refactor: remove validator regions and the region-shuffle fork gate - #1328
Draft
MavenRain wants to merge 8 commits into
Draft
refactor: remove validator regions and the region-shuffle fork gate#1328MavenRain wants to merge 8 commits into
MavenRain wants to merge 8 commits into
Conversation
… gate (#1279) Implement the region-aware committee shuffle documented in tn-contracts design.md, deferred out of PR #653 because the RNG draw order is consensus-critical. The ordering step of assemble_new_committee now branches on a new REGION_SHUFFLE_FORK_EPOCH gate (dormant u32::MAX on adiri, active from genesis elsewhere), keyed on the epoch the committee will serve. The region arm partitions by GSMA region, Fisher-Yates shuffles each group, the unassigned pool, and the region visit order, then round-robins one seat per region per round before the unassigned pool fills the rest. With every region 0 the sequence draws identically to the flat shuffle, so an armed fork changes nothing until governance assigns a region. The legacy arm keeps the historical draws verbatim. Closes #1279. Signed-off-by: Onyeka Obi <softwareengineerasaservant@isurvivable.cv>
…-network into feat/1279-region-aware-committee-shuffle
…e-committee-shuffle Signed-off-by: Onyeka Obi <softwareengineerasaservant@isurvivable.cv>
…e-committee-shuffle Signed-off-by: Onyeka Obi <softwareengineerasaservant@isurvivable.cv>
…1327) A region assignment under the region-aware shuffle (#1279) is a governance attestation with a guaranteed committee seat attached: round one seats one validator from every assigned region, so a validator alone in its claimed region is always seated while the flat shuffle gave it C/N, and the protocol cannot verify where a validator runs. Document the seat-probability analysis on `region_aware_order` and on the `REGION_SHUFFLE_FORK_EPOCH` rollout notes, and make the advantage observable at every region-aware epoch close: `RegionSeatReport` tallies per-region pool and seat counts, `record_region_seats` logs the tally, warns on any assigned singleton region, and publishes `tn_reth.epoch_close_region_pool{region}`, `tn_reth.epoch_close_region_seated{region}` and `tn_reth.epoch_close_singleton_regions`. The draw sequence is untouched and the flat pre-fork arm publishes nothing. Closes #1327 (items 1 and 2). Signed-off-by: Onyeka Obi <softwareengineerasaservant@isurvivable.cv>
…hreat-model-observability Signed-off-by: Onyeka Obi <softwareengineerasaservant@isurvivable.cv> # Conflicts: # crates/tn-reth/src/evm/block.rs # crates/tn-reth/src/metrics.rs # crates/types/src/forks.rs
MavenRain
added
the
cantina
Contributor
Author
|
Putting into draft in preparation for eradication of the region concept |
MavenRain
marked this pull request as draft
September 4, 2026 17:23
…shuffle fork gate Standup decision (2026-09-04): the network does not support validator regions yet, and a future spec will decide how they are consumed. Remove every client-side trace: the region-aware committee draw and its REGION_SHUFFLE_FORK_EPOCH gate (#1294), the per-region seat observability this branch had added on top (#1327), and the unused setValidatorRegion binding. crates/tn-reth/src/evm/block.rs, crates/types/src/forks.rs and crates/telcoin-network-cli/src/node.rs are byte-identical to their pre-#1294 content (main 286888c): assemble_new_committee is the flat Fisher-Yates draw again, forks.rs keeps every other fork constant and gate, and the startup fork-schedule log drops the region entry. metrics.rs and the tn-reth README are back to main, without the region seat tally and gauges. No fork is needed. The gate was dormant (u32::MAX) on adiri, no validator carries a nonzero on-chain region, and with every region 0 the removed arm drew identically to the flat shuffle. The committee draw sequence is unchanged on every network, and the restored code is the code that produced the chain's history. ValidatorInfo.region stays in the ConsensusRegistry sol! binding: the pinned contract still returns it, so the struct layout must match for ABI decoding. The client never reads it. Removing the field from the contract, and the design.md claim that the client shuffles region-aware, are tn-contracts work. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Onyeka Obi <softwareengineerasaservant@isurvivable.cv>
MavenRain
changed the title
…hreat-model-observability Signed-off-by: Onyeka Obi <softwareengineerasaservant@isurvivable.cv> # Conflicts: # crates/telcoin-network-cli/src/node.rs # crates/types/src/forks.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces this PR's previous scope (#1327 items 1 and 2). Closes #1327: the seat guarantee it documents no longer exists.
Problem
Standup (2026-09-04): the network does not support validator regions yet. A future spec will decide how regions are consumed. Until then the client carries a region-aware committee draw behind a dormant fork gate (#1294), the per-region seat tally this branch had added (#1327), and a
setValidatorRegionbinding with no caller. Dead machinery on a consensus-critical path costs review and audit time and gives nothing back.Changes
crates/tn-reth/src/evm/block.rs:assemble_new_committeeis the flat Fisher-Yates draw again.region_aware_order,fisher_yates, theregion_awareparameter, the seat-tally wiring and the region tests are gone. The file is byte-identical to main before feat(tn-reth): draw epoch-close committees region-aware behind a fork gate (#1279) #1294 (286888c).crates/types/src/forks.rs:REGION_SHUFFLE_FORK_EPOCH,region_shuffle_active,region_shuffle_build_fork_active, theTN_REGION_SHUFFLE_FORK_EPOCHtest override and their two tests are gone. Every other fork constant and gate is untouched. Byte-identical to pre-feat(tn-reth): draw epoch-close committees region-aware behind a fork gate (#1279) #1294.crates/telcoin-network-cli/src/node.rs: the startup fork-schedule log drops the region entry. Byte-identical to pre-feat(tn-reth): draw epoch-close committees region-aware behind a fork gate (#1279) #1294.crates/tn-reth/src/metrics.rsandcrates/tn-reth/README.md:RegionSeatReport,record_region_seats, the threetn_reth_epoch_close_region_*gauges and their README section are gone. Both files are byte-identical to main.crates/tn-reth/src/system_calls.rs: the unusedsetValidatorRegionbinding is gone.ValidatorInfo.regionstays, documented as a storage field the client never reads.Threat model
u32::MAX). On every other build the region arm was active from genesis, but no validator carries a nonzero on-chain region (setValidatorRegionis the only writer, and the feat(tn-reth): draw epoch-close committees region-aware behind a fork gate (#1279) #1294 rollout rule forbade a write before the fork epoch), and with every region 0 that arm drew identically to the flat shuffle (the equivalence test in feat(tn-reth): draw epoch-close committees region-aware behind a fork gate (#1279) #1294 pinned it). The committee draw sequence is unchanged on every network, and the restored code is the code that produced the chain's history.ValidatorInfo.regionmust stay in thesol!struct: the pinned ConsensusRegistry still returns it, and an ABI struct with a missing field fails to decode. From the client's view the field is now write-only.setValidatorRegionon the contract. The client ignores the value, so the call is a no-op for consensus, which is the state the chain was in before feat(tn-reth): draw epoch-close committees region-aware behind a fork gate (#1279) #1294.Out of scope
ValidatorInfo.region,setValidatorRegionand theValidatorRegionUpdatedevent in tn-contracts, plus the "Region-Aware Committee Shuffle" section ofdesign.mdandinvariants.mdthat says the client implements it. Those are tn-contracts PRs, and the submodule pin is untouched here.Testing
cargo +nightly fmt -- --checkon tn-reth, tn-types and telcoin-network-cli.cargo +1.94 check -p tn-reth -p tn-types -p telcoin-network-cli --all-targets.cargo +1.94 test -p tn-reth --lib -- assemble: the four pre-existing committee-assembly tests, including the seed-pinned golden order.cargo +1.94 test -p tn-types --lib -- forks::: the remaining fork-gate tests.+1.94attest runs on the second machine.🤖 Generated with Claude Code