A reveal's txid does not commit to its witness (BIP-141), and the envelope
lives in the witness. Anchoring the reveal by txid therefore says nothing
about the pointer, the envelope's input, or the envelope bytes: a server can
rewrite all of them, keep the txid, and hand over a bundle whose inclusion
proofs still fold correctly.
What the txid DOES commit to is each input's outpoint, and a bundle's prev
txs are pinned by those outpoints. The envelope input's prevout therefore
yields a trustworthy P2TR scriptPubKey, and BIP-341 requires the witness
tapscript to be committed by it. Checking that commitment is what makes the
envelope trustworthy, and it is the same check the L2 content path runs.
What this does NOT establish is that the observed tapscript was the script
the reveal executed. A single-leaf P2TR output is spendable by key path as
well as by script path, and the txid commits to neither the witness nor the
spend path chosen, so control block depth 0 proves that the prevout's author
committed the observed tapscript and nothing more. Under ord semantics an
input spent by key path reveals no envelope at all. Proving which envelope
the id names therefore needs the block's BIP-141 witness commitment, and the
callers decide that separately (see IndexProof); this function binds input
k alone.
The residual at input k is the L2 residual: a multi-leaf taptree lets a
witness present any leaf its author committed, so this proves the commit
output's author committed the observed tapscript. singleLeafTree reports
when the taptree provably held nothing else.
Bind the envelope to txid-committed data.
A reveal's txid does not commit to its witness (BIP-141), and the envelope lives in the witness. Anchoring the reveal by txid therefore says nothing about the pointer, the envelope's input, or the envelope bytes: a server can rewrite all of them, keep the txid, and hand over a bundle whose inclusion proofs still fold correctly.
What the txid DOES commit to is each input's outpoint, and a bundle's prev txs are pinned by those outpoints. The envelope input's prevout therefore yields a trustworthy P2TR scriptPubKey, and BIP-341 requires the witness tapscript to be committed by it. Checking that commitment is what makes the envelope trustworthy, and it is the same check the L2 content path runs.
What this does NOT establish is that the observed tapscript was the script the reveal executed. A single-leaf P2TR output is spendable by key path as well as by script path, and the txid commits to neither the witness nor the spend path chosen, so control block depth 0 proves that the prevout's author committed the observed tapscript and nothing more. Under ord semantics an input spent by key path reveals no envelope at all. Proving which envelope the id names therefore needs the block's BIP-141 witness commitment, and the callers decide that separately (see IndexProof); this function binds input
kalone.The residual at input k is the L2 residual: a multi-leaf taptree lets a witness present any leaf its author committed, so this proves the commit output's author committed the observed tapscript.
singleLeafTreereports when the taptree provably held nothing else.