mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekayandHanzo Dev
937578257d
verifyCert's count-only branch verified a certificate and checked its declared quorum against the number the committee derives, and read nothing else against that committee. The derived clause cannot see a small one, because it shrinks with it: TwoThirdsCount(2) is 2, so two signatures over a two-member committee ARE that committee's quorum and the certificate passes as the one this node would have built itself. What passed was export finality — irreversible, the rung bridges read — over a committee whose Byzantine budget f=⌊(n−1)/3⌋ is zero, where every signer is load-bearing and one compromised key is not a fault absorbed by a margin but a forged certificate. It did not stop at the node that admitted it, and that is the part that made it worth a clause. TryAccept hands the accepted cert's bytes to GossipCert, and applyBranchFinalization files them as the proof served to stragglers on catch-up. So one admission turned a stake-less node into a second source for a certificate carrying no fault budget, and every node it convinced became a third. The floor stops that at each hop, which is why it belongs at the arrival gate and not only at the accept. The clause is the one verifyQuasarSupermajority already holds on the WEIGHTED road, read here against the committee because that is this road's authoritative view of its set — the same sentinel and the same TwoThirdsCount number, so the two Go roads refuse the same certificate by the same name. Both roads are Go's, and that is the whole comparison. No other implementation has a stake-less accept road for this clause to exist on: Rust's Cert::verify is the structural predicate its weighted road runs first, never an accept rule on its own, and C++'s QuorumCertEngine::verify_cert fails closed on an empty stake model before it reads a vote. Go alone accepts with no stake source, so Go alone needed this, and it is Go's own weighted road it is brought up to. The predicate is AuthorizesExport, not an equality on Quasar. The weighted road is fail-closed by construction — its tier switch ends in ErrQCUnknownTier — and an equality here would be allow-by-omission: Horizon sits above Quasar on the ladder, so the day it becomes attestable a Horizon cert would cross this road with no floor at all. Behaviour is identical today, because Verify refuses any tier that is not Nova or Quasar before this line; the rung's own predicate makes tomorrow safe by construction rather than by review. Nova keeps no such floor and must not grow one: it authorizes only local execution the chain can still reorg away, and a small chain has to be able to make local progress. The Nova case pins that. Not reachable on a stake-wired chain, which takes the weighted road, and not mintable — quasarAttestor, the one Quasar producer, is wired only when a stake source is present, so a stake-less chain has no export cert of its own. It had to ARRIVE. Fail-closed once closed, at no cost to the deployment that has always run Nova-only. TestExportCommitteeFloorHoldsOnTheCountOnlyRoad is the regression, on the road TestExportNeedsAByzantineCommittee could not reach: a stake-less engine whose committee is exactly n, and a certificate unanimous over it declaring the quorum it derives, so nothing but the committee can refuse it. It admits at n of one, two and three without this clause. Also widens the reject table's G2 identity to its real width. At 95 bytes it died at the proof-width gate and never reached the decode it exists to test — a green duplicate of the short-proof row above it. At 96 it is refused where the frozen corpus records the refusal. Co-authored-by: Hanzo Dev <[email protected]>