Fix/pin root commit program

.claude/commands/run-challenger-node.md

@@ -7,6 +7,7 @@ The Challenger verifies operator operations and submits challenges if necessary.
 1. Ask the user for the following parameters (skip any already provided as arguments: $ARGUMENTS):
    - **network**: Which network? `testnet4` or `regtest`
    - **rpc_addr**: RPC listen address. Default: `127.0.0.1:8906`
+   - **metrics_addr**: Prometheus listen address. Default: `127.0.0.1:9902`
    - **p2p_port**: P2P listen port. Default: `8449` (testnet4) or `8450` (regtest)
    - **db_path**: SQLite database path. Default: `sqlite:$PWD/bitvm-node.db`
 
@@ -32,26 +33,28 @@ The Challenger verifies operator operations and submits challenges if necessary.
 4. Start the challenger node:
 
 ```bash
-./bin/bitvm-noded --rpc-addr <rpc_addr> --db-path <db_path> --p2p-port <p2p_port> --bootnodes "$BOOTNODES"
+./bin/bitvm-noded --rpc-addr <rpc_addr> --metrics-addr <metrics_addr> --db-path <db_path> --p2p-port <p2p_port> --bootnodes "$BOOTNODES"
 ```
 
 To run in the background:
 ```bash
-nohup ./bin/bitvm-noded --rpc-addr <rpc_addr> --db-path <db_path> --p2p-port <p2p_port> --bootnodes "$BOOTNODES" >challenger_$(date +'%Y%m%d').log 2>&1 &
+nohup ./bin/bitvm-noded --rpc-addr <rpc_addr> --metrics-addr <metrics_addr> --db-path <db_path> --p2p-port <p2p_port> --bootnodes "$BOOTNODES" >challenger_$(date +'%Y%m%d').log 2>&1 &
 ```
 
 5. Verify the node is running:
 ```bash
 curl -s http://<rpc_addr>/
+curl -s http://<metrics_addr>/metrics
 ```
-Should return `Hello, World!`.
+The first request should return `Hello, World!`; the second should return
+Prometheus metrics in OpenMetrics text format.
 
 ### Example (testnet4)
 
 ```bash
 cp deployment/testnet4/bitvm-noded/challenge_0/.env.challenge_0 .env
 # Edit .env to fill in BITVM_SECRET, GOAT_ADDRESS, PEER_KEY
-./bin/bitvm-noded --rpc-addr 127.0.0.1:8906 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8449 --bootnodes /ip4/34.215.238.232/tcp/8445/p2p/12D3KooWCrPTAmhFdC5DBGgkxZvJi6iuSeiDWKRL87isrt4iMHXv
+./bin/bitvm-noded --rpc-addr 127.0.0.1:8906 --metrics-addr 127.0.0.1:9902 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8449 --bootnodes /ip4/34.215.238.232/tcp/8445/p2p/12D3KooWCrPTAmhFdC5DBGgkxZvJi6iuSeiDWKRL87isrt4iMHXv
 ```
 
 For full deployment documentation, see `deployment/README.md` (section **Challenger**).

.claude/commands/run-operator-node.md

@@ -7,6 +7,7 @@ The Operator manages bridge operations, kickoff processing, and pegout (Gateway.
 1. Ask the user for the following parameters (skip any already provided as arguments: $ARGUMENTS):
    - **network**: Which network? `testnet4` or `regtest`
    - **rpc_addr**: RPC listen address. Default: `127.0.0.1:8902`
+   - **metrics_addr**: Prometheus listen address. Default: `127.0.0.1:9903`
    - **p2p_port**: P2P listen port. Default: `8445` (testnet4) or `8446` (regtest)
    - **db_path**: SQLite database path. Default: `sqlite:$PWD/bitvm-node.db`
 
@@ -35,26 +36,28 @@ The Operator manages bridge operations, kickoff processing, and pegout (Gateway.
 4. Start the operator node:
 
 ```bash
-./bin/bitvm-noded --rpc-addr <rpc_addr> --db-path <db_path> --p2p-port <p2p_port> --bootnodes "$BOOTNODES"
+./bin/bitvm-noded --rpc-addr <rpc_addr> --metrics-addr <metrics_addr> --db-path <db_path> --p2p-port <p2p_port> --bootnodes "$BOOTNODES"
 ```
 
 To run in the background:
 ```bash
-nohup ./bin/bitvm-noded --rpc-addr <rpc_addr> --db-path <db_path> --p2p-port <p2p_port> --bootnodes "$BOOTNODES" >operator_$(date +'%Y%m%d').log 2>&1 &
+nohup ./bin/bitvm-noded --rpc-addr <rpc_addr> --metrics-addr <metrics_addr> --db-path <db_path> --p2p-port <p2p_port> --bootnodes "$BOOTNODES" >operator_$(date +'%Y%m%d').log 2>&1 &
 ```
 
 5. Verify the node is running:
 ```bash
 curl -s http://<rpc_addr>/
+curl -s http://<metrics_addr>/metrics
 ```
-Should return `Hello, World!`.
+The first request should return `Hello, World!`; the second should return
+Prometheus metrics in OpenMetrics text format.
 
 ### Example (testnet4)
 
 ```bash
 cp deployment/testnet4/bitvm-noded/operator_0/.env.operator_0 .env
 # Edit .env to fill in BITVM_SECRET, GOAT_ADDRESS, PEER_KEY, GOAT_PRIVATE_KEY
-./bin/bitvm-noded --rpc-addr 127.0.0.1:8902 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8445 --bootnodes /ip4/34.215.238.232/tcp/8445/p2p/12D3KooWCrPTAmhFdC5DBGgkxZvJi6iuSeiDWKRL87isrt4iMHXv
+./bin/bitvm-noded --rpc-addr 127.0.0.1:8902 --metrics-addr 127.0.0.1:9903 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8445 --bootnodes /ip4/34.215.238.232/tcp/8445/p2p/12D3KooWCrPTAmhFdC5DBGgkxZvJi6iuSeiDWKRL87isrt4iMHXv
 ```
 
 For full deployment documentation, see `deployment/README.md` (section **Operator**).

crates/bitcoin-light-client-circuit/src/lib.rs

@@ -33,6 +33,12 @@ pub const VK_HASH_SIZE: usize = 66;
 pub const TOTAL_WORK_SIZE: usize = 32;
 pub const CONSENSUS_BLOCK_HEIGHT_SIZE: usize = 4;
 
+// 0xc3d8382a8efed79d564f8ec6da4dd00a4e77572d1e02f5f81dda441a36fdc9d8
+pub const ROOT_COMMIT_PROGRAM_ID: verifier::ProgramId = [
+    195, 216, 56, 42, 142, 254, 215, 157, 86, 79, 142, 198, 218, 77, 208, 10, 78, 119, 87, 45, 30,
+    2, 245, 248, 29, 218, 68, 26, 54, 253, 201, 216,
+];
+
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct WatchtowerPublicOutputs {
     pub total_work: [u8; TOTAL_WORK_SIZE],
@@ -74,15 +80,25 @@ fn checked_history_root(
 }
 
 /// Verifies that the latest Bitcoin commitment authorizes every supplied circuit proof.
+///
+/// `root_commit_program_id` is the pinned anchor; it is the only identity here that does not
+/// come from the proofs being checked, so it is asserted before anything reads the
+/// Commit-chain output. See [`ROOT_COMMIT_PROGRAM_ID`].
+#[allow(clippy::too_many_arguments)]
 fn verify_commitment_authorization(
     commit_chain_output: &CommitChainCircuitOutput,
     header_chain_output: &BlockHeaderCircuitOutput,
     state_chain_output: &StateChainCircuitOutput,
     header_program_id: verifier::ProgramId,
     state_program_id: verifier::ProgramId,
     commit_program_id: verifier::ProgramId,
+    root_commit_program_id: verifier::ProgramId,
     sequencer_set_hash: [u8; 32],
 ) -> AuthorizedProgramIds {
+    assert_eq!(
+        commit_program_id, root_commit_program_id,
+        "commit proof program id does not match the pinned root anchor"
+    );
     let authorized = commit_chain_output.chain_state.authorized_program_ids;
     authorized.validate().expect("invalid authorized ProgramIds");
     check_program_id(commit_program_id, commit_chain_output.self_program_id, authorized.commit);
@@ -215,6 +231,7 @@ pub fn watch_longest_chain(
             header_program_id,
             state_program_id,
             commit_program_id,
+            ROOT_COMMIT_PROGRAM_ID,
             sequencer_set_hash,
         );
     } else {
@@ -382,6 +399,7 @@ pub fn propose_longest_chain(
                 header_program_id,
                 state_program_id,
                 commit_program_id,
+                ROOT_COMMIT_PROGRAM_ID,
                 sequencer_set_hash,
             )
         } else {

deployment/README.md

@@ -69,10 +69,29 @@ Configure the `.env` file for the specific role and run the node.
 **Common Arguments:**
 
 - `--rpc-addr <ADDR>`: Address for the RPC server (default: `0.0.0.0:8080`)
+- `--metrics-addr <ADDR>`: Address for the dedicated Prometheus listener (disabled when omitted)
+- `--metrics-path <PATH>`: Path served by the metrics listener (default: `/metrics`)
 - `--db-path <PATH>`: Path to the SQLite database (default: `sqlite:/tmp/bitvm-node.db`)
 - `--p2p-port <PORT>`: Port for P2P communication (default: `0`)
 - `--bootnodes <MULTIADDR>`: Bootnodes to connect to 
 
+Bind metrics to a private interface and use a unique port for every node running
+on the same host. The business RPC listener does not serve metrics, so
+`GET /metrics` on `--rpc-addr` returns `404`. For remote Prometheus servers,
+expose the dedicated listener through a private network, proxy, or access-control
+layer instead of binding it directly to a public interface.
+
+The provided Docker Compose deployment enables the listener on port `9108`
+inside each container and publishes it only on the host loopback interface:
+
+| Service | Host metrics endpoint |
+|---------|-----------------------|
+| `committee_0` | `http://127.0.0.1:9900/metrics` |
+| `committee_1` | `http://127.0.0.1:9901/metrics` |
+| `verifier_0` | `http://127.0.0.1:9902/metrics` |
+| `operator_0` | `http://127.0.0.1:9903/metrics` |
+| `watchtower_0` | `http://127.0.0.1:9904/metrics` |
+
 ### Committee
 
 The Committee is responsible for signing presign transactions.
@@ -113,6 +132,7 @@ GOAT_SWAP_EVENT_FILTER_FROM=9368978
 ```bash
 ./target/release/bitvm-noded \
   --rpc-addr 0.0.0.0:9100 \
+  --metrics-addr 127.0.0.1:9108 \
   --p2p-port 8443 \
   --db-path ./committee.db
 ```
@@ -148,6 +168,7 @@ BOOTNODES=... # empty if this is the first node
 ```bash
 ./target/release/bitvm-noded \
   --rpc-addr 0.0.0.0:9100 \
+  --metrics-addr 127.0.0.1:9108 \
   --p2p-port 8443 \
   --db-path ./operator.db
 ```
@@ -183,6 +204,7 @@ BOOTNODES=... # empty if this is the first node
 ```bash
 ./target/release/bitvm-noded \
   --rpc-addr 0.0.0.0:9100 \
+  --metrics-addr 127.0.0.1:9108 \
   --p2p-port 8443 \
   --db-path ./challenger.db
 ```
@@ -217,6 +239,7 @@ BOOTNODES=... # empty if this is the first node
 ```bash
 ./target/release/bitvm-noded \
   --rpc-addr 0.0.0.0:9100 \
+  --metrics-addr 127.0.0.1:9108 \
   --p2p-port 8443 \
   --db-path ./watchtower.db
 ```

deployment/docker-compose.yml

@@ -8,12 +8,15 @@ services:
     volumes:
       - ./committee_0:/var/data
       - ./committee_0/.env:/app/.env
-    ports:
-      - "8900:9100"
-      - "8443:8443"
     env_file:
       - ./committee_0/.env
+    environment:
+      METRICS_ADDR: "0.0.0.0:9108"
     restart: unless-stopped
+    ports:
+      - "8900:9100"
+      - "8443:8443"
+      - "127.0.0.1:9900:9108"
 
   committee_1:
     image: ghcr.io/goatnetwork/bitvm-node:${TAG:-0.1.0}
@@ -24,8 +27,11 @@ services:
     ports:
       - "8901:9100"
       - "8444:8443"
+      - "127.0.0.1:9901:9108"
     env_file:
       - ./committee_1/.env
+    environment:
+      METRICS_ADDR: "0.0.0.0:9108"
     restart: unless-stopped
     depends_on:
       - committee_0
@@ -39,8 +45,11 @@ services:
     ports:
       - "8902:9100"
       - "8445:8443"
+      - "127.0.0.1:9902:9108"
     env_file:
       - ./verifier_0/.env
+    environment:
+      METRICS_ADDR: "0.0.0.0:9108"
     restart: unless-stopped
     depends_on:
       - committee_0
@@ -54,8 +63,11 @@ services:
     ports:
       - "8903:9100"
       - "8456:8443"
+      - "127.0.0.1:9903:9108"
     env_file:
       - ./operator_0/.env
+    environment:
+      METRICS_ADDR: "0.0.0.0:9108"
     restart: unless-stopped
     depends_on:
       - committee_0
@@ -69,8 +81,11 @@ services:
     ports:
       - "8904:9100"
       - "8457:8443"
+      - "127.0.0.1:9904:9108"
     env_file:
       - ./watchtower_0/.env
+    environment:
+      METRICS_ADDR: "0.0.0.0:9108"
     restart: unless-stopped
     depends_on:
-      - committee_0
+      - committee_0

deployment/regtest/bitvm-noded/committee_0/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 0.0.0.0:8900   --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8444   >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 0.0.0.0:8900 --metrics-addr 127.0.0.1:9900  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8444   >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/regtest/bitvm-noded/committee_1/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8901  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8445  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8901 --metrics-addr 127.0.0.1:9901 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8445  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/regtest/bitvm-noded/operator_0/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8902  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8446  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8902 --metrics-addr 127.0.0.1:9903 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8446  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/regtest/bitvm-noded/verifier_0/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8906  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8450  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8906 --metrics-addr 127.0.0.1:9902 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8450  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/regtest/bitvm-noded/watchtower_0/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8904  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8448  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8904 --metrics-addr 127.0.0.1:9904 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8448  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/testnet4/bitvm-noded/committee_0/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8902   --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8445   >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8902 --metrics-addr 127.0.0.1:9900  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8445   >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/testnet4/bitvm-noded/committee_1/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8901  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8444  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8901 --metrics-addr 127.0.0.1:9901 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8444  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/testnet4/bitvm-noded/operator_0/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8902  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8445  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8902 --metrics-addr 127.0.0.1:9903 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8445  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/testnet4/bitvm-noded/verifier_0/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8906  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8449  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8906 --metrics-addr 127.0.0.1:9902 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8449  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &

deployment/testnet4/bitvm-noded/watchtower_0/run.sh

@@ -1 +1 @@
-nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8904  --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8447  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &
+nohup ../bitvm-noded  --rpc-addr 127.0.0.1:8904 --metrics-addr 127.0.0.1:9904 --db-path sqlite:$PWD/bitvm-node.db --p2p-port 8447  --bootnodes $bootnode_urls  >$PWD/$(date +'%Y%m%d').log 2>&1 &

node/README.md

@@ -814,6 +814,7 @@ bitvm-noded key funding-address
 ```bash
 bitvm-noded \
   --rpc-addr 0.0.0.0:8080 \
+  --metrics-addr 127.0.0.1:9108 \
   --db-path ./node.db \
   --p2p-port 4001 \
   --bootnodes /ip4/x.x.x.x/tcp/4001/p2p/<peer_id>
@@ -850,7 +851,8 @@ real graph raw data in the database.
 | `--db-path` | SQLite database path | `sqlite:/tmp/bitvm-node.db` |
 | `--p2p-port` | P2P listen port | `0` (random) |
 | `--bootnodes` | Bootstrap node addresses | - |
-| `--metrics-path` | Prometheus metrics endpoint | `/metrics` |
+| `--metrics-addr` | Dedicated Prometheus listener address | Disabled |
+| `--metrics-path` | Path served by the dedicated metrics listener | `/metrics` |
 | `--enable-kademlia` | Enable Kademlia DHT | `true` |
 
 ---
@@ -899,6 +901,10 @@ Relayer nodes should:
 
 ## RPC API
 
+Prometheus metrics are not served by the business RPC listener. Set
+`--metrics-addr` to a private, process-unique address and scrape
+`http://<metrics-addr>/metrics`; `GET /metrics` on `--rpc-addr` returns `404`.
+
 ### Endpoints
 
 | Endpoint | Method | Description |
@@ -918,7 +924,7 @@ Relayer nodes should:
 | `/v1/swaps` | GET | List swap bridge-out escrows |
 | `/v1/swaps/:escrow_hash` | GET | Get swap escrow details |
 | `/challenge` | POST | Submit challenge |
-| `/metrics` | GET | Prometheus metrics |
+| `/metrics` | GET | Prometheus metrics (dedicated metrics listener only) |
 
 ---
 

node/entrypoint.sh

@@ -1,8 +1,13 @@
 #!/bin/bash
 
-bn=""
-if [ -n "$BOOTNODES" ]; then
-    bn="--bootnodes $BOOTNODES"
+args=(--rpc-addr 0.0.0.0:9100 --db-path /var/data/bitvm-node-0.db --p2p-port 8443)
+
+if [ -n "${BOOTNODES:-}" ]; then
+    args+=(--bootnodes "$BOOTNODES")
+fi
+
+if [ -n "${METRICS_ADDR:-}" ]; then
+    args+=(--metrics-addr "$METRICS_ADDR")
 fi
 
-bitvm-noded --rpc-addr 0.0.0.0:9100 --db-path /var/data/bitvm-node-0.db --p2p-port 8443 $bn
+exec bitvm-noded "${args[@]}"

proof-builder-rpc/README.md

@@ -52,6 +52,23 @@ To enable multiple Gateways without interrupting proof polling, first upgrade Pr
 single Gateway, then upgrade all Nodes to send `gateway_address`, and finally configure the
 comma-separated Gateway list.
 
+## Metrics
+
+Prometheus metrics use a dedicated listener and are disabled unless `--metrics-addr` is set. The
+business RPC listener does not serve metrics, so `GET /metrics` on `--rpc-addr` returns `404`.
+
+```bash
+proof-builder-rpc \
+  --rpc-addr 0.0.0.0:7777 \
+  --metrics-addr 10.42.0.8:9109 \
+  --config proof-builder.toml
+```
+
+The dedicated listener serves only `/metrics`. Bind it to a private interface and allow only the
+Prometheus source network to reach it. The listener does not provide TLS or authentication and
+should not be exposed directly to the public internet. An unavailable metrics port causes startup
+to fail.
+
 ## Failure recovery
 
 Long-running proof tasks (stored in the `long_running_task_proof` table) — such as header-chain, commit-chain, and state-chain proofs — can be recovered from the database. Recovery notes: