fibre

Independent, outside-the-validator tooling for Celestia Fibre — the low-latency data-availability path where validators sign for a blob and then owe a retention window of serving it.

Nothing here needs to be run by a validator, and nothing trusts a validator's self-report. Each module reads what it needs from the chain and recomputes the rest.

module	what it is	dependencies
fibre-tlsverify	verifies the validator-endorsed TLS identity a Fibre server presents (consensus-key signed extension, no CA)	none — stdlib only
fibre-assign	recomputes which validator must serve which blob rows; ShardMap.Verify classifies what one actually returned	none — stdlib only (the differential test in fibre-assign/reftest/ pulls celestia-app)
fibre-sentinel	the observer: sentinel-scan records every publication from the chain; sentinel-probe probes the assigned validators across each blob's window and classifies the result	celestia-app (pinned), + the two above
fibre-devnet	multi-node-fibre.sh — a multi-validator local devnet with retention lowered to the 10-minute protocol floor, so assignment and pruning are observable in minutes	shell + a celestia-app build

Repository layout

A monorepo of three Go modules plus a script directory:

fibre-tlsverify/         module github.com/plsgiveup/fibre/fibre-tlsverify   (go 1.23)
fibre-assign/            module github.com/plsgiveup/fibre/fibre-assign      (go 1.23)
fibre-assign/reftest/    module github.com/plsgiveup/fibre/fibre-assign/reftest (go 1.26.5, differential test)
fibre-sentinel/          module github.com/plsgiveup/fibre/fibre-sentinel   (go 1.26.5)
fibre-devnet/            shell scripts, no Go module

fibre-sentinel and fibre-assign/reftest depend on their siblings through in-repo relative replace directives — build them from a full checkout of this repo, not from the subdirectory alone. fibre-tlsverify and fibre-assign are independently go get-able as libraries.

For cross-module local development, drop a go.work at the repo root (it is git-ignored):

go work init ./fibre-tlsverify ./fibre-assign ./fibre-assign/reftest ./fibre-sentinel

Verify everything

Each claim is one command, reproducible from a clean checkout. CI (.github/workflows/ci.yml) runs all of them on every push.

# fibre-tlsverify — 21 golden vectors (1 valid + 20 typed failures), byte-exact envelope
cd fibre-tlsverify && go test -race ./...

# fibre-assign — 21 unit tests, then ~890 scenarios bit-identical to celestia-app
cd fibre-assign         && go test -race ./...
cd fibre-assign/reftest && go test ./...

# fibre-sentinel — 14 unit tests
cd fibre-sentinel && go test ./...

# fibre-sentinel — full devnet run with fault injection: 60 measurements, 0 misclassifications
#   (needs a celestia-app + fibre build on PATH; ~14 min)
cd fibre-sentinel && ./probe-devtest.sh 4 3

Pinned upstream

celestia-app commit 0b69316466c3ba02f708c0e2a101f834d5d1827f (v10.0.0-20260901162319-0b69316466c3), celestia-core v0.40.8, cosmos-sdk fork v0.52.11. TLS golden vectors from celestia-app commit dba155084505a8f6c5d37260a94f70f939fb96de. fibre-assign/reftest/go.mod and fibre-sentinel/go.mod each carry a verbatim copy of celestia-app's replace block (Go does not apply a dependency's replaces); refresh the pin and the block together.

License

Apache-2.0. See LICENSE and NOTICE.