aere-network/aere-node
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SPEC.md, registries/README.md: ten validators since 2026-09-11 (the tenth is the Nethermind client): f=3, QBFT quorum 7 of 10; the anchor certificate minimum stays 6 seals, now below the quorum; dated history kept

Browse Source
This commit is contained in:
Aere Network 2026-09-11 14:18:32 +03:00
parent 3b085911fa
commit a2d2db9693
2 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
SPEC.md
View File

@ -181,17 +181,17 @@ Aere adds, changes, or that a follower must check.
in `genesis.json`). in `genesis.json`).
- Validator set changes are made by the standard QBFT voting mechanism (the vote element of - Validator set changes are made by the standard QBFT voting mechanism (the vote element of
extraData, section 2.3). The set had 3 validators at genesis (source: `genesis.json`), and the extraData, section 2.3). The set had 3 validators at genesis (source: `genesis.json`), and the
live chain seals with nine validators, seven until 2026-08-09 (source: `RUN-A-NODE.md`, "What the live chain seals with ten validators since 2026-09-11 (nine from 2026-08-09, seven until then) (source: `RUN-A-NODE.md`, "What the
two bootnodes are"). The block-by-block vote history is on the chain itself and is not restated two bootnodes are"). The block-by-block vote history is on the chain itself and is not restated
here. here.
### 2.2 Quorum ### 2.2 Quorum
The QBFT commit quorum is `ceil(2N/3)`: 2 at N=3, 5 at N=7, 6 at N=9. This is the value the formal The QBFT commit quorum is `ceil(2N/3)`: 2 at N=3, 5 at N=7, 6 at N=9, 7 at N=10. This is the value the formal
models prove is the exact safety threshold (quorum intersection greater than f for all N, and the models prove is the exact safety threshold (quorum intersection greater than f for all N, and the
negative control shows a majority quorum forks) (source: negative control shows a majority quorum forks) (source:
`../aere-research/formal-consensus/qbft_safety_smt.py`, property L1, and `../aere-research/formal-consensus/qbft_safety_smt.py`, property L1, and
`../aere-research/formal-consensus/RULEAZA-TOT.md`). Fault tolerance at N=9 is f=2. `../aere-research/formal-consensus/RULEAZA-TOT.md`). Fault tolerance at N=10 (since 2026-09-11) is f=3; it was f=2 at N=9.
### 2.3 The extraData structure, with the Aere sixth element ### 2.3 The extraData structure, with the Aere sixth element
@ -267,8 +267,8 @@ validate base fees.
### 2.6 Consensus messages under post-quantum seal (emission live since 2026-09-02; enforcement armed by height on 2026-09-05) ### 2.6 Consensus messages under post-quantum seal (emission live since 2026-09-02; enforcement armed by height on 2026-09-05)
Since 28-31 August 2026 every one of the four QBFT message types (PROPOSAL, PREPARE, COMMIT, Since 28-31 August 2026 every one of the four QBFT message types (PROPOSAL, PREPARE, COMMIT,
ROUND-CHANGE) can carry a Falcon-512 seal of its author, and since 2 September 2026 all nine ROUND-CHANGE) can carry a Falcon-512 seal of its author, and since 2 September 2026 all
validators of chain 2800 EMIT such seals on every message they send (source: validators of chain 2800 (nine then, ten since 2026-09-11) EMIT such seals on every message they send (source:
`PqAnchor.java`, the four `*_DOMAIN` constants and `*Message` builders; the four payload classes `PqAnchor.java`, the four `*_DOMAIN` constants and `*Message` builders; the four payload classes
`ProposalPayload.java`, `PreparePayload.java`, `CommitPayload.java`, `RoundChangePayload.java`; `ProposalPayload.java`, `PreparePayload.java`, `CommitPayload.java`, `RoundChangePayload.java`;
fleet configuration measured 2026-09-02). This section specifies the wire format, the signed fleet configuration measured 2026-09-02). This section specifies the wire format, the signed
@ -346,7 +346,7 @@ methods and their message strings):
Below the configured height nothing changes: the upstream ECDSA rules alone decide. There is no Below the configured height nothing changes: the upstream ECDSA rules alone decide. There is no
consensus binding on these heights (the same caveat as section 3.2): two validators armed at consensus binding on these heights (the same caveat as section 3.2): two validators armed at
different heights disagree about which votes count, and the published activation procedure arms different heights disagree about which votes count, and the published activation procedure arms
all nine at the same four heights, one node at a time, with the chain measured to advance between every validator at the same four heights, one node at a time, with the chain measured to advance between
restarts (source: `ARMAREA-IMPUNERII-MESAJELOR-2026-09-02.md`, restarts (source: `ARMAREA-IMPUNERII-MESAJELOR-2026-09-02.md`,
`armeaza-impunerea-pe-flota.sh`). `armeaza-impunerea-pe-flota.sh`).
@ -385,12 +385,12 @@ required, the minimum applies to each scheme separately, and every SLH-DSA seal
that also carries a valid Falcon seal [MEASURED 2026-09-05, 400 consecutive anchors] (source: that also carries a valid Falcon seal [MEASURED 2026-09-05, 400 consecutive anchors] (source:
`anchor/consensus/common/.../PqAnchorV2.java`, `PqSchemeSchedule.java`; the public verifier `anchor/consensus/common/.../PqAnchorV2.java`, `PqSchemeSchedule.java`; the public verifier
`tools/verify-anchor.mjs`). The enforced minimum number of valid seals is a height `tools/verify-anchor.mjs`). The enforced minimum number of valid seals is a height
schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of nine; enforced on the fleet since schedule: 0 from 13,014,000 (warm-up), 3 from 13,034,000 (f+1 of the nine validators of that time; enforced on the fleet since
2026-08-14), and **6 of 9 from block 14,961,456** (a full 2f+1 quorum, the same count QBFT itself 2026-08-14), and **6 from block 14,961,456** (of nine then, a full 2f+1 quorum at that size and below the ten-validator quorum of seven since 2026-09-11, the same count QBFT itself
requires) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section). requires) (source: `anchor/README.md`, "Scope boundary"; `RUN-A-NODE.md`, the anchor section).
The defensible sentence, and the only form this document endorses: *every 32nd block does not The defensible sentence, and the only form this document endorses: *every 32nd block does not
finalize without a certificate of at least six of nine valid Falcon-512 validator seals under its finalize without a certificate of at least six valid Falcon-512 validator seals (of ten validators since 2026-09-11) under its
hash (three, before block 14,961,456; see the schedule and the historical windows)*. Blocks between hash (three, before block 14,961,456; see the schedule and the historical windows)*. Blocks between
anchors carry no Falcon seals and are finalized by ECDSA alone. Consensus (proposal, identity, anchors carry no Falcon seals and are finalized by ECDSA alone. Consensus (proposal, identity,
transport, per-block finality) is classical secp256k1 ECDSA; the anchor is a binding, not a transport, per-block finality) is classical secp256k1 ECDSA; the anchor is a binding, not a
@ -691,7 +691,7 @@ to know they exist:
- `PqAnchorThresholdGuard`: refuses to arm a seal threshold at or above the QBFT quorum of the - `PqAnchorThresholdGuard`: refuses to arm a seal threshold at or above the QBFT quorum of the
CURRENT validator set (a proposer could never gather it), and refuses any threshold above CURRENT validator set (a proposer could never gather it), and refuses any threshold above
N - f = 7 at N=9 (source: `anchor/consensus/common/.../PqAnchorThresholdGuard.java`; N - f (7 at N=9, 7 at N=10) (source: `anchor/consensus/common/.../PqAnchorThresholdGuard.java`;
`anchor/README.md`; `RUN-A-NODE.md`, "Why the seal-threshold ceiling"). The refusal code is `anchor/README.md`; `RUN-A-NODE.md`, "Why the seal-threshold ceiling"). The refusal code is
`AERE-PQC-THRESHOLD-01`, and it is the reason a from-genesis follower needs the ceiling `AERE-PQC-THRESHOLD-01`, and it is the reason a from-genesis follower needs the ceiling
(section 6.4). (section 6.4).
@ -957,7 +957,7 @@ material historically; the wrong lesson is to pick one and "fix" the other (sour
**D2. Genesis `qbft.startBlock` folklore.** Any Aere document giving 2,138,451 as "when the chain **D2. Genesis `qbft.startBlock` folklore.** Any Aere document giving 2,138,451 as "when the chain
accelerated" is quoting configuration, not measurement; the acceleration is at 2,137,652 accelerated" is quoting configuration, not measurement; the acceleration is at 2,137,652
[MEASURED, section 1.4]. The genesis file the fleet runs is identical on all nine validators [MEASURED, section 1.4]. The genesis file the fleet runs is identical on all nine Besu validators (the tenth validator, Nethermind since 2026-09-11, runs the same chain from a chainspec derived from it)
(sha256 `e5038e6a14...` since 2026-09-10, when a third `config.pqRegistryHash` entry at 18,082,816 was added; `361709dcce...` before) and is not to be touched. (sha256 `e5038e6a14...` since 2026-09-10, when a third `config.pqRegistryHash` entry at 18,082,816 was added; `361709dcce...` before) and is not to be touched.
**D3. Base-fee floor lapse, blocks 12,978,617 to 13,087,959 inclusive.** On 2026-08-09 the **D3. Base-fee floor lapse, blocks 12,978,617 to 13,087,959 inclusive.** On 2026-08-09 the
@ -1026,7 +1026,7 @@ first public build lacked this and rejected the first real anchor with "certific
**D9. K schedule steps and their real dates.** `13014000:0` (warm-up; the first anchor's **D9. K schedule steps and their real dates.** `13014000:0` (warm-up; the first anchor's
certificate is legitimately empty), `13034000:3` (f+1 of nine; effectively in force from certificate is legitimately empty), `13034000:3` (f+1 of nine; effectively in force from
2026-08-14, see D5), `14961456:6` (2f+1, in force from 2026-08-21) (source: `RUN-A-NODE.md`, 2026-08-14, see D5), `14961456:6` (2f+1 of nine at the time; below the ten-validator quorum of seven since 2026-09-11; in force from 2026-08-21) (source: `RUN-A-NODE.md`,
`anchor/README.md`). "Certificate of f+1 validators" and "quorum certificate" are different `anchor/README.md`). "Certificate of f+1 validators" and "quorum certificate" are different
claims; before 14,961,456 only the former is true, and calling K=3 a quorum is a counting error claims; before 14,961,456 only the former is true, and calling K=3 a quorum is a counting error
anyone will catch (source: `anchor/README.md`, "Terminology, used precisely"). anyone will catch (source: `anchor/README.md`, "Terminology, used precisely").
@ -1047,7 +1047,7 @@ certificate under the block hash that is PROVEN AND INDEPENDENTLY VERIFIABLE, an
the "proven and verifiable" half of that sentence (source: `anchor/README.md`, "One claim we the "proven and verifiable" half of that sentence (source: `anchor/README.md`, "One claim we
retracted, on purpose"). retracted, on purpose").
**D12. Validator-set size statements are dated.** Seven validators until 2026-08-09, nine since **D12. Validator-set size statements are dated.** Seven validators until 2026-08-09, nine from then, ten since 2026-09-11
(source: `RUN-A-NODE.md`). Registry rotation heights (13,014,000 seven keys; 13,600,000 nine keys) (source: `RUN-A-NODE.md`). Registry rotation heights (13,014,000 seven keys; 13,600,000 nine keys)
are the authoritative in-protocol trace of the expansion (source: `registries/README.md`). are the authoritative in-protocol trace of the expansion (source: `registries/README.md`).

2
registries/README.md
View File

@ -29,7 +29,7 @@ are mode 600 and stay on the validators. The repository's secret gate passes on
| `manifest-13014000.json` | 13,014,000 | 7 | the registry in force from the first anchor; carried in `registry.history` | | `manifest-13014000.json` | 13,014,000 | 7 | the registry in force from the first anchor; carried in `registry.history` |
| `registru-2800-v2-13600000.properties` | 13,600,000 | 9 | the nine-validator registry from the set expansion; carried in `registry.history` | | `registru-2800-v2-13600000.properties` | 13,600,000 | 9 | the nine-validator registry from the set expansion; carried in `registry.history` |
| `manifest-13600000.json` | 13,600,000 | 9 | the head registry until 2026-09-10; kept for provenance, not wired by `run-node.sh` (its nine keys are those of `registru-2800-v2-13600000.properties`) | | `manifest-13600000.json` | 13,600,000 | 9 | the head registry until 2026-09-10; kept for provenance, not wired by `run-node.sh` (its nine keys are those of `registru-2800-v2-13600000.properties`) |
| `manifest-18082816.json` | 18,082,816 | 10 | the head registry since 2026-09-10, passed as `aere.falcon.manifest`: the nine validators and one further validator index bound at 18,082,816 | | `manifest-18082816.json` | 18,082,816 | 10 | the head registry since 2026-09-10, passed as `aere.falcon.manifest`: the ten validators bound at 18,082,816 (the tenth, index 9, admitted to the set on 2026-09-11) |
| `hibrid-10.properties` | 18,082,816 | 10 | the SLH-DSA-SHA2-128s public keys for the same ten indices (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry` since 2026-09-10; `hibrid-1.properties` is the nine-key file it replaces | | `hibrid-10.properties` | 18,082,816 | 10 | the SLH-DSA-SHA2-128s public keys for the same ten indices (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry` since 2026-09-10; `hibrid-1.properties` is the nine-key file it replaces |
| `hibrid-1.properties` | 17,047,568 | 9 | the SLH-DSA-SHA2-128s public keys of the same nine validators (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry` until 2026-09-10 (`hibrid-10.properties` since); needed from the first hybrid anchor, block 17,047,600; kept for provenance | | `hibrid-1.properties` | 17,047,568 | 9 | the SLH-DSA-SHA2-128s public keys of the same nine validators (`formatVersion=hybrid-1`), passed as `aere.pq.hybridRegistry` until 2026-09-10 (`hibrid-10.properties` since); needed from the first hybrid anchor, block 17,047,600; kept for provenance |