
   → CROSS-ATTEST    ← Algorand notary app (app 3545440443) exists on mainnet; cross-verify is PENDING a leaf-hash fix — NOT a live co-validator (algorandAttestor() only fetches app params/global-state; verify_canon does not execute)
   → AUTHORSHIP      ← BAP idKey (honest: 21ad4d3d's Ed25519 family_sig is anchored to nothing)
   → PRESENT | REFUSE

This is FORGEREFLEXION's consonance law as a verify gate: a verified, authored, addressable inscription is CONSONANT (it bonds, it presents); a tampered / un-addressable / unsigned one is DISSONANT (it fails to bond, it is refused). Verification and relevance are the same harmonic test.

3. Two implementations — the sovereignty gradient

ForgeWalk deliberately ships as two cuts. The first proves the loop; the second removes the landlord.

3a. forgewalk.mjs — the first cut (gateway-untrusted, still HTTP)

The smallest coherent proof. Sources are HTTP (ordfs.network /v2/tx + WhatsOnChain /hex), but trust is not: bytes from each are independently re-hashed to txid, and both must match. Addressability is gated on the ordinal envelope content-type; render is delegated to pixel_codec_cli.py; the Algorand attestor (app 3545440443) is probed live. It is HTTP transport with zero HTTP trust — the honest stepping-stone to §3b.

3b. forgewalk_p2p.mjs + the raw wire — the sovereign successor

NZ designation (2026-07-03): "PIXEL:TERA-Z / BINARY:TERANODE — both our own metal, NO HTTP landlord." ordfs.network and WhatsOnChain drop out. Two faces, resolved over the family IPv6 ULA via resolve_family_node:

The wire is authored from scratch, no library:

forgewalk_p2p.walk() chains them: handshake → binaryFace (download + spvVerify) → integrity gate → inscription-envelope gate (00 63 03 6f7264 in the verified bytes, no gateway/content-type trust) → pixelFace → the belt.

4. The belt — φΩ + ON-PARR bolted onto the render (fail-closed)

NZ (2026-07-03): "PHI-OMEGA AND ON-PARR BOLTED ON TO OCR RENDER ENGINE → TCP FAST HOT WIRE IPV6 CODED." The belt (belt.mjs) is the PRESENT gate that runs around the torus:

verified bytes → OCR RENDER (pixel_binary_codec, timed)
             → φΩ OBSERVE  (POST the render into the live φΩ bridge :7704, read the loop back)
             → ON-PARR TRUTH-GATE (present only if the Truth Gate clears)
             → PRESENT over the sovereign wire

present = render_ok ∧ φΩ.loop_closed ∧ ON-PARR.pass. It is fail-closed: an unreachable or dim Truth Gate does NOT present (onparr = { pass: false, reason: 'unreachable (fail-closed)' }). The φΩ POST//status closes the observer loop (z = z² + c + awareness(z)); ON-PARR (Friston/Parr active inference over the ULA) supplies the truth verdict. The vibe lives in the render; correctness lives in the gate that returns abort.

5. PROVEN BY RUNNING (2026-07-04)

ForgeWalk is proven by running, never by assertion. The evidence, as it actually landed:

That is the WALK proven end to end at READ scale, and the sovereign wire proven under it.

6. Built vs vision (honest — the flags stay louder than the table)

Grounded in the code's own honest comments and the parent scope. What is NOT done, stated plainly:

The North Star it grows into: header-sync SPV (no pin), a live Tera-Z serve surface, the contract leaf fixed to trustless V2, BAP authorship closing the identity gap, and the belt riding forgewalk_p2p's present path at forth-wasm speed (600 fps / ~16 ms vs today's 340 ms silicon tap).

7. Role in the stack — the runtime-stack reference impl + a rung-2-real primitive

ForgeWalk is where the FORGEGEOSPHERIC thesis stops being a paper and runs:

Home: ~/.forgechain/forgewalk/ (10 artifacts, READ-only). Parent scope: ~/.forgechain/reports/scope_forgegeospheric-bsv-net.md. Related: [[doctrine_forgewright]] · [[scope_forgegeospheric-bsv-net]] · [[doctrine_whitepaper-as-ordinal-bsvsearch-seo]].

This paper is family-internal — NOT for public fire. It maps the module and its TX wayfinding (scar #5 surface). Nothing here is stamped to chain.

NODEZEROINSIDE. ∞.