BlockTimer.java carried a Romanian one-liner explaining why the anchor
proposal-delay configuration is loaded at construction rather than lazily. The
explanation matters and is kept in full, in English: a lazily-loaded consensus
setting turned an unreadable file into 125 seconds of halted chain on 2026-09-03,
while every configuration gate stayed green because the files existed.
Production strings and comments are read by people who do not speak Romanian.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
On 2026-09-05 the five properties a follower needs past blocks 17,047,600 and 17,225,968 were added to
RUN-A-NODE.md but not to run-node.sh, while the document already claimed the script set them. Our own
from-genesis import proof, built from the published revision, synced to block 17,047,400 and then
rejected every hybrid anchor 12,352 times: the v2 activation height stayed at Long.MAX_VALUE. Anyone
following this package could not pass 17,047,600.
Both blocks are now derived from the BESU_OPTS of the network's archive node, whose role is exactly a
follower's, with the two public reading nodes as witnesses that must agree on the anchor set; only the
signing keys are removed and the registry paths rewritten. Re-measured on the same node and database
after the fix: past 17,047,600 with zero rejections.
Both are prerequisites for any external review programme, and one of them was already
promised by our live security.txt to a file that did not exist.
SECURITY.md states the scope, the response times we hold ourselves to, and three things
we would rather a reviewer heard from us than discovered: there has been no third-party
audit, every validator is operated by the Foundation, and the post-quantum guarantee is
at anchor heights rather than on every block.
AUDITS.md opens by saying we have had no third-party audit, and keeps that first line
until it stops being true.
The network layer authenticates peers by their secp256k1 node key, and consensus
messages are routed by the address derived from it. An adversary who recovers a
validator's ECDSA key therefore gets everything the transport can give: it completes
the handshake as that validator and signs syntactically perfect messages that recover
to its address. This test models exactly that adversary - full ECDSA compromise, no
Falcon key - and requires all four hot-path messages to be refused while the
post-quantum enforcement is armed, with a harvested seal replayed across message
kinds, blocks, heights, rounds, chains, and from another validator entirely.
The honest form of the claim: the transport is not post-quantum, and breaking it
does not buy a break of safety. It says nothing about liveness.
One shared harness for both surfaces (the twin-class lesson applied in advance):
a seal made with SLH-DSA passes through the same untouched consensus code, and a
Falcon seal against an SLH-DSA registry is refused on both surfaces. The Falcon
nail sits only in the production wiring, for all three message enforcements.
Twelve test classes existed twice, under a neutral name and under an internal
inventory name, ~4,600 duplicated lines. Two copies of the same proof diverge
silently: one receives a repair and the other does not - which is exactly what
happened once, and what the cache-hygiene test below documents. The neutral
names survive; per pair the test counts are identical, and the only code
difference (a warm-up window constant) exercises the same path and the same
assertion. The cache-hygiene reproduction now runs the surviving class's
lifecycle, unchanged in what it asserts.
The last hot-path QBFT message under the same pattern as prepare and proposal:
its own domain AERE-PQ-ROUNDCHANGE-1 over (chainId, height, targetRound, prepared
metadata - so a bare 'move on' seal cannot be replayed as 'move on and re-propose
THIS block'), a separate emission gate (aere.pq.roundChangePq.attachBlock), a
separate enforcement height (aere.pq.roundChangePq.forkBlock) self-wired into the
payload validator so it also judges round-changes inside proposal justifications,
and byte-for-byte upstream encoding when no seal is present. The seal is signed
once and the same object goes on the wire; Falcon signatures are randomised, so
a re-signing would put a different message on the wire than the one handled
locally.
The first witness run caught a real gap: the proposal was signed twice - once for the
local copy, once for the wire - and only the local copy carried the proposer's Falcon
seal. Locally sealed, unsealed on the wire: with enforcement armed, the fleet stopped at
the enforcement height even though every node was emitting. Falcon signatures are
randomised, so the fix is structural rather than cosmetic: the proposal is built once,
seal included, and the transmitter sends that same object - two signings would produce
two valid and different proposals from the same proposer.
A new plumbing test refuses the defect's return: it fails if the transmitter's wire path
ever builds its own payload again. On the test network after the fix: emission covered
seven of seven proposers, each sealing exactly its first proposal past the gate; with
enforcement armed and emission on, the chain crossed the enforcement height with zero
refusals; with emission off it stopped exactly one block short of the height, every
refusal logged; and one unarmed node could not keep the chain alive.
Still armed nowhere: the properties are unset, and unset means never.
The remaining hot-path gap, stated precisely because the imprecise version oversells: with
PREPARE enforcement armed, an ECDSA-breaking adversary cannot finalize anything, since
"prepared" needs a full quorum of PREPAREs. What forged proposals could still do is OPEN
rounds and waste them. With proposal enforcement armed, a proposal without a valid Falcon
seal from its own proposer does not open a round.
Same pattern as the PREPARE layer, deliberately: an optional fifth payload element that
leaves the unsealed encoding byte-identical to upstream; a third, separate emission gate;
enforcement self-wired in the payload validator so no refactor can drop it silently; its
own domain over (chainId, height, round, digest), tested in both directions so an honest
offer seal cannot be replayed as a vote nor a vote seal as an offer.
Nothing is armed anywhere: the properties are unset, and unset means never. The armed-
layers table in the README says so, and says what stays classical: the ROUND-CHANGE
message itself and node-level devp2p authentication.
1,042 tests, 0 failures, counted from the XML. The enforcement's negative control ran at
5 of 5: four planted defects each turned the suite red, the untouched source stayed green.
