Watchers

Watchers are the independent operators who make VIGIL scores mean something. A Watcher stakes $VIGIL and runs Probes that call paid x402 endpoints, then signs and publishes each result onchain as an Attestation. This page covers what a Watcher needs, how staking works, how to run the reference probe, what it measures, how rewards are paid, and how false attestations are punished.

Requirements

A Watcher needs three things:

1. Stake. Once $VIGIL is launched, a Watcher bonds a minimum stake to the Watcher registry. Attestations from an unstaked key are ignored by the aggregator. The stake is what gets slashed, so it is the reason anyone can trust a Watcher they have never met.
2. A probe in at least one region. The reference network wants every endpoint covered from at least 3 regions, so a single Watcher does not need to be everywhere. A Watcher declares the regions it operates in; the aggregator uses this to cap how much one region's view can move a score.
3. A signing key. Every attestation is signed. The key is separate from the wallet that holds the stake, so a probe host can be compromised without exposing the stake. The stake wallet registers the signing key and can rotate it.

Probes pay for every call. The budget per probe is the endpoint's quoted price, so a Watcher also needs USDC on Base. Probe payments route through the VIGIL Facilitator, so a failing endpoint refunds the Watcher like any other agent.

Staking

Staking is a bond, not a deposit. It can be lost.

• Bonding. The Watcher transfers $VIGIL to the staking contract and registers a signing key. Attestations signed by that key count from the next epoch. The minimum stake is a governance parameter and is not set.
• Weight. Attestation weight in the score is proportional to stake, with a per-Watcher cap of 10% of total weight per endpoint. Stake above the cap does not increase influence over any single endpoint's score; it does increase reward share and vote weight.
• Unbonding. A Watcher can begin unbonding at any time. The stake remains locked and slashable for 14 days, then becomes withdrawable. Attestations stop counting the moment unbonding begins.
• Slashing. A fraction of stake defined by governance is burned when a slashing condition is met. See below.

Running a probe

The reference implementation is a single binary, vigil-probe, driven by a YAML config. It is not released. The config and commands below show the intended shape.

regions:
  - eu-west
  - us-east
  - ap-southeast

# "auto" pulls the current registered and observed endpoint set from the
# placeholder API. A list restricts probing to named endpoints.
endpoints: auto
# endpoints:
#   - https://api.weather.example/v1/forecast
#   - https://api.geo.example/v2/lookup

cadence: 60s

budget:
  # Per-probe spend. "quoted" means pay exactly the endpoint's quoted price
  # and skip endpoints quoting above max.
  per_probe: quoted
  max: "0.10" # USDC

facilitator: https://facilitator.vigil.example # placeholder, not live

signer:
  key_env: VIGIL_SIGNER_KEY # hex private key; never in the config file
  stake_address: "0x0000000000000000000000000000000000000000" # placeholder — contracts not deployed

# Write a starter config and check the signer key is reachable
vigil-probe init --config vigil-probe.yaml

# Start probing on the configured cadence and publish attestations
vigil-probe run --config vigil-probe.yaml

# Show stake, active regions, endpoints probed and attestations accepted this epoch
vigil-probe status

# Probe one endpoint once and print the attestation without signing or publishing
vigil-probe attest --dry-run https://api.weather.example/v1/forecast

Start with attest --dry-run. It pays for one call, runs the four checks locally and prints what would be attested without publishing.

What a Probe measures

Each probe call produces one attestation with four measurements. The measurement enters the score with the weight shown; the weights sum to 100.

Attestations are aggregated as a weighted mean with exponential time decay (half-life 7 days). A score is public after 25 attestations from 5 distinct Watchers. Details are on Checks and scoring.

Attestation rewards

Protocol fees are 0.5% of volume routed through the escrow plus VIGIL Verified subscriptions. Half of all fees go to Watchers; the other half is used to buy back and burn $VIGIL.

The Watcher half is distributed per epoch. An epoch is one week. Within an epoch, each Watcher's share is pro-rata by accepted attestations, weighted by stake: a Watcher's share equals its accepted attestations multiplied by its stake, divided by the same product summed over all Watchers.

An attestation is accepted when it is signed by a registered key, the Watcher was bonded when it was made, and it was not later contradicted by a dispute. Attestations against endpoints that have no public score still count, which is what pays Watchers to probe new endpoints. Rewards are paid in USDC because fees are collected in USDC.

Disputes

A dispute is how a contested result gets settled without a central operator.

• Opening. Any staked Watcher can open a dispute against an escrow check result or a set of attestations within 24 h of the result. Opening requires the Watcher to put forward its own attestation of the same endpoint as evidence.
• Voting. Active Watchers vote over 48 h. Votes are weighted by stake. A Watcher whose attestation is under dispute cannot vote on it.
• Resolution. The side with the majority of stake weight wins. The disputed escrow, which has been held in the Disputed state, is then released or refunded according to the outcome. Attestations on the losing side are marked contradicted, removed from the aggregate, and their Watchers are slashed.

Opening a dispute against a correct result costs the opener their own attestation and a slash, so disputes are expected to be rare.

Slashing conditions

Slashed $VIGIL is burned, not paid to the winning side, so there is no profit in disputing for its own sake. See Token for the fee split and Security and risks for what a compromised Watcher can and cannot do.