papers/lux-quasar-composition/sections/11-conclusion.tex

\section{Conclusion}
\label{sec:conclusion}

\subsection{What QuasarCert is}

QuasarCert is the wire-format finality certificate for the Lux
Network's PQ consensus suite. It composes up to five independent
cryptographic legs --- a BLS12-381 aggregate, a Pulsar threshold
ML-DSA-65 signature, an optional Corona threshold M-LWE signature,
an optional Magnetar threshold SLH-DSA signature, and a Z-Chain
Groth16 rollup of per-validator ML-DSA-65 identity signatures ---
under a strict conjunctive verifier. Three cert profiles
(\texttt{Pulsar}, \texttt{Aurora}, \texttt{Polaris}) select which
legs are populated, with profile-specific hardness diversification:

\begin{itemize}[leftmargin=2em,nosep]
\item \texttt{Pulsar} (PQ floor, $\sim 3.5$ KB): co-CDH $\wedge$
      M-LWE $\wedge$ KEA. Forging the cert under quantum attack
      requires breaking Pulsar.
\item \texttt{Aurora} (intra-lattice, $\sim 37$ KB): adds a second
      Module-LWE leg (Corona) at a distinct parameter set and
      codebase. Forging requires breaking both legs --- parameter
      and implementation diversity within M-LWE, not a second
      hardness family.
\item \texttt{Polaris} (cross-family, $\sim 53$ KB): adds SHA-3
      one-wayness. Forging requires breaking lattice and hash
      assumptions both.
\end{itemize}

\subsection{What QuasarCert delivers}

\paragraph{Hardness diversification, not redundancy.} Each populated
leg invokes an independent hardness assumption; the conjunctive
soundness theorem (Theorem~\ref{thm:composition}) bounds forgery
by the minimum advantage over legs. A cryptanalytic break against
one family does not transfer to the others (Corollaries
\ref{cor:diversification}, \ref{cor:polaris}).

\paragraph{Wire-format stability.} The QuasarCert byte layout is
specified at \texttt{luxfi/quasar/SPEC.md} and is byte-compatible
with the Go canonical at \texttt{luxfi/consensus/protocol/quasar/types.go}.
Cross-chain finality propagation uses the same byte string
regardless of consensus mode (linear-chain or DAG); cross-chain
Warp messaging carries QuasarCerts as the universal finality
envelope.

\paragraph{Composable primitives.} Each primitive lives in its own
repository with its own audit, version pin, and submission
trajectory. The umbrella does not re-implement primitives; the
primitives do not depend on the umbrella. The only shared contract
is the wire format. This is the only sustainable PQ-stack
architecture for the migration era: primitives must be swappable
without rebuilding the engine.

\paragraph{Per-chain profile selection.} A single Lux chain is
configured with one profile via the \texttt{FinalitySchemeID}
field on its consensus config. Different chains may run different
profiles; cross-chain interoperability is via the universal
QuasarCert envelope. Profile rotation is a coordinated
multi-window event documented in the deployment runbooks.

\subsection{Tier status by primitive}

\begin{itemize}[leftmargin=2em,nosep]
\item Pulsar: \textbf{Tier A} (cut-ready for NIST MPTC v0.1
      submission on $2026$-$11$-$16$). Cryptographer sign-off
      APPROVED WITH GATES \cite{pulsar}.
\item Corona: \textbf{Tier A documentation shape complete}.
      Four open gates to full Tier A
      (EC / Lean$\leftrightarrow$EC / dudect / external audit).
\item Magnetar: \textbf{Tier B} (v0.1 reveal-and-aggregate impl
      landed). Tier A roadmap targets 2027 Q3.
\item BLS / Z-Chain Groth16: production-deployed; existing
      literature audit.
\end{itemize}

The Pulsar profile is the current production deployment on Lux
primary network's Q-Chain. The Aurora profile is operationally
ready and gated on Corona Tier A. The Polaris profile is
operationally ready and gated on Magnetar Tier A.

\subsection{Path to Polaris}

The path from current production (\texttt{Pulsar} profile) to
maximum-assurance deployment (\texttt{Polaris} profile) is:

\begin{enumerate}[leftmargin=2em,nosep]
\item \textbf{Corona Tier A closure}. Land EC theory shells, the
      Lean$\leftrightarrow$EC bridge, dudect $10^9$ samples, and
      external audit. Target: 2027 Q1.
\item \textbf{Aurora profile activation}. Coordinated multi-window
      rotation from Pulsar to Aurora on a target chain (initial
      candidate: Z-Chain itself, which has the highest assurance
      requirements).
\item \textbf{Magnetar Tier A closure}. Land the full Tier A
      artifact bundle for Magnetar; complete the Tier B$\rightarrow$Tier A
      gap analysis in \texttt{luxfi/magnetar/BLOCKERS.md}.
      Target: 2027 Q3.
\item \textbf{Polaris profile activation}. Coordinated rotation
      from Aurora to Polaris on the target chain.
\end{enumerate}

At each step, the cert wire format is stable; only the populated-leg
set changes. This is what the umbrella spec was designed to make
possible.

\subsection{Open questions}

\paragraph{Hash agility.} The QuasarCert binds all legs to
round-digest $\mu$, which is currently SHA3-256. A hash break
would require migrating $\mu$ to a different hash function. The
umbrella spec does not currently specify a hash-agility upgrade
path; this is a candidate for a future LP.

\paragraph{Cert size at large $n$.} The Pulsar and Corona threshold
signatures are $O(1)$ in $n$ (the validator count) after DKG, but
the Z-Chain Groth16 prover time scales linearly in $n$
($\sim 2^{20}$ constraints per validator). At $n \geq 1000$, the
Z-Chain leg's prover cost becomes the bottleneck. The
\texttt{pq-finality-no-bls.tex} analysis~\cite{pqfinalitynobls}
proposes fixed-committee signing ($k = 128$) as a scale-invariant
alternative; this is a candidate for the next iteration of the
Z-Chain leg.

\paragraph{PQ VRF for committee sampling.} The current Photon
committee selection uses a VRF based on classical primitives. A
fully PQ-safe committee sampler would require a lattice-based VRF
(see Boneh-Dai 2024 \cite{bonehdai2024}); this is an open research
area.

\paragraph{Strict-PQ profile.} A profile that omits the BLS leg
entirely is implemented as \texttt{pq-finality-no-bls}
\cite{pqfinalitynobls} and is available behind a chain-config
flag. The wire format supports an empty $\sigma^{\mathrm{BLS}}$
slot, so the strict-PQ profile is a valid QuasarCert variant. The
profile-match clause would need to allow this variant; this is a
candidate for a fourth registered profile (working name: ``Quanta'').

\subsection{Closing}

QuasarCert is the cryptographic conscience of Lux consensus. Each
primitive does one thing, in one place; each profile composes them
under one verifier; each cert carries one byte string; each chain
selects one profile. The composition is conjunctive --- one leg
breaks, the cert still stands --- and the assumptions are
diversified across discrete-log, two lattice families, and
hash-based primitives. The wire format is stable; the primitives
are swappable; the profiles are independently selectable.

This is what hardness diversification looks like when it is
designed orthogonally from day one. No redundant computation, no
braided concerns, no implicit cross-leg dependencies. Each
primitive is independently complete; the umbrella composes them
without owning them. As Hickey would put it: simple, not easy.

The PQ migration is not a single event; it is a multi-year
trajectory across multiple primitives, audits, standards, and
deployments. QuasarCert is the wire-format contract that makes the
trajectory coherent: a Pulsar-profile cert today, an Aurora-profile
cert tomorrow, a Polaris-profile cert when Magnetar matures, all
carrying the same Go struct, the same verifier, the same Warp
envelope, the same Z-Chain proof structure.

The primitives change; the contract is forever.