Covenants and Opcodes

POSITRONIC turns Neurai Script into a covenant environment. A covenant is a script that constrains how funds or assets may be spent, not only who may spend them. Constraints are enforced at consensus level, with no virtual machine and no trusted party.

AuthScript: the execution environment

Covenants run inside AuthScript, a witness version 1 output that extends SegWit with post-quantum signatures and a tagged commitment.

Auth type	Byte	Key check	Typical use
Script-only	0x00	None. The witness script alone decides	Pure covenants, vaults, DEX orders
Post-quantum	0x01	ML-DSA-44 signature from the committed key	Quantum-resistant addresses
Classical	0x02	ECDSA secp256k1 signature from the committed compressed key	Classical keys with covenant logic

The witness stack for spending is:

<authType> [<signature> <pubkey>] <arg1> <arg2> ... <witnessScript>

Script element limits are raised so that an ML-DSA-44 public key (1312 bytes) and signature (about 2420 bytes) fit. See Post-quantum addresses.

Covenant primitives

OP_CHECKTEMPLATEVERIFY

Rigid templates, as in BIP 119. The spending transaction must match a pre-committed hash of its version, locktime, input count and sequences, all outputs and the input index. The hash does not commit to input prevouts, so the covenant works whichever UTXO funds it.

<template_hash> OP_CHECKTEMPLATEVERIFY

Use it for batched payouts, vaults and congestion control: once committed, no signer can change destinations or amounts.

OP_CHECKSIGFROMSTACK

Verifies a signature over an arbitrary message from the stack instead of the transaction hash. Both ECDSA and ML-DSA-44 keys are accepted. This is the oracle primitive: a script can require an attestation signed by a known key before releasing funds.

<sig> <msg> <pubkey> OP_CHECKSIGFROMSTACK OP_VERIFY

OP_TXHASH

A flexible commitment. A one-byte bitmask selects which transaction fields go into a double-SHA256 hash, so a script can commit to the outputs and leave the inputs free, or the reverse.

Bit	Field
0	Version
1	Locktime
2	All input prevouts
3	All input sequences
4	All serialized outputs
5	Current input prevout
6	Current input sequence
7	Current input index

Opcode catalogue

All opcodes below are enabled on testnet and regtest and disabled on mainnet until activation.

Covenants

Opcode	Byte	Replaces	Description
OP_CHECKTEMPLATEVERIFY	0xb3	OP_NOP4	Commit to a template of the spending transaction
OP_CHECKSIGFROMSTACK	0xb4	OP_NOP5	Verify a signature over a stack message, ECDSA or ML-DSA-44
OP_OUTPUTAUTHCOMMITMENT	0xd5	new	Push the 32-byte AuthScript commitment of a selected output (NIP-023)

Transaction introspection

Opcode	Byte	Replaces	Description
OP_TXHASH	0xb5	OP_NOP6	Hash of selected transaction fields
OP_TXFIELD	0xb6	OP_NOP7	Fields of the spent output: value, AuthScript commitment, scriptPubKey
OP_TXLOCKTIME	0xc5	new	The transaction locktime as 4 little-endian bytes
OP_OUTPUTVALUE	0xcc	new	Value of a selected output
OP_OUTPUTSCRIPT	0xcd	new	scriptPubKey of a selected output
OP_INPUTCOUNT	0xd0	new	Number of inputs
OP_OUTPUTCOUNT	0xd1	new	Number of outputs
OP_INPUTVALUE	0xd6	new	Value of a selected input's prevout (NIP-024)
OP_CHAINCONTEXT	0xd7	new	Chain height, median time past or chain id (NIP-026)

Asset introspection

Opcode	Byte	Description
OP_OUTPUTASSETFIELD	0xce	Field of the asset payload attached to an output
OP_INPUTASSETFIELD	0xcf	Field of the asset payload of an input's prevout

Reference inputs

Opcode	Byte	Description
OP_REFINPUTCOUNT	0xd4	Number of reference inputs
OP_REFINPUTFIELD	0xd2	Field of a reference input, without spending it
OP_REFINPUTASSETFIELD	0xd3	Asset field of a reference input

These require transaction v3. See Transactions and consensus.

Bytes and arithmetic

Opcode	Byte	Description
OP_CAT	0x7e	Concatenate two byte strings (re-enabled, BIP 347)
OP_SPLIT	0xb7	Split a byte string at a position
OP_REVERSEBYTES	0xbc	Reverse the top stack item
OP_MUL, OP_DIV, OP_MOD	0x95, 0x96, 0x97	Re-enabled with 64-bit signed, overflow-checked arithmetic. OP_ADD and OP_SUB are upgraded to 64 bits as well

Hashes and signatures

Opcode	Byte	NIP	Description
OP_KECCAK256	0xba	030	Keccak-256, for Ethereum-compatible commitments
OP_BLAKE2B	0xbb	030	BLAKE2b
OP_CHECKMERKLEINCLUSION	0xc1	031	Native Merkle proof verification with a tree-scheme selector
OP_BLAKE3	0xc8	034	BLAKE3
OP_POSEIDON	0xc9	036	SNARK-friendly hash over the BN254 scalar field
OP_SHA3_256	0xca	034	SHA3-256
OP_SHA512	0xcb	034	SHA-512
OP_CHECKSIG_ED25519	0xdd	035	Strict RFC 8032 Ed25519 verification
OP_CHECKSIGADD	0xde	039	Signature accumulator for threshold scripts, classical and PQ keys

Activation and safety

• Each opcode has its own consensus flag. When the flag is off, an opcode that replaces a NOP behaves as that NOP, a re-enabled opcode returns a disabled-opcode error, and an opcode on a new byte slot returns a bad-opcode error. The mainnet rules therefore stay byte-for-byte unchanged until activation.
• OP_CHAINCONTEXT co-activates 64-bit integers, because median time past will not fit in 4 bytes after 2038.
• Policy code that verifies scripts outside consensus, such as signing RPCs and the neurai-tx tool, reads its flags through one helper so signing matches block validation on the chain the node runs on (NIP-020).

Examples

Output-only covenant. Commit to the outputs, accept any inputs:

0x10 OP_TXHASH <expected_outputs_hash> OP_EQUAL

Oracle-gated release. Spend only with an attestation from a known oracle key:

<oracle_pubkey> OP_CHECKSIGFROMSTACK OP_VERIFY

Partial-fill sell order. Read the asset payload of the spent output, compute the remaining amount with 64-bit arithmetic, and require the change output to re-create the same covenant. The @neuraiproject/neurai-scripts package ships a builder for this pattern.

Reference

The full opcode specification with stack diagrams, error conditions and examples is in the node repository under doc/covenants.md and doc/new-opcodes-depin-branch.md.