Repository navigation
feat(network): MVP v2 -- tri-net's receipt, admission and verifier economics, with our quorum, replay and key-id rules - #8685
Merged
Conversation
…onomics, with our quorum, replay and key-id rules specs/network/mvp_v2.t27: the network MVP evolved, v1 unchanged. - Receipt envelope in tri-net digest_pre order and tag "TRCP", one SHA-256 block; device_id and executor are 64-bit (two words each). device_id 0 is SOFTWARE_SIGNED, a die is its 64-bit FUSE_DNA, never DNA_PORT. - Admission in tri_receipt_verify order and codes: BAD_SIG, NOT_IN_BATCH, BAD_COMPUTE. The batch is a signed Merkle root (merkle_pair_pre). - VERIFIER_FEE = burned / honest_count out of slashed stake, dust unminted; the watcher that upholds a challenge gets the executor's bond. - Credits pending until the challenge window passes; never final while challenged; a slashed job is clawed back and never finalizes. - Quorum 2M > N + F (tri-bridge), spent (node, nonce) set with a durable mark (ledger.t27, node-work-credit.t27), 64-bit key ids. - The treasurer settles through specs/trinet/ledger.t27 settle(). - trace_len / trace_row: the seeded network in actor_events.t27's shape. Closes #8648 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gHashTag
enabled auto-merge (squash)
October 10, 2026 15:43
Contributor
This was referenced Oct 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #8648
Part of the network MVP epic (see #8613); v1 is
specs/network/mvp.t27(see #8610) and is unchanged.specs/network/mvp_v2.t27uses v1's draws and helpers throughuse network::mvpand replaces its receipt, admission, settlement and accounts.Taken from gHashTag/tri-net (at d6deeb39)
t27 cannot
useanother repository, so these are restated in section 1 under tri-net's own names:tri_compute_receipt.t27:digest_pre, a one-block SHA-256 preimage [TAG "TRCP" 0x54524350, request_id, device_id, executor, task, in_hash, out, epoch, prev_head, pad]. Alsomerkle_pair_pre(the verifier signs one root over a job's receipts) andledger_entry_pre("TRLG": the ledger head commits every credit, slash, finalize and clawback). SHA-256 istri/crypto/sha256.t27compress, checked against the FIPS "abc" vector.tri_receipt_verify.t27: a claim is accepted iff its signature checks, it is in the batch and its result recomputes, judged in that order (RV_BAD_SIG1,RV_NOT_IN_BATCH2,RV_BAD_COMPUTE3).tri_compute_challenge.t27:verifier_reward = burned / honest_count, so the VERIFIER_FEE comes out of slashed stake, never the pool; floor division leaves the dust unminted;challenger_stake_after).tri_compute_account.t27:is_final(a window ofCHALLENGE_WINDOWepochs);may_finalizeadds our gates: never while a challenge is open, never once slashed;Our corrections, kept
tri-bridge.t27quorum_valid,quorum_met), N 4, F 1, M 3, not tri-net's n/2 + 1. The test walks N 1..9 and every F, and shows where n/2 + 1 is unsafe (for example N 3, F 1).specs/trinet/ledger.t27settle(), plus the durable nonce mark ofnode-work-credit.t27(may_issue,next_mark,resume_nonce), not a task-id high-water mark. The test shows a high-water mark refusing honest work settled out of order. A dispatcher restart resumes at the mark, and the observer checks that no nonce is issued twice.KEY_ID_HEX_LEN16) and the die's 64-bit FUSE_DNA as the device id, so digest_pre's device_id and executor are two words each (44 bytes, still one block):dna_from_fuse) is refused as a device id;specs/trinet/ledger.t27settle(), the real ledger's rule: eligibility, identity, verdict, once per (node, nonce), and the slash amount. NOT_IN_BATCH with a committed leaf is told to the ledger as a nonce mismatch (a replay) or a wrong result (an equivocation). A claim no key vouches for never reaches the ledger.The network
Actors are pids (actors.t27): supervisor, dispatcher, executor and three verifiers, verifier, treasurer, watcher, griefer.
Faults drawn from the seed:
The observer judges these after every step:
The same seed gives the same ledger digest.
Trace for the Queen runtime (see #8642, #8652):
trace_len(seed)andtrace_row(seed, i)yield the seeded network's events inactor_events.t27's shape:For seed 1 the test finds a signer's crash and its restart as the next generation, the liar's slash (M_SLASH to the liar's pid), the replayed nonce (the executor's credited claim presented again and refused by the spent set) and a replayed receipt.
Verdicts (t27c lab, master c266397)
t27c test-report specs/network/mvp_v2.t27: 12 of 12 pass, 3 invariants, 0 vacuous; 5907 runtime asserts. Per test: 179, 31, 194, 50, 3045, 462, 383, 109, 348, 17, 21, 1068.t27b corpus specs/network(qemu aarch64,--blockers --reference t27c --timeout-ms 60000): mvp_v2.t27 reference pass, t27b pass, 5922 runtime asserts, 0 disagreements, 0 JIT/interpreter mismatches. mvp.t27 still passes with 1103 asserts.t27b testtakes 7.7 s under qemu.Seeds: the network tests use
run_seed(GATE_BASE_SEED, i), 12 jobs each:Digests: the network compares digests only for equality, so a fast mix32 fold of the same preimages gives the same run.
the_digest_does_not_steer_the_networkruns SHA-256 throughout and checks the same books and the same event trace. The many-seed tests run fast so the interpreter cross-check finishes insidecheck_budgetFILE_FUEL and the asserts are counted (with SHA-256 throughout they were "unknown").Mutants: 15 seeded mutants of the wiring. 14 fail at least one test:
The survivor, n/2 + 1 in place of 2M > N + F inside the network, is equivalent at N 4, F 1 (both give 3), which is why the quorum test walks N 1..9.
t27c seal --verify: all hashes MATCH.Ledger notes (see #8658, not changed here)
settle().settle()judges a lie before the spent set, so a lying receipt presented twice would be slashed twice. The MVP never re-presents a lie, so this does not show up here.0 hand-written lines outside .t27. The other files are the seal and one ledger row, written with
t27b.dump_ledgeron the lab. max_not_pass is unchanged.🤖 Generated with Claude Code