aere-network/aere-node
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
87 Commits 1 Branch 0 Tags 15 MiB
a94c0f2686
Commit Graph

87 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Aere Network
a94c0f2686 verify-anchor: from KEYS_FROM the OK line names the registry v3 epoch whose keys verified the seals, not the key manifest 2026-09-23 18:35:06 +03:00
Aere Network
089dc9803c verify-anchor.mjs: AIP-22 stage 3b read path, inert until an index marks it - from KEYS_FROM (or the v3 epoch whose index entry carries keysFrom) the key and the id of a seal's index come from the v3 epoch in force at the parent, as both clients read them; the ECDSA link of an id is inherited across epochs that omit it, and an id linked again drops its older address. Without keysFrom anywhere nothing changes: chain 2800 5/5, testnet 28001 5/5 re-run on 2026-09-23. 2026-09-23 16:05:24 +03:00
Aere Network
944dc0bba6 tools: verify-anchor.mjs discovers registry v3 epochs (AIP-22 stage 3, formatVersion 3 entries of the same manifest index) and verifies each in full with registry-v3.mjs (every proof of possession, every ECDSA link, the rotation chain, the Merkle registry hash), then requires every v3 row to carry exactly the Falcon-512 key, SLH-DSA key and address of the key manifest that signs at its height; the identity height is the first epoch's bindHeight, IDENTITY_BLOCK=none disables it as a negative control. Adds tools/registry-v3.mjs and tools/falcon512.mjs, which verify-anchor.mjs imports and the package did not carry. Checked 2026-09-23: testnet 28001 20/20 with its published v3 epoch (registry hash 0xd19eef4a..., identity from 3,080,010); chain 2800 20/20 unchanged; a byte-altered epoch and an epoch whose SLH-DSA key differs from the signing manifest both refused with the reason. 2026-09-23 15:33:49 +03:00
Aere Network
79e5dafd53 verify-anchor.mjs: per-scheme anchor intervals (AIP-22 stage 2: SCHEME_SCHEDULE entries like falcon-512/32+slh-dsa-sha2-128s/128; a scheme off its own grid at an anchor is surplus, verified but not required) and post-quantum validator identity (AIP-22 stage 3: IDENTITY_BLOCK + REGISTRY_V3 translate the validator set to ids from H_id); testnet 28001 default gains the stage-2 step 3070656. Proven 2026-09-23 12:07Z on 28001: 11 of 11 anchors after 3,070,656 accepted (3 hybrid on the 128 grid, 8 Falcon-only at 32), and the pre-stage-2 schedule refuses exactly the 8 Falcon-only; 20 of 20 on chain 2800 unchanged. 2026-09-23 15:08:45 +03:00
Aere Network
5c99d51a3c RUN-A-NODE: the follower BESU_OPTS block carries -Daere.pqtx.forkBlock=19900000 like run-node.sh (the script already set it; the documented block lagged); SPEC 2.7: the seal-window journal opt-out is described as a property value, with its default read from PqSealWindowStore 2026-09-23 12:24:50 +03:00
Aere Network
b8e9bdf971 verify-anchor.mjs: the testnet 28001 default seal-threshold schedule gains the AIP-22 stage-1 rehearsal step 2988864:4 (the per-scheme minimum becomes the QBFT quorum, 4 of 5); chain 2800 unchanged, and any value is still overridable via MIN_SEALS_SCHEDULE 2026-09-23 02:51:21 +03:00
Aere Network
0d22adbd62 Patches 0006 (AIP-20, native post-quantum transactions, type 0x50) and 0007 (AIP-21, per-block post-quantum finality record): the recipe now reproduces the chain-2800 fleet distribution of 2026-09-22 (wt3f12ef0d) class for class on consensus and on both AIPs, with the Apache 4(b) notice inside every modified upstream file and 20 lines of context; run-node.sh arms aere.pqtx.forkBlock=19900000 for followers of chain 2800; SPEC 2.7 and 5.3; RUN-A-NODE carries the measured record; LICENSING regenerated 2026-09-23 01:28:43 +03:00
Aere Network
54774eb719 SPEC 1.2.0 amended 2026-09-17: the four enforcement heights have passed (17,250,000 / 17,400,000 / 17,550,000 / 17,700,000, 5-8 September), hybrid keys live since 17,047,600; 'emission only' is dated history; LICENSING regenerated 2026-09-17 21:25:42 +03:00
Aere Network
690340357d LICENSING.md: the regenerator is cited by a path this package does not ship; the citation now names the file a reader can open. Unresolved-citation disclosure regenerated against the full published family 2026-09-12 09:50:41 +03:00
Aere Network
17eee07493 RUN-A-NODE: your clock is the fifth requirement, with the BREACH_OF_PROTOCOL line it produces when it is a second behind 2026-09-12 08:10:31 +03:00
Aere Network
aeee182204 LICENSING: lista fisierelor cu copyright strain e generata din fisierele pachetului, nu scrisa de mana; peticul 0003 arata antetul amontelui pentru build.gradle 2026-09-12 02:22:24 +03:00
Aere Network
1fba9df623 anchor/README: the six-of-nine quorum sentence is dated now that the set is ten; RUN-A-NODE: what the emergency-ceiling ERROR stream is and what a real refusal looks like 2026-09-12 01:51:12 +03:00
Aere Network
50bf1a07ca precompiles: withdraw the uncitable 'audited' adjective from the patch and the published sources (O-006, D-376) 2026-09-11 21:33:52 +03:00
Aere Network
ba7f09d46d RUN-A-NODE: banda de heap masurata iar la 8,4 milioane (2400m intra in colaps de colectare, 3400m zero colectari complete) 2026-09-11 19:02:55 +03:00
Aere Network
7d40356aeb bootnodes: the second published address is withdrawn since 2026-09-11 (its host no longer fits the rule that a bootnode is not a validator; a replacement public read host follows); anchor corpus re-staged from the overlay (read-path classes and their tests, controller import-time retry) 2026-09-11 15:00:59 +03:00
Aere Network
a2d2db9693 SPEC.md, registries/README.md: ten validators since 2026-09-11 (the tenth is the Nethermind client): f=3, QBFT quorum 7 of 10; the anchor certificate minimum stays 6 seals, now below the quorum; dated history kept 2026-09-11 14:18:32 +03:00
Aere Network
3b085911fa RUN-A-NODE.md: dated note (2026-09-11) on the bootnodes: the second accepts only its configured peers; a node behind NAT keeps one peer and Besu does not fetch transaction-bearing bodies from a single busy peer; forward the P2P port and set --p2p-host 2026-09-11 12:39:33 +03:00
Aere Network
cbaf4e15b9 run-node.sh: GENESIS_SHA256 pinned to the v10 fleet genesis (e5038e6a...) that this package ships since 2026-09-10; the old pin (361709dc...) made run-node.sh refuse its own genesis.json at step 2/6 for ~13 hours (found 2026-09-11 by the from-genesis import proof) 2026-09-11 09:34:49 +03:00
Aere Network
5839eb0468 patches 0001/0003/0004: original messages with the Apache-2.0 section 4(b) notice restored, regenerated from the production tree whose modified upstream files now carry the in-file section 4(b) notice; 20 lines of context so the upstream headers are visible 2026-09-10 22:40:48 +03:00
Aere Network
bc8dc80946 patches 0001/0003/0004 regenerated from the production tree over the same file sets (section 4(b) notices); measured: a build from this recipe reproduces the fleet's consensus jars class by class 2026-09-10 22:08:27 +03:00
Aere Network
5aac751be5 registries/README: the nine-key hybrid registry is dated (superseded by hibrid-10.properties on 2026-09-10) 2026-09-10 21:06:47 +03:00
Aere Network
b54aba6381 follower options re-derived after the fleet dropped attachBlockAcknowledgePast (21 properties) 2026-09-10 20:28:30 +03:00
Aere Network
72468c4c47 registries: manifest-18082816.json and hibrid-10.properties (ten indices, bound at 18,082,816); genesis.json with the third pqRegistryHash entry; follower options re-derived from the live archive node (22 properties) 2026-09-10 20:20:23 +03:00
Aere Network
665b86365e O-017: the anchor verifier ships in tools/, the Bouncy Castle licence is cited at its real path, two operator-repository scripts are declared as unpublished 2026-09-10 15:38:34 +03:00
Aere Network
e604ca0387 anchor: translate the last Romanian comment on a production path 
BlockTimer.java carried a Romanian one-liner explaining why the anchor
proposal-delay configuration is loaded at construction rather than lazily. The
explanation matters and is kept in full, in English: a lazily-loaded consensus
setting turned an unreadable file into 125 seconds of halted chain on 2026-09-03,
while every configuration gate stayed green because the files existed.

Production strings and comments are read by people who do not speak Romanian.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-08 17:01:32 +03:00
Aere Network
367d44d21b SPEC.md was a THIRD copy of the follower configuration, and it had drifted: it was missing aere.pq.hybridRegistry entirely, without which no SLH-DSA seal in a v2 certificate can be verified, and its anchorMinSeals still lacked the two dated steps from 4 September. It is now generated from the same live source as run-node.sh and RUN-A-NODE.md, and the gate compares all three: a value that lives in three places drifts in at least one 2026-09-06 21:24:13 +03:00
Aere Network
b46c815398 RUN-A-NODE: the measured RAM figure for a from-genesis import. The requirement grows with the height: the same import that ran comfortably at 3 M blocks was, at 12.2 M, using 5.96 GB resident with a 3.4 GB heap, old generation 99.8 percent full, four full GCs every five seconds, and no room left to raise the heap. 8 GB is the floor at which a full import stops being practical, not a comfortable size 2026-09-06 20:14:52 +03:00
Aere Network
84a6093517 The heap note, corrected: the first version gave a fraction-of-RAM rule, and the measurement does not support it. Same machine, same database, four values at two heights: 2400m ran at ~82,000 blocks/min up to 8 M and then collapsed to ~640 with the old generation 99.88 percent full and 1,409 full GCs, while 3400m past 9.7 M did zero full GCs at ~28,800. Too large dies of OutOfMemoryError because the storage engine lives off-heap; too small dies of full GC once the post-quantum precompiles make blocks heavier. The advice is now to read jstat, not to pick a fraction 2026-09-06 18:31:54 +03:00
Aere Network
76095a942e RUN-A-NODE: a measured note on JVM heap sizing. On one machine, one database and one chain within a single hour: -Xmx4500m gave 89 OutOfMemoryError and a dead import, 3200m gave ~1,500 blocks/min with repeated download failures, 2400m gave ~82,000 blocks/min with no OOM at all. Heap is not memory: the storage engine keeps its cache off-heap, and at six million blocks that part is larger than the heap. If you see OutOfMemoryError, try a SMALLER -Xmx 2026-09-06 16:23:04 +03:00
Aere Network
46d2a1cfa5 LICENSING.md now records every file that carries a third-party copyright header: 49 rows added, derived by scanning the shipped tree for the same criterion the licence gate applies (its own message truncates the list at five names, so reading the message was not enough) 2026-09-06 14:23:11 +03:00
Aere Network
65611c15a5 Patch 0004 regenerated so the patch ITSELF carries the Apache-2.0 4(b) change notice in the file header, with enough context that the upstream copyright line is visible in the diff: sections 4(c) and 4(d) were previously NOT MEASURABLE from the patch, because the repository does not ship LondonFeeMarket.java and the diff never showed its header. Self-checked: applied to the clean upstream file it reproduces the production file exactly 2026-09-06 14:20:12 +03:00
Aere Network
1df188ab98 Apache-2.0 section 4(b): the nine upstream files this package ships as modified copies now carry the change notice, next to the upstream copyright header, which is left exactly as found (4(c)). The list was derived from the licence gate's own output, not written by hand 2026-09-06 14:13:51 +03:00
Aere Network
54e256786e run-node.sh now actually sets the five post-4-September properties, and both it and RUN-A-NODE.md are generated from the live archive node 
On 2026-09-05 the five properties a follower needs past blocks 17,047,600 and 17,225,968 were added to
RUN-A-NODE.md but not to run-node.sh, while the document already claimed the script set them. Our own
from-genesis import proof, built from the published revision, synced to block 17,047,400 and then
rejected every hybrid anchor 12,352 times: the v2 activation height stayed at Long.MAX_VALUE. Anyone
following this package could not pass 17,047,600.

Both blocks are now derived from the BESU_OPTS of the network's archive node, whose role is exactly a
follower's, with the two public reading nodes as witnesses that must agree on the anchor set; only the
signing keys are removed and the registry paths rewritten. Re-measured on the same node and database
after the fix: past 17,047,600 with zero rejections.
 2026-09-06 13:00:23 +03:00
Aere Network
75be84f043 0004 regenerated from the production tree: the base-fee floor reads its fork height and value from the documented properties instead of hard-coded constants; with it the public recipe reproduces LondonFeeMarket and all three consensus jars class for class (measured 2026-09-05) 2026-09-05 13:06:49 +03:00
Aere Network
3d51da9747 Follower configuration and anchor patch at the live revision: registries/hibrid-1.properties (SLH-DSA public keys), the five properties a follower needs past blocks 17,047,600 and 17,225,968, 0003 regenerated from the staged overlay on d2032017 (169 files; applies with 0001/0004/0005 in run-node order, tree equals anchor/); the from-genesis import proof is stated as not yet repeated 2026-09-05 08:07:54 +03:00
Aere Network
32ca7453e0 Anchor corpus at the live overlay: hybrid v2 certificate (Falcon-512 + SLH-DSA-SHA2-128s), in-tree SLH-DSA engine on the JDK digest (Bouncy Castle licence alongside), seal-store fix (D-339), anchor interval schedule; docs and SPEC 1.2.0 state the arming heights measured on the fleet on 2026-09-05 2026-09-05 07:48:07 +03:00
Aere Network
971754aad9 SPEC 8: D9, Osaka header fields under QBFT (block 0 only), found 2026-09-02 2026-09-02 22:54:57 +03:00
Aere Network
edd046d504 Citations: family-wide resolution (published repositories on the forge) and the disclosure regenerated 2026-09-02 21:51:52 +03:00
Aere Network
985bc961f4 anchor/README: the staging script is cited as an operator-repository path and declared 2026-09-02 21:46:50 +03:00
Aere Network
1d3fc3e54e Citations: the unresolved-citation disclosure regenerated (2026-09-02) 2026-09-02 21:39:30 +03:00
Aere Network
2bb2c134f0 LICENSING: every Besu-derived file under anchor/ listed with its copyright line and provenance (Apache-2.0 section 4(b)) 2026-09-02 20:50:16 +03:00
Aere Network
77d5bbb846 README: see also DEVNET.md, the public testnet and its x402 facilitator, SPEC 2.6 2026-09-02 20:08:07 +03:00
Aere Network
83a453a075 DEVNET.md: aere-devnet in one command (public image), read-only trace on the public read node 2026-09-02 17:07:13 +03:00
Aere Network
4043e5114f vectors: act de provenienta SURSE.md (vectorii NIST numiti, poarta de secrete TRECE) 2026-09-02 16:17:06 +03:00
Aere Network
8d3ae8a83d SPEC 1.1.0: section 2.6 consensus messages under post-quantum seal (wire format, domains, commit form under armed anchor = D8, emission gates, enforcement rules, activation order), G11, registry-binding domains; amended 2026-09-02 2026-09-02 16:08:24 +03:00
Aere Network
2f6950e44e Add SECURITY.md and AUDITS.md 
Both are prerequisites for any external review programme, and one of them was already
promised by our live security.txt to a file that did not exist.

SECURITY.md states the scope, the response times we hold ourselves to, and three things
we would rather a reviewer heard from us than discovered: there has been no third-party
audit, every validator is operated by the Foundation, and the post-quantum guarantee is
at anchor heights rather than on every block.

AUDITS.md opens by saying we have had no third-party audit, and keeps that first line
until it stops being true.
 2026-09-01 11:58:34 +03:00
Aere Network
2b73bcb961 Prove that consensus safety does not depend on the transport 
The network layer authenticates peers by their secp256k1 node key, and consensus
messages are routed by the address derived from it. An adversary who recovers a
validator's ECDSA key therefore gets everything the transport can give: it completes
the handshake as that validator and signs syntactically perfect messages that recover
to its address. This test models exactly that adversary - full ECDSA compromise, no
Falcon key - and requires all four hot-path messages to be refused while the
post-quantum enforcement is armed, with a harvested seal replayed across message
kinds, blocks, heights, rounds, chains, and from another validator entirely.

The honest form of the claim: the transport is not post-quantum, and breaking it
does not buy a break of safety. It says nothing about liveness.
 2026-09-01 01:52:18 +03:00
Aere Network
2ac6ecc316 Prove scheme agility of the proposal and round-change enforcements 
One shared harness for both surfaces (the twin-class lesson applied in advance):
a seal made with SLH-DSA passes through the same untouched consensus code, and a
Falcon seal against an SLH-DSA registry is refused on both surfaces. The Falcon
nail sits only in the production wiring, for all three message enforcements.
 2026-09-01 00:28:13 +03:00
Aere Network
473832438c Consolidate twin test classes: one copy of each proof 
Twelve test classes existed twice, under a neutral name and under an internal
inventory name, ~4,600 duplicated lines. Two copies of the same proof diverge
silently: one receives a repair and the other does not - which is exactly what
happened once, and what the cache-hygiene test below documents. The neutral
names survive; per pair the test counts are identical, and the only code
difference (a warm-up window constant) exercises the same path and the same
assertion. The cache-hygiene reproduction now runs the surviving class's
lifecycle, unchanged in what it asserts.
 2026-09-01 00:13:42 +03:00
Aere Network
7242a2c388 The round-change now carries an optional post-quantum seal, disarmed by default 
The last hot-path QBFT message under the same pattern as prepare and proposal:
its own domain AERE-PQ-ROUNDCHANGE-1 over (chainId, height, targetRound, prepared
metadata - so a bare 'move on' seal cannot be replayed as 'move on and re-propose
THIS block'), a separate emission gate (aere.pq.roundChangePq.attachBlock), a
separate enforcement height (aere.pq.roundChangePq.forkBlock) self-wired into the
payload validator so it also judges round-changes inside proposal justifications,
and byte-for-byte upstream encoding when no seal is present. The seal is signed
once and the same object goes on the wire; Falcon signatures are randomised, so
a re-signing would put a different message on the wire than the one handled
locally.
 2026-09-01 00:03:54 +03:00