From 75d08560d4600fc7792ea5b9ca7ee54d4f2dd7a5 Mon Sep 17 00:00:00 2001 From: Nicholas Dudfield Date: Fri, 10 Jul 2026 16:21:03 +0700 Subject: [PATCH] docs(export): describe optional executor gate --- src/xrpld/app/consensus/ConsensusExtensionsDesign.md | 11 +++++++++++ src/xrpld/app/consensus/ExportIntent.md | 10 ++++++++++ 2 files changed, 21 insertions(+) diff --git a/src/xrpld/app/consensus/ConsensusExtensionsDesign.md b/src/xrpld/app/consensus/ConsensusExtensionsDesign.md index 018680022..86fb59374 100644 --- a/src/xrpld/app/consensus/ConsensusExtensionsDesign.md +++ b/src/xrpld/app/consensus/ConsensusExtensionsDesign.md @@ -455,6 +455,17 @@ static destination SignerList should remain anchored to the original source universe during NegativeUNL periods, trading Export liveness for unchanged destination authority. +A hardened deployment may add a separate mandatory executor signer to the +destination SignerList. Choose weights so destination quorum requires both the +source-validator threshold and the executor; for validator weight total `V` and +required validator weight `q`, executor weight `V` with target quorum `V + q` +is the simple construction. Proposal-carried validator shares then remain inert +until the executor observes a validated source latch and signs. The executor +cannot authorize alone but becomes a liveness and censorship dependency. It +consumes one destination SignerList entry, so this profile supports at most 31 +source validator identities under a 32-entry limit, and it does not solve XPOP +replay after target execution. + The extended proposal machinery is enabled when either feature needs signed sidecar fields. Do not make Export depend on RNG availability just because RNG was the first consumer of `ExtendedPosition`. diff --git a/src/xrpld/app/consensus/ExportIntent.md b/src/xrpld/app/consensus/ExportIntent.md index 6fae38eec..e57654999 100644 --- a/src/xrpld/app/consensus/ExportIntent.md +++ b/src/xrpld/app/consensus/ExportIntent.md @@ -145,6 +145,16 @@ SignerList is static, configure it against the original pre-NegativeUNL source universe and accept reduced Export liveness during NegativeUNL periods rather than lowering destination authority. +An optional stronger deployment profile adds a separate mandatory executor +signer. If validator weights total `V`, validator threshold is `q`, executor +weight is `C`, and target quorum is `C + q > V`, validator shares alone cannot +execute and the executor still needs validator weight `q`. The executor signs +only after observing the validated source latch. This converts the executor into +a liveness/censorship dependency, not a sole safety authority, and does not +replace callback replay protection after target execution. A separate executor +also consumes one target SignerList entry, leaving at most 31 source validator +identities under a 32-entry destination limit. + ## Replay Witness Shape The accepted local export sidecar snapshot is not consumed directly by