ARCHIVE/xahaud
3
0
Fork 0
mirror of https://github.com/Xahau/xahaud.git synced 2026-07-23 23:20:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: pin Export committee replay guard

Browse Source
This commit is contained in:
Nicholas Dudfield
2026-07-16 13:48:02 +07:00
parent 66214c8ab3
commit 142fde5acd
3 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/test/app/Export_test.cpp
View File

@@ -911,6 +911,17 @@ struct Export_test : public beast::unit_test::suite
BEAST_EXPECT(
releasedLatch->getFieldH256(sfExportSignatureHash) ==
witness->getTransactionID());
// Witnessed latches still resolve their immutable committee during
// replay. The committee therefore remains undeletable until the latch
// itself reaches terminal cleanup.
Json::Value eraseCommittee;
eraseCommittee[jss::TransactionType] = jss::Export;
eraseCommittee[jss::Account] = alice.human();
eraseCommittee[jss::Flags] = tfExportEraseCommittee;
eraseCommittee[sfExportCommitteeHash.jsonName] =
to_string(committeeHash);
env(eraseCommittee, fee(XRP(1)), ter(tecHAS_OBLIGATIONS));
}
void

4
src/xrpld/app/consensus/ConsensusExtensionsDesign.md
View File

@@ -449,7 +449,9 @@ default committee and no implicit capped subset of the full UNL. Bare setup may
pre-stage a roster, but every actual intent checks every roster master against
the exact admitting parent ledger's pre-NegativeUNL `UNLReport`. Inline roster
creation and intent admission perform that check atomically. Committee deletion
is blocked while the owner has any live Export latch.
is blocked while the owner has any live Export latch. That guard is coupled to
witness apply's parent-state committee lookup: weakening it to pending-only
would make a retained latch's accepted witness unreplayable.
The destination account's SignerList remains the actual remote authority. Its
keys, weights, optional operator signer, and rotation policy are client/operator

5
src/xrpld/app/consensus/ExportIntent.md
View File

@@ -41,7 +41,10 @@ as an explicit template, but the protocol never silently selects it.
Committee deletion is rejected while the owner has any live Export latch. This
coarse rule keeps every accepted witness replayable without storing the roster
again in every latch or maintaining a metadata-expensive reference count.
again in every latch or maintaining a metadata-expensive reference count. The
deletion guard and witness apply's committee lookup are one load-bearing
invariant: do not weaken the guard to pending-only while latches retain only a
committee digest.
**INV-3 - qC and qV answer different questions.**
qC is the content threshold for one account-selected committee: