web3.path

PHASE 20 Lightning + operations · 16–24 hours

Lightning, Operations & Production Capstone

Lightning adds a second state machine on top of Bitcoin: channel funding, commitment updates, routing, liquidity, backups, and on-chain recovery. Production work means operating all of that deliberately.

Goal — run a test Lightning integration against a controlled Bitcoin environment, then ship either the EVM or Bitcoin capstone with observable, recoverable operations.

1. Lightning primitives

PrimitiveOperational meaning
Channel fundingA 2-of-2 on-chain output anchors off-chain commitments; it is not a custodial database balance.
Commitment transactionEach state update replaces the economic ownership view; old-state publication is punished/recovered through protocol mechanisms.
HTLCConditional payment using a hash preimage and timelock; it drives routing and atomicity.
Invoice / offerPayment request and amount/expiry metadata; validate network, amount, expiry, and destination policy.
LiquidityInbound and outbound capacity are distinct; a channel can be open and still fail a payment.
Watchtower / backupAvailability and recovery are security properties; monitor channels and rehearse restoration.

Read the relevant BOLTs and choose a stack intentionally: LND, Core Lightning, or LDK. Their API and operational tradeoffs differ. Use a test environment first; do not expose an unauthenticated node RPC or assume a hosted provider removes custody/liquidity risk.

1b. LDK & watchtowers

2. Lightning service boundaries

3. Production operations checklist

SystemMonitorRunbook trigger
RPC / nodeblock height lag, peer health, RPC latency/errors, disk and index stateprovider/node lag exceeds policy
Indexer / relayercursor lag, reorg rollback, queue depth, nonce age, fee replacementlag grows or a nonce is stuck
Contractsadmin calls, pause events, invariant/event anomalies, oracle deviation, cap utilizationunexpected privileged/economic event
Bridge / messagessent → delivered → executed state, retries, rate-limit use, supply capmessage exceeds SLA or state diverges
Lightningchannel availability, inbound/outbound liquidity, payment success, force-close/watchtower alertsliquidity or channel-security threshold breached

Use two independent data sources for critical state. Keep secrets in a KMS/HSM or a dedicated signer; use a Safe/timelock for EVM administration. Run incident drills: pause/disable, contain, reconcile, communicate, recover, and write the postmortem.

4. Practical lab — Lightning payment service

Deliverable
  1. Run two Lightning nodes on a controlled test network backed by regtest/signet. Open and fund a channel, make a payment, and observe invoice/payment/channel events.
  2. Build a small API with POST /invoices (idempotency key) and a webhook/event consumer that marks an order paid only after durable settlement reconciliation.
  3. Simulate an expired invoice, failed route, restart, duplicate webhook, channel liquidity shortage, and a force-close/recovery procedure. Each scenario must have an automated test or written runbook.
  4. Expose dashboards for payment success rate, pending/failed invoices, channel liquidity, on-chain confirmations, and reconciliation mismatches. Alert on an actionable threshold.

5. Final capstone — choose a production boundary

TrackBuildNon-negotiable evidence
EVM protocolGuarded vault/lending integration on an L2Foundry fuzz/invariants/fork tests, verified deploy, Safe/timelock, monitoring, threat model
EVM infrastructureReorg-safe indexer + relayer + operations dashboardbackfill/reorg tests, provider failover, nonce runbook, lag/error alerts, load test
Bitcoin walletDescriptor + PSBT treasury workflowregtest integration tests, fee/RBF/CPFP tests, multisig recovery drill, signer boundary
Lightning serviceInvoice settlement service with controlled node integrationidempotent ledger, reconciliation, failure drills, channel/liquidity monitoring
Gate — testnets and local networks prove mechanics, not security or economic safety. Do not use real funds until an independent reviewer has evaluated the code, keys, operations, and threat model. Capstone rubric: docs/capstone-rubric.html.
Track note — Lightning capstone evidence continues in Phase 26 if you have not yet published a reproducible repo.
← Phase 19Phase 21: Smart Contract Security →