Milestone 2: Programmability

Milestone 2 extends Skyhook swaps from payments to programs. Once value moves in both directions, a swap can carry logic that runs at settlement time: conditional releases, splits among several parties, and programmable escrows, following the direction for atomic swaps set out by Zcash Community Grants committee member GGuy.¹ The milestone delivers the two halves of that capability: ESMASL, the language and interface in which programs are written, and the evaluator contracts that execute them on-chain.

Language and machine

The two halves are named differently on purpose. An author writes a program once, off-chain, in JavaScript; the chain runs it later, on-chain, against committed inputs. ESMASL is what authors write: a JavaScript constructor for building swap programs, with an interface inside the bridge prototype that requires no knowledge of bytecode, so anyone who can use the demo page can program a swap. The evaluator is what runs it: the on-chain contracts of ESMASTe, which keep the settlement computer’s one-execution-per-transaction rule and step budgets and introduce no new trust assumptions.

Keeping the halves separate prevents the speed of iterating on the language from being tied to the audit surface of the machine. The language is optimized for people: expressive constructors, guidance in the interface, clear error messages and example programs. The evaluator is optimized for properties that must hold without trusting any authoring tool: determinism, bounded execution, exact dispatch and accounting for value calls. Either half can be extended or replaced without reopening the other, so improvements to the language never force the settlement semantics to be re-audited.

The separation also simplifies the trust argument for non-technical reviewers. Program authors have no privileges beyond those of any swap participant, and execution checks each program against its commitment rather than trusting where it came from. Malicious and buggy programs alike fail closed, and the machine needs no view of the author’s intent to enforce its rules.

The authoring interface

The programming interface sits in the bridge prototype alongside the existing swap flow. Authors build programs through guided interaction and never see raw bytecode; the constructor translates their choices into valid program structures. The interface also previews what a program will do before it settles. An accurate preview matters as much as correct execution, because a program that does something other than what its preview showed would be indistinguishable from fraud.

Example programs

Three classes of program illustrate the intended range, though they don’t exhaust it:

• Conditional release pays out only when committed conditions hold at execution, as in an escrow with release criteria.
• Multi-party splits divide an escrow among several parties in uneven shares in a single atomic execution, replacing sequences of trusted transfers.
• Time-gated logic makes distribution depend on chain-observable time, as in vesting schedules with deadlines.

All three compile to the same deterministic execution, respect the same budgets and dispatch through the same selectors.

Acceptance

Acceptance is deliberately practical. Community and committee members must be able to test the deliverables themselves; operation by the developers alone doesn’t count. Real programs must be built in the real interface and must settle real swaps on test networks. If a committee member can’t construct a program and watch it settle, the milestone is incomplete. This extends the beta’s evaluation method from simple transfers to programmed ones.

Status

Done

The execution layer is implemented and tested. A standalone virtual machine contract exists with passing test suites, a SingletonRunner is reached by delegatecall from a fresh contract created for each execution, a factory handles that creation and funding, and value calls work through TRANSFERNATIVE with ex-post step accounting. Named functions register through REGFUN with deterministic traps, fallback dispatch follows four-byte selectors in Ethereum convention, the assembler toolchain ships with golden vectors, and every release includes measured gas profiles. In short, both the machine that runs programs and the low-level tools that build them exist.

Remaining

The authoring layer and its interface remain. The JavaScript ESMASL constructor library, which must let developers write swap programs without touching bytecode, has yet to be built, as has the programming interface inside the bridge prototype. The acceptance bar is a reviewer constructing a program in the interface and settling a swap with it.

References

1. GGuy, The future of atomic swaps, Zcash Community Forum. ↩