papers/lux-warp-v2/sections/02-warp-evolution.tex

%% ====================================================================
\section{Warp Evolution}
\label{sec:warp-evolution}
%% ====================================================================

Lux Warp evolves on the same lane structure as Quasar finality. This section traces the version history.

\subsection{Warp 1.x: BLS aggregate}

LP-021 / LP-075 \cite{lp021,lp075}. Source-chain validators emit a $\mathsf{BitSetSignature}$ (signer bitmap plus aggregated BLS signature, 96 bytes total) over an $\mathsf{UnsignedMessage}$ that binds the source $\mathsf{networkID}$, $\mathsf{sourceChainID}$, and a $\mathsf{payload}$. The destination chain verifies the aggregate against the source's registered validator set (BLS public keys, weights). Warp 1.x is shipping; the corresponding code lives at \texttt{github.com/luxfi/warp/message.go}, \texttt{signature.go}, and \texttt{validator.go} \cite{warpgo}.

\paragraph{What 1.x gives.} Classical fast cross-chain. Sub-millisecond destination-side BLS aggregate verify (Section~\ref{sec:warp-implementation}). Operationally simple: one signing primitive, one verifier.

\paragraph{What 1.x does not give.} (1) Post-quantum guarantee on the cross-chain envelope: a quantum break of BLS forges any cross-chain message. (2) Source-finality binding: no transcript field anchors the envelope to a specific source-chain bundle root. (3) Source-key-era lineage: the validator set the destination resolves at verify time may differ from the validator set the source signed with.

\subsection{Warp 1.5: hybrid (transitional)}

Warp 1.5 was a transitional design that added an optional ML-DSA cert set alongside the BLS aggregate. It bound to the source chain id and payload but not to a Nebula root or a key-era lineage. In production it added per-validator PQ accountability without the compact PQ threshold seal.

\paragraph{Status.} Superseded by Warp 2.0. Code never shipped to mainnet; the design persisted only long enough to validate that the Pulse field could compose with the existing $\mathsf{Message}$ shape without breaking the Warp 1.x BLS path. The Mar-3 freeze ships Warp 2.0; Warp 1.5 is documented here for historical completeness.

\subsection{Warp 2.0: Pulse-backed cross-chain finality}

The current target, shipped over the ZAP wire (Section~\ref{sec:envelope-format}). A Warp 2.0 envelope carries:
\begin{itemize}[leftmargin=2em,nosep]
  \item a single signed $\mathsf{Message}$ that folds the former unsigned body ($\mathsf{networkID}$, $\mathsf{sourceChainID}$, $\mathsf{payload}$) together with the four source-chain lineage fields ($\mathsf{sourceNebulaRoot}$, $\mathsf{sourceKeyEraID}$, $\mathsf{sourceGeneration}$, $\mathsf{HashSuiteID}$) --- so the BLS Beam now signs over the \emph{whole} subject and authenticates the lineage it previously left unsigned;
  \item the Beam (BLS aggregate) over $\text{``LUX-WARP-ZAP-BEAM-v1''}\,\|\,D$, where $D$ is the canonical digest of $\mathsf{Message}$;
  \item one Pulsar Pulse over $\text{``LUX-WARP-ZAP-PULSE-v1''}\,\|\,D$;
  \item optionally an ML-DSA cert set (per-validator FIPS-204 attestations) over $\text{``LUX-WARP-ZAP-MLDSA-v1''}\,\|\,D$.
\end{itemize}

The destination verifier (\texttt{warp/pulsar/KernelVerifier} \cite{warpgo}) resolves $(\mathsf{sourceChainID}, \mathsf{sourceKeyEraID}, \mathsf{sourceGeneration})$ to the source's $\mathsf{GroupKey}_\eta$ via the destination chain's source-chain key registry; runs $\mathsf{Pulsar.Verify}$ on the Pulse; runs the BLS aggregate verify on the Beam; runs the ML-DSA cert-set verify if the lane is present; returns Prism-accepted iff all lanes verify against the same digest $D$.

\subsection{Warp Private: FHE-encrypted payload}
\label{sec:warp-private}

Z-Chain FHE ciphertext envelope. The Pulsar pulse signs the ciphertext digest; the destination verifies under unchanged $\mathsf{GroupKey}_\eta$ without seeing plaintext. Warp Private is \emph{production-research}, orthogonal to Warp 2.0; the two compose: a Warp Private envelope MAY carry a Pulse, in which case the v2.0 soundness theorem (Theorem~\ref{thm:warp-v2-soundness}) applies unchanged to the encrypted-payload binding. See Remark~\ref{rem:warp-private-orthogonal} of \texttt{proofs/quasar/warp-pq-soundness.tex}.

\subsection{Future PQ proof system}

The current Z-Chain rollup uses Groth16 for ML-DSA cert-set compression; a future $\mathsf{Warp\,Private\,PQ}$ replaces the pairing-based SNARK with P3Q~\cite{luxp3q} or a lattice-based transparent proof system. Until that lands, do not classify the Groth16-wrapped lane as post-quantum (Remark~\ref{rem:groth16-wrapper-warp}, Section~\ref{sec:soundness}).

\subsection{Version table}

\begin{tabular}{@{}p{0.18\textwidth}p{0.30\textwidth}p{0.18\textwidth}p{0.28\textwidth}@{}}
  \toprule
  \textbf{Version} & \textbf{Signing lane(s)} & \textbf{Status} & \textbf{Description} \\
  \midrule
  Warp 1.x & Beam (BLS aggregate) & Shipping & Classical cross-chain. No PQ guarantee. \\
  Warp 1.5 & Beam + optional ML-DSA & Superseded & Hybrid transitional; never deployed. \\
  Warp 2.0 & Beam + ML-DSA + Pulse & Shipping (Mar-3 freeze) & Pulse-backed source finality. PQ-sound under the conjunctive Prism predicate. \\
  Warp Private & Pulse over FHE ciphertext digest & Production-research & Confidentiality + PQ source finality, orthogonal composition. \\
  Warp Private PQ & Pulse + P3Q~\cite{luxp3q} / lattice ZK wrapper & Future & Replaces Groth16 wrapper for true PQ succinctness. \\
  \bottomrule
\end{tabular}

The Mar-3 freeze ships Warp 2.0 in production. Warp 1.x remains available only on its own independent legacy channel; the v1 channel and the v2 channel coexist without negotiation, per the forward-only migration discipline (Section~\ref{sec:introduction}).