From 89ed8ca22dd2dfb9b403ff370cdce9e06bc3a8f8 Mon Sep 17 00:00:00 2001 From: Aere Network Date: Wed, 4 Nov 2026 05:32:16 +0200 Subject: [PATCH] Dated correction 2026-11-04 to 'since block 24,300,000 (AIP-22 stage 4) every vote counts only with the verified post-quantum seal of its author' and its variants: one path of the second client until 2026-10-31 12:27Z (AIP-22 rule 3, correction of 2026-11-01); dated notes at the top of AIP-4, 7, 9, 13, 22 --- README.md | 2 +- aips/AIP-1.md | 2 +- aips/AIP-13.md | 2 ++ aips/AIP-22.md | 4 ++++ aips/AIP-4.md | 2 ++ aips/AIP-7.md | 2 ++ aips/AIP-9.md | 2 ++ aips/CONTRIBUTING.md | 2 +- aips/README.md | 2 +- execution-kernel/MACHINE-INTERFACE-CONTRACT.md | 2 +- execution-kernel/mi-replay-diferential.mjs | 2 +- 11 files changed, 18 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 64a9b7c..0d22225 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ Falcon-1024 (`0x0AE2`), ML-DSA-44 (`0x0AE3`), SLH-DSA-128s (`0x0AE4`) and SHAKE2 have been live as precompiles since block 9,189,161. You can call them yourself against `https://rpc.aere.network` without asking us for anything. -**Consensus on chain 2800 is QBFT, with a post-quantum checkpoint every 32 blocks; since block 24,300,000 (AIP-22 stage 4) every validator attributes each consensus vote only through the verified post-quantum seal of its author (since block 25,080,000, AIP-22 stage 5, headers no longer carry ECDSA commit seals and are admitted on the Falcon-512 seal of their proposer alone; a commit still carries the ECDSA commit seal of its validator as an additional check).** Since block 13,014,000 anchor blocks carry, under the block hash, a +**Consensus on chain 2800 is QBFT, with a post-quantum checkpoint every 32 blocks; since block 24,300,000 (AIP-22 stage 4) every validator attributes each consensus vote only through the verified post-quantum seal of its author (corrected 2026-11-04: from block 24,300,000 until 2026-10-31 12:27Z one path of the second client took the author of a proposal that named a height below 24,300,000 from its ECDSA envelope, as the correction of 2026-11-01 to rule 3 of AIP-22 says) (since block 25,080,000, AIP-22 stage 5, headers no longer carry ECDSA commit seals and are admitted on the Falcon-512 seal of their proposer alone; a commit still carries the ECDSA commit seal of its validator as an additional check).** Since block 13,014,000 anchor blocks carry, under the block hash, a certificate of validator post-quantum seals (Falcon-512, with SLH-DSA-SHA2-128s as well since 2026-09-04, at every 128th block since 2026-09-29; every anchor was 128 blocks apart from block 17,225,968 to block 20,746,736). Since block 20,715,632 (2026-09-29) a validator rejects an anchor block diff --git a/aips/AIP-1.md b/aips/AIP-1.md index 0efea64..7c9d65b 100644 --- a/aips/AIP-1.md +++ b/aips/AIP-1.md @@ -238,7 +238,7 @@ correctly formed is not the same person deciding whether the idea wins.* - Aere consensus is QBFT on chain 2800: anchor blocks carry a post-quantum certificate under their hash since block 13,014,000, and since block 24,300,000 (AIP-22 stage 4) a consensus vote counts only with the verified - post-quantum seal of its author (since block 25,080,000, AIP-22 stage 5, headers no longer carry ECDSA commit seals and are admitted on the Falcon-512 seal of their proposer alone; a commit still carries the ECDSA commit seal of its validator as an additional check); that arrangement has three limits: the transport between nodes is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet. No AIP claims or implies post-quantum consensus without naming them. Post-quantum also applies to signatures, accounts and + post-quantum seal of its author (corrected 2026-11-04: from block 24,300,000 until 2026-10-31 12:27Z one path of the second client took the author of a proposal that named a height below 24,300,000 from its ECDSA envelope, as the correction of 2026-11-01 to rule 3 of AIP-22 says) (since block 25,080,000, AIP-22 stage 5, headers no longer carry ECDSA commit seals and are admitted on the Falcon-512 seal of their proposer alone; a commit still carries the ECDSA commit seal of its validator as an additional check); that arrangement has three limits: the transport between nodes is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet. No AIP claims or implies post-quantum consensus without naming them. Post-quantum also applies to signatures, accounts and applications (this rule corrected on 2026-10-26: until that date it said that Aere consensus is classical secp256k1 ECDSA QBFT and that post-quantum applies to signatures, accounts and applications only). diff --git a/aips/AIP-13.md b/aips/AIP-13.md index 22debb4..368ba5a 100644 --- a/aips/AIP-13.md +++ b/aips/AIP-13.md @@ -6,6 +6,8 @@ > **Note added 2026-11-03 (to the note of 2026-10-27 above).** Its sentence on vote attribution since block 24,300,000 had one exception until 2026-10-31 12:27Z: on one path of the second client (the Nethermind-derived one) the author of a proposal was taken at the height named in its payload, so for a payload height below 24,300,000 it was the signer of the ECDSA envelope. Since 2026-10-31 12:27Z that client refuses at decoding a proposal whose block number differs from its payload height. See the correction of 2026-11-01 to rule 3 in section 4 of AIP-22. The note above is kept as it was written. +> **Note added 2026-11-04 (to the last sentence of the note of 2026-10-28 above, and to Erratum 1 in the Errata section below).** Their clauses that since block 24,300,000 every vote is attributed only through, or counts only with, the verified post-quantum seal of its author had one exception until 2026-10-31 12:27Z: on one path of the second client (the Nethermind-derived one) the author of a proposal was taken at the height named in its payload, so for a payload height below 24,300,000 it was the signer of the ECDSA envelope. Since 2026-10-31 12:27Z that client refuses at decoding a proposal whose block number differs from its payload height. See the correction of 2026-11-01 to rule 3 in section 4 of AIP-22. The note and the erratum are kept as they were written. + ## Preamble | Field | Value | diff --git a/aips/AIP-22.md b/aips/AIP-22.md index 159120a..bcf314a 100644 --- a/aips/AIP-22.md +++ b/aips/AIP-22.md @@ -33,6 +33,8 @@ > **Note added 2026-10-30.** Stage 5 is active on chain 2800 since block 25,080,000: from it every header, anchors included, is admitted only with an empty ECDSA committed-seals element and a valid Falcon-512 proposer seal in element 6 (section 5), so no header carries an ECDSA signature. Below it every header carried the ECDSA commit quorum, which both clients required on import exactly as upstream does: rule 2 of section 4 was not implemented separately. Since stage 4 a vote counts only with its author's verified post-quantum seal, and a commit still carries the validator's ECDSA commit seal as an additional check (the correction of 2026-10-25 under section 5), so the classical uses that remain are that commit seal, the ECDSA envelope that every consensus message still carries on the wire (no longer naming its author) and the RLPx transport between nodes; the ten validators are run by one operator, and no third party has audited the stages. A node that does not take part in consensus admits a header between anchors on the Falcon-512 seal of its proposer alone, so the post-quantum key of one validator can serve such a node a branch up to the block before the next anchor (below block 25,080,000 that took the ECDSA keys of a quorum), and the next anchor ends it for a node that requires the seals of a quorum in its certificate (the published follower, with its seal ceiling at 1, is not such a node: for it one leaked or misused post-quantum key of a validator makes the rewrite depth unbounded, section 6.4 of the aere-node SPEC). Where the notes above, Motivation item 1 and the "Today" of the per-height bullet in Security Considerations say that headers carry ECDSA commit seals, they describe chain 2800 below that block. Item (4) of the Abstract describes the design; on chain 2800 the ECDSA commit seal of a commit remains a validity criterion, as rule 3 of section 4 and the correction of 2026-10-25 under section 5 say. +> **Note added 2026-11-04 (to the notes of 2026-10-25 and 2026-10-30 above, and to point 4 of the Motivation).** Their statements that from stage 4, block 24,300,000, every validator on both clients takes the author of a consensus message from its verified post-quantum seal, and that a vote counts only with that seal, had one exception until 2026-10-31 12:27Z: on one path of the second client (the Nethermind-derived one) the author of a proposal was taken at the height named in its payload, so for a payload height below 24,300,000 it was the signer of the ECDSA envelope. Since 2026-10-31 12:27Z that client refuses at decoding a proposal whose block number differs from its payload height. See the correction of 2026-11-01 to rule 3 in section 4. The notes and the Motivation are kept as they were written. + ## Preamble | Field | Value | @@ -436,6 +438,8 @@ Two refinements to the text above, recorded rather than silently applied: the Me - 2026-11-01, the Security Considerations erratum of 2026-10-27, the note of 2026-10-25 at the top of this document, the correction of 2026-10-26 to rule 2 of section 4, and the field `ecdsa` of table 3.2: four dated notes. Two items of that erratum's list of what bounds a peer are withdrawn (deduplication on bytes, and the parenthesis on the future-message buffer, which holds for the Nethermind-derived client only); for a commit, the author is taken in the form of rule 3 of section 4, not only from the post-quantum seal; and the field `ecdsa`, optional in the loader after the switch epoch, is required in fact by both clients. Nothing else changes. +- 2026-11-04, the notes of 2026-10-25 and 2026-10-30 at the top of this document and point 4 of the Motivation: a dated note says that their statement on vote attribution from stage 4 had one exception on the second client until 2026-10-31 12:27Z, as the correction of 2026-11-01 to rule 3 of section 4 says. + ## Post-Acceptance Outcome Record Not accepted; nothing to record. diff --git a/aips/AIP-4.md b/aips/AIP-4.md index 28ce96a..b0b887a 100644 --- a/aips/AIP-4.md +++ b/aips/AIP-4.md @@ -2,6 +2,8 @@ > **Note added 2026-08-19.** Statements in this document that consensus on chain 2800 is (or remains) classical secp256k1 ECDSA QBFT were written before the post-quantum header anchor went live, and remain true for block-by-block finality. Since block 13,014,000 anchor blocks (every 32nd block, on every one since block 13,889,296) also carry, under the block hash, a certificate of validator Falcon-512 seals, and since 2026-08-14 a node rejects an anchor block with fewer than three valid seals (f+1 of nine; eight or nine are carried in practice). That is a post-quantum checkpoint about every 16 seconds, not a per-block quorum: the claim published on 2026-08-15 that from block 14,050,000 no block finalizes without a post-quantum quorum was wrong (the per-block rule armed at that height is retired in the shipped code in favour of the anchor rules) and was withdrawn on 2026-08-19. Details: https://aere.network/quantum.html and the aere-node repository, anchor/README.md. +> **Note added 2026-11-04 (to Erratum 1 in the Errata section below).** Its clause that since block 24,300,000 every vote counts only with the verified post-quantum seal of its author had one exception until 2026-10-31 12:27Z: on one path of the second client (the Nethermind-derived one) the author of a proposal was taken at the height named in its payload, so for a payload height below 24,300,000 it was the signer of the ECDSA envelope. Since 2026-10-31 12:27Z that client refuses at decoding a proposal whose block number differs from its payload height. See the correction of 2026-11-01 to rule 3 in section 4 of AIP-22. The erratum is kept as it was written. + ## Preamble | Field | Value | diff --git a/aips/AIP-7.md b/aips/AIP-7.md index 1e0fe36..b814c9d 100644 --- a/aips/AIP-7.md +++ b/aips/AIP-7.md @@ -6,6 +6,8 @@ > **Note added 2026-11-03 (to the note of 2026-10-27 above).** Its sentence on vote attribution since block 24,300,000 had one exception until 2026-10-31 12:27Z: on one path of the second client (the Nethermind-derived one) the author of a proposal was taken at the height named in its payload, so for a payload height below 24,300,000 it was the signer of the ECDSA envelope. Since 2026-10-31 12:27Z that client refuses at decoding a proposal whose block number differs from its payload height. See the correction of 2026-11-01 to rule 3 in section 4 of AIP-22. The note above is kept as it was written. +> **Note added 2026-11-04 (to Erratum 2 in the Errata section below).** Its clause that since block 24,300,000 every vote counts only with the verified post-quantum seal of its author had one exception until 2026-10-31 12:27Z: on one path of the second client (the Nethermind-derived one) the author of a proposal was taken at the height named in its payload, so for a payload height below 24,300,000 it was the signer of the ECDSA envelope. Since 2026-10-31 12:27Z that client refuses at decoding a proposal whose block number differs from its payload height. See the correction of 2026-11-01 to rule 3 in section 4 of AIP-22. The erratum is kept as it was written. + ## Preamble | Field | Value | diff --git a/aips/AIP-9.md b/aips/AIP-9.md index f4e671c..16c1ee7 100644 --- a/aips/AIP-9.md +++ b/aips/AIP-9.md @@ -1,5 +1,7 @@ # AIP-9: Consensus Mechanism: QBFT, not HotStuff +> **Note added 2026-11-04 (to Erratum 2 in the Errata section below).** Its clause that since block 24,300,000 every vote counts only with the verified post-quantum seal of its author had one exception until 2026-10-31 12:27Z: on one path of the second client (the Nethermind-derived one) the author of a proposal was taken at the height named in its payload, so for a payload height below 24,300,000 it was the signer of the ECDSA envelope. Since 2026-10-31 12:27Z that client refuses at decoding a proposal whose block number differs from its payload height. See the correction of 2026-11-01 to rule 3 in section 4 of AIP-22. The erratum is kept as it was written. + ## Preamble | Field | Value | diff --git a/aips/CONTRIBUTING.md b/aips/CONTRIBUTING.md index c83442e..755b042 100644 --- a/aips/CONTRIBUTING.md +++ b/aips/CONTRIBUTING.md @@ -81,7 +81,7 @@ The rules that get proposals bounced fastest: - **Do not claim post-quantum consensus without its limits.** On chain 2800 anchor blocks carry a post-quantum certificate under their hash since block 13,014,000, and since block 24,300,000 (AIP-22 stage 4) a consensus vote - counts only with the verified post-quantum seal of its author (since block 25,080,000, AIP-22 stage 5, headers no longer carry ECDSA commit seals and are admitted on the Falcon-512 seal of their proposer alone; a commit still carries the ECDSA commit seal of its validator as an additional check); that arrangement has three limits: the transport between nodes is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet. Aere's post-quantum work is also at the signature, account and application layers. A proposal that names fewer of these limits, or blurs them, will be sent back (this + counts only with the verified post-quantum seal of its author (corrected 2026-11-04: from block 24,300,000 until 2026-10-31 12:27Z one path of the second client took the author of a proposal that named a height below 24,300,000 from its ECDSA envelope, as the correction of 2026-11-01 to rule 3 of AIP-22 says) (since block 25,080,000, AIP-22 stage 5, headers no longer carry ECDSA commit seals and are admitted on the Falcon-512 seal of their proposer alone; a commit still carries the ECDSA commit seal of its validator as an additional check); that arrangement has three limits: the transport between nodes is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet. Aere's post-quantum work is also at the signature, account and application layers. A proposal that names fewer of these limits, or blurs them, will be sent back (this rule corrected on 2026-10-26: until that date it said that Aere consensus is classical secp256k1 ECDSA QBFT). diff --git a/aips/README.md b/aips/README.md index ef85a17..ddeff52 100644 --- a/aips/README.md +++ b/aips/README.md @@ -80,7 +80,7 @@ on chain 2800 since 2026-09-22; AIP-20 is deployed and armed for 19,900,000. what is live is the dated list above), AIP-16 (a skeleton that verifies nothing), AIP-19 (a process change under review), rule 4 of section 4 and stage 6 of AIP-22 (the provisional tail and its rollback, implemented in neither client, and the equivocation evidence of section 6, proven on the public testnet 28001 only; stages 1 to 5 and stage R are live, above, stage R since block 24,148,752, 2026-10-24, stage 4 since block 24,300,000, 2026-10-25, and stage 5 since block 25,080,000, 2026-10-30). -**Not claimed:** a post-quantum transport. Since block 25,080,000 (AIP-22 stage 5) headers on chain 2800 no longer carry ECDSA commit seals, and since block 24,300,000 (stage 4) every vote counts only with the verified post-quantum seal of its author, and a commit still carries the ECDSA commit seal of its validator as an additional check, which we call post-quantum consensus; the transport between nodes (RLPx) is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet. Stages 1 to 5 and stage R of AIP-22 are live on chain 2800 (above); stage 6 and rule 4 of section 4 are not. (Corrected 2026-10-09: until that date these two paragraphs said that AIP-22 +**Not claimed:** a post-quantum transport. Since block 25,080,000 (AIP-22 stage 5) headers on chain 2800 no longer carry ECDSA commit seals, and since block 24,300,000 (stage 4) every vote counts only with the verified post-quantum seal of its author (corrected 2026-11-04: from block 24,300,000 until 2026-10-31 12:27Z one path of the second client took the author of a proposal that named a height below 24,300,000 from its ECDSA envelope, as the correction of 2026-11-01 to rule 3 of AIP-22 says), and a commit still carries the ECDSA commit seal of its validator as an additional check, which we call post-quantum consensus; the transport between nodes (RLPx) is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet. Stages 1 to 5 and stage R of AIP-22 are live on chain 2800 (above); stage 6 and rule 4 of section 4 are not. (Corrected 2026-10-09: until that date these two paragraphs said that AIP-22 is design only and that nothing in it is implemented; its stages 1 to 3 have been live on chain 2800 since 2026-09-29 and 2026-09-30.) The precompiles `0x0AE6` and `0x0AE7` are testnet-only. diff --git a/execution-kernel/MACHINE-INTERFACE-CONTRACT.md b/execution-kernel/MACHINE-INTERFACE-CONTRACT.md index 04cddbc..ca7a16b 100644 --- a/execution-kernel/MACHINE-INTERFACE-CONTRACT.md +++ b/execution-kernel/MACHINE-INTERFACE-CONTRACT.md @@ -317,7 +317,7 @@ The harness prints a NOT MEASURED block naming these on every run, and its JSON them in the `honesty` field, so the non-claims travel with every result rather than living only in this document: -- **That consensus is post-quantum.** The contract does not make that claim: MI is an execution seam and says nothing about consensus. What the chain states is that since block 25,080,000 (AIP-22 stage 5) headers no longer carry ECDSA commit seals and, since block 24,300,000 (AIP-22 stage 4), every vote counts only with the verified post-quantum seal of its author, and a commit still carries the ECDSA commit seal of its validator as an additional check, which it calls post-quantum consensus, with three limits: the transport between nodes is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet; a Falcon certificate sits at every anchor. +- **That consensus is post-quantum.** The contract does not make that claim: MI is an execution seam and says nothing about consensus. What the chain states is that since block 25,080,000 (AIP-22 stage 5) headers no longer carry ECDSA commit seals and, since block 24,300,000 (AIP-22 stage 4), every vote counts only with the verified post-quantum seal of its author (corrected 2026-11-04: from block 24,300,000 until 2026-10-31 12:27Z one path of the second client took the author of a proposal that named a height below 24,300,000 from its ECDSA envelope, as the correction of 2026-11-01 to rule 3 of AIP-22 says), and a commit still carries the ECDSA commit seal of its validator as an additional check, which it calls post-quantum consensus, with three limits: the transport between nodes is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet; a Falcon certificate sits at every anchor. - **That equal header roots prove independent execution by themselves.** See the honesty boundary in section 5. The load-bearing fact is Nethermind's reject-on-disagreement behaviour, not the served bytes. diff --git a/execution-kernel/mi-replay-diferential.mjs b/execution-kernel/mi-replay-diferential.mjs index f159e15..8e1a550 100644 --- a/execution-kernel/mi-replay-diferential.mjs +++ b/execution-kernel/mi-replay-diferential.mjs @@ -335,7 +335,7 @@ async function main() { honesty: 'A matching header root served over RPC proves both endpoints serve the same bytes; ' + 'the load-bearing fact is that Nethermind validates on processing and rejects on ' + 'disagreement. ' - + 'Consensus finality is QBFT: since block 25,080,000 (AIP-22 stage 5) headers no longer carry ECDSA commit seals and, since block 24,300,000 (AIP-22 stage 4), every vote counts only with the verified post-quantum seal of its author, and a commit still carries the ECDSA commit seal of its validator as an additional check; the transport between nodes is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet, and a Falcon certificate sits at every anchor. ' + + 'Consensus finality is QBFT: since block 25,080,000 (AIP-22 stage 5) headers no longer carry ECDSA commit seals and, since block 24,300,000 (AIP-22 stage 4), every vote counts only with the verified post-quantum seal of its author (corrected 2026-11-04: from block 24,300,000 until 2026-10-31 12:27Z one path of the second client took the author of a proposal that named a height below 24,300,000 from its ECDSA envelope, as the correction of 2026-11-01 to rule 3 of AIP-22 says), and a commit still carries the ECDSA commit seal of its validator as an additional check; the transport between nodes is still authenticated by secp256k1, the ten validators are run by one operator, and no third party has audited it yet, and a Falcon certificate sits at every anchor. ' + 'MI is execution only and this is not a post-quantum-consensus claim. Not a benchmark. Both endpoints are ' + 'operated by the same party (the trust root does not move; what is removed is the class ' + 'of lies needing only one client implementation). State older than the ~512-block RPC '