papers/lux-quasar-horizon/sections/01-introduction.tex

%% ====================================================================
\section{Introduction}
\label{sec:introduction}
%% ====================================================================

Lux is not merely adding post-quantum signatures to a chain; it defines a hybrid finality architecture for DAG-native consensus, with protocol-agnostic threshold lifecycle, post-quantum threshold sealing, and cross-chain propagation of Horizon finality.

This paper specifies the consensus-level composition that makes that thesis precise. The cryptographic kernels --- BLS12-381 \cite{bls,boneh2001short,lp075}, ML-DSA-65 (FIPS 204) \cite{fips204,lp070}, the Pulsar lattice threshold (LP-073) \cite{luxpulsar,lp073}, and the Lens curve threshold (LP-103) \cite{lp103} --- are specified elsewhere. The threshold lifecycle that rotates Pulsar and Lens shares across validator generations (LSS, LP-077) \cite{luxlssmpc,lp077} is specified elsewhere. What this paper specifies is \emph{Horizon}: the finality boundary that exists when, and only when, every required certificate lane verifies against a single shared transcript bound to the same Nebula DAG root.

\subsection{The DAG-native motivation}

A linear-chain consensus finalizes blocks. A DAG-native consensus finalizes \emph{frontiers} or \emph{bundle roots}: cuts in the partial order that the local node has decided are committed. Lux's Quasar engine (LP-020 \cite{lp020}) sits inside the latter family, alongside Narwhal--Tusk \cite{narwhal}, Bullshark \cite{bullshark}, and Aleph \cite{aleph}. A NebulaRoot is the canonical commitment to such a cut: a 32-byte digest binding the validator-set hash, the parent epoch, and the bundled vertices.

The post-quantum question for a DAG-native chain is therefore not ``how do we sign a block?'' but ``how do we seal a NebulaRoot under post-quantum hardness, while preserving the operational properties (sub-second finality, leaderless operation, large rotating validator sets) that motivated the DAG choice in the first place?'' Horizon is the answer.

\subsection{Three lanes, one transcript}

A Horizon certificate (Definition~\ref{def:horizon-cert} from \cite{quasarcertsoundness}) carries:

\begin{itemize}[leftmargin=2em,nosep]
  \item a \textbf{BLS Beam} (LP-075) --- a 48-byte aggregate signature giving classical fast-path finality;
  \item an \textbf{ML-DSA cert set} (LP-070) --- per-validator FIPS-204 attestations carrying PQ accountability, optionally compressed via a Z-Chain Groth16 rollup (LP-307 \cite{lp307});
  \item a \textbf{Pulsar Pulse} (LP-073) --- one lattice-threshold signature over the same NebulaRoot under the active key era's GroupKey;
  \item optionally, a \textbf{Lens classical-threshold control-plane certificate} (LP-103) --- a curve-side threshold signature used for governance and control-plane operations that benefit from the smaller artefact and faster verify of a Schnorr family signature.
\end{itemize}

The composition rule is \emph{not} ``BLS OR Pulsar.'' Horizon-final is the conjunction over a shared transcript: each lane signs the same canonical \texttt{QuasarTranscript} (Definition~\ref{def:horizon-transcript} from \texttt{proofs/definitions/transcript-binding.tex}). The verifier --- \emph{Prism} (LP-105 \cite{lp105}) --- checks that every lane references the same chain id, network id, epoch, round, validator-set hash, KeyEraID, generation, hash-suite identifier, and NebulaRoot. Failure of any lane, or transcript drift across lanes, fails the composite.

\subsection{What is novel}

Each piece is well-established in isolation:
\begin{itemize}[leftmargin=2em,nosep]
  \item BLS aggregates over independent keypairs are the standard classical fast path \cite{bls,boneh2001short}.
  \item Two-round MAC-authenticated lattice threshold signing is established \cite{ringtail,thresholdraccoon,hermine}.
  \item Per-validator ML-DSA over FIPS-204 \cite{fips204} is a NIST-standard PQ identity scheme.
  \item Proactive secret sharing \cite{hjky97} and verifiable resharing \cite{desmedtjajodia97,wongwangwing02} are decades old.
\end{itemize}

What is novel is the \emph{composition into a DAG-native consensus}: the shape of a single finality artefact that binds a fast classical aggregate, a per-validator PQ accountability set, and a compact PQ threshold seal to one NebulaRoot through one canonical transcript, and ships in a permissionless engine with rotating validator sets, no per-epoch trusted dealer, and a tested no-slashing-dependency rollback ladder. Section~\ref{sec:formal-model} states the model. Section~\ref{sec:prism-composition} states the verifier. Section~\ref{sec:horizon-soundness} states the composition theorem (the proof lives in the canonical bucket file). Section~\ref{sec:async-pq-finality} documents the asynchronous-finality discipline that allows the Pulse to follow the Beam without blocking the hot path. Section~\ref{sec:tier-model} states the L1/L2/L3 model. Section~\ref{sec:grouped-pulsar} documents the grouped-Pulsar deployment for large validator sets. Section~\ref{sec:implementation} cites the running 258-test code path. Sections~\ref{sec:related-work} and \ref{sec:future-work} compare to prior consensus protocols and outline open work.

\subsection{What this paper does not do}

This paper does not redefine or rederive Pulsar, Lens, LSS, or ML-DSA. Where the underlying threshold mathematics is needed, we cite the canonical proof-bucket files (\texttt{proofs/pulsar/*}, \texttt{proofs/lss/*}, \texttt{proofs/quasar/*}) and the LP-073 paper \cite{luxpulsar}. We are explicit about what is and is not post-quantum: in particular, the Z-Chain Groth16 wrapper around the ML-DSA cert set is a \emph{classical} succinct proof of post-quantum signature verification, useful for compression and EVM verifier compatibility, but \textbf{not} a contribution to the post-quantum reduction (Remark~\ref{rem:groth16-wrapper-horizon}; see also \texttt{proofs/quasar/horizon-soundness.tex}). Horizon's PQ finality lives in the ML-DSA cert set and the Pulsar Pulse, not in any pairing-based wrapper.