Kaspa Covenant Binding connects an RPC transaction output to the optional covenant metadata that identifies a programmable UTXO’s lineage. Rusty-kaspa PR #1056 fixed one conversion path that had dropped this field, allowing vSPC v2 consumers, including wallets and indexers, to receive the binding instead of reconstructing an incomplete output.

Key takeaways

• A covenant binding contains a 32-byte covenant_id and the input index that authorizes the output.
• Rusty-kaspa PR #1056 changed one optional RPC-output conversion from TransactionOutput::new to TransactionOutput::with_covenant.
• The patch carries item.covenant into the internal transaction output instead of silently discarding it.
• This is a three-line data-plumbing fix, not a new consensus feature or a wallet user-interface release.
• Wallets, explorers and indexers still need updated schemas and explicit lineage logic to make covenant state understandable.

What does a Kaspa covenant binding contain?

A Kaspa transaction output normally records an amount and a script public key. Under KIP-20, Covenant IDs, a version-1 output can also declare an optional CovenantBinding. The binding has two fields: authorizing_input, a u16 input index, and covenant_id, a 32-byte identifier.

The authorizing input answers which spent UTXO permits the new covenant-bound output. The covenant ID answers which programmable lineage the new output claims to continue. When the output enters the UTXO set, its covenant ID is stored with the UTXO entry. That gives later transactions and off-chain software a stable label to follow even though the specific outpoint changes after every spend.

KIP-20 defines two valid origins. A continuation output can inherit the same ID from an authorizing covenant UTXO. A genesis output must derive its ID from a unique previous outpoint and the committed initial output set. Consensus therefore does more than accept an arbitrary application label: it checks the rules for creating or continuing that label.

What exactly did rusty-kaspa PR #1056 fix?

The merged patch changed one function in rpc/core/src/convert/tx.rs: conversion from RpcOptionalTransactionOutput into the internal TransactionOutput. Before the change, the converter called Self::new with only value and script_public_key. After the change, it calls Self::with_covenant and passes the optional covenant value through after converting its inner representation.

The pull request contains one commit, one changed file, two additions and one deletion. A maintainer’s review comment states the practical impact plainly: vSPC v2 consumers could not access covenant bindings. Eight automated checks passed before the change was merged into master on June 17, 2026.

This matters because an RPC model can contain a field while a particular conversion path still loses it. Downstream code then receives an output that looks structurally valid—its amount and locking script are present—but lacks the metadata required to recognize the covenant relationship. The bug was not in the covenant-ID consensus rule; it was at the boundary between an optional RPC representation and the core transaction representation.

How can wallets track programmable UTXOs correctly?

A covenant-aware wallet should treat the outpoint and the covenant ID as different identifiers. The outpoint identifies one spendable output at one moment. The covenant ID identifies the continuing protocol instance. After a valid state transition, the old outpoint is spent and one or more authorized outputs can carry the same covenant ID forward.

A practical indexer flow is:

1. Decode transaction version, outputs and optional covenant bindings without dropping fields.
2. Store each new outpoint with its amount, script public key, covenant ID and authorizing input.
3. Mark consumed outpoints as spent when processing the next accepted transaction.
4. Link authorized continuation outputs to the input covenant ID.
5. Handle chain reorganization by rolling the indexed UTXO changes back and replaying the accepted branch.
6. Present state only after applying the application’s own script and confirmation policy.

The binding is especially useful for an explorer or wallet that wants to list all currently live UTXOs for one covenant instance. It avoids treating every state transition as an unrelated contract. The same data completeness principle applies to Kaspa sequencing-commitment lane proofs, where consumers need both a committed identifier and the correct proof context rather than a partial RPC object.

Why is the RPC boundary a security boundary?

Consensus nodes ultimately decide whether a transaction is valid, but applications make decisions before and after submission. A wallet may estimate which output represents current state. An exchange may decide what data to persist. An indexer may build a lineage graph. If the RPC layer omits a binding, those systems can display incomplete state or fail to find an output they are meant to monitor.

The safest response is not to infer a missing covenant ID from a familiar script alone. Scripts can be reused, and KIP-20 deliberately supplies a consensus-tracked lineage identifier. Software should reject or flag incomplete version-1 objects where covenant data is required, log the node and SDK versions used, and test round trips from RPC decoding through storage and re-encoding.

Operators should also update compatible node and SDK components together. The rusty-kaspa v2.0.1 RPC and synchronization overview provides broader context for the maintenance release in which covenant data, lane-proof RPCs and client tooling were being refined.

What this fix does not prove

PR #1056 does not prove that every wallet, explorer or indexer is covenant-aware. It fixes one conversion path in rusty-kaspa. Each downstream project must still confirm that its generated RPC bindings, database schema, serializers and user interface preserve and interpret the fields correctly.

The patch also does not validate an application’s state machine for the application. Consensus checks covenant-ID creation and continuation rules, while the script constrains allowed spends. A wallet’s friendly label, balance view or history remains an off-chain interpretation that should be tested against actual accepted transactions.

Finally, a covenant ID is not an issuer endorsement, asset valuation or audit result. It establishes a non-forgeable lineage under the specified consensus rules; it does not establish the economic legitimacy or safety of whatever an application associates with that lineage.

Frequently asked questions

Is a covenant ID the same as a Kaspa transaction ID?

No. A transaction ID identifies a transaction, and an outpoint adds an output index. A covenant ID can persist across multiple transactions as authorized outputs carry the programmable lineage forward.

Did PR #1056 activate covenants on mainnet?

No. The pull request only corrected RPC-to-core output conversion. Covenant behavior comes from the Toccata consensus changes and their activation parameters.

Can an old wallet safely ignore covenant bindings?

It may continue handling ordinary outputs, but it cannot reliably represent covenant-bound application state if it discards the binding. Developers should follow the maintained compatibility guidance rather than assume a partial object is sufficient.

Source and verification note

This article is based on kaspanet/rusty-kaspa PR #1056, merged June 17, 2026, and cross-checked against the data model and consensus rules in KIP-20. The public diff changes one file with two additions and one deletion. Claims about downstream wallet and indexer behavior are implementation guidance derived from those interfaces, not evidence that every third-party product has adopted the fix.