aere-network/aere-node
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SPEC.md, registries/README.md: ten validators since 2026-09-11 (the tenth is the Nethermind client): f=3, QBFT quorum 7 of 10; the anchor certificate minimum stays 6 seals, now below the quorum; dated history kept

Browse Source
This commit is contained in:
Aere Network 2026-09-11 14:18:32 +03:00
parent 3b085911fa
commit a2d2db9693
2 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
SPEC.md
View File

@ -181,17 +181,17 @@ Aere adds, changes, or that a follower must check.
in `genesis.json`).
- Validator set changes are made by the standard QBFT voting mechanism (the vote element of
extraData, section 2.3). The set had 3 validators at genesis (source: `genesis.json`), and the
live chain seals with nine validators, seven until 2026-08-09 (source: `RUN-A-NODE.md`, "What the
live chain seals with ten validators since 2026-09-11 (nine from 2026-08-09, seven until then) (source: `RUN-A-NODE.md`, "What the
two bootnodes are"). The block-by-block vote history is on the chain itself and is not restated
here.
### 2.2 Quorum
The QBFT commit quorum is `ceil(2N/3)`: 2 at N=3, 5 at N=7, 6 at N=9. This is the value the formal
The QBFT commit quorum is `ceil(2N/3)`: 2 at N=3, 5 at N=7, 6 at N=9, 7 at N=10. This is the value the formal
models prove is the exact safety threshold (quorum intersection greater than f for all N, and the
negative control shows a majority quorum forks) (source:
`../aere-research/formal-consensus/qbft_safety_smt.py`, property L1, and
`../aere-research/formal-consensus/RULEAZA-TOT.md`). Fault tolerance at N=9 is f=2.
`../aere-research/formal-consensus/RULEAZA-TOT.md`). Fault tolerance at N=10 (since 2026-09-11) is f=3; it was f=2 at N=9.
### 2.3 The extraData structure, with the Aere sixth element
@ -267,8 +267,8 @@ validate base fees.
### 2.6 Consensus messages under post-quantum seal (emission live since 2026-09-02; enforcement armed by height on 2026-09-05)
Since 28-31 August 2026 every one of the four QBFT message types (PROPOSAL, PREPARE, COMMIT,
ROUND-CHANGE) can carry a Falcon-512 seal of its author, and since 2 September 2026 all nine
validators of chain 2800 EMIT such seals on every message they send (source:
ROUND-CHANGE) can carry a Falcon-512 seal of its author, and since 2 September 2026 all
validators of chain 2800 (nine then, ten since 2026-09-11) EMIT such seals on every message they send (source:
`PqAnchor.java`, the four `*_DOMAIN` constants and `*Message` builders; the four payload classes
`ProposalPayload.java`, `PreparePayload.java`, `CommitPayload.java`, `RoundChangePayload.java`;
fleet configuration measured 2026-09-02). This section specifies the wire format, the signed
@ -346,7 +346,7 @@ methods and their message strings):
Below the configured height nothing changes: the upstream ECDSA rules alone decide. There is no
consensus binding on these heights (the same caveat as section 3.2): two validators armed at
different heights disagree about which votes count, and the published activation procedure arms
all nine at the same four heights, one node at a time, with the chain measured to advance between
every validator at the same four heights, one node at a time, with the chain measured to advance between
restarts (source: `ARMAREA-IMPUNERII-MESAJELOR-2026-09-02.md`,
`armeaza-impunerea-pe-flota.sh`).
@ -385,12 +385,12 @@ required, the minimum applies to each scheme separately, and every SLH-DSA seal
that also carries a valid Falcon seal [MEASURED 2026-09-05, 400 consecutive anchors] (source:
`anchor/consensus/common/.../PqAnchorV2.java`, `PqSchemeSchedule.java`; the public verifier
`tools/verify-anchor.mjs`). The enforced minimum number of valid seals is a height
schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of nine; enforced on the fleet since
2026-08-14), and **6 of 9 from block 14,961,456** (a full 2f+1 quorum, the same count QBFT itself
schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of the nine validators of that time; enforced on the fleet since
2026-08-14), and **6 from block 14,961,456** (of nine then, a full 2f+1 quorum at that size and below the ten-validator quorum of seven since 2026-09-11, the same count QBFT itself
requires) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section).
The defensible sentence, and the only form this document endorses: *every 32nd block does not
finalize without a certificate of at least six of nine valid Falcon-512 validator seals under its
finalize without a certificate of at least six valid Falcon-512 validator seals (of ten validators since 2026-09-11) under its
hash (three, before block 14,961,456; see the schedule and the historical windows)*. Blocks between
anchors carry no Falcon seals and are finalized by ECDSA alone. Consensus (proposal, identity,
transport, per-block finality) is classical secp256k1 ECDSA; the anchor is a binding, not a
@ -691,7 +691,7 @@ to know they exist:
- `PqAnchorThresholdGuard`: refuses to arm a seal threshold at or above the QBFT quorum of the
CURRENT validator set (a proposer could never gather it), and refuses any threshold above
N - f = 7 at N=9 (source: `anchor/consensus/common/.../PqAnchorThresholdGuard.java`;
N - f (7 at N=9, 7 at N=10) (source: `anchor/consensus/common/.../PqAnchorThresholdGuard.java`;
`anchor/README.md`; `RUN-A-NODE.md`, "Why the seal-threshold ceiling"). The refusal code is
`AERE-PQC-THRESHOLD-01`, and it is the reason a from-genesis follower needs the ceiling
(section 6.4).
@ -957,7 +957,7 @@ material historically; the wrong lesson is to pick one and "fix" the other (sour
**D2. Genesis `qbft.startBlock` folklore.** Any Aere document giving 2,138,451 as "when the chain
accelerated" is quoting configuration, not measurement; the acceleration is at 2,137,652
[MEASURED, section 1.4]. The genesis file the fleet runs is identical on all nine validators
[MEASURED, section 1.4]. The genesis file the fleet runs is identical on all nine Besu validators (the tenth validator, Nethermind since 2026-09-11, runs the same chain from a chainspec derived from it)
(sha256 `e5038e6a14...` since 2026-09-10, when a third `config.pqRegistryHash` entry at 18,082,816 was added; `361709dcce...` before) and is not to be touched.
**D3. Base-fee floor lapse, blocks 12,978,617 to 13,087,959 inclusive.** On 2026-08-09 the
@ -1026,7 +1026,7 @@ first public build lacked this and rejected the first real anchor with "certific
**D9. K schedule steps and their real dates.** `13014000:0` (warm-up; the first anchor's
certificate is legitimately empty), `13034000:3` (f+1 of nine; effectively in force from
2026-08-14, see D5), `14961456:6` (2f+1, in force from 2026-08-21) (source: `RUN-A-NODE.md`,
2026-08-14, see D5), `14961456:6` (2f+1 of nine at the time; below the ten-validator quorum of seven since 2026-09-11; in force from 2026-08-21) (source: `RUN-A-NODE.md`,
`anchor/README.md`). "Certificate of f+1 validators" and "quorum certificate" are different
claims; before 14,961,456 only the former is true, and calling K=3 a quorum is a counting error
anyone will catch (source: `anchor/README.md`, "Terminology, used precisely").
@ -1047,7 +1047,7 @@ certificate under the block hash that is PROVEN AND INDEPENDENTLY VERIFIABLE, an
the "proven and verifiable" half of that sentence (source: `anchor/README.md`, "One claim we
retracted, on purpose").
**D12. Validator-set size statements are dated.** Seven validators until 2026-08-09, nine since
**D12. Validator-set size statements are dated.** Seven validators until 2026-08-09, nine from then, ten since 2026-09-11
(source: `RUN-A-NODE.md`). Registry rotation heights (13,014,000 seven keys; 13,600,000 nine keys)
are the authoritative in-protocol trace of the expansion (source: `registries/README.md`).

2
registries/README.md
View File

@ -29,7 +29,7 @@ are mode 600 and stay on the validators. The repository's secret gate passes on
| `manifest-13014000.json` | 13,014,000 | 7 | the registry in force from the first anchor; carried in `registry.history` |
| `registru-2800-v2-13600000.properties` | 13,600,000 | 9 | the nine-validator registry from the set expansion; carried in `registry.history` |
| `manifest-13600000.json` | 13,600,000 | 9 | the head registry until 2026-09-10; kept for provenance, not wired by `run-node.sh` (its nine keys are those of `registru-2800-v2-13600000.properties`) |
| `manifest-18082816.json` | 18,082,816 | 10 | the head registry since 2026-09-10, passed as `aere.falcon.manifest`: the nine validators and one further validator index bound at 18,082,816 |
| `manifest-18082816.json` | 18,082,816 | 10 | the head registry since 2026-09-10, passed as `aere.falcon.manifest`: the ten validators bound at 18,082,816 (the tenth, index 9, admitted to the set on 2026-09-11) |
| `hibrid-10.properties` | 18,082,816 | 10 | the SLH-DSA-SHA2-128s public keys for the same ten indices (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry` since 2026-09-10; `hibrid-1.properties` is the nine-key file it replaces |
| `hibrid-1.properties` | 17,047,568 | 9 | the SLH-DSA-SHA2-128s public keys of the same nine validators (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry` until 2026-09-10 (`hibrid-10.properties` since); needed from the first hybrid anchor, block 17,047,600; kept for provenance |