papers/lux-quasar-horizon/sections/06-l1-l2-l3-tier-model.tex

%% ====================================================================
\section{L1 / L2 / L3 Tier Model}
\label{sec:tier-model}
%% ====================================================================

This section specifies the Lux network-tier model. The L1 / L2 / L3 distinction here is \emph{not} the rollup-vs-settlement distinction of other ecosystems; it is a co-validation model rooted in Pulsar's KeyEraID lineage and validator-set inclusion.

\subsection{Tier definitions}

\begin{definition}[Lux network tiers]
\label{def:network-tiers-horizon}
A Lux-architecture chain occupies exactly one of three tiers (cf.\ Definition~\ref{def:network-tiers} in \texttt{proofs/definitions/finality-definitions.tex}, restated here):
\begin{description}[leftmargin=2em,nosep]
  \item[L1 (sovereign).] No $\mathsf{primary\_network\_id}$ declared. Own validator set, own KeyEraID lineage, own Beam, own ML-DSA cert set, own Pulse. Whether other chains anchor to this L1 is a graph property, not a protocol distinction.
  \item[L2 (co-validating).] Declares $\mathsf{primary\_network\_id} = N_P$. Activation cert binds $\mathsf{primary\_nebula\_root}$ from $N_P$; validator set is required to be a subset of $N_P$'s active set at the era's Bootstrap or Reanchor. Not a rollup --- L2 produces its own Beam, ML-DSA cert set, and Pulse over its own NebulaRoot.
  \item[L3 (rollup / validity / app-execution).] Settles or anchors to an L1 or L2 via a succinct proof (Groth16, STARK), an FHE circuit, or a fraud / validity proof. The proof system is a compatibility / compression / privacy adapter, not the PQ root of trust. PQ finality of an L3 inherits from the underlying L1/L2's Pulse + ML-DSA, never from a pairing-based SNARK alone.
\end{description}
A chain may transition between tiers via a Reanchor-class governance event.
\end{definition}

\subsection{L1: the default}

L1 is the baseline tier. Every Lux-architecture network is implicitly L1; no opt-in is required. There is no ``L0'' or ``settlement layer'' below L1. Two distinct deployment shapes share the L1 protocol:
\begin{itemize}[leftmargin=2em,nosep]
  \item \textbf{Primary network.} A Lux-architecture network that other chains may opt to co-validate with (Lux mainnet itself is the canonical example).
  \item \textbf{Independent L1.} A chain that runs entirely on its own validator set, never co-validates with any primary, and is never declared as a primary by other chains. Operationally identical to a primary network with no downstream L2s.
\end{itemize}
The two shapes are protocol-equivalent. A chain becomes a ``primary'' simply by being declared as $\mathsf{primary\_network\_id}$ by some L2; it is a graph property of who anchors to whom.

\subsection{L2: co-validation, not subordination}

A chain becomes L2 of a primary network $N_P$ by declaring $\mathsf{primary\_network\_id} = N_P$ and committing, at the consensus layer, to co-validation:
\begin{verbatim}
L2 chain_id            = X
L2 network_id          = N_X
L2 primary_network_id  = N_P    (declared)
L2 validator set       subseteq N_P validator set
\end{verbatim}

Co-validation is enforced by binding $N_P$'s NebulaRoot into the L2's activation transcript and bundle Pulses. The L2 activation message extends the canonical \texttt{QUASAR-PULSAR-ACTIVATE-v1} prefix with two fields:
\begin{verbatim}
L2 activation message:
    QUASAR-PULSAR-ACTIVATE-v1 ||
        chain_id              = X
        network_id            = N_X
        primary_network_id    = N_P
        primary_nebula_root   = NebulaRoot_P
        key_era_id            = ...
        old_generation, new_generation, ...
        nebula_root           = NebulaRoot_X
        ...
\end{verbatim}

The L2's validators must be members of $N_P$'s validator set (or a configurable subset thereof). Their Pulsar shares for the L2 derive from the same Bootstrap Dealer / Signature Coordinator roles that validate $N_P$ (\cite{luxlssmpc,lp077}), so a Prism accepting an L2 Horizon-final implicitly verifies the validators were active on $N_P$ at the bound primary epoch.

\subsection{The L2 co-validation soundness theorem}

The L2 inheritance theorem is \texttt{proofs/quasar/l1-l2-covalidation.tex}. We restate it:

\begin{theorem}[L2 co-validation security inheritance]
\label{thm:l2-covalidation}
Let $\mathsf{Chain}_X$ be an L2 with $\mathsf{primary\_network\_id} = N_P$, and let $V_X \subseteq V_{N_P}^{(\eta_P, g_P)}$ at the moment of $\mathsf{Chain}_X$'s key-era Bootstrap. If a Horizon-final certificate on $\mathsf{Chain}_X$ binds $\mathsf{primary\_nebula\_root} = R_P$ (a NebulaRoot of $N_P$ at era $\eta_P$ generation $g_P$), then any adversary forging conflicting finality on $\mathsf{Chain}_X$ must:
\begin{enumerate}[leftmargin=2em,nosep]
  \item Compromise enough of $V_X$ to forge an L2-local Pulse, AND
  \item Either compromise enough of $V_{N_P}$ to forge an alternative $R_P$ (whence the security reduction inherits Theorem~\ref{thm:horizon-soundness} applied to $N_P$), OR
  \item Break the transcript binding (collision on TupleHash256 \cite{nistsp800185}).
\end{enumerate}
Therefore the L2's safety bound is at least the minimum of $N_P$'s safety bound and the L2's own validator-set safety bound.
\end{theorem}

This is co-validation security, not rollup security. There is no fraud-proof window, no validity-proof anchoring; the inheritance is purely via shared validator-set membership and transcript binding (\cite{luxpulsar} Section 11; \texttt{proofs/quasar/l1-l2-covalidation.tex}).

\subsection{L3: the proof-system tier}

\begin{remark}[L3 is a different layer model]
\label{rem:l3-model}
$\mathsf{Chain}_X$ at L3 inherits security via a succinct proof of state transitions, not via co-validation membership. L3 chains may use Groth16 or STARKs for compression. PQ finality of an L3 inherits from the underlying L1/L2's Pulse + ML-DSA; the proof system itself is not the PQ root of trust (Remark~\ref{rem:groth16-wrapper-horizon}). A Z-Chain instance, for example, can be L1 (sovereign validator set), L2 (co-validating with another primary), or L3 (privacy/validity execution layer anchored to an L1/L2). The tier is a deployment role, not a property of the proof system in use.
\end{remark}

The mapping:

\begin{tabular}{@{}p{0.10\textwidth}p{0.40\textwidth}p{0.40\textwidth}@{}}
  \toprule
  \textbf{Tier} & \textbf{Anchors via} & \textbf{PQ root of trust} \\
  \midrule
  L1 & own validator set & own Pulse + ML-DSA \\
  L2 & co-validation with primary $N_P$ & primary's Pulse + ML-DSA, transitively (Theorem~\ref{thm:l2-covalidation}) \\
  L3 & succinct proof / fraud proof / FHE & underlying L1/L2's Pulse + ML-DSA (the proof system itself does not provide PQ security) \\
  \bottomrule
\end{tabular}

\subsection{Tier transitions}

Tier changes are governance events gated by Reanchor:
\begin{itemize}[leftmargin=2em,nosep]
  \item L1 $\to$ L2: declare a $\mathsf{primary\_network\_id}$, bind to that primary's NebulaRoot at the next Reanchor; this creates a fresh KeyEraID under the primary's validator set.
  \item L2 $\to$ L1: drop the $\mathsf{primary\_network\_id}$ declaration; future eras run on the chain's own validator set.
  \item L1/L2 $\to$ L3: declare a settlement target and proof system; future Horizon-finality on the L3 inherits from the underlying L1/L2.
  \item L3 $\to$ L1/L2: graduate to running its own validator set.
\end{itemize}
Every transition is gated by the same Reanchor mechanism that handles fresh KeyEraID creation; the underlying KeyEraID stops at the old tier and a fresh KeyEraID starts under the new tier.

\subsection{Multiple primaries}

A chain may declare any one Lux-architecture network as its primary (Lux mainnet, Hanzo, Zoo, or another L1). The choice is deployment configuration, not protocol-level constraint. If the primary network undergoes a Reanchor (fresh GroupKey, new validator authority), every L2 anchored to it must either Reanchor to follow, Reanchor to a different primary, or drop to L1. This is by design: the security inheritance is explicit, not silent.

\subsection{What L2 buys (and does not buy)}

\paragraph{L2 buys.} Shared validator security (compromising the L2 requires compromising enough of $N_P$'s validators). Cross-chain Prism binding (a Horizon-final L2 cert proves the L2 state was sealed at a specific $N_P$ primary state). Operational economy (no separate validator-acquisition path).

\paragraph{L2 does not buy.} Free liveness: an L2 still needs $\geq 2/3$-weight of its own validators to be live. Free safety on $N_P$: if $N_P$ itself is compromised, the L2's primary-bound transcripts inherit that compromise. Free upgrade path: L2 has its own KeyEraID lineage, and Reanchors must be coordinated explicitly with $N_P$'s lifecycle.

This is co-validation, not custody. The L2 is a sovereign chain whose validator-set authority happens to overlap with $N_P$'s, by explicit declaration, by Reanchor-class governance, with cryptographic transcript binding to the primary's NebulaRoot. It is the consensus-level analog of multi-sig delegation, not of upgrade-proxy admin.