diff --git a/SPEC.md b/SPEC.md index 0ca3413..3677ac8 100644 --- a/SPEC.md +++ b/SPEC.md @@ -181,17 +181,17 @@ Aere adds, changes, or that a follower must check. in `genesis.json`). - Validator set changes are made by the standard QBFT voting mechanism (the vote element of extraData, section 2.3). The set had 3 validators at genesis (source: `genesis.json`), and the - live chain seals with nine validators, seven until 2026-08-09 (source: `RUN-A-NODE.md`, "What the + live chain seals with ten validators since 2026-09-11 (nine from 2026-08-09, seven until then) (source: `RUN-A-NODE.md`, "What the two bootnodes are"). The block-by-block vote history is on the chain itself and is not restated here. ### 2.2 Quorum -The QBFT commit quorum is `ceil(2N/3)`: 2 at N=3, 5 at N=7, 6 at N=9. This is the value the formal +The QBFT commit quorum is `ceil(2N/3)`: 2 at N=3, 5 at N=7, 6 at N=9, 7 at N=10. This is the value the formal models prove is the exact safety threshold (quorum intersection greater than f for all N, and the negative control shows a majority quorum forks) (source: `../aere-research/formal-consensus/qbft_safety_smt.py`, property L1, and -`../aere-research/formal-consensus/RULEAZA-TOT.md`). Fault tolerance at N=9 is f=2. +`../aere-research/formal-consensus/RULEAZA-TOT.md`). Fault tolerance at N=10 (since 2026-09-11) is f=3; it was f=2 at N=9. ### 2.3 The extraData structure, with the Aere sixth element @@ -267,8 +267,8 @@ validate base fees. ### 2.6 Consensus messages under post-quantum seal (emission live since 2026-09-02; enforcement armed by height on 2026-09-05) Since 28-31 August 2026 every one of the four QBFT message types (PROPOSAL, PREPARE, COMMIT, -ROUND-CHANGE) can carry a Falcon-512 seal of its author, and since 2 September 2026 all nine -validators of chain 2800 EMIT such seals on every message they send (source: +ROUND-CHANGE) can carry a Falcon-512 seal of its author, and since 2 September 2026 all +validators of chain 2800 (nine then, ten since 2026-09-11) EMIT such seals on every message they send (source: `PqAnchor.java`, the four `*_DOMAIN` constants and `*Message` builders; the four payload classes `ProposalPayload.java`, `PreparePayload.java`, `CommitPayload.java`, `RoundChangePayload.java`; fleet configuration measured 2026-09-02). This section specifies the wire format, the signed @@ -346,7 +346,7 @@ methods and their message strings): Below the configured height nothing changes: the upstream ECDSA rules alone decide. There is no consensus binding on these heights (the same caveat as section 3.2): two validators armed at different heights disagree about which votes count, and the published activation procedure arms -all nine at the same four heights, one node at a time, with the chain measured to advance between +every validator at the same four heights, one node at a time, with the chain measured to advance between restarts (source: `ARMAREA-IMPUNERII-MESAJELOR-2026-09-02.md`, `armeaza-impunerea-pe-flota.sh`). @@ -385,12 +385,12 @@ required, the minimum applies to each scheme separately, and every SLH-DSA seal that also carries a valid Falcon seal [MEASURED 2026-09-05, 400 consecutive anchors] (source: `anchor/consensus/common/.../PqAnchorV2.java`, `PqSchemeSchedule.java`; the public verifier `tools/verify-anchor.mjs`). The enforced minimum number of valid seals is a height -schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of nine; enforced on the fleet since -2026-08-14), and **6 of 9 from block 14,961,456** (a full 2f+1 quorum, the same count QBFT itself +schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of the nine validators of that time; enforced on the fleet since +2026-08-14), and **6 from block 14,961,456** (of nine then, a full 2f+1 quorum at that size and below the ten-validator quorum of seven since 2026-09-11, the same count QBFT itself requires) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section). The defensible sentence, and the only form this document endorses: *every 32nd block does not -finalize without a certificate of at least six of nine valid Falcon-512 validator seals under its +finalize without a certificate of at least six valid Falcon-512 validator seals (of ten validators since 2026-09-11) under its hash (three, before block 14,961,456; see the schedule and the historical windows)*. Blocks between anchors carry no Falcon seals and are finalized by ECDSA alone. Consensus (proposal, identity, transport, per-block finality) is classical secp256k1 ECDSA; the anchor is a binding, not a @@ -691,7 +691,7 @@ to know they exist: - `PqAnchorThresholdGuard`: refuses to arm a seal threshold at or above the QBFT quorum of the CURRENT validator set (a proposer could never gather it), and refuses any threshold above - N - f = 7 at N=9 (source: `anchor/consensus/common/.../PqAnchorThresholdGuard.java`; + N - f (7 at N=9, 7 at N=10) (source: `anchor/consensus/common/.../PqAnchorThresholdGuard.java`; `anchor/README.md`; `RUN-A-NODE.md`, "Why the seal-threshold ceiling"). The refusal code is `AERE-PQC-THRESHOLD-01`, and it is the reason a from-genesis follower needs the ceiling (section 6.4). @@ -957,7 +957,7 @@ material historically; the wrong lesson is to pick one and "fix" the other (sour **D2. Genesis `qbft.startBlock` folklore.** Any Aere document giving 2,138,451 as "when the chain accelerated" is quoting configuration, not measurement; the acceleration is at 2,137,652 -[MEASURED, section 1.4]. The genesis file the fleet runs is identical on all nine validators +[MEASURED, section 1.4]. The genesis file the fleet runs is identical on all nine Besu validators (the tenth validator, Nethermind since 2026-09-11, runs the same chain from a chainspec derived from it) (sha256 `e5038e6a14...` since 2026-09-10, when a third `config.pqRegistryHash` entry at 18,082,816 was added; `361709dcce...` before) and is not to be touched. **D3. Base-fee floor lapse, blocks 12,978,617 to 13,087,959 inclusive.** On 2026-08-09 the @@ -1026,7 +1026,7 @@ first public build lacked this and rejected the first real anchor with "certific **D9. K schedule steps and their real dates.** `13014000:0` (warm-up; the first anchor's certificate is legitimately empty), `13034000:3` (f+1 of nine; effectively in force from -2026-08-14, see D5), `14961456:6` (2f+1, in force from 2026-08-21) (source: `RUN-A-NODE.md`, +2026-08-14, see D5), `14961456:6` (2f+1 of nine at the time; below the ten-validator quorum of seven since 2026-09-11; in force from 2026-08-21) (source: `RUN-A-NODE.md`, `anchor/README.md`). "Certificate of f+1 validators" and "quorum certificate" are different claims; before 14,961,456 only the former is true, and calling K=3 a quorum is a counting error anyone will catch (source: `anchor/README.md`, "Terminology, used precisely"). @@ -1047,7 +1047,7 @@ certificate under the block hash that is PROVEN AND INDEPENDENTLY VERIFIABLE, an the "proven and verifiable" half of that sentence (source: `anchor/README.md`, "One claim we retracted, on purpose"). -**D12. Validator-set size statements are dated.** Seven validators until 2026-08-09, nine since +**D12. Validator-set size statements are dated.** Seven validators until 2026-08-09, nine from then, ten since 2026-09-11 (source: `RUN-A-NODE.md`). Registry rotation heights (13,014,000 seven keys; 13,600,000 nine keys) are the authoritative in-protocol trace of the expansion (source: `registries/README.md`). diff --git a/registries/README.md b/registries/README.md index 032f537..5339391 100644 --- a/registries/README.md +++ b/registries/README.md @@ -29,7 +29,7 @@ are mode 600 and stay on the validators. The repository's secret gate passes on | `manifest-13014000.json` | 13,014,000 | 7 | the registry in force from the first anchor; carried in `registry.history` | | `registru-2800-v2-13600000.properties` | 13,600,000 | 9 | the nine-validator registry from the set expansion; carried in `registry.history` | | `manifest-13600000.json` | 13,600,000 | 9 | the head registry until 2026-09-10; kept for provenance, not wired by `run-node.sh` (its nine keys are those of `registru-2800-v2-13600000.properties`) | -| `manifest-18082816.json` | 18,082,816 | 10 | the head registry since 2026-09-10, passed as `aere.falcon.manifest`: the nine validators and one further validator index bound at 18,082,816 | +| `manifest-18082816.json` | 18,082,816 | 10 | the head registry since 2026-09-10, passed as `aere.falcon.manifest`: the ten validators bound at 18,082,816 (the tenth, index 9, admitted to the set on 2026-09-11) | | `hibrid-10.properties` | 18,082,816 | 10 | the SLH-DSA-SHA2-128s public keys for the same ten indices (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry` since 2026-09-10; `hibrid-1.properties` is the nine-key file it replaces | | `hibrid-1.properties` | 17,047,568 | 9 | the SLH-DSA-SHA2-128s public keys of the same nine validators (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry` until 2026-09-10 (`hibrid-10.properties` since); needed from the first hybrid anchor, block 17,047,600; kept for provenance |