f2ab368c36
A 6-lens hostile panel with adversarial verification confirmed 17 attacks that would hold in a public takedown. All repaired: the MI contract now carries the two base-fee floor-lapse windows (12,978,617-13,087,959 and 13,596,033-13,596,141) as explicit ruleset validation exceptions, so a stranger implementing the written rules no longer halts where our own follower did; the honesty boundary now states the full record of reject-on-disagreement including the windows, and why the fact stays load-bearing; the independence claim is bounded (upstream skeletons yes, AERE ruleset has one author in both forks, so a common-author bug passes any differential gate by construction); the harness verdict claims only what it measures, records engine identity via web3_clientVersion on every run, refuses same-URL endpoint pairs, and prints its NOT MEASURED block on every run; stage 4 names the live engine (upstream parallel processing enabled by default, idling on empty blocks) and its oracle's model limits; 'governed registry' became 'owner-controlled' with the single-key fact stated. The panel also confirmed the import-proof doc claimed a two-month validation history where six days is the truth; fixed.
2.8 KiB
Stage 4 determinism oracle: the run and its negative control, 2026-08-15
The Stage 4 gate is the reference executor's serial-vs-parallel harness, run as a determinism
oracle. Both runs below were executed on this machine (WSL, Rust release build of
aere-research/parallel-executor), not asserted from documentation.
Positive run: parallel Block-STM == sequential
cargo build --release
./target/release/aere-block-stm harness
mismatches : 0
RESULT: PASS -- parallel Block-STM == sequential on ALL cases
Across the harness profiles (mixed-moderate and others), seeds, and thread counts (4, 8, 16), the state root produced by optimistic parallel Block-STM is byte-identical to the state root the sequential oracle produces for the same synthetic batch and pre-state. Zero mismatches. The batches are synthetic with designed contention; chain-2800 blocks are empty today, so a real-block replay under contention does not exist yet for any engine, and that is stated, not hidden.
Negative control: disable validation, and the oracle goes red
Block-STM's validation phase is what catches a transaction that read a now-stale value and forces it to re-execute. It is exactly the mechanism that prevents a silent divergence. The control disables it (the validation match arm forced to report "matches" always) and rebuilds:
src/parallel.rs:198 _ => false -> _ => true /* PLANT: validation disabled */
./target/release/aere-block-stm harness
MISMATCH profile=mixed-moderate seed=0 threads=4: parallel != sequential
MISMATCH profile=mixed-moderate seed=0 threads=8: parallel != sequential
MISMATCH profile=mixed-moderate seed=0 threads=16: parallel != sequential
MISMATCH profile=mixed-moderate seed=1 threads=4: parallel != sequential
...
With validation removed, parallel execution commits a divergent state on contended traffic and the harness catches it on every profile. The source was restored immediately after.
What this proves, and what it does not
PROVES: the determinism oracle is load-bearing. A green from it means parallel and serial agree, because the same oracle demonstrably goes red the moment the safety mechanism that guarantees agreement is removed. This is the negative-control discipline (a gate that has never failed cannot be believed) applied to parallel execution: the failure mode of concern (silent state divergence under contention) is exactly the one the negative control plants and the oracle catches.
DOES NOT PROVE: a throughput number (none is claimed; blocks on 2800 are empty, so 8-10x is proven capacity, not realized debit), and does not put parallel execution on mainnet. It proves the equality that makes turning it on a measured decision rather than a hope. Turning it on, if it ever changes an observable, is one coordinated activation, the discipline proven at block 14,050,000.