Transactions

Every state change in Quidnug is a signed transaction. There are seven core types, plus sub-types for guardian flows.

Type	Purpose
TRUST	Declare trust from one quid to another in a domain.
IDENTITY	Create or update a quid’s name/attributes/home domain.
TITLE	Asset ownership (full or fractional, summing to 100.0).
EVENT	Append a signed event to a subject’s stream.
ANCHOR	Rotate key epoch, cap old epoch, or invalidate an epoch.
GUARDIAN_SET_UPDATE	Install or replace a guardian quorum for a quid.
GUARDIAN_RECOVERY_*	Init / Veto / Commit time-locked guardian recovery.
GUARDIAN_RESIGN	Guardian withdraws consent (prospective only).
FORK_BLOCK	Coordinate on-chain protocol activation at a future block.

Common fields

Every transaction carries:

• publicKey, the signer’s current epoch public key.
• nonce, per-signer monotonic; see QDP-0001.
• timestamp, Unix seconds.
• signature, Base64-encoded ECDSA P-256 signature over canonical bytes.

Canonical bytes exclude the signature field (and publicKey for EVENT transactions) before signing. See the integration guide for the exact byte layout and the FAQ for common pitfalls.

Nonces

Nonces are per-signer monotonic: each signer’s next nonce must be strictly greater than the highest nonce the network has seen for them. This gives replay protection without a global counter or coordination.

Anchor sub-types

• AnchorRotation, publish a signed anchor moving from epoch n to n+1. May cap old-epoch nonces.
• AnchorInvalidation, freeze an epoch so no further transactions at that epoch are admitted. Use this when a key is known-compromised.

Guardian sub-types

• GuardianSetUpdate, install or replace the M-of-N quorum for a subject.
• GuardianRecoveryInit, M guardians initiate a recovery on behalf of a subject who has lost their key.
• GuardianRecoveryVeto, the legitimate owner cancels an in-flight recovery during the time-lock window.
• GuardianRecoveryCommit, the time-lock has elapsed and the recovery rotates the subject to a new key.
• GuardianResign, a guardian withdraws consent without the subject’s cooperation; prospective only (doesn’t unwind in-flight recoveries).

See QDP-0002: Guardian-Based Recovery and QDP-0006: Guardian Resignation.