Finality pause of 6 October 2026: incident entry, ledger F27 and the F19 correction, spec 03 W7, the leave plan and harness case
- docs/bench-log.md: "6 October 2026, 18:40Z to 20:41Z, the live devnet's finality pause": the timeline from the hub's own log and the hands' logs (local time +01:00: both hands stopped 18:30:28Z, returned 18:41:54Z and 18:42:07Z, relaunched under launchd 18:45:57Z and 18:46:39Z), the cause in the code (rule v3's frozen table at lock 6842, 42.7 percent of it held by 20 keys that stopped at 17:20 to 18:30Z, expiring at DAA 216,402), what was ruled out with the line that rules it out (the hands, the aggregators, the "level is 0" rejects = the Igneum Wallet app's bundled 5 October igneumd on this Mac), and what "paused" meant per tier - docs/fud-ledger.md: F27 (the incident as a critic will post it, with the fix and the operational rule) and the F19 correction: a silent 40 percent under rule v3 stalls the full window, 30 days on mainnet, not "day 19 to 20" (the v2 arithmetic) - docs/spec/03-finality.md: W7, the departure announcement, and the Q5 note - docs/plans/finality-leave.md: the 0.3.16 plan (what changes, why this candidate, the Devnet 2 gate, what it does not do, per tier) - tools/finality-attacks/leave.mjs: the harness case on the v3 runner's shape (45 percent of weight stops with leaves; --silent is the known-failed case), designed and not yet run (it needs W7 binaries on the harness host); lib/net.mjs gains the noLeave option - infra/fast-time/override-60x.json: leave_delay 10 and the leave switch at never, explicit Fork: branch finality-pause-node on 4c6b129d (vendor/igneum-node-finpause). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
igneum-labs
parent
797b3dd163
commit
562c33e8e5
7 changed files with 222 additions and 3 deletions
|
|
@ -2597,3 +2597,28 @@ USD 20 an hour on community pods, against a devnet of 1.16 GH/s.
|
|||
Consequence: the devnet's hash is rentable for the price of a dinner, so nothing on it is a security result; the counter-ASIC and
|
||||
finality work is tested there for correctness, not for cost. The cost argument only starts at the TH/s scale, where the rental
|
||||
market's supply (not its price) is the limit, and that number belongs in the litepaper with this caveat.
|
||||
|
||||
## 6 October 2026, 18:40Z to 20:41Z, the live devnet's finality pause (finality owner, worktree `finality-pause`, fork `finality-pause-node` on 4c6b129d)
|
||||
|
||||
What happened, from the hub's own log (hub-1, RunPod 213.173.107.74, node bb43e9a8 up since 17:32:04Z, 54 peers; pulled read-only by the fleet agent), the two Mac hands' logs (local time +01:00) and the observer's rows (Horizon lane 3, `docs/analysis/horizon/finality-and-weight.md` 3.1):
|
||||
|
||||
| Time (UTC) | Event | Source |
|
||||
|---|---|---|
|
||||
| 17:20 to 18:30 | 20 keys stop mining the live chain: 7 earlier leavers, then the 13 fleet keys the class v4 rehearsal job took at 18:27 to 18:30; together 3,026 of 7,083 blue blocks (42.7 percent) of the table frozen at the last lock | observer `live_checkpoints`, Horizon 3.1 |
|
||||
| 18:30:28 | Both Mac hands stop (`igneumd has stopped...` at 19:30:28+01:00, SIGTERM); the wallet app's bundled node restarts 3 s later | `/tmp/igneum-devnet/node1.out`, `observer-v4.out`, `ps` |
|
||||
| 18:30 to 18:39 | Locks 6824 to 6842 form WITHOUT the hands (83 of 93 signers, 78.5 to 79.7 percent of total); the hub builds 6836 itself under the any-node fallback (`certificate built for checkpoint 6836 ... by 73 of 88 voters ... aggregator 6e80f3ef`) | hub-1 log |
|
||||
| 18:39:36.925 | Last lock: `certificate at index 6842 received: 71 of 91 voters, weight 4924 of 7078`, `LOCKED ... 78.8% of total, 78.7% of the table frozen at lock 6841`; folded 18:39:38.702 to 79 of 91 | hub-1, p1-4090 (18:39:37.115) |
|
||||
| about 18:40 | 6843 determined (DAA 209,233); 75 of 93 voters' votes, 53.1 percent of total: under two thirds, no certificate anywhere | observer rows, every node's log from here shows only `determined` |
|
||||
| 18:41:54 / 18:42:07 | The hands return, IBD from 192.168.68.67, receive and fold the certificates up to 6842, determine 6843 onward, lock nothing | the hands' logs |
|
||||
| 18:45:57 / 18:46:39 | The hands are SIGTERMed again and relaunched under launchd (the observer's node panics once at `igneum/exec/src/rpc.rs:591` index out of bounds and is relaunched) | `~/Library/Logs/Igneum/*.out` |
|
||||
| 19:14:53 | Checkpoint 6912: the stayers hold 74.9 percent of the sliding table and still no lock: they hold 57.3 percent of the table frozen at 6842 | observer rows |
|
||||
| 19:52 to 20:1x | API `finality.active=false`, `latest_locked_index=6842`; the hub and p1-4090 log `determined` every 30 s and nothing else | `/api/stats`, fleet pull |
|
||||
| 20:4x (expected) | The frozen table expires when a checkpoint block's DAA reaches 209,202 + 7,200 = 216,402 (sink rate 0.9905 DAA/s measured 18:30 to 20:01Z); first lock about index 7082 | arithmetic; the watcher's result is appended below |
|
||||
|
||||
Cause (confirmed in the code, `consensus/src/processes/finality.rs` `evaluate` and `frozen_table`): rule v3 (Q5) needs the signers at two thirds of the table frozen at the last lock on the chain, and `frozen_table()` returns `None` only when the checkpoint block's DAA is a full window past the lock's. The 20 departed keys hold 42.7 percent of that table, so no signer set can reach two thirds of it until it expires, whatever the sliding table says. Nothing on the aggregation path is involved: the fallback (any node, 15 DAA after determination) exists and fired, and every node computes the same frozen table from the chain.
|
||||
|
||||
Ruled out, with the line that rules it out: the hands as a star (locks 6824 to 6842 formed while both were down); vote routing through the VRF aggregators (the hub's own `certificate built` at 18:36:38Z under the fallback); votes dropped by the `level is 0 when it's expected to be at least 38` rejects (those are the Igneum Wallet app's bundled igneumd on this Mac, 2.121.2.18 public and 192.168.68.64 on the LAN, a 5 October build with no commit string at protocol version 12 and no params digest, dialling node 1 and the hub every 30 s, asking for block cd6666c9, failing to compute a class v3 block's level and dropping: 172 rejects on the hub since 18:30Z, all from that address, a block relay reply and not on any vote path; the fix is a 0.3.14 node in the wallet bundle); the 0.3.15 canary's version-1026 blocks (from 19:14Z, after the pause began).
|
||||
|
||||
What "paused" meant per tier (and means on mainnet for the same event, a 43 percent departure in three minutes): a holder saw `finality_active` false for 2 hours (30 days on mainnet under v3, 7.7 days under v2) and lost nothing: blocks, execution, payouts and the hourly program continued and every lock before 6842 stood (the F20 guarantees, measured); a home miner or rig mined and was paid, its blocks counted; a prover's segment records kept being paid through the pause (`segment record 143654..143661 ... accepted` at 20:53 local); a pool that moves servers without a leave holds the whole network's finality for a window, and with one (0.3.16) only its own hour; a rollup customer's proofs continued but anything that waits for a certified checkpoint waited the whole pause, which on mainnet is a month and is why the departure announcement is a launch requirement.
|
||||
|
||||
What was done: (1) the timeline and cause reported to main at 20:0xZ; (2) no operator action proposed: the frozen table is chain state, identical on every node, so no restart or re-dial can end the pause, only the departed keys returning (9.4 points of the frozen table would do) or the expiry; (3) the W7 departure announcement implemented on the fork (`docs/plans/finality-leave.md`): a signed leave item carried in blocks removes its key from the sliding and the frozen denominators `leave_delay` (3,600 DAA) after its first carrier until the window has passed, behind `finality_leave_activation_daa` and protocol version 17, with the miner sending it on a clean stop and `igneum-miner leave` by hand; unit test with the known-failed case (silent 40 percent pauses for the window) and the fixed case (lock within the delay); (4) ledger F27, the F19 correction (a silent 40 percent under v3 stalls the full window, not "day 19 to 20"), spec 03 W7.
|
||||
|
|
|
|||
|
|
@ -1505,7 +1505,7 @@ Evidence: M1, O-1.17, spec 1.13 and 1.16, M16's arithmetic. Experiment: the scor
|
|||
### F19. Old vote keys can be bought; fresh hashrate cannot buy weight
|
||||
"Weight is 30 days of blocks per key, and keys are free to make and free to sell. I do not rent hashrate for 20 days. I buy, borrow or steal the vote keys of pools that already mined those 20 days. Your simulation models the renter and never the buyer."
|
||||
|
||||
Status: Answered with evidence (`sim/results_v2.md` scenario K, 4 October 2026, at the 0.85 and the 2/3 floor, seeds 7 to 19): a bought key is worth the blocks it holds and nothing more. Keys worth 20% of the window plus 30% of hashrate never reach a third; keys worth 40% hold the veto from purchase until day 19 to 20 and are worth 30% on day 30, the same as fresh hashrate; 0 conflicting locks in every row. The cost at the 2/3 floor: a silent 40% buyer stalls 63,307 to 68,716 of 86,400 checkpoints in 30 days (305 to 1,085 at the old floor). The 40/40/20 row is scenario I (0 conflicts). O-3.15 was decided on 4 October 2026 (the 2/3 floor). Not modelled: a seller who keeps a copy of the key and equivocates; the price of a pool's key against F5's hashrate cost is not a simulator question. Was: Open, experiment scheduled (O-3.15).
|
||||
Status: Answered with evidence, CORRECTED for rule v3 (6 October 2026, 21:1xZ, the finality owner after the live devnet's pause): the "day 19 to 20" figure below is the rule v2 arithmetic (the sliding table alone, `30 (1 - 1/(3x))` days for a silent share x) and is no longer what the live rule does. Under rule v3 (Q5, active since N3 = 135,200 on 5 October 2026) a silent 40 percent that holds the veto stalls the FULL weight window, 30 days on mainnet, because the table frozen at the last lock keeps the silent keys at their weight until that lock is one window old; measured on the devnet tonight: 20 keys holding 42.7 percent of the frozen table stopped at 18:27 to 18:30Z, the last lock was 6842 at 18:39:36Z, the stayers held 74.9 percent of the sliding table from 19:14Z and still no lock; the first lock came at the frozen table's expiry, DAA 216,402 (lock 6842's DAA 209,202 plus the 7,200-DAA window), about 20:41Z (`docs/analysis/horizon/finality-and-weight.md` 3.1 and 4.1; bench-log "6 October 2026, 18:40Z to 20:41Z, the live devnet's finality pause"). What ends it sooner: the silent keys returning and signing (0 minutes after, J and L1), or, once the W7 leave rule of 0.3.16 is active, a leave by the departing keys (`leave_delay`, one hour, after its first carrier); a key that goes silent WITHOUT leaving still holds the veto for the window, under v3 as under v2, which is the rule's price and is stated in 3.3.1. Was: Answered with evidence (`sim/results_v2.md` scenario K, 4 October 2026, at the 0.85 and the 2/3 floor, seeds 7 to 19): a bought key is worth the blocks it holds and nothing more. Keys worth 20% of the window plus 30% of hashrate never reach a third; keys worth 40% hold the veto from purchase until day 19 to 20 and are worth 30% on day 30, the same as fresh hashrate; 0 conflicting locks in every row. The cost at the 2/3 floor: a silent 40% buyer stalls 63,307 to 68,716 of 86,400 checkpoints in 30 days (305 to 1,085 at the old floor). The 40/40/20 row is scenario I (0 conflicts). O-3.15 was decided on 4 October 2026 (the 2/3 floor). Not modelled: a seller who keeps a copy of the key and equivocates; the price of a pool's key against F5's hashrate cost is not a simulator question. Was: Open, experiment scheduled (O-3.15).
|
||||
|
||||
Answer: Correct, and the ledger had no entry for it. Spec 3.1 W6 says weight is the only Sybil-resistant quantity because it takes public mining to earn; it does not say what happens when an earned key changes hands. A compromised or sold key carries its whole 30-day history, so the 10-day and 20-day figures of F5 apply only to an attacker who mines; a buyer's day count is zero. What limits it today: W5 moves weight to a successor only by a message the old key signs (O-3.11), equivocation strips a key for 30 days (3.6), and pool keys are few and public (F10). What is missing: the acquisition cost of the top pools' keys against the hashrate cost of F5, whether weight should decay faster than 30 days when a key's blocks stop matching its earlier profile, and whether W5 should make the successor re-earn. Gate 3, in `finality_v2.py`: k% of weight changes hands at day 0 against the same k% arriving as fresh hashrate, for k in 20, 34 and 40, with the 40/40/20 partition row the reviewer asked for under the active-set rules and the floor, reporting time to a conflicting lock under each.
|
||||
|
||||
|
|
@ -1969,6 +1969,17 @@ Answer: Correct, measured. The red-team run's first scenario errored on it (`doc
|
|||
|
||||
Evidence: the first run's `/tmp/igneum-redteam-fin/n0/node.log` parse line (kept in the session scratchpad `rt/logs/fa_s8/n0/node.log`), `rt/logs/ord_s2.log`.
|
||||
|
||||
### F27. Twenty keys stopped without a word and finality paused for two hours; on mainnet that is a month
|
||||
"Your fleet operator moved 13 boxes to another chain at 18:30Z and your own devnet's finality stopped at 18:40Z and did not come back for two hours, with 93 voters online and the hub up. Under your frozen table a third of weight that goes quiet, a data centre fire, a hosting ban, holds every lock for 30 days. You called that a feature."
|
||||
|
||||
Status: Fix built, pending rollout (6 October 2026, 21:1xZ, the finality owner; fork branch `finality-pause-node` on 4c6b129d, sized for 0.3.16: the W7 departure announcement of spec 03, `finality_leave_activation_daa`, a digest move). Incident: ledger-grade timeline in bench-log "6 October 2026, 18:40Z to 20:41Z, the live devnet's finality pause"; cause and candidates in `docs/analysis/horizon/finality-and-weight.md` (Horizon lane 3). Operational rule in force since 20:0x UK (CLAUDE.md, the standing fleet): a standing box never leaves the live chain for an experiment; any orchestrated departure over 10 percent of weight is staged in slices under 10 percent an hour.
|
||||
|
||||
Answer: Correct on the facts and on the mainnet arithmetic; the pause was the rule doing what 3.7 item 2 says, and the frozen table of Q5 is why it lasted a window rather than the 35 minutes rule v2 would have taken (the stayers held 74.9 percent of the sliding table from 19:14Z). The topology hypotheses (the hands as a star, the aggregators, votes dropped by the old wallet node's rejects) were all refuted from the hub's own log: locks 6824 to 6842 formed while both Mac hands were down, the hub built a certificate itself at 18:36:38Z under the any-node fallback, and every node holds the same frozen table because it is computed from the chain. What distinguishes a departure from a partition is a message the departing key can sign and a partitioned key cannot: the leave (W7). With it, an orchestrated or clean departure of any size ends its pause one hour after the first block that carries the leave, with 0 conflicting locks in every partition, eclipse and equivocator row of the simulator (3 seeds, mainnet scale: `sim/horizon/finality-and-weight/results/`), and an attacker who buys keys to leave them gains nothing over signing with them (4.2). What it does not cover, stated: a crash, a power cut, a region going dark still age out over the window; the app's Stop and the fleet library send the leave, a node that returns after an unplanned stop sends it then, and staging under 10 percent an hour keeps finality on with no protocol change at all (every lock re-freezes the table). The known-failed case is the first assertion of the node's unit test `a_signed_leave_ends_the_pause_after_the_delay_and_a_silent_departure_holds_it_for_the_window`: a silent 40 percent pauses until the frozen table expires; with the leave, the first lock comes `leave_delay` after the carrier.
|
||||
|
||||
Per tier, what "paused" meant tonight and means on mainnet: a holder saw `finality_active` false for 2 hours (30 days on mainnet for the same event) and lost nothing: blocks, execution, payouts and the hourly program continued, every lock before 6842 stood, exchanges fall back to the 12-hour finality depth of 3.9; a miner (home, rig) mined and was paid as before and its blocks counted toward weight; a prover's records were paid (segment records kept landing through the pause); a pool: one leave per server on maintenance ends its own share's pause in an hour, and a pool that moves servers without one holds the network for a window; a rollup customer: proofs continued, but a bridge that waits for a certified checkpoint waited the whole pause (two hours tonight, a month on mainnet without the leave), which is the number that makes W7 a launch requirement and not a nicety.
|
||||
|
||||
Evidence: hub-1's log 18:30Z to 19:56Z (fleet pull, `scratchpad/finality-pause/hub-1.log`), `/tmp/igneum-devnet/node1.out` and `observer-v4.out` (local time +01:00), the observer's `live_checkpoints` rows, `consensus/src/processes/finality.rs` `frozen_table`. Experiment: the W7 harness case on the Devnet 2 gate of 0.3.16 (45 percent of weight stops with leaves, first lock within `leave_delay` plus one checkpoint, 0 conflicts in the 50/50 and 60/40 splits and the 34 percent eclipse).
|
||||
|
||||
### X19. Operational knobs and silences in the shipped node
|
||||
"A slow-clock node disconnects every peer on every relayed block and never says why; the handshake's `time_offset` is computed and unused; `IGNEUM_ATTACK_TS_OFFSET_MS` and `IGNEUM_POW_STRIKES` are compiled into the live binary; `timestamp_deviation_tolerance` is dead and still accepted."
|
||||
|
||||
|
|
|
|||
67
docs/plans/finality-leave.md
Normal file
67
docs/plans/finality-leave.md
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
# The departure announcement (spec 03 W7): plan for 0.3.16
|
||||
|
||||
Written 6 October 2026, 21:2xZ, by the finality owner, during the live devnet's finality pause (18:40Z to about 20:41Z).
|
||||
Cause and candidates: `docs/analysis/horizon/finality-and-weight.md` (Horizon lane 3). Incident: `docs/bench-log.md`
|
||||
"6 October 2026, 18:40Z to 20:41Z, the live devnet's finality pause"; ledger F27 and the F19 correction. Code: fork
|
||||
branch `finality-pause-node` on 4c6b129d (release 0.3.14's node), worktree
|
||||
`/Users/joshm/Projects/igneum-wt-finality-pause/vendor/igneum-node-finpause`.
|
||||
|
||||
## 1. What changes
|
||||
|
||||
| Piece | Where | What |
|
||||
|---|---|---|
|
||||
| The leave item | `consensus/core/src/finality.rs` | `Leave { daa, pubkey, signature }` (152 bytes) signed under `DST_LEAVE` over `"igneum-leave-v1/" || chain_id || 0 || daa_le`; `FinalityItem::Leave` tag 4; `FinalityGossip::Leave`; `FinalityParams::leave_delay` (serde default 3,600; mainnet and devnet 3,600) |
|
||||
| The switch | `consensus/core/src/config/params.rs` | `finality_leave_activation_daa` on `Params` and `OverrideParams` (never on mainnet, devnet, simnet; 0 on the testnet, which is born on every switch), in the digest with `leave_delay` |
|
||||
| The rule | `consensus/src/processes/finality.rs` | `leaves_at` (like `bans_at`: a key has left at C when a block in C's past carries its leave and `daa(e) + leave_delay <= daa(C) < daa(e) + window`); `voters_at` applies leaves with the bans (the sliding table); `frozen_floor` subtracts the keys that left at C from the frozen table's denominator and their signatures from its numerator (Q5); `ingest_leave` (one record per key, carriers dated), `submit_leave`, carriage in `template_section` LAST and only once the rule is active; persisted state layout 3 (`leaves`), layouts 2 and 1 read and upgraded |
|
||||
| p2p | `protocol/flows/src/v10/finality.rs`, `flow_context.rs`, `v17/`, `service.rs` | `KIND_LEAVE = 3`; protocol version 17; `broadcast_finality_leave` to peers at 17 or later only (an older relay flow returns a protocol error on an unknown kind and drops the peer); every peer still reads leaves from blocks |
|
||||
| RPC | `rpc/*` | `submitFinalityLeave` (hex of the wire bytes; `accepted`, `reason`), op 157, proto ids 1129 and 1130 |
|
||||
| The miner | `igneum/miner/src/main.rs` | `mine` sends the leave for every identity when `secs` run out unless `--no-leave`; `igneum-miner leave <grpc url> <label>` by hand (a node back from an unplanned stop, an operator retiring a key) |
|
||||
| The node's first lines | `kaspad/src/daemon.rs` | `Finality leave rule from the override file: ... from checkpoint DAA score N` and the `Finality v2 (...)` line ends with `leave rule (W7, delay 3600 DAA) from checkpoint DAA N` |
|
||||
|
||||
Nothing in block validity changes. A block carrying a leave is as valid as before on every version; a 0.3.14 or 0.3.15
|
||||
node's section decoder stops at the leave's tag and keeps the votes, certificates and evidence before it, which is why
|
||||
the template puts leaves last. Before the activation no node carries a leave in a block, so an old node never meets the
|
||||
tag; after it every node is new by the 95 percent signal rule (or the floor height), so the voter tables agree.
|
||||
|
||||
## 2. Why this and not the others
|
||||
|
||||
Section 4.2 of the Horizon analysis: a rule that removes weight on what a view has NOT seen (a vote missing for T
|
||||
hours, a decaying denominator, a hysteresis floor) gives each side of a partition a different denominator and reopens
|
||||
the double lock (467 to 473 conflicting locks in the 50/50 split under fast decay; the 13.3 percent equivocator bound
|
||||
of 3 October back under hysteresis). A leave is seen, not inferred: a partition side never sees the other side leave.
|
||||
In the simulator (3 seeds, mainnet scale) the leave rule gives a first lock 1 hour after a 34, 45 or 50 percent
|
||||
departure where v3 waits 30 days, 0 conflicting locks in every partition, eclipse and equivocator row, and an attacker
|
||||
who buys keys to make them leave is worse off than one who signs with them (w + L must still reach 2/3).
|
||||
|
||||
## 3. Gate (Devnet 2, the 0.3.16 crossing)
|
||||
|
||||
| Step | Pass line |
|
||||
|---|---|
|
||||
| Unit tests on igneum-build-1 (`cargo test -p kaspa-consensus --lib finality`, `-p kaspa-consensus-core --lib`) | `a_signed_leave_ends_the_pause_after_the_delay_and_a_silent_departure_holds_it_for_the_window` passes: the known-failed case (a silent 40 percent pauses until the frozen table expires) and the fixed case (lock within `leave_delay` plus a few checkpoints), and a leave before activation removes nothing; `leave_item_round_trips_and_an_older_decoder_keeps_the_items_before_it` passes |
|
||||
| Digest test | `("finality leave height", ...)` and `("finality leave delay", ...)` move the digest; the fast-time profile keeps the devnet switch |
|
||||
| Devnet 2, the node cut's standing checks | a MINING 0.3.16 node beside a 0.3.15 node on the live file for ten minutes: the old node accepts the new node's blocks, the hub's reject count unchanged (no leave is carried before activation); a 0.3.16 node restarted mid-window re-syncs from an old peer |
|
||||
| Devnet 2, the W7 case (the fast-time harness, `tools/finality-attacks`, a new `leave.mjs` on the v3 runner's shape: N nodes, the switch at 0 in the override, `leave_delay` 10 in the 60x profile) | 45 percent of weight stops with leaves (their `mine` runs end): first lock within `leave_delay` + 1 checkpoint of the first carrier; the same 45 percent stopped with `--no-leave`: no lock until the frozen table expires (the known-failed case); 0 conflicting certificates in the 50/50 and 60/40 splits and the 34 percent eclipse (the s4 shape) with leaves in flight |
|
||||
| Activation on the live devnet | by the 95 percent signal rule with a floor height, miners first, hands last; the override object gains `"finality_leave_activation_daa": N7` |
|
||||
|
||||
The harness case is designed here and not yet run: it needs 0.3.16 binaries on the harness host (the box builds Linux
|
||||
binaries; the Mac's harness runs macOS ones), so it is the first thing the Devnet 2 crossing does.
|
||||
|
||||
## 4. What it does not do, stated
|
||||
|
||||
A crash, a power cut or a region going dark still age out over the window under Q5 (two hours on the devnet, 30 days on
|
||||
mainnet); the app's Stop and the fleet library send the leave, and a node back from an unplanned stop sends it on
|
||||
return (`igneum-miner leave`), which shortens the pause from that point. Staging a departure under 10 percent an hour
|
||||
keeps finality on with no protocol change (every lock re-freezes the table); the fleet rule of 20:0x UK stands beside
|
||||
this. Its interaction with W5 succession (O-3.11) and with a key that leaves and keeps mining (its blocks count again
|
||||
once the leave is a window old; before that it is out of every table) is written into spec 03 W7 and needs the
|
||||
cryptographer's read.
|
||||
|
||||
## 5. Per tier
|
||||
|
||||
| Tier | What changes |
|
||||
|---|---|
|
||||
| Home miner, rig (Windows, Linux, macOS; any card) | the app sends the leave on Stop and on a clean update restart, so a clean exit never holds the network; a crash still ages out over 30 days unless the operator sends the leave on return, which the app will offer |
|
||||
| Pool | one leave per server on maintenance; a pool that moves servers without one holds the network's finality for a window |
|
||||
| Holder | fewer and shorter pauses: an orchestrated departure of any size ends its pause in an hour |
|
||||
| Rollup customer, bridge | the same; anything that waits for a certified checkpoint waits an hour at most for a clean departure instead of a month |
|
||||
| Node operator | one more item type, one more RPC, protocol version 17; the persisted finality state upgrades itself on first start |
|
||||
|
|
@ -13,6 +13,7 @@ Two statements frame everything below. Finality is miner-only and self-contained
|
|||
- **W3.** Dust: a key with fewer than 100 blue blocks in the window (a block count, not bucket weight) is not a voter and is in no denominator. Measured consequence (`sim/results_v2.md` A and G): every honest key in a 1,000-key Pareto network clears 100 blocks by day 20 from zero history and the smallest new keys need up to 25 days after a doubling; a 9x renter's victims lose about one point to dust (B).
|
||||
- **W4.** Steady state: weight equals hashrate. Simulated correlation 1.00000 at day 60, Gini equal to three figures, weight-to-hash ratio within 0.82 to 1.12 for every key (`sim/results_v2.md` A).
|
||||
- **W5.** Key succession: a message signed by the old key naming a new key, included in any block, moves the old key's weight history to the new key once. The old key is dead thereafter: its later blocks earn nothing and its votes are invalid.
|
||||
- **W7.** The departure announcement (rule of 6 October 2026, after the live devnet's finality pause of 18:40Z to 20:41Z, `docs/analysis/horizon/finality-and-weight.md` proposal 1; active for checkpoints at or above `finality_leave_activation_daa`). A key MAY sign a leave, `(chain_id, daa)` under its own tag, and any block MAY carry it in its finality section (tag 4, after every other item). Let `e` be the lowest-DAA block in C's past that carries the key's leave. At every checkpoint C with `daa(e) + leave_delay <= daa(C) < daa(e) + W` the key is in no denominator (the sliding table of W2 and Q3, and the frozen table of Q5 at its own weights) and its votes are invalid; `leave_delay` is 3,600 DAA seconds on every network, `W` the weight window, after which its blocks are out of the window anyway. A leave is seen, not inferred: a partition side never sees the other side leave, so the one-third bound of 3.11.2 holds over the weight both sides count (the side that saw a leave of weight L needs 2/3 (1 - L) of signers, the other 2/3 of the full table; both locking needs s_A + s_B at least 2/3 (2 - L), more than the 1 - L available without an equivocator). An attacker who buys keys to make them leave holds w / (1 - L) of what remains and needs w at least 2/3 (1 - L), so w + L at least 2/3 + L/3: signing with the bought keys is the cheaper use of the same purchase. What a leave does not cover: a crash, a power cut or a region going dark still age out over W (the frozen table of Q5 holds finality for one window after a silent departure of over a third, measured 6 October 2026: 20 keys holding 42.7 percent of the frozen table stopped at 18:27 to 18:30Z and the first lock after 6842 came at the table's expiry, DAA 216,402); a node that returns after an unplanned stop MAY send its leave then. The miner sends the leave on a clean stop (`igneum-miner mine` unless `--no-leave`; `igneum-miner leave <url> <label>` by hand); the node carries it in its templates and gossips it to peers at protocol version 17 or later (an older relay flow drops a peer on an unknown kind, and an older section decoder stops at the tag, which is why it is carried last).
|
||||
- **W6.** Keys are free. Nothing in the protocol prices a vote key and the devnet launcher mints one per worker process (ledger F17, round 3). Weight is the only Sybil-resistant quantity in this specification, so every rule that draws from the voter population draws by weight and never per key: W2 (no damping, no per-key cap), the shard sortition of section 7.2 (drawn by weight since 3 October 2026) and the sub-user sortition of S2. A rule that counts keys is a rule a splitter wins.
|
||||
|
||||
The headline arithmetic (W2 with constant hashrate): an attacker with share a of hashrate for t days holds weight share `(t/30) x a/(1+a)`, verified by simulation to 0.04 points for a = 1 and 2 (`sim/results_v2.md` B).
|
||||
|
|
@ -41,7 +42,7 @@ All in public, on the hashrate charts. 51% never reaches 2/3 while honest miners
|
|||
- **Q2.** Participation of key k at index i, "block reading" (rule of 3 October 2026, ledger F3): the number of indices j in the presence window of i (Q1) for which a valid vote by k at index j appears in the past of C_i, divided by the number of indices in that window, capped at 1. A vote "appears in the past of C_i" when it is carried, as a vote or inside a certificate, by any block in the past of C_i, blue or red. A key whose first block is younger than the presence window counts 1. Votes are block payload: every block MUST carry every valid vote its producer has received for i_b or an index in its presence window (i_b the highest checkpoint index determined in the block's past) that is not already carried by a block in its past, up to the per-block vote bound of O-3.3; votes for one `(index, checkpoint hash)` pair MAY be aggregated inside the block into one BLS signature with a bitmap. A block that omits a vote it has received is not invalid (no node can prove what another received); the rule binds honest producers and the argument of 3.3.2 says why that is enough. This reading is objective, since every node computes it from the same past of C_i, and self-healing, since a missed index rolls out of the window after two hours of median time. The "cert reading" of the simulation (only votes inside certificates count) is a subset of it and was the reading the simulation ran with; the node-local "seen" reading is rejected as not objective and the "frozen" reading as total with extra steps (`sim/results_v2.md`, "Recommended parameters").
|
||||
- **Q3.** Active weight at i is the sum over voters of weight x participation. Total weight at i is the sum of weight over all keys above dust. A certificate for index i locks when the unscaled weight of its signers is at least **2/3 of active weight** AND at least **2/3 of total weight** (the floor; 17/30 from 3 October 2026 until the project lead raised it to two thirds on 4 October 2026, O-3.15). Both comparisons are inclusive: exactly two thirds locks. Both tests use weights and participation computed at C_i, so any node can verify a certificate from C_i's past. Since active weight never exceeds total weight, the second test implies the first: in plain words, a checkpoint locks when two thirds of all 30-day weight has signed it, and finality pauses whenever less than two thirds of that weight is connected and signing, with the chain continuing on proof of work meanwhile and the node reporting the pause (3.9). The active test and the participation of Q2 stay in the rule as the liveness-side report: they are what the node shows operators about who is present, and they are the test that would bind again if a later review lowered the floor.
|
||||
- **Q4.** Certificate fold (rule v3, 4 October 2026, evening, ledger F22; replaces the grace timer of O-3.4): a certificate forms the moment Q3 is met, so lock latency is not held back. Once every voter has signed, or `certificate_fold` DAA seconds after the checkpoint's determination (3 on devnet, 6 on mainnet; a relay-latency allowance, not a clock of the protocol), a node that holds a certificate rebuilds it from every vote it has seen when that carries more weight and gossips it, and every node replaces a held certificate with a verified certificate over the same block that carries more signed weight. A block carries the heaviest certificate its producer holds; a block that carries a lighter one is as valid as before, since every certificate still verifies against the table at C_i. The lock is never withdrawn by a replacement (3.11.4): a replacement only adds signers over the same block. Why: on the 12-node cloud devnet of 4 October 2026 the first certificate was built median 1.24 s after the first determination with 7 to 10 of 12 signers, while the last of the 12 votes was issued median 1.45 s, p90 2.36 s after it (`infra/cloud-devnet/results/2026-10-04/f22-vote-timing.md`), so two checkpoints locked at 66.8% of total with every key connected. The fold carries the votes that arrive after quorum.
|
||||
- **Q5.** The frozen weight table (rule v3, 4 October 2026, evening, ledger F21; active for checkpoints at or above `finality_v3_activation_daa`): let `C_f` be the highest certified checkpoint below i whose block is on the selected chain of C_i, and `T_f` the weight table at `C_f` (W2 at `C_f`, bans applied). A certificate for index i locks only if, in addition to Q3, its signers hold at least two thirds of `T_f` at the weights of `T_f`; a key outside `T_f`'s voter list (born since, under dust there, stripped) adds nothing. `T_f` stands while `daa(C_i) < daa(C_f) + 2,592,000` (one weight window); once a window has passed without a certified checkpoint the frozen table is empty and Q3 alone decides, as before v3. Before the first certificate there is no frozen table. In a connected network `C_f` is i - 1 or i - 2 and `T_f` differs from the table at C_i by a minute of blocks, so the test is Q3 with a 30-s lag. Across a partition `T_f` is the last table both sides certified together: a side holds its pre-split share of it whatever it mines afterwards, so no side under two thirds locks until that table has expired, 30 days after the last certified checkpoint (3.7 item 9).
|
||||
- **Q5.** The frozen weight table (rule v3, 4 October 2026, evening, ledger F21; active for checkpoints at or above `finality_v3_activation_daa`): let `C_f` be the highest certified checkpoint below i whose block is on the selected chain of C_i, and `T_f` the weight table at `C_f` (W2 at `C_f`, bans applied). A certificate for index i locks only if, in addition to Q3, its signers hold at least two thirds of `T_f` at the weights of `T_f`; a key outside `T_f`'s voter list (born since, under dust there, stripped) adds nothing. `T_f` stands while `daa(C_i) < daa(C_f) + 2,592,000` (one weight window); once a window has passed without a certified checkpoint the frozen table is empty and Q3 alone decides, as before v3. Before the first certificate there is no frozen table. Under W7 a key that has left at C_i (its leave carried in C_i's past, `leave_delay` old) is subtracted from `T_f` at its frozen weight and signs nothing, so a departure that announces itself ends a pause `leave_delay` after its first carrier instead of at `T_f`'s expiry. In a connected network `C_f` is i - 1 or i - 2 and `T_f` differs from the table at C_i by a minute of blocks, so the test is Q3 with a 30-s lag. Across a partition `T_f` is the last table both sides certified together: a side holds its pre-split share of it whatever it mines afterwards, so no side under two thirds locks until that table has expired, 30 days after the last certified checkpoint (3.7 item 9).
|
||||
|
||||
### 3.3.1 Why the floor, and why two thirds, from the simulation
|
||||
|
||||
|
|
|
|||
|
|
@ -46,7 +46,8 @@
|
|||
"equivocation_ban": 120,
|
||||
"min_daa": 120,
|
||||
"aggregator_fallback": 1,
|
||||
"certificate_fold": 3
|
||||
"certificate_fold": 3,
|
||||
"leave_delay": 10
|
||||
},
|
||||
"pow_epoch_blocks": 60,
|
||||
"pow_epoch_lead": 10,
|
||||
|
|
@ -54,6 +55,7 @@
|
|||
"difficulty_v2_activation_daa": 18446744073709551615,
|
||||
"proving_v0_activation_daa": 18446744073709551615,
|
||||
"finality_v3_activation_daa": 18446744073709551615,
|
||||
"finality_leave_activation_daa": 18446744073709551615,
|
||||
"program_class_v3_activation_daa": 18446744073709551615,
|
||||
"program_class_v4_activation_daa": 18446744073709551615,
|
||||
"program_class_v4_signal_window_daa": 120,
|
||||
|
|
|
|||
112
tools/finality-attacks/leave.mjs
Normal file
112
tools/finality-attacks/leave.mjs
Normal file
|
|
@ -0,0 +1,112 @@
|
|||
// The departure announcement (spec 03 W7, 6 October 2026, after the live devnet's finality pause of 18:40Z to 20:41Z):
|
||||
// the fast-time 3-node network, six voters, 45 percent of the weight stops at the warm boundary. Ports 29800 and up,
|
||||
// network igneum-devnet-980, data under /tmp/igneum-fin-leave; the live devnet is never touched.
|
||||
//
|
||||
// node tools/finality-attacks/leave.mjs # the departing keys send their leave on stop (the fix): first lock
|
||||
// # within leave_delay plus one checkpoint of the first carrier
|
||||
// node tools/finality-attacks/leave.mjs --silent # the same keys stop with --no-leave (the known-failed case: no lock
|
||||
// # until the table frozen at the last lock is a full window old)
|
||||
// BPS=1 WARM=230 AFTER=200 node tools/finality-attacks/leave.mjs ...
|
||||
//
|
||||
// Needs a node and a miner that carry W7 (fork branch finality-pause-node or 0.3.16): IGNEUMD and IGNEUM_MINER, or the
|
||||
// default paths below. The fast-time profile (infra/fast-time/override-60x.json) sets weight_window 120 DAA and
|
||||
// leave_delay 10 DAA; the override object here switches rule v3 and the leave rule on from checkpoint DAA 0.
|
||||
//
|
||||
// Designed 6 October 2026, 21:3xZ, by the finality owner; NOT yet run (it needs W7 binaries on the harness host). It is
|
||||
// the Devnet 2 gate step of docs/plans/finality-leave.md section 3 and is trusted only once it has fired on both the
|
||||
// known-finished case (default) and the known-failed case (--silent), per CLAUDE.md.
|
||||
|
||||
const ROOT = new URL('../../', import.meta.url).pathname;
|
||||
const NODE_ROOT = process.env.IGNEUM_NODE_ROOT || ROOT;
|
||||
process.env.IGNEUM_FIN_BASE_PORT ||= '29800';
|
||||
process.env.IGNEUM_FIN_SUFFIX ||= '980';
|
||||
process.env.IGNEUM_FIN_TMP ||= '/tmp/igneum-fin-leave';
|
||||
process.env.IGNEUM_FAST_TIME ||= '1';
|
||||
process.env.IGNEUMD ||= `${NODE_ROOT}vendor/igneum-node-finpause/target/release/igneumd`;
|
||||
process.env.IGNEUM_MINER ||= `${NODE_ROOT}vendor/igneum-node-finpause/target/release/igneum-miner`;
|
||||
const SILENT = process.argv.includes('--silent');
|
||||
const BPS = +(process.env.BPS || 1);
|
||||
const WARM = +(process.env.WARM || 230), AFTER = +(process.env.AFTER || 200);
|
||||
const LEAVE_DELAY = 10, WINDOW = 120, INTERVAL = 30; // the 60x profile's values (DAA)
|
||||
process.env.IGNEUM_FIN_OVERRIDE_JSON ||= JSON.stringify({ finality_v3_activation_daa: 0, finality_leave_activation_daa: 0 });
|
||||
|
||||
const { Node, Miner, stopAll, sleep, log, assertBinaries, TMP, IGNEUMD } = await import('./lib/net.mjs');
|
||||
const { mkdirSync, writeFileSync, appendFileSync } = await import('node:fs');
|
||||
mkdirSync(TMP, { recursive: true });
|
||||
const CASE = SILENT ? 'silent' : 'leave';
|
||||
const out = (line) => { console.log(line); appendFileSync(`${TMP}/results-${CASE}.md`, line + '\n'); };
|
||||
|
||||
const lockedMap = (cp) => new Map((cp?.checkpoints || []).filter(c => c.state === 'locked').map(c => [c.index, c.hash]));
|
||||
const maxLocked = (cp) => Math.max(0, ...lockedMap(cp).keys());
|
||||
async function checkpoints(node, last = 800) { return node.rpc.call('getFinalityCheckpoints', { last }).catch(() => null); }
|
||||
async function daaOf(node) { const d = await node.rpc.call('getBlockDagInfo', {}).catch(() => null); return d?.virtualDaaScore ?? null; }
|
||||
|
||||
async function run() {
|
||||
const n1 = await new Node(1).start();
|
||||
const n0 = await new Node(0, { connect: [`127.0.0.1:${n1.p2pPort}`] }).start();
|
||||
const n2 = await new Node(2, { connect: [`127.0.0.1:${n1.p2pPort}`] }).start();
|
||||
const nodes = [n0, n1, n2];
|
||||
// the departing 45 percent on n0 (three keys at 0.15), the staying 55 percent on n1 and n2 (three keys at 0.1833)
|
||||
const leavers = ['d0', 'd1', 'd2'].map(label => new Miner(n0, { label, share: 0.15, bps: BPS, secs: WARM, noLeave: SILENT }).start());
|
||||
const stayers = [[n1, 's0'], [n1, 's1'], [n2, 's2']].map(([node, label]) => new Miner(node, { label, share: 0.55 / 3, bps: BPS, secs: WARM + AFTER + 60 }).start());
|
||||
await sleep(WARM * 1000);
|
||||
// the leavers' runs end now: with the fix each sends its leave to n0, which carries it in n0's templates and gossips it
|
||||
const tStop = Date.now();
|
||||
for (let i = 0; i < 100 && leavers.some(m => m.exited === null); i++) await sleep(100);
|
||||
const cpAtStop = await checkpoints(n1);
|
||||
const preMax = maxLocked(cpAtStop);
|
||||
const daaStop = await daaOf(n1);
|
||||
log(`${CASE}: leavers stopped at warm ${WARM} s, daa ~${daaStop}, max locked ${preMax}`);
|
||||
let firstNew = null, firstNewDaa = null, carrierDaa = null;
|
||||
while (Date.now() - tStop < AFTER * 1000) {
|
||||
if (carrierDaa == null) {
|
||||
// the first block that carries a leave, from any node's log (the node says so once per key)
|
||||
const m = nodes.flatMap(n => n.grepLog(/announced its departure .* carried by \S+ at DAA (\d+)/)).map(l => +l.match(/at DAA (\d+)/)[1]);
|
||||
if (m.length) carrierDaa = Math.min(...m);
|
||||
}
|
||||
const cp = await checkpoints(n1);
|
||||
const mx = maxLocked(cp);
|
||||
if (firstNew == null && mx > preMax) { firstNew = Math.round((Date.now() - tStop) / 1000); firstNewDaa = await daaOf(n1); }
|
||||
await sleep(2000);
|
||||
}
|
||||
const ends = await Promise.all(nodes.map(n => checkpoints(n)));
|
||||
const maps = ends.map(lockedMap);
|
||||
let disagree = 0;
|
||||
const common = new Set([...maps[0].keys()].filter(k => maps[1].has(k) && maps[2].has(k)));
|
||||
for (const k of common) if (new Set(maps.map(m => m.get(k))).size > 1) disagree++;
|
||||
const conflicts = nodes.map(n => n.grepLog(/CONFLICTING certificate/).length);
|
||||
const leavesSeen = nodes.map(n => n.grepLog(/announced its departure/).length);
|
||||
const leftNotes = nodes.map(n => n.grepLog(/key\(s\) left since/).length);
|
||||
for (const m of [...leavers, ...stayers]) await m.stop();
|
||||
await stopAll();
|
||||
// pass lines (docs/plans/finality-leave.md section 3): with leaves, the first lock lands within leave_delay plus one
|
||||
// checkpoint of the first carrier (DAA), 0 conflicts, every node agrees; silent, no lock before the frozen table has
|
||||
// expired (a window after the last lock), which at BPS blocks/s is about WINDOW / BPS seconds after the stop
|
||||
let pass;
|
||||
if (!SILENT) {
|
||||
const within = carrierDaa != null && firstNewDaa != null && firstNewDaa <= carrierDaa + LEAVE_DELAY + INTERVAL + 10;
|
||||
pass = leavesSeen.every(c => c >= 3) && firstNew != null && within && conflicts.every(c => c === 0) && disagree === 0;
|
||||
} else {
|
||||
const expiry = Math.round(WINDOW / BPS);
|
||||
pass = leavesSeen.every(c => c === 0) && (firstNew == null || firstNew >= expiry - INTERVAL / BPS) && conflicts.every(c => c === 0) && disagree === 0;
|
||||
}
|
||||
out(`\n### ${CASE}: warm ${WARM} s, ${AFTER} s after the stop, ${BPS} blocks/s in all, 45 percent of weight stops ${SILENT ? 'without a word (--no-leave)' : 'and sends its leave'}; leave_delay ${LEAVE_DELAY} DAA, window ${WINDOW} DAA\n`);
|
||||
out('| measure | n0 (the leavers\' node) | n1 | n2 |');
|
||||
out('|---|---|---|---|');
|
||||
out(`| leaves recorded (log) | ${leavesSeen.join(' | ')} |`);
|
||||
out(`| LOCKED lines noting keys left since the frozen lock | ${leftNotes.join(' | ')} |`);
|
||||
out(`| conflicting certificates | ${conflicts.join(' | ')} |`);
|
||||
out(`\nmax locked at the stop ${preMax} (daa ~${daaStop}); first carrier of a leave at DAA ${carrierDaa ?? 'none'}; first new lock ${firstNew == null ? 'none within ' + AFTER + ' s' : firstNew + ' s after the stop, daa ~' + firstNewDaa}; locked indices disagreeing across nodes ${disagree}`);
|
||||
out(`\n[${pass ? 'PASS' : 'FAIL'}] ${CASE}`);
|
||||
writeFileSync(`${TMP}/results-${CASE}.json`, JSON.stringify({ case: CASE, pass, preMax, daaStop, carrierDaa, firstNew, firstNewDaa, conflicts, disagree, leavesSeen }, null, 2));
|
||||
return pass;
|
||||
}
|
||||
|
||||
async function main() {
|
||||
assertBinaries();
|
||||
log(`case ${CASE}; node ${IGNEUMD}; ${BPS} blocks/s; override ${process.env.IGNEUM_FIN_OVERRIDE_JSON}`);
|
||||
let pass = false;
|
||||
try { pass = await run(); } catch (e) { log(`${CASE} threw: ${e.stack || e}`); await stopAll(); }
|
||||
process.exit(pass ? 0 : 1);
|
||||
}
|
||||
main();
|
||||
|
|
@ -118,6 +118,7 @@ export class Miner {
|
|||
if (o.label) a.push('--label', o.label);
|
||||
if (o.vote === false) a.push('--no-vote');
|
||||
if (o.equivocate) a.push('--equivocate');
|
||||
if (o.noLeave) a.push('--no-leave'); // W7: the known-failed case of leave.mjs (a departure without a word)
|
||||
if (o.equivocateAt != null) a.push('--equivocate-at', String(o.equivocateAt));
|
||||
if (o.dropVotes) a.push('--drop-votes');
|
||||
if (o.sybil) a.push('--sybil', o.sybil);
|
||||
|
|
|
|||
Loading…
Reference in a new issue