Add CAP-0089: VRF-Based Protocol Randomness and Fair Leader Selection - #2005

Open

EslaM-X wants to merge 53 commits into

stellar:masterfrom

EslaM-X:cap-0089-vrf-randomness

Commits on Sep 4, 2026

Add cap 0089 initial draft: VRF-derived protocol randomness and leader election
EslaM-X
committed
76bd905
Rework CAP-0089 per review: aggregated delayed-reveal VRF randomness
EslaM-X
committed
26b0c3d
Address second Copilot review: consensus-visible commits, NodeID ordering, honest withholding bounds
EslaM-X
committed
ec4ac39
cap-0089: threshold, purpose bytes, XDR sig/const, verification & vectors (#Round4 Copilot fixes)
EslaM-X
committed
1f2ad4e
cap-0089: layer A/B split, R_pre/R_post consumer sealing, one-future-neutrality exit gate, V9/V10 vectors
EslaM-X
committed
4e96c6e
cap-0089: Layer B randomness epoch target, V11 authenticated-commit vectors, V2 fallback fix, deterministic warm-up phases
EslaM-X
committed
0515ceb
cap-0089: normative sig domain, full-combination V9 root set, predecessor-based placeholder, first carrier = L_up+1
EslaM-X
committed
2ef4435
cap-0089: Layer B pre-locked outcome classes, m_pre/m_post challenge-after-lock, executable B1-B4 model, real-Ed25519 commit sig, honest V1/V10, Layer A/B deployment fork
EslaM-X
committed
698b1ea
cap-0089: harden Layer B model per review (proof-verifying resolve, epoch active_at gate, schedule-driven B3 convergence, real non-tautological O2, varied C realizations, pinned digests) + align CA…
EslaM-X
committed
6f8af45
cap-0089: address full second review — structured EventLock + proof-verifying resolve, admission-based RandomnessSource (real non-tautological O2/S2), schedule-driven C convergence, canonical epoch…
EslaM-X
committed
83bdc9e
CAP-0089: Layer B review hardening; checker 80-byte proof; deployment-fork scoping
EslaM-X
committed
6e280c9
CAP-0089: Layer B proof/root split, executable event_mapping, confirm/externalize boundary
EslaM-X
committed
6fc666f
CAP-0089: single-pulse Layer B rework (one root per externalized close)
EslaM-X
committed
bc82bf1
CAP-0089: resolve reviewer threads - canonical proof, verifier rule, admission hardening
EslaM-X
committed
ff31163
CAP-0089: one close-input contract, genuine threshold theorem, LedgerHeader proof path
EslaM-X
committed
861cc21
CAP-0089: one close-input contract, genuinely thresholded authority, pure archival verifier / review resolution
EslaM-X
committed
9428156
CAP-0089: close monolithic durable sign-once, harden threshold+forge+b3 gates, unify close-input encoding
EslaM-X
committed
b93bc48
CAP-0089: reject duplicate roster keys, define CONFIRM->EXTERNALIZE emit-path share generation, unify PR description
EslaM-X
committed
e80157f
CAP-0089: add named working-group representatives (Horizon/RPC, SDK, node operators)
EslaM-X
committed
9310d8f
CAP-0089: Byzantine honest-intersection bound, admission-gated shares, public-only verifier, share carrier contract, root(C_s,canonical(P_s))
EslaM-X
committed
624e783
CAP-0089: answer Copilot review round 3 (secret-bound proof, unforgeable boundary witness, pure abstract verifier, per-event delivery schedules, Byzantine f)
EslaM-X
committed
25ab391
CAP-0089: round-4 review -- pure public-key verifier, availability boundary t<=n-f, lp-wire hash32 fix, key separation, real cross-net/slot rejections
EslaM-X
committed
7bf6bd1
CAP-0089: round-5 review -- real Shamir threshold (Lagrange recover), candidate-independent canonical root, cert-based CONFIRM externalize (no caller boolean), fix availability f wording, quorum-ro…
EslaM-X
committed
6251de3
CAP-0089: round-6 review -- AttackerView honest/attacker surface split (GROUP_SK is primitive-internal, not forgeable by public interface), canonical_root depends on unpredictable canonical proof P…
EslaM-X
committed
ff0bd7c
CAP-0089: round-7 review -- subgroup/order-q authority-key validation (raise on Y=1/non-residue), FROST message-dependent threshold shares + per-close nonce poly (cross-message non-reuse), epoch-bo…
EslaM-X
committed
5f42931
CAP-0089: round-8 review -- CONFIRM votes authenticate member-held SECRET subkeys (derived from private group secret, only public K_i committed in epoch hash -> observer cannot mint a vote), re-pin…
EslaM-X
committed
c7cb32d
CAP-0089: round-9 review -- distributed-FROST peer-verifiable threshold (share carrier carries public N_i/C_i, verify_share/recover_proof read only public commitments + committed epoch surface, NO …
EslaM-X
committed
c04061d
CAP-0089: round-10 review -- 96-byte per-member share carrier (s_i|N_i|C_i, peer-verifiable FROST partial, epoch-committed C_i binding closes forged-carrier poison), precommit NodeID->VRF-key mappi…
EslaM-X
committed
ae1a643
CAP-0089: round-11 review -- commit confirm_pub/feldman_pub in roster INDEX order (permutation changes epoch.hash; add R2b conformance check), two-round FROST round-1 nonce registry (authenticated …
EslaM-X
committed
b688eaf
CAP-0089: round-12 review -- liveness theorem SCP-finalizable=>randomness-reconstructible + FROST two-round ordering + committed finality binding
EslaM-X
committed
927b819
CAP-0089: round-13 review -- correct the liveness theorem (roster is NOT an SCP quorum) + non-circular red test
EslaM-X
committed
cfa2d19
CAP-0089: round-14 review -- confirm/feldman key soundness, weighted aggregate nonce, two-round release timing, per-member release gate, committed release policy + UNKNOWN adjudication
EslaM-X
committed
a171d13
CAP-0089: round-14b review -- authenticated per-member release boundary, non-malleable VUF root (committed nonce R), distributed verifiable nonce-sharing (subset-independence), canonical V_s XDR en…
EslaM-X
committed
e9145e8
CAP-0089: round-15 consumer-by-consumer matrix + executable event_mapping opt-out (tacticalnoot): consumer_kdf gates APPLY/PRNG/NOMINATION by the committed event_mapping; opted-out consumers releas…
EslaM-X
committed
10803d2
CAP-0089: round-15 Copilot re-review (12 threads) -- bias-resistant Feldman nonce-sharing (commit-then-open + verifiable share distribution), mandatory APPLY/PRNG event_mapping validation, normativ…
EslaM-X
committed
1ad0094
CAP-0089: round-15b Copilot re-review (7 new threads) -- verified-only CONFIRM membership (3930442925), canonical qualified-dealer set via reliable broadcast (3930442958), XDR-aware zero-in-place c…
EslaM-X
committed
eb73cb3
CAP-0089: round-16 Copilot re-review (11 new threads) -- private-seed domain-separated VRF key derivation (3934382949), consensus-agreed live open phase with <= f non-participants (3934383007), aut…
EslaM-X
committed
48878e2
cap-0089: address round-17 review (canonical P, committed-dealer recovery, key-separation, observer-independent NOMINATION, deployment precondition, valid ECVRP clone keys)
EslaM-X
committed
59b2762
cap-0089: address round-18 review (separate commit-set consensus object, commit-time share escrow, RFC9381 identity rejection, observer-independent nomination priority, align B1 with normative even…
EslaM-X
committed
223aebb
cap-0089: address round-19 review (Feldman-verifiable commit-time shares, non-consensus-critical dispute notice, in-protocol recovery path, observer-independent finalized nomination stall, determin…
EslaM-X
committed
babec18
Round-20: canonical commit register + never-None consensus-bound nomination (Copilot 3936012458,3936012529,3936012578,3936012616,3936012670,3936012700,3936012751)
EslaM-X
committed
756cdd6
Round-21: unforgeable per-member release witness, consensus-determined nomination rule, pre-ballot commit register, AVSS canonical qualification, per-arm StellarValueType canonicalization (Copilot …
EslaM-X
committed
de5f4a8
CAP-0089: security/correctness evidence package and isolated proof-context vectors
EslaM-X
committed
6119299

Commits on Sep 5, 2026

Commits on Sep 6, 2026

Commits on Sep 7, 2026