smart-byte: governance, burns, and transfers between clusters #135

Merged

dcharlot merged 2 commits from smart-byte-lifecycle into main 2026-10-01 12:22:03 -04:00

Conversation 0 Commits 2 Files changed 22 +12919 -303

dcharlot commented 2026-10-01 12:00:02 -04:00

Owner

Copy link

Finishes the cluster state machine. It covers the three things its spec had left open.

What changes

• Governance. Changes to the issuer registry and to the peers are proposals:

  • sequence-numbered, so none applies twice;
  • approved by ⌊2m/3⌋+1 of the electorate: the issuers of the cargo type, else every issuer;
  • an issuer being removed never votes, so it cannot block its own removal;
  • time-locked by the cluster's governance delay.

  A registry with no issuers can never change.

• Burns. The owner retires a byte under its own signature. The identity stays held, so no transfer or replayed mint revives it. Redemption is a return to the issuer and the issuer's burn, in one frame.

• Transfers between clusters.

  • Export. A transition may name a destination cluster. Its signature and history hash cover the destination.
  • Certificate. The source cluster's committing nodes certify the byte's state as it left.
  • Import. The destination checks the certificate against a supermajority of that peer's node keys. Each certified member must match the envelope. The destination then verifies the byte's full history itself, from the envelope and the controllers' logs. Each certificate is imported once.

• Envelope frame rule. Frames rise within a cluster, and a move to another cluster starts that cluster's count. Otherwise a byte returning to a cluster with a lower frame count would be refused.

• Lockstep fix. Export certificates are now built from what a committing node applied. They used to come from node 0's report, which is wrong when node 0's state has diverged. The new test fails on the old code.

Not specified: cluster membership (nodes joining and leaving, clusters splitting and merging). See cluster_state.md §8.

Spec and pack

• spec/cluster_state.md is rewritten. spec/envelope_wire_format.md gains the destination member (§5) and the frame rule (§8).
• state_vectors.json grows to 23 vectors: state-013 to state-023 are new, and state-011 gains malformed burn, governance and import inputs. It is regenerated in place, since v1 is DRAFT. The README documents 14 new error classes.
• crosscheck/verify_v1.py implements all of it from the spec text. It reproduces every vector: 117, plain and under -O.

Falsification

Each mutant disables one rule. It counts as caught only if it still compiles and named tests fail.

Implementation	Mutants	Caught by the published vectors	Caught by unit tests only	Missed
Python (second implementation)	56	56	0	0
Rust (reference)	66	63	3	0

• Python. The first pass caught 39 of 56. One of the 17 misses was my harness counting only state-vector failures. The other 16 were real gaps:

  • enactment order of changes accepted in the same frame;
  • the empty and repeated peer-key checks;
  • the quorum and certificate thresholds, against a simple majority;
  • importing a byte that is live or burned here;
  • each certified member checked separately;
  • the burn frame, history and owner checks;
  • mints before imports.

  Each now has a vector.

• Rust. The 3 caught by unit tests only are not state-machine output: the lockstep certificate signing (two mutants) and the frame report's statement for the nodes to sign. The statement's content is the exported record, which the vectors pin.

• Plant. state-023 has a plant, and each plant fails exactly its own vector.

🤖 Generated with Claude Code

Finishes the cluster state machine. It covers the three things its spec had left open. ## What changes - **Governance.** Changes to the issuer registry and to the peers are proposals: - sequence-numbered, so none applies twice; - approved by ⌊2m/3⌋+1 of the electorate: the issuers of the cargo type, else every issuer; - an issuer being removed never votes, so it cannot block its own removal; - time-locked by the cluster's governance delay. A registry with no issuers can never change. - **Burns.** The owner retires a byte under its own signature. The identity stays held, so no transfer or replayed mint revives it. Redemption is a return to the issuer and the issuer's burn, in one frame. - **Transfers between clusters.** - **Export.** A transition may name a destination cluster. Its signature and history hash cover the destination. - **Certificate.** The source cluster's committing nodes certify the byte's state as it left. - **Import.** The destination checks the certificate against a supermajority of that peer's node keys. Each certified member must match the envelope. The destination then verifies the byte's full history itself, from the envelope and the controllers' logs. Each certificate is imported once. - **Envelope frame rule.** Frames rise within a cluster, and a move to another cluster starts that cluster's count. Otherwise a byte returning to a cluster with a lower frame count would be refused. - **Lockstep fix.** Export certificates are now built from what a committing node applied. They used to come from node 0's report, which is wrong when node 0's state has diverged. The new test fails on the old code. Not specified: cluster membership (nodes joining and leaving, clusters splitting and merging). See cluster_state.md §8. ## Spec and pack - `spec/cluster_state.md` is rewritten. `spec/envelope_wire_format.md` gains the destination member (§5) and the frame rule (§8). - `state_vectors.json` grows to 23 vectors: state-013 to state-023 are new, and state-011 gains malformed burn, governance and import inputs. It is regenerated in place, since v1 is DRAFT. The README documents 14 new error classes. - `crosscheck/verify_v1.py` implements all of it from the spec text. It reproduces every vector: 117, plain and under `-O`. ## Falsification Each mutant disables one rule. It counts as caught only if it still compiles and named tests fail. | Implementation | Mutants | Caught by the published vectors | Caught by unit tests only | Missed | | --- | --- | --- | --- | --- | | Python (second implementation) | 56 | 56 | 0 | 0 | | Rust (reference) | 66 | 63 | 3 | 0 | - **Python.** The first pass caught 39 of 56. One of the 17 misses was my harness counting only state-vector failures. The other 16 were real gaps: - enactment order of changes accepted in the same frame; - the empty and repeated peer-key checks; - the quorum and certificate thresholds, against a simple majority; - importing a byte that is live or burned here; - each certified member checked separately; - the burn frame, history and owner checks; - mints before imports. Each now has a vector. - **Rust.** The 3 caught by unit tests only are not state-machine output: the lockstep certificate signing (two mutants) and the frame report's statement for the nodes to sign. The statement's content is the exported record, which the vectors pin. - **Plant.** state-023 has a plant, and each plant fails exactly its own vector. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 2 commits 2026-10-01 12:00:02 -04:00

smart-byte spec: governance, burns, and transfers between clusters ... 31f5d6bba4

cluster_state.md, rewritten. The state gains the cluster's identifier, its
peers, its governance (delay, sequence number, pending changes), and the
retired, exported and imported records.
- Governance proposals change the registry and the peers. Each is
  sequence-numbered, needs approval from floor(2m/3)+1 of its electorate,
  and is time-locked by the cluster's delay.
- A burn retires a byte for good.
- A transition may name a destination cluster. The source's committing nodes
  certify the byte's state as it left. The destination checks the
  certificate and verifies the byte's full history itself.

envelope_wire_format.md: the destination member, covered by the signature
and the history hash. Frames rise within a cluster; a move to another
cluster starts that cluster's count.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

smart-byte: governance, burns and transfers between clusters, with vectors ... f9fbd5a3af

smart-byte-state implements cluster_state.md:
- governance: Change and Proposal, electorates, the quorum, the time lock;
- burns: Burn and the retired record;
- exports: ExportStatement and Certificate;
- the import checks.

smart-byte-core: Transition::sign_export and the destination member. The
envelope compares frames within a cluster only.

smart-byte-lockstep: the committing nodes sign each committed frame's export
certificates. The certificates are built from a committing node's report,
never from a node whose state diverged.

state_vectors.json grows to 23 vectors (state-013 to state-023 new,
state-011 extended) and is regenerated in place; v1 is DRAFT. Every new check
has a vector that fails an implementation leaving it out. The README
documents the 14 new error classes, and the regeneration log records the
change.

crosscheck/verify_v1.py implements governance, burns, exports and imports
from the spec text. It reproduces every vector, 117 of them, both plain and
under -O.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 3377b81d05 into main 2026-10-01 12:22:03 -04:00

dcharlot referenced this pull request from a commit 2026-10-01 12:22:04 -04:00

Merge pull request 'smart-byte: governance, burns, and transfers between clusters' (#135) from smart-byte-lifecycle into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!135

No description provided.