mirror of
https://github.com/lux-cpp/node.git
synced 2026-10-30 14:48:15 +00:00
zeekayandHanzo Dev
b98e8d9d61
LP-10603 said the chain was in the NAME and I implemented that. The document now says otherwise, and it is right: Go derives a node's own identity with ids.Empty (node.go's MyNodeID = DeriveNodeID(ids.Empty)) and re-derives with ids.Empty to check a peer, so a node answers to one name on every chain it serves. Putting the chain in the name gave it as many names as it had chains, and it broke agreement with Rust, which was right all along. What the chain scopes is the ENTITLEMENT, and that belongs one layer down. The possession proof is now signed and checked over chain | node | key rather than node | key alone, so a line published for one network authorises nothing on another while the name stays the same everywhere. Committee::claim is the one statement of those 100 bytes; Signer::publish signs them and the door checks them. The link goes back to binding a peer at chain zero, which is what Go does and what a name is. The door is this file's own now, and that is a consequence worth naming. consensus::admit holds the REGISTRATION proof, whose message is fixed at node | key and pinned across three languages by a frozen corpus; a committee proof is a different message, so it cannot go through that door. The clauses are the same clauses in the same order — encoding, possession, one key per node — and the pairing is under the tag lux::consensus::bls publishes. That surface exposes a general pop_sign and only a node-bound pop_verify; the general verify would belong there. Measured, three ways, on test/committee/four.txt: C++ Committee::read(...).root() de34e8d1948f90d09610c8737c6487d494e093ba01680f1a54095a1cdfa696e7 Rust lux_node::engine::Committee de34e8d1948f90d09610c8737c6487d494e093ba01680f1a54095a1cdfa696e7 Go luxfi/validators SetRoot de34e8d1948f90d09610c8737c6487d494e093ba01680f1a54095a1cdfa696e7 with the four names agreeing one for one in all three — the divergence from Rust is gone. Go checks every proof over chain | node | key with its own bls.VerifyProofOfPossession and answers for all four; read as a committee of another network the same file names the same validators and admits none of them. test/committee/elsewhere.txt is the mirror: the same four publishing somewhere else, refused here. Rust computes the same root and then says PopInvalid, because it still checks the node-bound proof — the remaining half of the port, not a disagreement. TWO THINGS CARRIED, both in this commit because they are what the link needed. Signing is deterministic now. LP-10602 mandates it and Go signs that way, but the C ABI offered only SignCtx(rand.Reader, ...), so a published handshake could be checked and never reproduced. mldsa65_sign_ctx_det now exists in luxfi/crypto's cabi — SignCtxDeterministic was already there, it was simply not exported — and the link signs through it. The vector carries both secrets, and pq_vector_test re-makes both signatures and compares them byte for byte: signing prefix_resp here gives back the bytes GO put on the wire, which says the two implementations agree on the signature rather than merely accepting each other's. And the nine-line ZAP pairing is gone from plugin.cpp. zap-cpp-core wrote and read an error response's body length-prefixed where Go writes it raw, so every error from a Go plugin arrived as "truncated error response" — fixed in both halves on lux-cpp/zap-cpp-core branch net/error-body-is-raw, with a conformance case that pins the bytes rather than a round trip. Verified live: the plugin's real complaint now reaches the caller through ZapClient. Co-authored-by: Hanzo Dev <[email protected]>
65 lines
2.0 KiB
C++
65 lines
2.0 KiB
C++
// Copyright (C) 2026, Lux Industries, Inc. All rights reserved.
|
|
// SPDX-License-Identifier: BSD-3-Clause-Eco
|
|
//
|
|
// names.hpp — the identities a test cluster greets with.
|
|
//
|
|
// A mesh proves who is on the other end of every link (LP-10602), so a test
|
|
// that builds hosts has to give them something to prove. `Names` makes N
|
|
// ML-DSA-65 identities once and answers the seat question the way a committee
|
|
// does: by looking the PROVEN name up in the list it was built from.
|
|
//
|
|
// It lives in one header because four tests need it and four copies of it would
|
|
// be four chances to disagree about what a seat is.
|
|
|
|
#pragma once
|
|
|
|
#include "lux/node/mesh.hpp"
|
|
|
|
#include <array>
|
|
#include <cstdint>
|
|
#include <optional>
|
|
#include <vector>
|
|
|
|
namespace lux::node::test {
|
|
|
|
class Names {
|
|
public:
|
|
explicit Names(std::uint32_t n) {
|
|
ids_.reserve(n);
|
|
for (std::uint32_t i = 0; i < n; ++i) ids_.push_back(pq::Identity::make());
|
|
}
|
|
|
|
// The greeting for the validator at `seat`. Borrowed from this object, so it
|
|
// must outlive the hosts that hold it — which in a test it does.
|
|
[[nodiscard]] Link link(std::uint32_t seat) const {
|
|
Link l;
|
|
l.me = ids_[seat];
|
|
l.chain = chain_;
|
|
l.seat = [this](const std::array<std::uint8_t, 20>& who) -> std::optional<std::uint32_t> {
|
|
for (std::uint32_t i = 0; i < ids_.size(); ++i)
|
|
if (ids_[i].node_id() == who) return i;
|
|
return std::nullopt;
|
|
};
|
|
return l;
|
|
}
|
|
|
|
// A greeting for somebody who is in no committee: a real identity, and no
|
|
// seat anywhere.
|
|
[[nodiscard]] Link stranger() const {
|
|
Link l = link(0);
|
|
l.me = pq::Identity::make();
|
|
return l;
|
|
}
|
|
|
|
[[nodiscard]] std::array<std::uint8_t, 20> name(std::uint32_t seat) const {
|
|
return ids_[seat].node_id();
|
|
}
|
|
[[nodiscard]] const std::array<std::uint8_t, 32>& chain() const noexcept { return chain_; }
|
|
|
|
private:
|
|
std::array<std::uint8_t, 32> chain_{};
|
|
std::vector<pq::Identity> ids_;
|
|
};
|
|
|
|
} // namespace lux::node::test
|