Complete protocol specification derived from the C++ source code. Every constant, formula, and rule documented with exact file references. Genesis: 2026-03-15 18:00:00 UTC.
CPU-friendly memory-hard Proof of Work based on gradient descent over a random 32×32 linear system, mixed with reads from a 4GB dataset and 4GB scratchpad.
512M uint64_t entries generated via sequential LCG from prev_block_hash. Multiplier: 6364136223846793005, increment: 1442695040888963407, plus SplitMix64 mixing. Dataset v2: independently indexable via SplitMix64 — O(1) per value, no full 4GB needed for verification. Thread-local; reused across all nonce attempts for the same block. Source: convergencex.cpp:12-28
Sequential SHA256 hash chain from epoch key. Scratchpad v2: independently indexable via SHA256(MAGIC||"SCR2"||seed||index) — O(1) per block, no full 4GB needed for verification. Mining still uses the full 4GB for performance. Source: scratchpad.cpp:45-81
Each block generates a unique program from block_key = SHA256(prev_hash || "BLOCK_KEY"). 256 instructions, each one of 8 opcodes: MUL, XOR, ADD, ROT, AND, OR, NOT, SUB. Immediates derived from block_hash bytes. Prevents ASIC optimization. Source: convergencex.cpp:35-48
Each round: compute A(x) = MT(Mx) + λx (two 32×32 matrix-vector multiplies), sample 4 scratchpad indices from state hash, execute per-block program on dataset entry, apply gradient step x[i] -= (A(x)[i] - b[i]) >> 18, mix scratchpad values into x, update state via SHA256. Every 6,250 rounds: save checkpoint (state_hash, x_hash, round, residual).
B0 profile: scale=1, k=4, steps=4, margin=185. Generates 4 deterministic perturbations δ ∈ [-1, +1], applies 4 gradient steps to reference and perturbed copies, verifies L1 distance doesn't grow > 180 per step. Large perturbations must compress to 70% ratio. Source: convergencex.cpp:156-197
commit = SHA256(MAGIC || "COMMIT" || header_core[72] || seed || final_state || x_bytes[128] || segments_root || checkpoints_root || stability_metric)
352 bytes hashed. Commit V2 includes segments_root binding the full computation transcript. Block also includes segment_proofs (merkle proofs for challenged segments) and round_witnesses for sampled round verification. Block accepted if commit ≤ target(bitsQ).
target_from_bitsQ() uses a 256-entry LUT of precomputed 2256 × 2-i/256 values with linear interpolation. For bitsQ = 765730: integer part = 11, fractional = 44834. Target is LUT interpolation shifted right by 11 bits. Source: sostcompact.cpp:73-105
timestamp: 1773597600 (2026-03-15 18:00:00 UTC) bitsQ: 765730 (11.6841) nonce: 6643 block_id: 6517916b98ab9f807272bf94f89297011dd5512ecea477bd9d692fbafe699f37 commit: 0012826c6896fe10ef4c726913d21765da650004ad3e00ff822e2d6dad3c35b3 segments_root: e0bb171d31dc03501b380c13f128095f90605f6a1b75d0166cf5a28f665d83b5 checkpoints_root: 93e1107cab5370c61c54a8b23e2b39f496fcb261ebdf0ab0872eb7a5490269cb metric: 94 profile_index: 0 (B0 — committed to hash) subsidy: 785,100,863 stocks (7.85100863 SOST) split: miner 392,550,433 | gold 196,275,215 | popc 196,275,215
Single integrated controller for block timing combining bitsQ (primary hardness), equalizer (structural correction), and anti-stall (recovery).
Difficulty encoded as 32-bit fixed-point: upper 16 bits = integer (leading zero bits in target), lower 16 = fraction. GENESIS_BITSQ = 765730 → 11 + 44834/65536 = 11.6841. Higher bitsQ = harder blocks.
td = actual_time - (anchor_time + blocks_since_anchor × 600) exponent = (-td × 65536) / 43200 factor = 2^(frac/65536) via Horner cubic polynomial raw = anchor_bitsq × factor delta = clamp(raw - prev_bitsq, ±prev_bitsq/16) result = clamp(prev_bitsq + delta, [MIN_BITSQ, MAX_BITSQ])
Half-life: 48 hours (172,800s). Delta cap: 6.25% per block. Source: casert.cpp:67-115
5 EWMA signals computed over last 128 blocks: short (8-block), long (96-block), volatility (16-block), integrator (leaky accumulator), burst score (short - long). Control signal: U = 0.05·r + 0.40·lag + 0.15·I + 0.05·burst + 0.02·V. Schedule lag dominates (60% of total signal). Maps to profile index H ∈ [-4, 9]. 17 profiles E4(-4) through H12(+12); H10–H12 defined in code but capped at H9. Profile changes limited to ±1 level per block (slew rate limit) to prevent oscillation.
| Profile | H | Scale | Steps | K | Margin | Effect |
|---|---|---|---|---|---|---|
| E4 | -4 | 1 | 2 | 3 | 280 | Emergency easing |
| E3 | -3 | 1 | 3 | 3 | 240 | Deep easing |
| E2 | -2 | 1 | 4 | 3 | 225 | Easing |
| E1 | -1 | 1 | 4 | 4 | 205 | Light easing |
| B0 | 0 | 1 | 4 | 4 | 185 | Baseline |
| H1 | 1 | 1 | 5 | 4 | 170 | Light hardening |
| H2 | 2 | 1 | 5 | 5 | 160 | Moderate |
| H3 | 3 | 1 | 6 | 5 | 150 | Moderate+ |
| H4 | 4 | 1 | 6 | 6 | 145 | Strong |
| H5 | 5 | 2 | 5 | 5 | 140 | Strong+ (scale=2) |
| H6 | 6 | 2 | 6 | 5 | 135 | Severe |
| H7 | 7 | 2 | 6 | 6 | 130 | Severe+ |
| H8 | 8 | 2 | 7 | 6 | 125 | Maximum |
| H9 | 9 | 2 | 7 | 7 | 120 | Maximum (CASERT_H_MAX) |
| H10 | 10 | 3 | 7 | 6 | 115 | Defined, capped at H9 |
| H11 | 11 | 3 | 7 | 7 | 110 | Defined, capped at H9 |
| H12 | 12 | 3 | 8 | 7 | 105 | Defined, capped at H9 |
17 profiles. CASERT_H_MIN=-4 (E4), CASERT_H_MAX=9 (H9). H10–H12 defined in code but capped at H9. Easing profiles E1–E4 only activate after 6+ hours at B0. Source: params.h:131-138
Mining-only (now_time > 0). If stalled > max(7200s, lag×600s), zone-based decay to B0: H9–H7 at 600s/level, H6–H4 at 900s/level, H3–H1 at 1200s/level. Easing profiles E1–E4 activate only after 6 hours extra at B0. Source: casert.cpp:204-215
version (u32, always 1), tx_type (0x00=standard, 0x01=coinbase), inputs (max 256, 133 bytes each: prev_txid[32] + prev_index[4] + signature[64] + pubkey[33]), outputs (max 256: amount[8] + type[1] + pubkey_hash[20] + payload_len[2] + payload[N]).
| Type | Code | Status |
|---|---|---|
| OUT_TRANSFER | 0x00 | Active |
| OUT_COINBASE_MINER | 0x01 | Active (coinbase only) |
| OUT_COINBASE_GOLD | 0x02 | Active (coinbase only) |
| OUT_COINBASE_POPC | 0x03 | Active (coinbase only) |
| OUT_BOND_LOCK | 0x10 | After height 5000 |
| OUT_ESCROW_LOCK | 0x11 | After height 5000 |
Sighash preimage (146 bytes): version[4] || tx_type[1] || hashPrevouts[32] || prev_txid[32] || prev_index[4] || spent_amount[8] || spent_type[1] || hashOutputs[32] || genesis_hash[32]. Double SHA256. Compact 64-byte signature (r[32] || s[32]). LOW-S mandatory: s ≤ n/2. Source: tx_signer.cpp:154-182
q = (subsidy + fees) / 4 miner = (subsidy + fees) - 2*q // 50% + rounding remainder gold_vault = q // 25% popc_pool = q // 25%
Each output creates a UTXO indexed by (txid, output_index). ConnectBlock/DisconnectBlock with BlockUndo for reorgs. Coinbase maturity: 1000 blocks. Fee: sum(inputs) - sum(outputs) ≥ 1 stock/byte. Source: utxo_set.cpp
Block ≤ 1MB. 1–65536 txs. tx[0] = coinbase. tx[1..n] = standard. Merkle root verified. CVE-2012-2459 protection.
prev_block_hash links correctly. height = prev+1. Timestamp > MTP(11) and ≤ now+600s. bits_q = casert_next_bitsq(chain, height).
R-rules (R1-R14): version=1, valid tx_type, input/output counts, amounts > 0, no overflow, no duplicate inputs, size ≤ 100KB, active output types, valid payloads.
S-rules (S1-S12): UTXO exists, PKH matches, valid pubkey, non-zero signature, LOW-S, ECDSA verifies, inputs ≥ outputs, fee ≥ 1 stock/byte, valid output types, coinbase maturity 1000, bond locked, burn unspendable.
CB-rules (CB1-CB10): coinbase tx_type, single null input, height in sig field, output order [miner, gold, popc], exact split, constitutional PKH, 3 outputs, zero pubkey, no payload.
Atomic: spend all inputs, create all outputs, record BlockUndo for reorgs.
The node does NOT recompute the full 100K-round gradient descent. Transcript V2 verifies a compact proof in ~0.2ms with an 11-phase pipeline:
1. x_bytes length == 128 bytes (32 × 4) 2. merkle_root_16(checkpoint_leaves) == checkpoints_root 3. Recompute seed from header + nonce (deterministic) 4. Verify segments_root against segment_proofs (merkle proofs for challenged segments) 5. Derive challenge set from commit (deterministic challenge derivation) 6. For each challenged segment: verify local round transitions via round_witnesses 7. Dataset v2 spot-check: SplitMix64 indexing at O(1) per challenged value 8. Scratchpad v2 spot-check: SHA256(MAGIC||"SCR2"||seed||index) at O(1) per block 9. SHA256(MAGIC||COMMIT||header||seed||state||x_bytes||segments_root||root||metric) == commit 10. verify_stability_basin(x_bytes) passes 11. stability_metric matches
Plus: commit ≤ target(bitsQ). No dataset or scratchpad needed — both are independently indexable at O(1). Source: convergencex.cpp:374-442
Miner: 8 GB RAM (4 GB dataset + 4 GB scratchpad) to solve ConvergenceX. Node: ~500 MB to verify via Transcript V2 (~0.2ms per block). Mining is memory-hard (ASIC resistant); verification is lightweight (anyone can run a node). The miner generates the full proof; the node only checks it.
SOST uses best-chain-by-cumulative-work selection, not longest-chain. Each block contributes work = floor(2^256 / (target + 1)). The chain with the highest total accumulated work wins. This prevents attacks using many easy blocks to outpace a shorter chain with more real work. This is the same approach used by Bitcoin. Source: sostcompact.cpp:compute_block_work()
If a better chain is found (higher cumulative work), the node performs an atomic reorganization: disconnect current blocks from tip to fork point, connect the new chain, and recover orphaned transactions to the mempool. If any block in the new chain fails validation, the entire reorganization is aborted and the original chain is restored. Orphan blocks (parent unknown) are stored separately from fork candidates (parent known) and re-processed when their parent arrives. MAX_REORG_DEPTH = 500 blocks (~3.5 days). Source: sost-node.cpp:try_reorganize()
subsidy(h) = floor(R0 × q^epoch) R0 = 785,100,863 stocks (7.85100863 SOST) q = e^(-1/4) ≈ 0.7788 epoch = floor(h / 131,553) Hard cap: 466,920,160,910,299 stocks (~4,669,201 SOST)
Enforced in consensus: if cumulative emission would exceed cap, subsidy reduced to remainder. When exhausted, subsidy = 0 (fees only). Source: subsidy.cpp:40-94
| Epoch | Blocks | Subsidy/block | Epoch Total | Cumulative | % Max |
|---|---|---|---|---|---|
| 0 | 0–131,552 | 7.851 SOST | 1,032,535 | 1,032,535 | 22.1% |
| 1 | 131,553–263,105 | 6.114 SOST | 804,286 | 1,836,821 | 39.3% |
| 2 | 263,106–394,658 | 4.761 SOST | 626,250 | 2,463,071 | 52.7% |
| 3 | 394,659–526,211 | 3.708 SOST | 487,684 | 2,950,755 | 63.2% |
| 4 | 526,212–657,764 | 2.888 SOST | 379,811 | 3,330,566 | 71.3% |
| Role | Address | Allocation |
|---|---|---|
| Gold Funding Vault | sost11a9c6fe1de076fc31c8e74ee084f8e5025d2bb4d | 25% of every block |
| PoPC Pool | sost1d876c5b8580ca8d2818ab0fed393df9cb1c3a30f | 25% of every block |
The remaining 50% goes to whichever miner solves the block (configured via --address). The miner address is NOT constitutional — it changes per miner. Only the Gold Vault and PoPC Pool addresses are hardcoded and immutable.
Enforced by CB4 (output order) and CB6 (PKH validation). Any block deviating from the 50/25/25 split or sending gold/popc to wrong addresses is rejected. Source: params.h:187-188
Hard cap: Total supply ≤ 466,920,160,910,299 stocks (~4,669,201 SOST). Enforced in subsidy calculation at consensus level.
Coinbase maturity: 1000 blocks (~7 days). Coinbase outputs cannot be spent before this.
Messages: EKEY (X25519), VERS/VACK (handshake), GETB (request blocks), BLCK (block data), TXXX (tx relay), PING/PONG, DONE. Encryption: X25519 + ChaCha20-Poly1305, ON by default. Limits: 64 inbound peers, 4 per IP, 4MB max message. Ban: 100 misbehavior points → 24h ban.
22 JSON-RPC methods. Auth required by default (Basic Auth). Read-only methods accessible without auth. Write methods (submitblock, sendrawtransaction) require auth. Key methods: getblocktemplate (mining), submitblock (block submission), getinfo, getblock, getbalance, listunspent, sendrawtransaction.
Max 5000 entries. Fee-rate ordered with rational arithmetic (__int128, no floats). Acceptance: no coinbase, no duplicates, no double-spends (spent_index_ map), consensus validation (R1-R14, S1-S12), policy validation (size ≤ 16KB, inputs ≤ 128, outputs ≤ 32, fee ≥ 1 stock/byte, dust ≥ 10000 stocks). BuildBlockTemplate selects by fee-rate descending up to 1MB.
New node flow: load genesis_block.json → connect to peers via P2P → VERS/VACK handshake → GETB for missing blocks → validate each block (L1-L4 + verify_cx_proof + pow_meets_target) → connect UTXO set → propagate.
Node validation requires ~500 MB RAM. No 4GB dataset or scratchpad needed. Transcript V2 compact proof (commit V2 + segments_root + sampled round witnesses + checkpoint merkle + stability basin) verifies PoW in ~0.2ms per block without recomputation.
Mining requires ~8 GB RAM (4GB dataset + 4GB scratchpad + ~100MB overhead). Scratchpad built once per epoch (~25s SHA256 chain). Dataset generated once per block (~3s LCG).
| Aspect | Bitcoin | Monero (RandomX) | SOST (ConvergenceX) |
|---|---|---|---|
| PoW algorithm | SHA256d | RandomX | Gradient descent + stability |
| Mining hardware | ASICs | CPU (anti-ASIC) | CPU (8GB memory-hard) |
| Mining memory | Negligible | ~2GB | ~8GB |
| Node verification memory | Negligible | ~2GB (must build dataset) | ~500MB (no dataset needed) |
| Verification method | Recompute hash | Recompute full RandomX | Transcript V2: segments + round witnesses (~0.2ms) |
| Verification cost/block | ~1μs | ~50-200ms | ~0.2ms |
| Difficulty adjustment | Every 2016 blocks | Every block (LWMA) | Every block (cASERT, 48h half-life) |
| Scenario | RAM Min | RAM Recommended | CPU | Disk |
|---|---|---|---|---|
| Node only (VPS) | 2 GB | 4 GB | 1 core | 10 GB |
| Miner only | 10 GB | 16 GB | 4+ cores | 20 GB |
| Node + Miner | 12 GB | 16 GB | 4+ cores | 20 GB |
The node uses ~500MB (UTXO set + mempool + P2P buffers). The miner uses ~8GB (4GB dataset + 4GB scratchpad). They don't overlap: the node does not need the mining dataset or scratchpad.
User locks SOST bond (20-30% of gold value), maintains XAUT/PAXG in own Ethereum wallet (EOA only). Random audits from ConvergenceX entropy triple (block_id, commit, checkpoints_root). Audit probability: 30% at 0 stars, 5% at 5 stars. Slash on failure: 50% to PoPC Pool + 50% to Gold Vault. Rewards: 12-22% annualized (1-12 months).
User deposits XAUT/PAXG in immutable EVM escrow (no admin key, no upgrade proxy). Reward paid immediately from PoPC Pool. No bond, no slash risk. Lower rewards: 0.25-7% annualized.
On-chain BOND_LOCK/ESCROW_LOCK: height 5000 (~35 days post-genesis). PoPC Ethereum contracts: Q1 2027 target. Full custody audit system: Q1 2027 target. Gold purchases: no earlier than Q2 2027 (8 months post public launch, per rule G4).