mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekay
5be093c149
Red proved a deterministic cross-node fork in v1.33.1: the finality layer had NO signing-side per-height equivocation lock, so an honest node would sign accept for two conflicting valid siblings at one height; each gathered a ≥⅔-stake cert → different honest nodes finalized different blocks → fork (reachable f=0 via the down-proposer transient the liveness fix opens; ~1-2/8 emergent). Port of consensus2 committed_slot_ to Go: a per-height committedSlot map (height → bound canonical id), reserved through ONE self-locking funnel reserveSlotForSign that BOTH signing sites route through — recordOwnVoteLocked (own proposal, t.mu held) and followVerifiedBlock (follower, t.mu released). A second DIFFERENT canonical at a bound height is REFUSED (never signed); the same one is idempotent (safe re-solicit). Pruned below the finalized height (bounded). This makes honest double-vote IMPOSSIBLE BY CONSTRUCTION — the quorum-intersection overlap that a fork needs can no longer be honest, so a real fork requires f≥n/3 (beyond the guarantee). Tests: all 3 Red repros (red_sibling_fork_test.go) flip RED→GREEN; the shared test validator set now models honest per-validator vote-once (equivocation needs actual Byzantine validators); emergent probe 15× no fork; full engine/chain suite green under -race. BFT ≥ avalanche, f<n/3 safety restored; extends, does not break.