From 5e2cbf62fe337ed0a04814bf9c2029d01462abed Mon Sep 17 00:00:00 2001 From: Nicholas Dudfield Date: Fri, 10 Jul 2026 16:24:35 +0700 Subject: [PATCH] docs(export): simplify submitter co-signer model --- .../consensus/ConsensusExtensionsDesign.md | 19 +++++++++---------- src/xrpld/app/consensus/ExportIntent.md | 17 ++++++++--------- 2 files changed, 17 insertions(+), 19 deletions(-) diff --git a/src/xrpld/app/consensus/ConsensusExtensionsDesign.md b/src/xrpld/app/consensus/ConsensusExtensionsDesign.md index 86fb59374..29506432a 100644 --- a/src/xrpld/app/consensus/ConsensusExtensionsDesign.md +++ b/src/xrpld/app/consensus/ConsensusExtensionsDesign.md @@ -455,16 +455,15 @@ static destination SignerList should remain anchored to the original source universe during NegativeUNL periods, trading Export liveness for unchanged destination authority. -A hardened deployment may add a separate mandatory executor signer to the -destination SignerList. Choose weights so destination quorum requires both the -source-validator threshold and the executor; for validator weight total `V` and -required validator weight `q`, executor weight `V` with target quorum `V + q` -is the simple construction. Proposal-carried validator shares then remain inert -until the executor observes a validated source latch and signs. The executor -cannot authorize alone but becomes a liveness and censorship dependency. It -consumes one destination SignerList entry, so this profile supports at most 31 -source validator identities under a 32-entry limit, and it does not solve XPOP -replay after target execution. +A hardened deployment may add a required submitter co-signer to the destination +SignerList, held by the target-submission process. Choose weights so destination +quorum requires both the source-validator threshold and that key; for validator +weight total `V` and required validator weight `q`, submitter weight `V` with +target quorum `V + q` is the simple construction. Proposal-carried validator +shares then remain inert until the submitter observes a validated source latch +and signs. The key cannot authorize alone but becomes a liveness and censorship +dependency. It consumes one destination SignerList entry, so this profile +supports at most 31 source validator identities under a 32-entry limit. The extended proposal machinery is enabled when either feature needs signed sidecar fields. Do not make Export depend on RNG availability just because RNG diff --git a/src/xrpld/app/consensus/ExportIntent.md b/src/xrpld/app/consensus/ExportIntent.md index e57654999..156eaff84 100644 --- a/src/xrpld/app/consensus/ExportIntent.md +++ b/src/xrpld/app/consensus/ExportIntent.md @@ -145,15 +145,14 @@ SignerList is static, configure it against the original pre-NegativeUNL source universe and accept reduced Export liveness during NegativeUNL periods rather than lowering destination authority. -An optional stronger deployment profile adds a separate mandatory executor -signer. If validator weights total `V`, validator threshold is `q`, executor -weight is `C`, and target quorum is `C + q > V`, validator shares alone cannot -execute and the executor still needs validator weight `q`. The executor signs -only after observing the validated source latch. This converts the executor into -a liveness/censorship dependency, not a sole safety authority, and does not -replace callback replay protection after target execution. A separate executor -also consumes one target SignerList entry, leaving at most 31 source validator -identities under a 32-entry destination limit. +An optional stronger deployment profile adds a required submitter co-signer held +by the target-submission process. If validator weights total `V`, validator +threshold is `q`, submitter weight is `C`, and target quorum is `C + q > V`, +validator shares alone cannot execute and the submitter still needs validator +weight `q`. It signs only after observing the validated source latch, turning +the submitter into a liveness/censorship dependency rather than a sole safety +authority. The separate key consumes one target SignerList entry, leaving at +most 31 source validator identities under a 32-entry destination limit. ## Replay Witness Shape