papers/lux-trust-kernel/sections/03-t-chain-threshold-governance.tex

%% ===================================================================
%% LP-134 canonical naming (2025-12-15):
%% Per LP-134 (Lux Chain Topology), T-Chain has been split into:
%%   M-Chain — MPC ceremonies for bridge custody of EXTERNAL wallets
%%             (CGGMP21, FROST, Pulsar-general)
%%   F-Chain — FHE compute + TFHE bootstrap-key generation (encrypted EVM)
%% The legacy name "T-Chain" is retained ONLY for `teleportvm` (LP-6332).
%% Where this paper says "T-Chain MPC" / "T-Chain threshold governance" /
%% "T-Chain TFHE" / "T-Chain custody", read as M-Chain (MPC) or F-Chain (FHE).
%% ===================================================================

\section{T-Chain: Threshold Governance}
\label{sec:tchain}
%% ===================================================================

The T-Chain handles quorum-controlled operations: actions that require $t$-of-$n$
authorization before execution. Unlike simple multi-signature schemes, the T-Chain
supports \emph{policy evaluation over encrypted inputs} via TFHE and \emph{confidential
aggregation} via CKKS.

\subsection{Quorum-Controlled Reveal}

\begin{definition}[Quorum Policy]\label{def:quorum}
A quorum policy $Q$ is a tuple:
\[
    Q = (n, t, \mathsf{voters}, \mathsf{predicate}, \mathsf{timeout})
\]
where $n$ is the total number of authorized voters, $t$ is the threshold,
$\mathsf{voters} \subseteq \mathsf{DID}^n$ is the voter set,
$\mathsf{predicate}$ is a boolean circuit evaluated on voter inputs,
and $\mathsf{timeout}$ is a block height deadline.
\end{definition}

Applications of quorum-controlled reveal include:
\begin{itemize}
    \item \textbf{Treasury approval}: $t$-of-$n$ board members must approve a
          disbursement before the transaction is signed on M-Chain.
    \item \textbf{Admin recovery}: a compromised admin key can be rotated if $t$
          recovery contacts authorize the rotation on K-Chain.
    \item \textbf{Conditional access}: a document is revealed to a requestor only
          if $t$ data stewards approve the access request.
\end{itemize}

\subsection{TFHE Policy Evaluation}

For policies where voter inputs must remain private (e.g., salary-based approval
thresholds, credit scoring), the T-Chain evaluates the quorum predicate as a
boolean circuit over TFHE-encrypted bits. Each voter submits an encrypted vote
$\hat{v}_i = \mathsf{TFHE.Enc}(v_i)$. The chain evaluates the predicate
circuit homomorphically:
\[
    \hat{r} = \mathsf{Circuit}(\hat{v}_1, \ldots, \hat{v}_n)
\]
and the result is threshold-decrypted by the T-Chain validators, yielding
$r \in \{0, 1\}$ without revealing individual votes. The TFHE parameters
follow \cite{lux-tfhe}: $N = 1024$, $q \approx 2^{27}$, 128-bit security.

\subsection{CKKS Confidential Compute}

For policies requiring arithmetic over real-valued inputs (e.g., weighted voting,
aggregate risk scores), the T-Chain supports CKKS approximate homomorphic encryption.
Each party submits $\hat{x}_i = \mathsf{CKKS.Enc}(x_i)$ where $x_i \in \mathbb{R}$.
The chain computes:
\[
    \hat{y} = \sum_{i=1}^{n} w_i \cdot \hat{x}_i
\]
and compares the result against a threshold $\tau$. The aggregated value $y$ is
revealed; individual inputs $x_i$ are not.

\begin{proposition}[Vote Privacy]\label{prop:vote-privacy}
Under the LWE assumption with parameters $(N, q, \sigma)$ as specified in
\cite{lux-pq-crypto-suite}, no coalition of fewer than $t$ T-Chain validators
can recover any individual vote $v_i$ from the transcript of a quorum evaluation.
\end{proposition}

\subsection{Treasury Approval and Admin Recovery}

Treasury operations bind T-Chain governance to M-Chain signing. A disbursement
follows a strict sequence:

\begin{enumerate}
    \item A proposer submits a \textsc{TreasuryProposal} to the T-Chain with
          the target address, amount, and justification hash.
    \item Authorized voters submit encrypted approvals.
    \item The T-Chain evaluates the quorum predicate.
    \item If approved, the T-Chain emits a \textsc{GovernanceReceipt} that
          authorizes the M-Chain to produce a threshold signature on the
          disbursement transaction.
    \item The M-Chain produces the signature only upon verifying the receipt.
\end{enumerate}

Admin recovery follows the same pattern with the rotation request replacing the
disbursement transaction. The recovery quorum is stored on the K-Chain as part
of the key record's policy (Definition~\ref{def:rotation}).

%% ===================================================================