feat(#98): VM-bridge cross-check auditor (observe-only divergence alarm)#107
Merged
Conversation
The VM bridge is normally a production dependency (state roots for block production). --vm-crosscheck reuses the same connection as an AUDITOR for the read path: every interval (default 60s) Lantern asks the bridge node for the canonical tipset at head-3 (default depth) and compares it against the local header store. - Agreement: counter. Divergence: loud DIVERGE error log + counter + dashboard card + OnDiverge hook. STRICTLY observe-only: reads stay 100% local, the head path is never blocked or rewritten. - No false alarms by construction: bridge lag, null rounds, shallow chains, unreachable bridge and unparseable responses are all skips, and the target depth (head-3) sits behind legitimate near-tip reorgs. - No new trust: the bridge is already trusted for block production (TRUST-MODEL 4.2 documents the auditor role). This catches the attack class full re-execution (#89 Stage C) would catch - headers that verify but state that was never honestly executed - at ~zero cost, and doubles as Stage C's future vector generator. Wiring: --vm-crosscheck + --vm-crosscheck-interval (requires --vm-bridge-rpc + header store), dashboard dev-page card, CHANGELOG. Tests: agree / diverge (+hook) / bridge-lag skip / bridge-down skip / shallow-chain skip (bridge not even called) / config validation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New
chain/crosscheck+ opt-in--vm-crosscheck: once a minute, compare the local canonical tipset at head-3 against the operator's own bridge node; alarm loudly on divergence.Soak tie-in (#104): the Forest bridge is already up for block production in Phase 5; this rides the same session as the bridge-outage drill's observability.
Tests: agree, diverge (+OnDiverge hook), lag-skip, down-skip, shallow-skip, config validation. Build/vet/gofmt clean.
Closes #98.