Every Second, specified.

This is the engineering description of the instrument: what is measured, how it is stored, how it is scored, how it is delivered. The site describes the promise; this document describes the machine that keeps it.

Overview

Every Second measures the reliability of every mainnet Avalanche L1 from outside the chain. Three probes, on infrastructure independent of every measured chain, send real signed transactions and record how long each takes to become final. From those timings, together with validator telemetry and cross-chain message tracing, the system derives a public, deterministic score per chain, an ecosystem index, and an incident stream.

• Listen — an AvalancheGo full node follows every L1 on mainnet: blocks, validator sets, ICM traffic. Passive, continuous, free for every chain.
• Touch — probes in Frankfurt, Virginia and Singapore send signed transactions on a 60-second cadence, tightening to 5 seconds on anomaly.
• Tell — the public sees the dashboard and the X feed; operators receive streams, webhooks and the API; foundations receive the instrument for their ecosystem.

Architecture

The invariant: every published number is a deterministic function of the raw store and a methodology version. No component may write a score by hand.

Regions & cadence

Roadmap: São Paulo, Johannesburg, Dubai, Tokyo — seven continent-scale internet regions. Cadence: 60 s base per chain per region; 5 s burst for a chain while any of its metrics is outside baseline; burst ends after five clean minutes. Probes never run on infrastructure operated by a measured chain.

Probe protocol

1. Construct a minimal self-transfer on the target chain from the probe wallet; sign locally.
2. t₀ — broadcast to the chain's public RPC; record wall-clock and monotonic time.
3. t₁ — first inclusion observed (block containing the tx seen by the listener or the RPC).
4. t₂ — finality confirmed: the block is irreversibly accepted by the validator set, as observed by the listener.
5. Emit a measurement event: {id, chain, region, sent_at, t1_ms, t2_ms, tx, probe_sig}. Timeouts emit measurement.failed with the stage reached.

Finality is t₂ − t₀. Per chain, per region and per window the scorer reports p50, p95 and p99.

Data model

measurement   { id, chain, region, wallet_epoch, rpc_id, sent_at, t1_ms, t2_ms, tx, probe_sig, methodology }  visibility: evidence
icm_trace     { id, route:{from,to}, sent_at, leg1_ms, leg2_ms, leg3_ms, delivered, evidence_tx }  visibility: evidence
validator_obs { chain, observed_at, count, hhi, churn_24h }
incident      { id, chain, type, leg?, started, ended, duration_ms, evidence_tx, public_post }       visibility: public
score         { chain, computed_at, F, U, M, V, score, ci_low, ci_high, rank_band, coverage (active|invited|passive|dormant|unsupported_vm|unmeasured), methodology } visibility: public
index         { period, median_finality_ms, chains, methodology }                                 visibility: public
commitment    { period, merkle_root, methodology, tx }                                             visibility: public

Raw events are immutable. Aggregates are derived and can be rebuilt from raw at any time.

Score specification

Windows: F over 24 h, U over 90 d, M over 24 h, V at computation time. Weights and thresholds are part of the methodology version; a change is a new version, announced before it takes effect. The dashboard shows a chain as healthy at score ≥ 93, degraded ≥ 87, incident below.

Three-leg ICM

Probes send Interchain Messages between measured chains. Each message is timed in three legs: leg 1 source finality (message finalised on the source chain), leg 2 relayer pickup (a relayer observes and submits it), leg 3 destination delivery (execution on the destination). A message undelivered after 90 s opens icm.stalled attributed to the leg that broke.

Incident model

Every incident carries an evidence transaction and, on open and on recovery, a public post on X.

Proof of measurement

The probe transaction proves that a measurement happened. A second mechanism proves that the record of it was never altered: every hour, the Merkle root of that hour's raw measurements is written to the chain in one transaction, together with the methodology version in force. Each monthly index value is committed the same way.

• Anyone can see that a commitment exists and when it was made — without seeing the raw data.
• A licensee or auditor holding the raw dataset verifies it against the on-chain root: the data is exactly what was recorded at the time.
• The index the foundation quotes has an on-chain source: value, month, methodology version.

Raw measurements themselves are never written on-chain; they stay in the evidence layer. Cost: one transaction per hour.

REST API

Base https://api.everysecond.online/v1. JSON, UTC, milliseconds. Auth Authorization: Bearer <key>. Endpoints: /chains, /chains/{id}, /chains/{id}/finality, /chains/{id}/incidents, /icm/routes, /index, /badge/{id}.svg, /methodology. See the API page for samples. Limits: 600 req/min per operator key; foundation keys are ecosystem-wide.

WebSocket

Two streams from one event log. wss://…/v1/public — no key: score.updated, incident.opened, incident.recovered, index.updated; the dashboard is a subscriber. wss://…/v1/stream?chain={id} — partnership key, one subscription per chain: every measurement and trace for that chain. Frames are the same JSON objects as the data model: measurement, measurement.failed, icm_trace, incident.opened, incident.recovered, score.updated. Heartbeat every 15 s; reconnect with ?since=<event id> to replay a gap.

Webhooks

JSON POST per event. Headers X-ES-Event, X-ES-Signature: sha256=HMAC(body, secret). Non-2xx responses retried 5 times with exponential backoff (1 m → 30 m). Events are idempotent by id; stream and webhook share ids.

Public layer

Two layers. Public, for everyone, no key: the dashboard, the public stream and API (scores, incidents with evidence transactions, the index, badges) and the incident feed on X. Evidence, for an ecosystem through its foundation's partnership: raw measurements, three-leg timings, region and incident detail, history, webhooks, signed scorecards — provisioned to L1 teams by the foundation. Raw historical data is licensed to institutions. The score is never sold.

Operations: listener phases, wallets, cost

• Listener phases. Tracking every L1 with one node is not feasible (each tracked L1 is a full sync). Phase 1: t₂ from RPC receipts and finality queries; the node tracks the most active chains only. Phase 2: additional nodes as coverage grows. Phase 3: passive metrics for every registered L1 from P-Chain plus tracked nodes.
• Probe wallets. Minimal balances on every chain; automatic top-up from a cold wallet; spend anomaly halts the probe and raises an internal alert. Keys never leave the probe host; hosts expose no inbound ports.
• Gas. Every Second funds gas for every measured chain. Cadence follows activity: the most active chains every 60 seconds from all regions, the rest every 5 minutes, dormant chains not probed. Anomaly burst runs on a bounded number of chains at once. Gas is a line in the ecosystem partnership budget.
• No relayers. Every Second never operates an ICM relayer; routes without one are not applicable for M.

Retention

Raw events: 90 days. Hourly aggregates: indefinitely. Incidents and evidence transactions: indefinitely. Methodology versions and the raw store are sufficient to rebuild every published number.

Deployment

The site is static: HTML, CSS and JavaScript with Three.js from a CDN; no build step. Upload the folder to Cloudflare Pages; _headers sets security headers. The dashboard reads demo data until it is pointed at the stream; switch by replacing the demo universe in assets/dashboard.js with a WebSocket subscriber that emits the same objects.

Build order

The order in which the instrument becomes real. Each step is independently demonstrable; nothing below depends on a step above being polished.

1. Probe + collector — one region, the 100 most active chains, one wallet per chain, one RPC. Signed measurements landing in the raw store. Proves t₀/t₁/t₂. Test configuration: no rotation, no cross-check yet.
2. Three regions, every mainnet L1 — funded wallets, chain registry, cadence and burst. Proves coverage.
3. Scorer + full methodology — percentiles with confidence intervals, rank bands, components, score, incidents, index, coverage classes; rotating wallet pools, randomised timing, multiple RPC endpoints per chain switched on. Methodology v1.0 frozen. Proves reproducibility and resistance to gaming — because from here on, scores are published.
4. Delivery — REST, WebSocket, webhooks, X publisher from one event log; hourly Merkle commitment on-chain. Proves "we push" and "we cannot rewrite".
5. Dashboard on the stream — replace the demo universe with the subscriber; the page is already built for it.
6. Listener + ICM traces — validator telemetry, three-leg timing and the organic cross-check (passive measurement of third-party transactions). Completes V and M and the probe-preference flag.

Step 3 is the moment the foundation conversation changes: from "an idea" to "a number you can recompute".

Glossary