Native consensus

Finalized Native state is the canonical record of authorization, assignment, evidence, and accounting. End-block reserves at most 24 candidate slots for Native facts, leaving at least eight of the 32 total slots for finalized EVM observations. Validator vote extensions sign the complete domain-separated candidate envelope—kind, logical key, digest, and payload—without changing ordinary block sign bytes. Core verifies every auxiliary BDN aggregate against the frozen committee before application, retains the complete auxiliary certificates in the indexed quorum certificate for the following block, and the plugin independently repeats signature and strict-weight verification before persisting the recoverable certificate. Signer bitmaps, BDN coefficients, handoff manifests, and EVM verifier rosters all use the core committee's canonical order: descending raw stake, then descending validator address for equal stake. Missing auxiliary votes delay only the dependent action and never halt ordinary Native consensus; an included malformed certificate makes the proposal invalid.

• Governed model, schema, fee, timing, bond, slash, emission, treasury, bridge, and settlement-domain registry parameters.
• Domain-scoped deposit observations and the credit/reservation ledger derived from them.
• Request-scoped off-chain escrow authorizations bound to one settlement domain.
• Eligible servicers, attested enclave identities, deterministic assignments, and retries.
• Canonical execution receipts, producer accounting, slashing evidence, and terminal request state.
• Domain-partitioned settlement cohorts plus canonical-chain epoch rewards and bridge releases, per-domain validator rotations, and governance actions.

Protocol authorization requires signedWeight × denominator > totalWeight × numerator. Governance cannot configure a threshold below 2/3 or an unreachable threshold of 1. Exactly two thirds is insufficient. The core-frozen epoch roster and raw powers remain authoritative for the whole epoch; a later minimumValidatorBond change cannot remove a member or recalculate quorum until the next snapshot.

Every observation and conflict claim is keyed by its immutable validator-set ID and epoch. Rotation claims additionally include the settlement-domain ID, so signing one domain's chain-specific digest never prevents the same committee from authorizing another domain. The record stores that observer's snapshot weight and the snapshot total; later votes cannot combine with another snapshot or retroactively reprice old stake. Native Chain handoffs copy each exact raw uint64 voting power into every domain verifier's uint96 field, and observers require byte-for-byte key and weight equality. No normalization or remainder assignment can move an exactly-two-thirds coalition above the strict threshold. Enclaves do not pin validator committees, so registered enclave keys survive validator rotation. Each EVM verifier uses weighted public keys and an EIP-2537 pairing check.

Each validator operates one watcher per governed settlement domain. A watcher follows finalized EVM heads from a durable canonical cursor, validates exact calldata, events, historical block hashes, and contract state, then publishes only to its validator's loopback admin RPC. The validator-local candidate outbox is persisted atomically across restarts, and the watcher does not advance its EVM cursor after HTTP acceptance: it waits until the exact certificate is observable in finalized Native state. Core accepts only evm-observation/* runtime candidates from that boundary. There is no shared quorum bearer credential, coordinator fan-out, or observer signature-share endpoint. The API publishes ERC-1271 request intents as ordinary fee-paying Native transactions; watchers independently verify the pinned finalized contract-wallet state. EOA signatures remain deterministic Native validation.

• Deposits and bridge locks are credited only after exact requester, amount, contract, event, and finalized-block checks.
• Settlement, result, epoch-reward, bridge-release, timeout/reassignment, handoff, cancellation, and governed abandonment authorizations are derived entirely from frozen Native state.
• Settlement finalization, epoch mint, queue/cancellation, authority, and retirement facts are reconstructed independently at an exact finalized EVM block. State-only facts use a Native-time-derived five-minute checkpoint with a five-minute lag, so honest watchers with skewed finalized RPC heads query the same historical block. When a newly deployed domain is younger than that lag, every watcher deterministically uses finalized block zero until the first lagged checkpoint exists; readiness is pending without querying genesis state, which bounded development RPCs may already have pruned.
• Candidate keys are conflict-scoped and certificates are replay-protected by kind, identity, digest, validator set, and epoch snapshot.

Assignments are anchored to the previous finalized block, scoped to one request/model/attempt, and bind the servicer, TEE key, reserved budget, fee revision, maximum provider cost, and deadline. The worker reconstructs the model allocation and rejects a ceiling inconsistent with the snapshotted margin and foundation fee. A Merkle-rooted batch can share one quorum signature without losing per-assignment inclusion proofs.

A timeout is a deterministic Native transition, not a coordinator timer. End-block discovers expired assignments through a persisted 512-request continuation cursor, reserves timeout certificate capacity independently of settlement load, and validators certify the exact request/model/attempt transition in vote extensions. The certificate applies reassignment or terminal failure. The production worker persists receipts so a relayer failure is not misclassified as enclave non-performance.

Native Chain chooses a validator committee for each epoch, but settlement contracts on other chains cannot read Native Chain directly. Each settlement domain therefore keeps its own copy of the current committee in a quorum verifier. When validator keys or stake weights change, Takusen must install the same next committee in every governed verifier before Native Chain can treat that committee as current.

There is no lead-height preparation phase. At the nominal epoch boundary, one Native Chain end-block atomically snapshots the exact N+1 keys and raw voting powers, every governed settlement-domain ID, and the wall-clock notice. If the weighted roster is unchanged, it advances immediately without a new validator-set ID or EVM work. If changed, set N remains active while the boundary is extended and attempt 1 is created.

• No prepared handoff or generation exists before the nominal boundary.
• Each attempt timestamp is consensus time plus the snapshotted notice and is that attempt's outgoing-authority cutoff; a fully finalized pre-T cancellation is required before attempt + 1 can choose a later timestamp.
• The generation is SHA-256 over the v1 domain separator, Native Chain ID, epoch, old/new set IDs, frozen roster and domain-set hashes, attempt, timestamp, and that attempt's cutoff using fixed-width uint64 encoding.
• No validator-membership or domain traffic-state change may overlap a prepared handoff.
• A domain's active flag controls user traffic, not authority tracking. Staged and temporarily inactive domains still receive every committee update.
• Routine validator fee rewards go to the configured output under the governed early-withdrawal policy instead of auto-compounding into consensus power. Explicit stake edits still change N+1's exact weights and therefore require a handoff.

The verifier limit is 64 validators. Native Chain prepares at most 60, preserving gas headroom for the cross-chain update.

A queued attempt has exactly two outcomes. Before T, a Native consensus cancellation certificate may be relayed and finalized on every queued domain, after which Native may create the next deterministic attempt. Otherwise N+1 becomes effective automatically at T. There is no activation certificate, activation transaction, fail-closed waiting period, or post-cutoff metadata repair.

If not every domain can queue safely, governance does not invent a new generation and the coordinator does not collect signatures. Native consensus first creates a deterministic cancellation manifest for the current attempt. Set N vote extensions produce the cancellation certificate, any relayer submits each inclusion proof before T, and watchers attest finalized cancellation or finalized absence. Only then does Native increment the attempt exactly once, choose a later timestamp, and recompute the generation from the unchanged frozen plan.

1. Stop scheduling the incomplete attempt while T is still in the future.
2. Relay the consensus cancellation certificate to every domain that finalized the queue; prove finalized absence for domains where it never landed.
3. Wait for autonomous watcher certificates covering every snapshotted domain. A missing Native index is not evidence that an EVM transaction was absent.
4. Create attempt + 1 from the same frozen roster and domain snapshot, with a later timestamp and recomputed generation.
5. Relay the new global certificate and wait for every finalized queue before T.

After a restart, the relayer reads finalized Native certificates and contract state; it never reconstructs validator shares. Before T it can resume queue or cancellation relay. At or after T it recognizes timestamp-effective N+1 and may call finalizeQueuedSet. A different pending roster remains fatal.

Every Takusen plugin transaction pays at least the governed Native Chain send fee, with a one-atomic-unit fail-safe if governance configures zero. Core deducts the fee into the chain reward pool inside the same nested state transaction as plugin delivery, so failure rolls back both the charge and plugin writes. Clients query and cache the current governed fee before signing.

Producer payout mappings are accepted only for a current or prepared validator, or an identity marked by end-block consensus after actually producing a block. A self-signed fresh address cannot create permanent payout state. Likewise, a minority settlement observation remains indexed for coordinator discovery until quorum or a valid certificate performs the terminal transition.

Consensus range pages use a strict full-key continuation cursor backed by native Pebble and transaction-index seeking, so later pages do not rescan earlier keys. Native Chain rejects a cursor outside the requested prefix, and the plugin rejects duplicate, reordered, or non-prefix continuations. Direct rotation-schedule, pending-reward, pending-bridge-burn, pending-slash, latest-epoch, provisional-reservation, and active-servicer indexes avoid permanent-history scans in handoff, relay, slashing, deposit resolution, enclave revocation, and assignment; slash application is capped per boundary block and resumes from persisted state.

Compressed execution cohorts expose only their outer servicer identity during signer discovery. Core verifies that servicer signature before delivery decompresses the cohort, with a 3 KiB compressed ceiling, 64 KiB expanded/receipt ceiling, and 16:1 maximum expansion ratio; the client adaptively reduces a cohort until it fits.

The in-process plugin RPC is operationally private: it binds loopback by default, refuses a non-loopback listener without bearer authentication, limits connections, concurrent handlers, per-source request rates, and SSE subscribers, and gives every stream a write deadline and 30-second lifetime. RPC list clients follow opaque continuation cursors, while rotation recovery uses the direct indexed endpoint.