mirror of
https://github.com/lux-cpp/node.git
synced 2026-10-30 14:48:15 +00:00
zeekayandHanzo Dev
b98e8d9d61
LP-10603 said the chain was in the NAME and I implemented that. The document now says otherwise, and it is right: Go derives a node's own identity with ids.Empty (node.go's MyNodeID = DeriveNodeID(ids.Empty)) and re-derives with ids.Empty to check a peer, so a node answers to one name on every chain it serves. Putting the chain in the name gave it as many names as it had chains, and it broke agreement with Rust, which was right all along. What the chain scopes is the ENTITLEMENT, and that belongs one layer down. The possession proof is now signed and checked over chain | node | key rather than node | key alone, so a line published for one network authorises nothing on another while the name stays the same everywhere. Committee::claim is the one statement of those 100 bytes; Signer::publish signs them and the door checks them. The link goes back to binding a peer at chain zero, which is what Go does and what a name is. The door is this file's own now, and that is a consequence worth naming. consensus::admit holds the REGISTRATION proof, whose message is fixed at node | key and pinned across three languages by a frozen corpus; a committee proof is a different message, so it cannot go through that door. The clauses are the same clauses in the same order — encoding, possession, one key per node — and the pairing is under the tag lux::consensus::bls publishes. That surface exposes a general pop_sign and only a node-bound pop_verify; the general verify would belong there. Measured, three ways, on test/committee/four.txt: C++ Committee::read(...).root() de34e8d1948f90d09610c8737c6487d494e093ba01680f1a54095a1cdfa696e7 Rust lux_node::engine::Committee de34e8d1948f90d09610c8737c6487d494e093ba01680f1a54095a1cdfa696e7 Go luxfi/validators SetRoot de34e8d1948f90d09610c8737c6487d494e093ba01680f1a54095a1cdfa696e7 with the four names agreeing one for one in all three — the divergence from Rust is gone. Go checks every proof over chain | node | key with its own bls.VerifyProofOfPossession and answers for all four; read as a committee of another network the same file names the same validators and admits none of them. test/committee/elsewhere.txt is the mirror: the same four publishing somewhere else, refused here. Rust computes the same root and then says PopInvalid, because it still checks the node-bound proof — the remaining half of the port, not a disagreement. TWO THINGS CARRIED, both in this commit because they are what the link needed. Signing is deterministic now. LP-10602 mandates it and Go signs that way, but the C ABI offered only SignCtx(rand.Reader, ...), so a published handshake could be checked and never reproduced. mldsa65_sign_ctx_det now exists in luxfi/crypto's cabi — SignCtxDeterministic was already there, it was simply not exported — and the link signs through it. The vector carries both secrets, and pq_vector_test re-makes both signatures and compares them byte for byte: signing prefix_resp here gives back the bytes GO put on the wire, which says the two implementations agree on the signature rather than merely accepting each other's. And the nine-line ZAP pairing is gone from plugin.cpp. zap-cpp-core wrote and read an error response's body length-prefixed where Go writes it raw, so every error from a Go plugin arrived as "truncated error response" — fixed in both halves on lux-cpp/zap-cpp-core branch net/error-body-is-raw, with a conformance case that pins the bytes rather than a round trip. Verified live: the plugin's real complaint now reaches the caller through ZapClient. Co-authored-by: Hanzo Dev <[email protected]>