What is constrained
- The Ark Operator, governance, and arbiters cannot spend escrow alone.
- The taker can reconstruct and verify amount, keys, leaves, and timelocks.
- Signed Nostr records expose lifecycle actions, evidence, votes, and attestations.
- Thresholds prevent one juror or oracle from deciding alone.
Ark Operator boundary
Panel-selection covenants and upgrade rules are enforced by the Ark Operator’s Arkade co-signature policy, not Bitcoin Script. A colluding operator could include a malformed upgrade. Unilateral on-chain exits do not carry those Ark-internal policy guarantees.
Adjudication risks
Juror panels can collude; Sybil resistance depends on bonds and registry policy. Oracle sets can unanimously attest a false result, and maker-controlled endpoints can lie. Conflicting oracle attestations escalate, but unanimous collusion does not. This is partly mitigated by trusted oracles run by SatCode.
Governance and availability
Governance can slash juror and oracle bonds, and script cannot prove that a slash was justified; the signed record makes abuse visible. Relay censorship is mitigated operationally with multiple relays. A second failed juror panel falls back to direct governance resolution—an explicit extreme-case trust point.