ARCHIVE/xahaud
3
0
Fork 0
mirror of https://github.com/Xahau/xahaud.git synced 2026-07-23 15:10:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(entropy): state attribution gate ordering

Browse Source
This commit is contained in:
Nicholas Dudfield
2026-07-16 20:30:31 +07:00
parent 7241f6195d
commit fd144943b2
2 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/xrpld/app/consensus/ConsensusEntropyIntent.md
View File

@@ -150,12 +150,14 @@ bounded deadline. *Anti-pattern:* requiring `fullObservation()` before ignoring
below-quorum conflict, which lets a minority equivocation recreate a veto.
**INV-4A — Every counted position is authenticated; every reveal is proofed.**
Proposal sidecars are validator statements. Before a proposal position may enter
the peer-position store, count toward root alignment, or contribute a commitment
or reveal, its signature must verify and its signing key must resolve to the
claimed active-view master `NodeID`. Cluster-peer transport trust never
substitutes for either check. This authenticated active-view cohort is the only
universe alignment and contribution counts may observe.
Proposal sidecars are validator statements. A proposal signature must verify
before its position enters the peer-position store; cluster-peer transport trust
never substitutes for that check. Before a stored position may count toward root
alignment, its captured master `NodeID` must belong to the active view. Before it
may contribute a commitment or reveal, ingress additionally verifies that its
signing key resolves to that active-view master. These authenticated,
active-view-filtered cohorts are the only universes alignment and contribution
counts may observe.
In this document, a *proofed commitment* is a commitment from proposal sequence
zero accompanied by a self-contained serialized `ExtendedPosition` whose

15
src/xrpld/app/consensus/ConsensusExtensionsDesign.md
View File

@@ -257,13 +257,14 @@ commit transport path.
Commit quorum counts only proofed commits from active validators. A commit that
cannot be emitted as a verifiable sidecar leaf does not count.
Every proposal position used for commitment/reveal harvest or sidecar-root
alignment has already passed proposal-signature verification and active-view
master/signing-key attribution before entering consensus peer-position state.
Cluster transport trust does not bypass that boundary. Here, *proofed* means a
sequence-zero commitment accompanied by a self-contained serialized signed
`ExtendedPosition` whose signature and attribution both verify; a bare digest is
not a proofed commitment.
Every proposal signature is verified before its position enters consensus
peer-position state; cluster transport trust does not bypass that boundary.
Sidecar-root alignment then counts only stored positions whose captured master
belongs to the active view, while commitment/reveal harvest additionally verifies
the live signing-key-to-master attribution. Here, *proofed* means a sequence-zero
commitment accompanied by a self-contained serialized signed `ExtendedPosition`
whose signature and attribution both verify; a bare digest is not a proofed
commitment.
Reveal collection targets all known committers, because the commit sidecar set
defines who is expected to reveal. The reveal wait is still bounded. A node