BFT View-Change Quorum Certificate Validation Gap During Network Partitions

[JamesEjembi]

Problem Statement / Feature Objective

During a network partition, a replica may collect a quorum certificate (QC) for view-change while another partition independently finalizes a conflicting QC. When the partition heals, the convergence protocol lacks a deterministic tie-breaker for QCs with identical view numbers but divergent signature sets, leading to a liveness stall.

Technical Invariants & Bounds

• Quorum size: 2f+1 out of 3f+1 replicas.
• View-change timeout: 4x round-trip time (bounds: 2s-30s).
• Certificate validity window: 2 epochs (max 60s).
• Signature aggregation threshold: Ed25519 batch-verify at most 128 sigs per cert.
• Network assumption: partial synchrony with Delta <= 500ms after GST.

Codebase Navigation Guide

• src/consensus/view-change/qc-validator.rs — primary validate and merge logic.
• src/consensus/pacemaker/timeout-controller.rs — view-change timeout orchestration.
• src/consensus/commit/conflict-resolution.rs — tie-breaking on equivocal certificates.
• src/crypto/ed25519/batch-verify.rs — multi-signature verification.

Implementation Blueprint

1. Add a qc_epoch monotonic counter to each QC struct, incremented by the primary on proposal.
2. In conflict-resolution.rs, implement deterministic tie-breaking: highest qc_epoch wins; if equal, compare lexicographic hash of aggregated public-key set.
3. Add a quarantine buffer in qc-validator.rs that holds conflicting QCs for 2 view-change rounds before garbage collection.
4. Emit a QcConflictDetected{view, qc_epoch_a, qc_epoch_b} event for observability.
5. Integration test: partition 2 replicas, produce divergent QCs, heal network, verify convergence within 3 view-change rounds.