ARCHIVE/xahaud
3
0
Fork 0
mirror of https://github.com/Xahau/xahaud.git synced 2026-07-24 23:50:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(export): describe optional executor gate

Browse Source
This commit is contained in:
Nicholas Dudfield
2026-07-10 16:21:03 +07:00
parent b942a29fd8
commit 75d08560d4
2 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/xrpld/app/consensus/ConsensusExtensionsDesign.md
View File

@@ -455,6 +455,17 @@ static destination SignerList should remain anchored to the original source
universe during NegativeUNL periods, trading Export liveness for unchanged
destination authority.
A hardened deployment may add a separate mandatory executor signer to the
destination SignerList. Choose weights so destination quorum requires both the
source-validator threshold and the executor; for validator weight total `V` and
required validator weight `q`, executor weight `V` with target quorum `V + q`
is the simple construction. Proposal-carried validator shares then remain inert
until the executor observes a validated source latch and signs. The executor
cannot authorize alone but becomes a liveness and censorship dependency. It
consumes one destination SignerList entry, so this profile supports at most 31
source validator identities under a 32-entry limit, and it does not solve XPOP
replay after target execution.
The extended proposal machinery is enabled when either feature needs signed
sidecar fields. Do not make Export depend on RNG availability just because RNG
was the first consumer of `ExtendedPosition`.

10
src/xrpld/app/consensus/ExportIntent.md
View File

@@ -145,6 +145,16 @@ SignerList is static, configure it against the original pre-NegativeUNL source
universe and accept reduced Export liveness during NegativeUNL periods rather
than lowering destination authority.
An optional stronger deployment profile adds a separate mandatory executor
signer. If validator weights total `V`, validator threshold is `q`, executor
weight is `C`, and target quorum is `C + q > V`, validator shares alone cannot
execute and the executor still needs validator weight `q`. The executor signs
only after observing the validated source latch. This converts the executor into
a liveness/censorship dependency, not a sole safety authority, and does not
replace callback replay protection after target execution. A separate executor
also consumes one target SignerList entry, leaving at most 31 source validator
identities under a 32-entry destination limit.
## Replay Witness Shape
The accepted local export sidecar snapshot is not consumed directly by