guardian and relayer daemons (the off-chain half of the bridge)

[dendisuhubdy]

The wire format is frozen (spec/ATTESTATION.md) and all five verifiers pin their accept/reject to the 39 shared vectors, but nothing runs the format end to end: no guardian daemon watches a chain and signs, and no relayer daemon submits attestations. Until both exist, no token moves.

Guardian daemon (one per guardian, keys on distinct operators/hosts — no host may hold five):

• watch lock events on the four source chains (MessagePublished on EVM/TVM, PostedMessage PDAs on Solana) and Rand's rand_getBridgeBurn log;
• wait the emitter's consistency level before signing (Ethereum 1/finalized, BSC 15, Tron 19/solidified, Solana 1);
• rebuild the body from the event plus block timestamp, emitter chain id and emitter address, then sign mu = keccak256(keccak256(body)) — secp256k1, low-s, over the wire bytes exactly;
• after a guardian-set rotation, re-sign in-flight transfers under the current set (the superseded set's grace window is 86,400 s; rotations themselves must be signed by the current set);
• never sign a body whose emitter the destination would reject (registered emitters table, to_chain/token_chain rules, fee <= amount, amount within u64).

Relayer daemon (permissionless; anyone may submit):

• submit lock attestations to Rand as BridgeAttest and burn attestations to the home endpoint's release;
• Solana specifics: prepend an idempotent create-ATA instruction for the recipient's associated token account, keep the transaction within 1,232 bytes (address lookup tables if the guardian set ever grows), retry same-slot ["msg", sequence] PDA collisions on lock;
• handle CommitmentExists on Rand by re-sealing the deposit note (deposit_note recomputes it) — see the fullnode issue on commitment front-running;
• EVM: nothing special — release(bytes) and submitGuardianSetUpgrade(bytes) are open calls; gas pricing is the only policy.

[dendisuhubdy]

Closing: both daemons exist and have been running against mainnet since 2026-09-20.

• Built in 1f020fb (daemons/: rand-guardian, rand-relayer, later rand-bridge-gov and rand-bridge-audit). Signing and assembly reproduce the shared vectors byte for byte; a lock and a release run against the real EthereumRandBridge on anvil. cargo test --release in daemons/ is green today.
• Guardian: reads each source only past its consistency level (finalized on Ethereum, 15 on BSC, 19 on Tron, finalized on Solana), rebuilds the body, and signs only what the destination would accept (check_signable: registered emitter, to_chain / token_chain, fee <= amount, non-zero, within u64, EVM padding). A signature carries no guardian index, so after a rotation the relayer assembles the same signatures under the current set.
• Relayer: BridgeAttest to Rand through rand bridge-mint, releases through the EVM and Tron submitters and rand-bridge-cli release, which prepends the idempotent create-ATA instruction.
• The paths this issue listed as untested have all run live: Tron log facade and submitter, the Solana and Rand subprocess submitters (round 1 on every chain, 2026-09-20; tx table in docs/mainnet-deployment.md).
• Rotation: set 0 → set 1 on all five chains on 2026-09-25, and a release under set 1 (six signatures) landed on Solana at 1,198 of 1,232 bytes.
• CommitmentExists was settled on the chain side (bridge: deposit-note commitment front-running grief (CommitmentExists) fullnode#3, closed).

Not part of this issue and still open elsewhere: address lookup tables for a larger set (#5, O-1) and key custody across separate operators (BR-4, docs/guardian-hosts.md).