Expand description
Deterministic single-member Tempo development consensus.
This is a local signer, not a running Simplex network. It derives an ed25519 proposer and a
real 1-of-1 BLS sharing from ChaCha20(keccak256(seed || counter_be_u64)). The default seed is
keccak256("anvil/tempo-consensus/" || mnemonic). Keys are predictable development identities,
not production trust anchors. Each rotation derives a fresh sharing, rather than resharing an
existing key.
For epoch length L, height h uses epoch h / L. Signed heights in epoch zero use view h,
while later epochs use view h % L + 1; the parent view is one less. Genesis and each preceding
epoch boundary serve as view-zero parents. This no-skips development convention does not
inherit a remote chain’s rounds. A boundary at h % L == L - 1 announces the next committee
in a native [OnchainDkgOutcome]. The boundary is signed by the old committee; the next epoch
activates the announced key. The outcome’s is_next_full_dkg = false describes the next
ceremony, not whether this local key changed.
[TempoHeader] owns the full RLP encoding and hash, including all execution fields and the
optional context. Genesis is unsigned and contextless. Context is omitted before T4, following
TIP-1031’s activation gate. The supported wire mapping is pinned to Tempo 2c25f7cd
and Commonware 2026.9.0, and rejects unknown hardforks pending review. This is not a claim of
upstream format stability; protocol-owner confirmation remains tracked by OSS-1186. Older
execution hardforks still use the pinned certificate/DKG codec, not historical Commonware
codecs.
Cloning snapshots the complete controller, including pending rotations. Unwind instead restores
the retained height’s checkpoint and discards later certificates and rotations. Checkpoints
retain only their active and future committees. Callers can bound retained history with
TempoConsensus::prune; unwind cannot cross the pruning boundary. Reset restores the unsigned
initial anchor, including its original rewind floor. Re-signing replacement history can produce
valid certificates for conflicting headers at the same height: this development rewind behavior
is not consensus safety. Callers own canonical commit, execution/body validation, archive
pruning, and persistence; this module has no mining, RPC, CLI, or fork-routing integration.
Re-exports§
use alloy_consensus::Sealable;🔒use alloy_primitives::B256;🔒use alloy_primitives::Bytes;🔒use alloy_primitives::keccak256;🔒use commonware_codec::Encode;🔒use commonware_cryptography::Signer;🔒use commonware_cryptography::bls12381::dkg::feldman_desmedt;🔒use commonware_cryptography::bls12381::dkg::feldman_desmedt::Output;🔒use commonware_cryptography::bls12381::primitives::sharing::Mode;🔒use commonware_cryptography::bls12381::primitives::variant::MinSig;🔒use commonware_cryptography::ed25519::PrivateKey;🔒use commonware_cryptography::ed25519::PublicKey;🔒use commonware_math::algebra::Random;🔒use commonware_utils::N3f1;🔒use commonware_utils::TryFromIterator;🔒use commonware_utils::ordered;🔒use rand_chacha::ChaCha20Rng;🔒use rand_chacha::rand_core::SeedableRng;🔒use serde::Deserialize;🔒use serde::Deserialize;🔒use serde::Serialize;🔒use serde::Serialize;🔒use std::collections::BTreeMap;🔒use std::num::NonZeroU64;🔒use std::sync::Arc;🔒use tempo_dkg_onchain_artifacts::OnchainDkgOutcome;🔒use tempo_hardfork::TempoHardfork;🔒use tempo_primitives::TempoConsensusContext;🔒use tempo_primitives::TempoHeader;🔒
Modules§
- certificate 🔒
- The private wire adapter for Tempo’s Simplex finalization certificates.
Structs§
- Checkpoint 🔒
- Local identity state at the anchor or a finalized height.
- Committee 🔒
- Prepared
Header 🔒Metadata - Tempo
Consensus - A deterministic development committee with one participant and quorum one.
- Tempo
Consensus Identity - Public development committee information, without secret key material.
- Tempo
Finalization - Certificate data bound to a complete native Tempo header.
Enums§
- Tempo
Consensus Error - Invalid local consensus input or exhausted height/identity space.