Files
papers/lux-app-architecture/sections/07-provider-model.tex
zeekay cb3b572a9c papers: M/F/Z-Chain canonical naming per LP-134
Add LP-134 canonical naming banner to 46 LaTeX papers that reference
T-Chain in MPC/FHE context. Banner clarifies the M-Chain (MPC ceremonies
for external-wallet bridge custody) and F-Chain (FHE compute) split.

LP-020 quasar-consensus paper already correctly describes the M/F-Chain
split and is unmodified.
2026-05-05 16:28:50 -07:00

72 lines
3.4 KiB
TeX

%% ===================================================================
%% LP-134 canonical naming (2025-12-15):
%% Per LP-134 (Lux Chain Topology), T-Chain has been split into:
%% M-Chain — MPC ceremonies for bridge custody of EXTERNAL wallets
%% (CGGMP21, FROST, Pulsar-general)
%% F-Chain — FHE compute + TFHE bootstrap-key generation (encrypted EVM)
%% The legacy name "T-Chain" is retained ONLY for `teleportvm` (LP-6332).
%% Where this paper says "T-Chain MPC" / "T-Chain threshold governance" /
%% "T-Chain TFHE" / "T-Chain custody", read as M-Chain (MPC) or F-Chain (FHE).
%% ===================================================================
\section{Provider Model}
\label{sec:providers}
% ============================================================================
Providers are participants in the Web5 ecosystem that offer services to capsule
owners. They are not data owners. They never hold decryption keys. They are
replaceable.
\subsection{Provider Roles}
\begin{definition}[Provider]\label{def:provider}
A provider is a registered entity on I-Chain offering one or more services from
the set $\{\mathsf{relay}, \mathsf{storage}, \mathsf{gateway}, \mathsf{recovery},
\mathsf{compute}, \mathsf{index}\}$, with service quality commitments published
on-chain and enforced by staking.
\end{definition}
\begin{itemize}[nosep]
\item \textbf{Relay}: Forwards encrypted CRDT operations between peers.
Sees ciphertext. Provides availability, not confidentiality.
\item \textbf{Storage}: Hosts encrypted vault snapshots and WAL segments.
Provides durability. Subject to proof-of-storage challenges.
\item \textbf{Gateway}: HTTP/WebSocket endpoint for client applications.
Handles authentication (DID-based), rate limiting, and protocol
translation. Does not decrypt.
\item \textbf{Recovery}: Holds encrypted key shares for threshold recovery.
Cannot reconstruct alone (requires $t$-of-$n$ on T-Chain).
\item \textbf{Compute}: Executes FHE circuits or TEE enclaves for Class III
applications. Receives evaluation keys and ciphertext. Returns encrypted
results.
\item \textbf{Index}: Maintains searchable indexes over encrypted metadata
(using techniques like order-preserving encryption or searchable
symmetric encryption) for query acceleration.
\end{itemize}
\subsection{Provider Economics}
Providers stake LUX on the primary network. Capsule owners pay providers in LUX
for services consumed. Payments are per-operation (relay fees), per-byte-month
(storage fees), or per-circuit-evaluation (compute fees). Service level
agreements are on-chain; slashing occurs for downtime or data loss verified
by proof-of-storage audits.
\subsection{Provider Switching}
Switching providers is a four-step process:
\begin{enumerate}[nosep]
\item Update $\Sigma$ to include the new provider.
\item The new provider receives the encrypted vault snapshot and catches up
on the CRDT log from an existing peer or the old provider.
\item Verify replication by comparing checkpoint hashes.
\item Update $\Sigma$ to exclude the old provider.
\end{enumerate}
No key rotation is required. No data re-encryption is required. The principal
does not need to be online during the transfer---any peer in $\Sigma$ can serve
the encrypted state.
% ============================================================================