aere-docs/AERE-SHADOW-PRODUCER-SUMMARY.md

Spec 13: Self-verifying parallel Shadow Block Producer

Note added 2026-09-24 (consensus). Where this document says that consensus is classical secp256k1 ECDSA and not post-quantum, read it as the per-block finality statement it was until block 24,300,000 (AIP-22 stage 4, 2026-10-25). Since that block every validator attributes a consensus vote only through its verified post-quantum seal, and a block is post-quantum final once the next anchor, at most 32 blocks later, carries the certificate that covers it; headers still carry classical ECDSA commit seals until AIP-22 stage 5 (this sentence corrected on 2026-10-25). It no longer describes all of consensus on chain 2800: since 2026-08-14 every anchor block must carry a certificate of validator post-quantum seals under its hash (Falcon-512, with SLH-DSA as well since 2026-09-04), and since 2026-09-05 the nine AERE-client validators (nine of the ten) refuse any QBFT consensus message without a valid Falcon-512 seal of its author, while the tenth, the second client, enforced that seal only on commit messages until block 24,300,000 and attributes every consensus message only through it since (this clause corrected on 2026-10-12 and 2026-10-25). (Note applied to this document on 2026-10-28.)

Note added 2026-08-19. Statements in this document that consensus on chain 2800 is (or remains) classical secp256k1 ECDSA QBFT were written before the post-quantum header anchor went live, and remain true for block-by-block finality. Since block 13,014,000 anchor blocks (every 32nd block, on every one since block 13,889,296) also carry, under the block hash, a certificate of validator Falcon-512 seals, and since 2026-08-14 a node rejects an anchor block with fewer than three valid seals (f+1 of nine; eight or nine are carried in practice). That is a post-quantum checkpoint about every 16 seconds, not a per-block quorum: the claim published on 2026-08-15 that from block 14,050,000 no block finalizes without a post-quantum quorum was wrong (the per-block rule armed at that height is retired in the shipped code in favour of the anchor rules) and was withdrawn on 2026-08-19. Details: https://aere.network/quantum.html and the aere-node repository, anchor/README.md.

Date: 2026-07-19. Chain 2800 (Aere Network mainnet), head ~10,364,611 at build time.

What was built

A live compliance monitor under aerenew/shadow-producer/ that re-derives each canonical chain-2800 block independently and raises a DIVERGENCE ALARM on any mismatch. It never produces the canonical chain (read-only monitor).

Files:

• aerenew/shadow-producer/shadow-producer.mjs - the runner (real, runnable).
• aerenew/shadow-producer/blockstm-adapter.mjs - Phase C [MEASURE] scaffold seam to the Block-STM parallel executor.
• aerenew/shadow-producer/README.md - overview + honest scope + run instructions.
• aerenew/shadow-producer/package.json - type:module, scripts, no deps (ethers resolved from repo installs via ../conformance/lib.mjs, same as the conformance suite).
• aerenew/shadow-producer/logs/ - captured live run logs (monitor, selftest, reexec).
• aerenew/docs/AERE-SHADOW-PRODUCER.md - architecture + honest-status design doc.

Phases

• Phase A [FRESH, RUNS LIVE]: recompute QBFT block hash from header fields, assert == canonical blockHash; recover committed seals to quorum against the validator set AS OF THAT BLOCK (set grew N=3 -> N=7 over history; per-block set is the honest check).
• Phase B [FRESH, RUNS LIVE]: for a post-EIP-2935 empty block the only state delta is one history-ring SSTORE, history[(n-1) % 8191] = blockhash(n-1); re-derive and assert. Verifiable for recent blocks (ring holds last 8191; public RPC non-archival).
• Phase C [MEASURE, SCAFFOLD]: full parallel re-execution of the block's txs through the Block-STM executor -> full world-state root, diff vs canonical stateRoot. Needs a full-state node + forked-Besu parallel EVM; adapter emits an inspectable plan + the exact command. Faithful backend = aerenew/parallel/ (253 real blocks re-imported, 0 mismatch), NOT the toy Rust executor (which proves concurrency correctness only).

REAL run result (FRESH)

node shadow-producer.mjs against https://rpc.aere.network, chain 2800:

• 29 blocks Phase A: block hash re-derived byte-for-byte at EVERY block, spanning the whole chain incl. EIP-2935 activation (9,189,161) and base-fee floor fork (10,141,734); per-block seal quorum verified (2/3 early N=3, 5/7 current N=7).
• 17 EIP-2935 empty-block state-delta re-derivations verified (Phase B).
• 75 total re-derivation assertions, 0 divergences, exit 0.
• Non-vacuity self-test (--selftest): genuine block re-derives (PASS); one-byte stateRoot tamper is CAUGHT (PASS). Proves the alarm is not a rubber stamp.
• Phase C (--reexec): emits [MEASURE] re-execution plans honestly (no fabricated root).

Flags / honesty

• Parallel execution is NOT live on L1; canonical chain is sequential Besu. Stated everywhere.
• Monitor never produces the canonical chain; a bug in it cannot affect consensus (writes nothing consensus reads). Zero-risk on-ramp reasoning documented.
• Consensus stays classical secp256k1 ECDSA QBFT; not touched, not post-quantum.
• Full parallel re-execution against real world state = [MEASURE]; block-fetch + hash/state-delta re-derivation = [FRESH] and actually ran.
• No em-dashes / no "--" in prose (only markdown rules, tables, ASCII diagram, CLI in code fences). Brand "Aere Network"/"Aere" title case; ticker AERE uppercase.
• One correctness fix during build: initial seal check wrongly used the current N=7 quorum on historical blocks -> false alarms; fixed to per-block validator set. This itself demonstrated the alarm firing, then passing cleanly once correct.
• Reused existing hashing/RLP/seal helpers from aerenew/conformance/lib.mjs (did not reinvent). Wired to existing evidence (Block-STM, cross-client determinism, 253-block re-import) rather than inventing new numbers.