consensus: deterministic reputation, uniform-VRF selection, equivocation slashing

reputation = pure chain fold {70 gate | 0 if slashed}, decoupled from the per-node live engine (fixes the epoch_commitment divergence that halted the network); live engine is now display/telemetry only.

validator selection = uniform VRF sortition among eligible, replacing reputation-rank top-N, which removes validator-set entrenchment at scale.

on-chain slashing: block double-sign + same-round checkpoint-vote double-sign, deterministically verified in the fold then permanent ban; fail-safe (a forged or different-round proof never bans); cumulative ban-set anchored in the macroblock body (O(window), pruning-safe).

tests: 8 proof-verification tests (valid detected; forged/identical/different-round never ban) + identity-test serialization (parallel flake fix). Fresh genesis required: TX / macroblock body / consensus formats changed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: AIQnetLab

core/qnet-state/src/block.rs

@@ -154,7 +154,20 @@ pub struct ConsensusData {
     /// Format: bincode serialized Vec<SlashingEventData>
     #[serde(default)]
     pub slashing_events_data: Option<Vec<u8>>,
-    
+
+    /// v2 SCALE ANCHOR: cumulative equivocation ban-set as of THIS macroblock.
+    /// Format: bincode serialized Vec<String> (sorted node_ids).
+    ///
+    /// Lets the next epoch's reputation fold derive the ban-set in O(window) — prev
+    /// macroblock's set ∪ this window's verified proofs — instead of re-scanning every
+    /// microblock from genesis (pruning-safe; scales to 100k+ nodes). NOT included in
+    /// MacroBlock::hash(): each node self-computes it deterministically, and the ban
+    /// EFFECT is independently re-verified every epoch via epoch_commitment (eligible
+    /// excludes banned), so a stale/forged copy self-heals through content_ok fail-stop
+    /// instead of forking the chain.
+    #[serde(default)]
+    pub banned_validators: Option<Vec<u8>>,
+
     /// Serialized automatic jails (computed deterministically)
     /// Format: bincode serialized Vec<AutomaticJailData>
     #[serde(default)]

core/qnet-state/src/lib.rs

@@ -21,7 +21,7 @@ mod python_bindings;
 
 pub use account::{Account, AccountState, NodeType};
 pub use block::{Block, BlockHeader, ConsensusProof, BlockType, MicroBlock, MacroBlock, ConsensusData, LightMicroBlock, BlockHash, EfficientMicroBlock, StoredMicroBlock, PoHState, storage_version, SlashingEventData, AutomaticJailData, EligibleProducer, RewardHeartbeat, HeartbeatSummary, ExcludedProducerEntry};
-pub use transaction::{Transaction, TransactionReceipt, TransactionType, gas_limits, PingSampleData, HeartbeatSampleData, ShardHeartbeatSummary, GAS_METERING_ACTIVATION_HEIGHT, MAX_CONTRACT_STORAGE_ENTRIES, DynamicGasPricing, init_dynamic_gas_pricing, update_dynamic_gas_pricing, get_dynamic_gas_pricing};
+pub use transaction::{Transaction, TransactionReceipt, TransactionType, EquivocationHeader, gas_limits, PingSampleData, HeartbeatSampleData, ShardHeartbeatSummary, GAS_METERING_ACTIVATION_HEIGHT, MAX_CONTRACT_STORAGE_ENTRIES, DynamicGasPricing, init_dynamic_gas_pricing, update_dynamic_gas_pricing, get_dynamic_gas_pricing};
 pub use state_db::StateDB;
 pub use state_manager::StateManager;
 pub use errors::{StateError, StateResult};

core/qnet-state/src/transaction.rs

@@ -69,6 +69,7 @@ const RESERVED_PROTOCOL_IDENTIFIERS: &[&str] = &[
     "system_emission",
     "system_rewards_pool",
     "system_ping_commitment",
+    "system_slashing", // EquivocationProof sender — block-construction only, never gossiped
 ];
 
 /// Validate whether the `tx.from` value matches one of the three accepted
@@ -242,6 +243,21 @@ pub mod gas_limits {
 /// Transaction hash type
 pub type TxHash = String;
 
+/// One side of an equivocation proof: the per-block signable header fields of a
+/// microblock (height + producer are shared across both sides, kept on the TX).
+/// Carries enough to reconstruct the exact `Block_Sig_v23.1` signing digest and
+/// re-verify the producer's Dilithium3 signature on-chain — no trust in the reporter.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct EquivocationHeader {
+    pub timestamp: u64,
+    pub merkle_root: [u8; 32],
+    pub previous_hash: [u8; 32],
+    pub state_root: [u8; 32],
+    pub vrf_output: Option<[u8; 32]>,
+    pub timeout_round: u64,
+    pub signature: Vec<u8>,
+}
+
 /// Transaction types
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 pub enum TransactionType {
@@ -251,7 +267,41 @@ pub enum TransactionType {
         to: String,
         amount: u64,
     },
-    
+
+    /// Cryptographic proof that `offender` signed two DIFFERENT microblocks at the
+    /// same `height` — provable equivocation. Both `EquivocationHeader.signature`s are
+    /// the offender's Dilithium3 sigs over the `Block_Sig_v23.1` digest of their fields;
+    /// unforgeable. Verified on-chain against the offender's registry PK and applied
+    /// deterministically in the reputation fold (offender → reputation 0 + ban). No
+    /// balance effect. Fail-safe: an invalid/forged proof simply fails verification.
+    EquivocationProof {
+        offender: String,
+        height: u64,
+        block_a: EquivocationHeader,
+        block_b: EquivocationHeader,
+    },
+
+    /// Cryptographic proof that `offender` signed two DIFFERENT checkpoint votes at the SAME
+    /// consensus round `index` — provable BFT vote equivocation (accountable safety: a
+    /// committee member double-voting is what an attacker would do to violate finality
+    /// safety). Both signatures are the offender's consensus-key sigs over the canonical
+    /// `QNET_BFT2_VOTE:<hex(checkpoint_hash)>` message; unforgeable. Verified on-chain against
+    /// the offender's registry PK and applied in the reputation fold (offender → ban). No
+    /// balance effect. Fail-safe: an invalid/forged proof simply fails verification.
+    VoteEquivocationProof {
+        offender: String,
+        /// bincode of BOTH conflicting checkpoints (qnet_consensus Checkpoint). SOUNDNESS:
+        /// the vote signature covers ONLY the checkpoint hash, NOT the round, so the full
+        /// preimages are REQUIRED — the fold re-derives each hash and reads each round `index`,
+        /// then bans ONLY if `index_a == index_b` (a same-round double-vote) and the hashes
+        /// differ and both sigs verify. Carrying only hashes would let a forger pair two honest
+        /// votes from DIFFERENT rounds and falsely slash an honest node.
+        checkpoint_a: Vec<u8>,
+        signature_a: Vec<u8>,
+        checkpoint_b: Vec<u8>,
+        signature_b: Vec<u8>,
+    },
+
     /// Token swap via DEX smart contract
     /// Fee: standard gas fee goes directly to block producer (v3.18: Pool 2 removed)
     Swap {
@@ -810,6 +860,8 @@ impl Transaction {
                 | TransactionType::LightNodeEligibilityBitmap { .. }
                 | TransactionType::RewardDistribution
                 | TransactionType::KeyRotation { .. }
+                | TransactionType::EquivocationProof { .. }
+                | TransactionType::VoteEquivocationProof { .. }
         )
     }
 
@@ -936,6 +988,9 @@ impl Transaction {
             // gas costs to deter quantum-readiness adoption. Rate-limited via
             // per-account nonce monotonicity (one upgrade per account, ever).
             TransactionType::SetPQRequirement {} => 0,
+            // Equivocation slashing proofs: system TX, free (no gas, no balance effect).
+            TransactionType::EquivocationProof { .. } => 0,
+            TransactionType::VoteEquivocationProof { .. } => 0,
         }
     }
 
@@ -1521,6 +1576,35 @@ impl Transaction {
                 // because it inspects fields on the parent Transaction struct.
                 // Empty sender is already caught at the top of `validate()`.
             }
+            TransactionType::EquivocationProof { offender, block_a, block_b, .. } => {
+                // Structural check only — the cryptographic verification (Dilithium3 over
+                // the Block_Sig_v23.1 digest against the offender's registry PK) runs at the
+                // integration layer, which holds the consensus PK registry.
+                if offender.is_empty() {
+                    return Err("[REJECT][TX] equivocation_proof empty_offender".to_string());
+                }
+                if block_a == block_b {
+                    return Err("[REJECT][TX] equivocation_proof identical_blocks".to_string());
+                }
+                if block_a.signature.is_empty() || block_b.signature.is_empty() {
+                    return Err("[REJECT][TX] equivocation_proof missing_signature".to_string());
+                }
+            }
+            TransactionType::VoteEquivocationProof { offender, checkpoint_a, signature_a, checkpoint_b, signature_b } => {
+                // Structural check only — the cryptographic + same-round verification (deserialize
+                // both checkpoints, index_a == index_b, hashes differ, both consensus-key sigs over
+                // QNET_BFT2_VOTE:<hex(hash)> valid vs the offender's registry PK) runs at the
+                // integration layer, which holds the consensus PK registry + the Checkpoint type.
+                if offender.is_empty() {
+                    return Err("[REJECT][TX] vote_equivocation_proof empty_offender".to_string());
+                }
+                if checkpoint_a == checkpoint_b {
+                    return Err("[REJECT][TX] vote_equivocation_proof identical_checkpoints".to_string());
+                }
+                if signature_a.is_empty() || signature_b.is_empty() {
+                    return Err("[REJECT][TX] vote_equivocation_proof missing_signature".to_string());
+                }
+            }
         }
 
         Ok(())
@@ -2713,11 +2797,16 @@ impl Transaction {
                     }
                 }
             }
+            // Equivocation slashing proofs: no account-state effect. The penalty
+            // (offender → reputation 0 + ban) is applied deterministically in the
+            // reputation fold from the committed proof, not in account state.
+            TransactionType::EquivocationProof { .. } => {}
+            TransactionType::VoteEquivocationProof { .. } => {}
         }
 
         Ok(())
     }
-    
+
     /// Check if transaction qualifies for instant local finalization
     pub fn can_be_locally_finalized(&self, config: &LocalFinalizationConfig) -> bool {
         // Small amount transactions get instant finalization

development/qnet-integration/src/consensus_v2_node.rs

@@ -174,6 +174,19 @@ pub async fn execute(effects: Vec<Effect>, node_id: &str, p2p: &Arc<SimplifiedP2
                         .and_then(|m| bincode::serialize(&m).ok());
                     (hb, lt)
                 } else { (None, None) };
+                // v2 SCALE ANCHOR: cumulative equivocation ban-set as of this window (prev
+                // macroblock's set ∪ this window's verified proofs), sorted for byte-stable
+                // bincode. Lets the next epoch's reputation fold derive bans in O(window)
+                // instead of re-scanning from genesis (pruning-safe, scales to 100k). Pure
+                // function of the committed chain ⇒ every sealer produces the same bytes.
+                let banned_validators = {
+                    let mut v: Vec<String> =
+                        crate::node::BlockchainNode::compute_cumulative_ban_set(&storage, window)
+                            .await
+                            .into_iter().collect();
+                    v.sort();
+                    Some(bincode::serialize(&v).unwrap_or_default())
+                };
                 let mb = qnet_state::MacroBlock {
                     height: window,
                     timestamp: checkpoint.timestamp,
@@ -185,6 +198,7 @@ pub async fn execute(effects: Vec<Effect>, node_id: &str, p2p: &Arc<SimplifiedP2
                         randomness_beacon: Some(checkpoint.beacon),
                         excluded_producers_for_next_epoch: excluded,
                         consensus_committee: Some(committee),
+                        banned_validators,
                         reward_heartbeats,
                         reward_light_nodes,
                         ..Default::default()
@@ -394,6 +408,18 @@ pub async fn run(
                                 // epoch_commitment (eligible+committee). Honest 2f+1 reject any forged
                                 // checkpoint ⇒ a malicious leader cannot finalize fake state. No local
                                 // content ⇒ can't check here (re-verified on macroblock sync).
+                                // ACCOUNTABLE SAFETY (pure side effect — never alters handling below):
+                                // cache authentic checkpoints + detect a committee member signing two
+                                // DIFFERENT checkpoints at the SAME round → records sound on-chain
+                                // vote-equivocation evidence (drained into a VoteEquivocationProof TX,
+                                // verified + banned in the deterministic reputation fold).
+                                match &msg {
+                                    ConsensusMsg::Proposal(cp) => crate::node::observe_checkpoint_proposal(
+                                        cp.index, cp.hash(), bincode::serialize(cp).unwrap_or_default()),
+                                    ConsensusMsg::Vote(v) => crate::node::observe_checkpoint_vote(
+                                        v.index, &v.voter, v.checkpoint_hash, v.signature.clone()),
+                                    _ => {}
+                                }
                                 let content_ok = match &msg {
                                     ConsensusMsg::Proposal(cp) => window_buf.get(&(cp.window_head_height / 90))
                                         .map(|c| cp.state_root == c.state_root

development/qnet-integration/src/crypto/key_manager.rs

@@ -45,6 +45,15 @@ fn keypair_init_locks() -> &'static DashMap<PathBuf, Arc<Mutex<()>>> {
     GLOBAL_KEYPAIR_INIT_LOCKS.get_or_init(DashMap::new)
 }
 
+/// Serializes identity/keypair tests across modules. They all mutate process-wide global
+/// state — the keypair cache, the `CACHED_KEY_DIR` OnceLock, and `canonicalize()` over
+/// transient `tempdir()`s — which races under parallel `cargo test` (one test's temp dir
+/// is cleaned while another canonicalizes the cached path → key mismatch → spurious
+/// `identity_not_installed`). Production installs identity once at boot, so this guard is
+/// strictly test-only. Poison-tolerant: a panicking test must not wedge the rest.
+#[cfg(test)]
+pub(crate) static IDENTITY_TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
 /// Compute the canonical cache key for a given key directory.
 /// Uses canonicalized parent dir to ensure two managers pointing to the same on-disk
 /// file (even via different relative paths) share the same global cache entry.
@@ -901,6 +910,7 @@ mod tests {
 
     #[test]
     fn test_singleton_same_dir_returns_same_keypair() {
+        let _identity_guard = IDENTITY_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         let temp = tempdir().expect("tempdir");
         let key_dir = temp.path().join("keys_singleton_a");
 
@@ -940,6 +950,7 @@ mod tests {
     /// producing two different on-disk and in-memory identities.
     #[test]
     fn test_singleton_concurrent_init_no_divergence() {
+        let _identity_guard = IDENTITY_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         use std::thread;
         use std::sync::Arc as StdArc;
         use std::sync::Barrier;
@@ -998,6 +1009,7 @@ mod tests {
     /// paths (e.g., trailing slash, current-dir prefix) still share state.
     #[test]
     fn test_singleton_canonical_path_keying() {
+        let _identity_guard = IDENTITY_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         let temp = tempdir().expect("tempdir");
         let key_dir = temp.path().join("keys_canon_c");
         fs::create_dir_all(&key_dir).expect("mkdir");
@@ -1024,6 +1036,7 @@ mod tests {
     /// accidental cross-contamination via the global cache).
     #[test]
     fn test_singleton_distinct_dirs_distinct_keypairs() {
+        let _identity_guard = IDENTITY_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         let temp = tempdir().expect("tempdir");
         let dir_a = temp.path().join("keys_distinct_a_d");
         let dir_b = temp.path().join("keys_distinct_b_d");

development/qnet-integration/src/crypto/quantum_crypto.rs

@@ -1376,6 +1376,13 @@ mod tests {
     async fn test_dilithium_sign_and_verify() {
         println!("[TEST][QUANTUM_CRYPTO] test_dilithium_sign_and_verify start");
 
+        // Serialize against the key_manager identity tests: all share the process-wide
+        // keypair cache + CACHED_KEY_DIR OnceLock + canonicalize() over transient temp
+        // dirs. Without this, a parallel identity test cleans a dir mid-run and our
+        // install/sign resolve to different canonical keys → spurious identity_not_installed.
+        let _identity_guard = crate::crypto::key_manager::IDENTITY_TEST_LOCK
+            .lock().unwrap_or_else(|e| e.into_inner());
+
         // 1. Initialize crypto
         let mut crypto = QNetQuantumCrypto::new();
         let init_result = crypto.initialize().await;