In brief
This page is source-sensitive. Treat application, covenant, proof, and readiness wording as bounded by the listed public sources and Open Questions.
What this page explains#
Successor validation is the covenant safety center: the script must check what the next output is allowed to be. This page sits in Covenants. It gives the topic a plain-language handle first, then shows the working idea, the mechanism, the source trail, and any limits that still matter. This category keeps the UTXO model visible while explaining stateful patterns. A covenant does not mutate account storage in place; it validates a spend and the successor output that carries the next state.
The writing follows a simple Kaspa documentation pattern: answer the practical question first, then link outward for details. The closest public sources for this page are DOC-TOCCATA-COVENANT-STATE, RK-COVENANTS, RK-TXSCRIPT, RK-TX-VALIDATION, KIP-0020. Local notes can help choose what to explain, but public-facing references resolve to upstream websites, repositories, papers, release pages, or docs.
How to think about it#
The practical model starts by naming the layer that owns the topic: wallet use, node operation, consensus, transaction validation, Toccata script behavior, tooling, or research. From there, the page shows which public source can support the explanation and where the explanation becomes incomplete.
For Successor Output Validation, the model is built around these anchors: successor existence and output index need explicit checks; script public key and value policy are part of state safety; covenant binding and authorizing input must be clear; state encoding should be deterministic; negative tests are recommended review coverage, not a separate consensus rule. This model is useful, but it does not encode every constant, branch, error type, or edge case. Those details belong in the source path and the source notes.
How it works#
1. successor existence and output index need explicit checks. Covenant mechanics stay anchored in UTXOs, but the page's main question is state continuity. The current output is spent, the script inspects transaction context, and the successor output must carry the allowed next state. Covenant IDs, authorization groups, script context, and indexer head tracking are helper surfaces; they do not replace the actual successor validation rule.
2. script public key and value policy are part of state safety. Covenant mechanics stay anchored in UTXOs, but the page's main question is state continuity. The current output is spent, the script inspects transaction context, and the successor output must carry the allowed next state. Covenant IDs, authorization groups, script context, and indexer head tracking are helper surfaces; they do not replace the actual successor validation rule.
3. covenant binding and authorizing input must be clear. Covenant mechanics stay anchored in UTXOs, but the page's main question is state continuity. The current output is spent, the script inspects transaction context, and the successor output must carry the allowed next state. Covenant IDs, authorization groups, script context, and indexer head tracking are helper surfaces; they do not replace the actual successor validation rule.
4. state encoding should be deterministic. Covenant mechanics stay anchored in UTXOs, but the page's main question is state continuity. The current output is spent, the script inspects transaction context, and the successor output must carry the allowed next state. Covenant IDs, authorization groups, script context, and indexer head tracking are helper surfaces; they do not replace the actual successor validation rule.
5. negative tests are recommended review coverage, not a separate consensus rule. Covenant mechanics stay anchored in UTXOs, but the page's main question is state continuity. The current output is spent, the script inspects transaction context, and the successor output must carry the allowed next state. Covenant IDs, authorization groups, script context, and indexer head tracking are helper surfaces; they do not replace the actual successor validation rule.
This mechanism section keeps the covenant rule, the spent output, the successor output, covenant ID, authorization context, and indexer responsibility separate. Local case studies stay local experience unless rewritten against public sources.
How to check it#
| Step | Check | Evidence gate |
|---|---|---|
| 1 | Check successor existence and output index need explicit checks. | Read DOC-TOCCATA-COVENANT-STATE, RK-COVENANTS, RK-TXSCRIPT; verify spent-output context, successor-output rule, covenant ID, and negative cases separately. |
| 2 | Check script public key and value policy are part of state safety. | Read DOC-TOCCATA-COVENANT-STATE, RK-COVENANTS, RK-TXSCRIPT; verify spent-output context, successor-output rule, covenant ID, and negative cases separately. |
| 3 | Check covenant binding and authorizing input must be clear. | Read DOC-TOCCATA-COVENANT-STATE, RK-COVENANTS, RK-TXSCRIPT; verify spent-output context, successor-output rule, covenant ID, and negative cases separately. |
| 4 | Check state encoding should be deterministic. | Read DOC-TOCCATA-COVENANT-STATE, RK-COVENANTS, RK-TXSCRIPT; verify spent-output context, successor-output rule, covenant ID, and negative cases separately. |
| 5 | Check negative tests are recommended review coverage, not a separate consensus rule. | Read DOC-TOCCATA-COVENANT-STATE, RK-COVENANTS, RK-TXSCRIPT; verify spent-output context, successor-output rule, covenant ID, and negative cases separately. |
When using this page for covenant design, verify the spent output, script context, authorization rule, successor output, state encoding, and negative cases separately. Indexer head tracking and local design notes are supporting evidence, not replacements for the covenant rule.
Related Pages#
- covenants-and-state
- covenants
- covenant-ids-and-lineage