Skip to content

BLS key expiry and dedicated registration certificate - #37

Closed
ch1bo wants to merge 36 commits into
masterfrom
leios
Closed

ch1bo wants to merge 36 commits into
masterfrom
leios

Conversation

@ch1bo

@ch1bo ch1bo commented Aug 27, 2026

Copy link
Copy Markdown
Member

Specifying BLS key expiry on CIP-164 using a genesis parameter.

Also explored how the CIP would need to change if we'd be going with a dedicate BLS key registration, in course of input-output-hk/ouroboros-leios#1024

perturbing and others added 30 commits April 28, 2026 07:49
make non-persistent vote depend on Praos nonce
* Add CPS-????: Coordination of Hierarchical Handle Namespace

* Add CPS-????: Coordination of Hierarchical Handle Namespace

This CPS documents the problem of uncoordinated handle namespaces on
Cardano and proposes requirements for a governance solution.

Submitted following the discussion in CIP PR cardano-foundation#1187 where the CIP
editors identified the need for a broader problem statement before
a technical solution can be proposed.

Related: cardano-foundation#1187

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-0???/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* also remove Problem hard-coded number 5

* right-brain mistake of using `Author:` for 1-member `Authors:` list

* Update CPS-0???/README.md

Co-authored-by: Ryan <ryan.williams@intersectmbo.org>

* Update README.md

Rewrite CPS: Handle Provider Interoperability — incorporate meeting feedback

* add missing `Proposed Solutions:` header field

* concise label for initial (closed) PR discussion

* add `Original PR` label to this discussion link

* assign CPS number 32

* Rename directory to CPS-0032

* Update README.md

* Mark CPS-0008 as superseded by CPS-0032

* Fix directory name: CPS-032 to CPS-0032

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
Co-authored-by: Ryan <ryan.williams@intersectmbo.org>
…on#1205)

* Add CIP-0309: Proof of Existence Transaction Metadata

* CIP-0309: set Discussions to the submission PR (cardano-foundation#1205)

* CIP-proof-of-existence: address editor review

- remove the self-assigned CIP number throughout (preamble now `CIP: \?`;
  folder renamed CIP-0309 -> CIP-proof-of-existence; metadata label 309 kept
  as the on-chain identifier)
- drop the redundant CIP-0001-template intro paragraph and the
  section-separator horizontal rules (native Markdown headers only)
- capitalise the Motivation/Rationale question headings
- point the reference-implementation links at their renamed repositories
- rename the grammar file cip-309.cddl -> label-309.cddl

* Revise PoE spec: cryptographic hardening; move the metadata-label note into the Abstract

* assign CIP number 190

* CIP-0190: rename containing directory per editor number assignment

* CIP-0190: revise spec — finalized sealed-PoE construction, de-chunked carriage, verifier contract

Regenerated from the Label 309 source corpus. Highlights: sealed-PoE
construction finalized (nonce-salted KEKs, hashes_hash transcript binding,
STREAM content format, in-ciphertext passphrase commitment, per-slot MAC
fold); carriage finalized to whole-body chunk-array transport with de-chunked
field shapes; verifier tx-byte binding, block-time/depth definitions, and
not-found taxonomy; validator/verifier contract with ENC_UNSUPPORTED
degrade-to-opaque and the multi-URI availability/integrity split;
fetched-content attribution so gateway corruption cannot condemn a record;
expanded security and privacy considerations; registries, error codes, and
the CDDL reconciled to the spec text.

* CIP-0190: conform document structure to the CIP validation rules

- Discussions preamble entry in 'Label: URL' form
- 'Conventions and terminology' moved under Specification
- 'Security and Privacy Considerations' nested under Specification
  (subsection levels shifted accordingly)

No normative content changes.

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
* CIP-165 revision 2: improvements and uncertanty fixes

Co-authored-by: João Santos Reis <joao.reis@moduscreate.com>
Co-authored-by: Christopher Harrison <christopher.harrison@moduscreate.com>

Improvements to the scls format. During implementation of
the Haskell library, integration of that library with cardano-ledger,
and Rust implementation. Several improvements were identified:
- improvements and fixing uncertainty from the text, found during
  Rust library implementation
- updates to the namespaces, found during integration with cardano-ledger.

* Update discussions

* Try to fix the conflicts
…n#1220)

* CIP-0002: removed TOC invalidated by many removed headings

* CIP-0002: replace @edsko defunct web site by GitHub page

* CIP-0002: reassign removed subheading links to their parent heading + disambiguate State heading

* #goals section renamed

* (continued) subheading link to parent

* install more proper web link for @edsko
…ation#1130)

* Create CPS-tiebreakers

* Update CPS-tiebreakers/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-tiebreakers/README.md

Co-authored-by: Ryan <ryan.williams@intersectmbo.org>

* assign CPS number 25

* Assigned CPS-0025

* Update CPS-0025/README.md

* Update CPS-0025/README.md

* Add IPFS link to 2025 IOE Proposal

* robust IPFS link for IOR proposal + link to References where it appears in document

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
Co-authored-by: Ryan <ryan.williams@intersectmbo.org>
* Create .gitattributes

* Update registry.json

* remove accidentally proposed change to `.gitattributes`

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
According to the CIP#0137, message body is between 360 and 2000 bytes.
KES signatures are 448 bytes

Added definitions of `word16`, `word32` and `word64` values.

Co-authored-by: Jean-Phillippe Raynaud <jpraynaud@users.noreply.github.com>
…n#1101)

* init draft for governance metadata extension

* add reference to other issue

* clean up proposal, ready for pull request

* fix example

* add dicussion link to header

* Update cip-governance-metadata-extension/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update cip-governance-metadata-extension/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* add common and update number

* remove confusing typescript definitions

* Init schema for CIP169

* Ref objects to cip 116

* Apply suggestions from code review

Co-authored-by: Ryan <ryan.williams@intersectmbo.org>

* Add language to common json

* rename directory

* improve and focus the schema

* downgrade to older schema

* update schema and add 116 as ref

* add explicit references

* fix where onChain is

* fix ada symbol

* tweak example

* further examples

* pass workflow

* rename cip

* add implementation plan, implementations and author

* fix CIP-0100 reference

* reform throughout

* reform test vectors and examples

* add on-chain examples

* improve test vector

* add tx studio link

* spec will be "merged" from the time it is merged

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
Co-authored-by: Elena Bardho <ebardho17@epoka.edu.al>
Co-authored-by: elenabardho <71819187+elenabardho@users.noreply.github.com>
* CIP-0010: attribute metadata label 309 to CIP-0190

Label 309 was already reserved as "Proof of Existence record" but the entry
did not name the specification that defines it. CIP-0190 does. The registry
has no url or owner field, so the attribution goes in the description text,
matching labels 721, 777, 867 and 3692.

* renamed label, broadened to cover changes like this

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
…n#1224)

* CIP-0179 | Revision 5: any-action linkage, rating require_all, sealed format

- Generalize governance linkage to any action type (was Info Actions only);
  mechanism-B vote binding available only while the action is votable.
- Carry the link inside the CIP-108 body as a namespaced cip179 object with
  required @context terms; shorten kind to "survey-link".
- Add a mandatory rating require_all flag; when set, a present rating answer
  must rate every option.
- Tighten sealed-response serialization: canonical-CBOR plaintext padded to
  padding_size, raw de-armored ciphertext (not AGE/PEM armored text).
- Bump spec_version to 5 across README, schemas, examples, and test vectors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* CIP-0179 | Revision 5 fixes: flag type, Keyholder role, additive vote binding

- Introduce a `flag` type (uint 1/0) for the `required` and `require_all`
  flags, since Cardano's transaction_metadatum subset has no boolean type;
  omitted means false and an explicit 0 MUST be accepted as false.
- Rename role 4 `Owner` -> `Keyholder` (prose only; tag and encodings
  unchanged) to remove the collision with the definition's `owner`
  (cancellation authority).
- Make the mechanism-B governance-vote binding purely additive: a
  non-qualifying voting_procedures entry is simply not a binding and never
  invalidates the response. Support surveys linked by more than one action
  and reconcile the linked_action_id wording accordingly.
- Normalize non-table markdown formatting (frontmatter indent, emphasis
  style, list spacing); tables keep the compact style.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Create CIP-calidus-for-ledger

* Update CIP-calidus-for-ledger/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CIP-calidus-for-ledger/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CIP-calidus-for-ledger/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CIP-calidus-for-ledger/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Assigned CIP-0175

* Update CIP-0175/README.md

Co-authored-by: Alexey Kuleshevich <lehins@yandex.ru>

* Rewrite to use ledger certificates

* Minor cleaning up

* Update CIP-0175/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Switch to single cert and add CDDL

* Clarify cold/hot override rules

* Clarify deterministic voting mechanism

* order PR discussions by significance

* Update CIP-0175/README.md

Co-authored-by: Alexey Kuleshevich <lehins@yandex.ru>

* Update CIP-0175/README.md

Co-authored-by: Alexey Kuleshevich <lehins@yandex.ru>

* Update CIP-0175/README.md

Co-authored-by: Alexey Kuleshevich <lehins@yandex.ru>

* Update CIP-0175/README.md

Co-authored-by: Alexey Kuleshevich <lehins@yandex.ru>

* Update CIP-0175/README.md

Co-authored-by: Alexey Kuleshevich <lehins@yandex.ru>

* Update with feedback from lehins

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
Co-authored-by: Alexey Kuleshevich <lehins@yandex.ru>
…no-foundation#1231)

* refresh validation error messages

* remove CIP body cross reference for unmerged CIPs

* document word placeholders and quote template "?" values

* fix validator gaps and extract shared validation module

* refine validator error messages and schema updates

* fix validator - reject non-string label/URL entries

* remove junk mac files
* CIP-0059 | Add van Rossem HF to Features table

* Update CIP-0059/feature-table.md

Co-authored-by: Ryan <dev.ryan.williams@gmail.com>

---------

Co-authored-by: Ryan <dev.ryan.williams@gmail.com>
* CIP-? | Cardano Wallet Deep-Link Signing

A deep-link wire protocol so native mobile dApps can ask an installed
Cardano wallet to perform CIP-30 operations (signTx, signData, ...)
over the OS URL-handling mechanism: no relay server, no embedded
WebView, no QR, no WebSocket. Addresses CPS-0010 for the
mobile-native dApp shape.

Reference implementations: Aegis (dApp) + Yuti (wallet), both from
Flux Point Studios.

Discussions:
  - https://forum.cardano.org/t/cip-proposal-mobile-deep-link-signing-for-native-dapps-cip-30-extension/154561
  - cardano-foundation#1189

* Update CIP-deeplink-signing/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CIP-deeplink-signing/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CIP-deeplink-signing/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* CIP-? | address PR cardano-foundation#1189 review feedback

Layered on top of the three accepted suggested-change commits from
rphair (TitleCase for Motivation/Rationale subtitles, Versioning -> H3).

Additional review-response changes in this commit:

- Acceptance Criteria -> lowercase 'criteria' (matches CIP-0001 line 487
  usage and the rest of the H3 subsection case convention).

- Reference Implementation section: replace the dApp-side link that
  previously pointed at aegis-contracts (the on-chain validator suite)
  with the dedicated public SDK repo created at draft submission:

    - dApp-side SDK:       Flux-Point-Studios/cip30-deeplink-client
                           (new, public, Apache-2.0, populated README)
    - Wallet-side handler: Flux-Point-Studios/yuti (now public)
    - aegis-contracts retained as a related-repositories pointer only,
      since CIP-0001 distinguishes "reference implementation" repos
      from companion-but-unrelated smart-contract repos.

- examples/.gitkeep: clarify that the folder holds informative snippets
  only, per CIP-0001's note that bulk implementations live in author
  repos. Lists all three reference-implementation repos by URL.

- Discussions field: prefix the Forum-thread and Original-PR entries
  with their labels per the link-labelling convention rphair flagged
  as forthcoming in CIP-0001.

* CIP-? | cite CIP-158 (Cardano URIs - Browse Authority) in Relationship to CIP-13

CIP-158 was merged 2026-03 and is a sibling CIP-13 extension authority
(adamkdean / @adamkdean). The draft already cited CIP-45 (connect
authority) and CIP-162 (drep authority) as precedents for CIP-13
extensibility; CIP-158 (browse authority) belongs in that list.

Two small additions in the Relationship to CIP-13 section:

  - Family-of-extensions list: add CIP-158 alongside CIP-45 and
    CIP-162, with its grammar and a note that CIP-158 is explicitly
    navigation-only and scopes out signing flows / callback paths
    per its own Rationale.

  - Future minor-revision paragraph: note that the prospective
    web+cardano://cip30dl/v1/... form mirrors CIP-158's grammar
    precedent for the established CIP-13 extension shape.

Public conversation thread on this (Adam Dean raised the comparison
on X; we credit CIP-158's isolation-of-authorities framing back at
him for CIP-30-DeepLink sitting in its own namespace) is linked from
the Discussions: preamble.

* CIP-? | cite CPS-16 as the web+cardano:// authority coordination point

CPS-0016 ("Cardano URIs", Open) — authored by Adam Dean and Mad Orkestra —
serves as the central reference and collision-prevention registry for the
web+cardano:// authority family (null, stake, claim, transaction, block,
addr, browse, drep, etc.). Pointed at by Adam during PR-thread discussion
on X as the right coordination point for this and adjacent wallet-URI
efforts.

Two small additions in the Relationship to CIP-13 section:

  - Family-of-extensions paragraph: add a closing sentence noting that
    the authorities catalogued in CPS-16 are the central registry, with
    CPS-16's authors and status.

  - Future minor-revision paragraph: note that the prospective
    web+cardano://cip30dl/v1/... variant would register through CPS-16's
    authority registry to avoid collisions with other emerging
    web+cardano:// authorities.

CPS-16 is NOT added to Solution-To: because it is a coordination CPS,
not a problem statement this CIP solves; this CIP is a participant in
CPS-16's registry rather than its solution.

* assign CIP number 186

* CIP-186 | rename directory + update path references

Per @rphair at the 2026-05-26 CIP editors meeting: this proposal was
accepted as Candidate and assigned CIP number 186 (rphair pushed
header update in 5c645d2). Follow-up: rename CIP-deeplink-signing/
to CIP-0186/ and update the schema $id / README $schema URLs that
referenced the old path.

The CIP-30-DeepLink protocol name itself remains as the friendly
identifier per the spec's Title field; only the on-disk directory
and the path component of canonical URLs change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | conformance test suite: 57 vectors + verifier

* CIP-186 | fix Appendix C.1 nonce example (36->32 chars, decodes to 24 bytes)

Spec mandates 24-byte nonce. Appendix C.1 example value
`AgICAgICAgICAgICAgICAgICAgICAgICAgIC` (36 chars) decodes to 27 bytes
under strict base64url-no-pad, violating the spec's own length rule.
Correct value for 24 bytes of 0x02 is `AgICAgICAgICAgICAgICAgICAgICAgIC`
(32 chars). Fix applied to both the constant listing and the request-URL
example. Caught independently by Yuti's parser conformance and the
conformance suite's base64url_001_valid_no_padding vector.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | add aead to request-key ABNF production

The aead URL parameter is referenced in the §Methods AEAD envelope
section (`aead=xsalsa20poly1305`, `aead=chacha20poly1305-ietf`) for
suite negotiation at connect time, but the URI-format ABNF `key`
production omits it. Under §Unknown-key policy strict-reject, a
conforming wallet would reject a connect URL carrying the spec-defined
`aead` parameter with errorCode=-9 — the spec contradicts itself.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | split key into request-key / response-key + enumerate response keys

§Response signing requires every response URL to carry `response`,
`walletKey`, `nonce`, `payload`, and `signature` parameters (and
`errorCode`/`errorMessage` on rejection envelopes), but the URI-format
ABNF only enumerates request-side keys. Under §Unknown-key policy
strict-reject, dApps parsing conformant wallet responses would reject
every response URL as carrying unknown keys.

Split `key` into `request-key` (wallet-bound) and `response-key`
(dApp-bound) productions. Update §Unknown-key policy to symmetrise the
strict-reject rule across both directions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | clarify errorCode=-4 envelope destination on redirect host mismatch

Spec says wallet MUST reject any subsequent request whose redirect host
differs from the connect-time persisted host, but does not say WHERE
the -4 rejection envelope is delivered. Two readings: (a) the offending
request's redirect host (defeats security — legitimate dApp never
observes the attack), (b) the connect-time persisted host (correct —
legitimate dApp can tear down the session). Pin to (b). Defence-in-depth
test updated to assert delivery target.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | promote result-json.commit echo verification to MUST

§Methods signTx response shows `result-json.commit` as "echo of request
commit" but does not state that the dApp MUST verify the echo. As a SHOULD
the wallet's pre-render commit check is sufficient; promoting to MUST
makes it the dApp-side complement and closes tx-body substitution as a
class across the full request/response loop. Defence-in-depth.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | specify partialSign=true witness merge semantics

Spec inherits CIP-30:343-347 partialSign verbatim but does not say how
the dApp merges a wallet-returned partial witness_set into an
in-flight transaction_witness_set that already carries co-signer vkey
witnesses. Two readings: (a) replace the map's vkey_witnesses array
(silently drops prior co-signers), (b) array-append (correct). Pin to
(b) for vkey_witnesses (map key 0) and extend to native scripts (key 1),
Plutus scripts (keys 3/6/7), datums (key 4), redeemers (key 5). Add
SHOULD-reject on wallet returning non-empty entries for keys the dApp
did not authorise (anti-injection).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | tx body extraction: literal-bytes rule (do not re-canonicalise)

Spec mandates re-serialise under RFC 8949 §4.2 canonical encoding, but
this contradicts the chain's tx_id rule: chain's tx_id is BLAKE2b-256
over the source body bytes the ledger validated. If the wallet
re-canonicaliser disagrees with the source encoder (definite-vs-
indefinite length, non-text-key map sort order), wallet's commit
diverges from chain's tx_id and every downstream hash-pin breaks.

Pin to literal-bytes extraction. dApp MUST supply Conway-era canonical
CBOR (per RFC 8949 §4.2) so the extraction is well-defined; wallets
MAY but need not check source canonicity.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | pin reference Conway canonical CBOR encoders

The aux-data consistency rule requires BLAKE2b-256(canonical-cbor(...))
without pinning what produces canonical-cbor. CBOR canonicalisation
has multiple incompatible interpretations (deterministic-only vs
strictly-deterministic, definite-vs-indefinite length, sort orders for
non-text keys). Pin to cardano-ledger (Haskell), pallas-codec (Rust),
or cardano-multiplatform-lib (JS/Rust). Conformance against any is
sufficient.

Also clarify the contrast with tx_body extraction: tx_body is
byte-literal (commit binds to the ledger-validated source bytes), aux
data re-canonicalises (verifying a chain-recorded hash, not extracting
chain-validated bytes).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | canonical-form port inclusion rule in Response signing

§Response signing canonical-form step 2 says
"Append <scheme>://<host_lowercased><path>" but does not specify
whether an explicit port is part of the canonical authority. Different
URL libraries disagree on default-port omission (RFC 3986 §3.2.3 says
default ports are equivalent but not identical). Pin: include port iff
it appears literally in the URL authority; default ports (443/80) MUST
NOT be emitted. Keeps canonical subject byte-deterministic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* CIP-186 | sign the connect response (method + echo) + conformance vector

The connect handshake previously delivered the session JSON without a
verifiable signature on the response itself, so a dApp adopted it on trust and
nothing bound the response to the dApp's request. Make connect a signed,
replay-bound first-contact handshake, consistent with the existing
"every response is signed" rule:

- ABNF: add `method` and `echo` to the response-key production.
- §connect: the response carries `method=connect` (domain-separation tag),
  `echo` (the request `nonce` copied verbatim), and `signature` (final param,
  over the canonical subject). The dApp box-decrypts, verifies `signature`
  against the `signingPublicKey` inside that same payload (TOFU pin), then
  checks `echo` == the nonce it sent. Missing method/signature/echo -> -10;
  echo mismatch -> -5.
- §Replay protection: connect replay is bound dApp-side via `echo`.
- §Response signing: "First contact" note (verify against the just-decrypted
  key) + an honest trust boundary (this does NOT authenticate which wallet
  replied; that rests on OS scheme-routing + in-wallet consent) + test (f).
- Appendix A / C.1: error-code clarifications.
- tests/vectors: sign_006 canonical_subject over the signed connect response
  (conformance harness 58/58). A byte-exact real KAT (fixed keys -> reproducible
  signature, plus -5/-10 negatives) ships with the reference implementation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* CIP-186 | promote CIP-95 governance profile from reserved to normative in v1

* CIP-186 | make origin-anchored well-known resolution normative, central registry advisory-only

* CIP-186 | mark universal links / app links preferred, custom scheme fallback only

* CIP-186 | trim title to Cardano Wallet Deep-Link Signing

* CIP-186 | unquote authors line to plain contact format

* CIP-186 | move Reference Implementation under top-level Appendices heading

* CIP-186 | demote Appendix A/B/C to H3 under Appendices

* CIP-186 | demote Appendix C subsections one level

* (mostly) trivial correction to test if CIP validator finally runs after merging cardano-foundation#1231

* confirming newly running validator will succeed by fixing all the things

* (continued) fixing all the validation things

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Create README.md

Add CPS: Managing DRep Voting Power Concentration in Stake-Weighted Governance

* Update README.md

Update PR number in Discussions field

* Update README.md

Revise CPS to address admissibility feedback: remove social governance elements, tighten framing to ledger rules, CIP-119 metadata, and wallet/explorer standards, update category to Tools

* Update CPS-????/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-????/README.md

standardise cip tag 0119

Co-authored-by: Robert Phair <rphair@cosd.com>

* convert citations to GitHub Markdown footnotes, standardise CIPs and CIP tags

* fix: footnotes now obey the laws of markdown

* Update CPS-????/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-????/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* Update CPS-????/README.md

Co-authored-by: Robert Phair <rphair@cosd.com>

* fix: convert raw URLs into proper markdown links

* Update README.md

* assign CPS number 33

* Rename CPS 33 directory

* remove `usp=` tracking variable from Google Drive link

* Update README to clarify multi-DRep delegation details

Clarified multi-DRep delegation support and limitations in the README.

* Apply suggestions from code review

Co-authored-by: Ryan <ryan.williams@intersectmbo.org>
Co-authored-by: Robert Phair <rphair@cosd.com>

* add link back from solving CIP to this CPS

* Refine problem statement, add supporting citations, Update concentration analysis and use case wording

Addressed initial editorial feedback by strengthening the evidence supporting concentration claims, adding references  and refining the problem statement to better distinguish observed evidence from structural tendencies. Also revised the small DRep use case to avoid attributing delegation patterns to wallet UX alone.

* Update README.md

Fixed links in the references
Added a clarification of the practical challenge within the first use case

* Fix line endings in CPS-0033 and add .gitattributes configuration

* back out changes to local `.gitattributes`

* fix: normalize CPS-0033/README.md line endings to LF

---------

Co-authored-by: Robert Phair <rphair@cosd.com>
Co-authored-by: Ryan <ryan.williams@intersectmbo.org>
Co-authored-by: daniellestanko-gov <danielle.stanko@iohk.io>
Resolves the TODO on under-representation: that risk was specific to
wFA^LS local sortition, which sampled the stake distribution, so
stake-based truncation can be governed by a direct committeeSize (N_c)
rather than a cumulative-stake target.

Adds guidance for choosing both voting parameters, including realized
coverage per seat count from current mainnet stake (epoch 649, where P99
is 890 pools).

Also mentions the equal-stake tie-break to ascending pool ID, since seat
indices are positional in voter_id and the certificate bitfield.
This is required analogously for Praos blocks to bound the loaded bytes
through reference scripts when validating transactions.
Also drop the RB max body size as it's a known parameter and other
existing ones are currently not in these tables
ch1bo and others added 6 commits August 20, 2026 10:54
* Introduce max reference script size for EBs

This is required analogously for Praos blocks to bound the loaded bytes
through reference scripts when validating transactions.

* Rename protocol parameters to be more consistent

Also drop the RB max body size as it's a known parameter and other
existing ones are currently not in these tables

* Fix table 7
Also replace the dropped $S_RB$ symbol with maxBlockBodySize in the mempool
sizing formula, since the RB size row was removed from the parameter tables.
The prose moved votes onto announcing_rb_hash but the CDDL still carried
slot_no and endorser_block_hash. Match the implementation, where a vote is
{announcing_rb_hash, voter_id, signature} and a certificate is {signers,
aggregated_signature} with the announcing RB taken from chain context.
Co-authored-by: Robert Phair <rphair@cosd.com>
L_hdr, L_vote and L_diff each derive from a network propagation time, which is
wall clock, so denominating them in slots coupled Leios timing to slotLength.
Follow the genesis slotLength precedent (CIP-9) and give them in seconds; the
feasible values are unchanged because mainnet's slotLength is one second.

This also requires precising the chain inclusion rule 3 to round up to
the next slot when determining a cert is valid to include in an RB.
@ch1bo
ch1bo requested a review from perturbing August 27, 2026 19:55
@ch1bo

ch1bo commented Aug 27, 2026

Copy link
Copy Markdown
Member Author

Wrong source branch..

@ch1bo ch1bo closed this Aug 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.