345 lines
11 KiB
Rust
345 lines
11 KiB
Rust
// Automated determinism invariants для mt-entry.
|
||
// M4 audit prep — node admission flow: NodeRegistration / candidate_vdf_init /
|
||
// selection event / Adaptive VDF / nr_sort_key. Любое non-determinism =
|
||
// consensus fork. Invariants ловят regression в byte-exact encode,
|
||
// hash composition, sort orders, либо state transition apply_*_batch.
|
||
|
||
use mt_codec::CanonicalEncode;
|
||
use mt_crypto::{Hash32, Signature, PUBLIC_KEY_SIZE, SIGNATURE_SIZE};
|
||
use mt_entry::{
|
||
candidate_vdf_init, compute_expiry_window, compute_node_id, is_selection_window, nodereg_hash,
|
||
nr_sort_key, rank_candidates_for_selection, required_vdf_length, selection_slots,
|
||
selection_sort_key, NodeRegistration, NODE_REGISTRATION_SIZE, TYPE_NODE_REGISTRATION,
|
||
};
|
||
use mt_state::{CandidatePool, CandidateRecord, NodeId};
|
||
|
||
// ---------- Helpers ----------
|
||
|
||
fn sample_node_registration(seed: u8) -> NodeRegistration {
|
||
NodeRegistration {
|
||
suite_id: 1,
|
||
node_pubkey: [seed; PUBLIC_KEY_SIZE],
|
||
operator_account_id: [seed.wrapping_add(1); 32],
|
||
proof_endpoint: [seed.wrapping_add(2); 32],
|
||
w_start: 100,
|
||
vdf_chain_length: 20_160,
|
||
signature: Signature::from_array([0u8; SIGNATURE_SIZE]),
|
||
}
|
||
}
|
||
|
||
fn sample_candidate(seed: u8, w_start: u64) -> CandidateRecord {
|
||
CandidateRecord {
|
||
node_id: [seed; 32],
|
||
node_pubkey: [seed; PUBLIC_KEY_SIZE],
|
||
suite_id: 1,
|
||
operator_account_id: [seed.wrapping_add(1); 32],
|
||
proof_endpoint: [seed.wrapping_add(2); 32],
|
||
w_start,
|
||
vdf_chain_length: 20_160,
|
||
registration_window: w_start,
|
||
expires: w_start + 60_480,
|
||
}
|
||
}
|
||
|
||
// ---------- Encoded size matches constant ([I-9] determinism) ----------
|
||
|
||
#[test]
|
||
fn node_registration_encoded_size_constant() {
|
||
let nr = sample_node_registration(0xAB);
|
||
let mut buf = Vec::new();
|
||
nr.encode(&mut buf);
|
||
assert_eq!(
|
||
buf.len(),
|
||
NODE_REGISTRATION_SIZE,
|
||
"NodeRegistration encoded size drift: expected {}, got {}",
|
||
NODE_REGISTRATION_SIZE,
|
||
buf.len()
|
||
);
|
||
}
|
||
|
||
#[test]
|
||
fn type_node_registration_stable() {
|
||
// SSOT [I-10]: type code immutable. Изменение = consensus fork.
|
||
assert_eq!(TYPE_NODE_REGISTRATION, 0x11);
|
||
}
|
||
|
||
// ---------- nodereg_hash R2 invariant ----------
|
||
|
||
#[test]
|
||
fn nodereg_hash_deterministic() {
|
||
let nr = sample_node_registration(0xAB);
|
||
assert_eq!(nodereg_hash(&nr), nodereg_hash(&nr));
|
||
}
|
||
|
||
#[test]
|
||
fn nodereg_hash_stable_under_signature_mutation() {
|
||
// R2: signature НЕ входит в hash.
|
||
let mut a = sample_node_registration(0xAB);
|
||
let mut b = a.clone();
|
||
b.signature = Signature::from_array([0xFF; SIGNATURE_SIZE]);
|
||
assert_eq!(nodereg_hash(&a), nodereg_hash(&b));
|
||
a.signature = Signature::from_array([0x42; SIGNATURE_SIZE]);
|
||
assert_eq!(nodereg_hash(&a), nodereg_hash(&b));
|
||
}
|
||
|
||
#[test]
|
||
fn nodereg_hash_changes_on_field_mutation() {
|
||
let base = sample_node_registration(0xAB);
|
||
let m_pubkey = sample_node_registration(0xFF);
|
||
let m_w_start = {
|
||
let mut x = base.clone();
|
||
x.w_start = 999;
|
||
x
|
||
};
|
||
let m_vdf = {
|
||
let mut x = base.clone();
|
||
x.vdf_chain_length = 99999;
|
||
x
|
||
};
|
||
let m_operator = {
|
||
let mut x = base.clone();
|
||
x.operator_account_id = [0xFF; 32];
|
||
x
|
||
};
|
||
assert_ne!(nodereg_hash(&base), nodereg_hash(&m_pubkey));
|
||
assert_ne!(nodereg_hash(&base), nodereg_hash(&m_w_start));
|
||
assert_ne!(nodereg_hash(&base), nodereg_hash(&m_vdf));
|
||
assert_ne!(nodereg_hash(&base), nodereg_hash(&m_operator));
|
||
}
|
||
|
||
// ---------- compute_node_id determinism ----------
|
||
|
||
#[test]
|
||
fn compute_node_id_deterministic() {
|
||
let pubkey = [0xCC; PUBLIC_KEY_SIZE];
|
||
assert_eq!(compute_node_id(&pubkey), compute_node_id(&pubkey));
|
||
}
|
||
|
||
#[test]
|
||
fn compute_node_id_changes_on_pubkey() {
|
||
assert_ne!(
|
||
compute_node_id(&[0xAA; PUBLIC_KEY_SIZE]),
|
||
compute_node_id(&[0xBB; PUBLIC_KEY_SIZE])
|
||
);
|
||
}
|
||
|
||
// ---------- candidate_vdf_init / [I-8] binding ----------
|
||
|
||
#[test]
|
||
fn candidate_vdf_init_deterministic() {
|
||
let t_r = [0x11; 32];
|
||
let cba = [0x22; 32];
|
||
let node_id: NodeId = [0x33; 32];
|
||
assert_eq!(
|
||
candidate_vdf_init(&t_r, &cba, &node_id),
|
||
candidate_vdf_init(&t_r, &cba, &node_id)
|
||
);
|
||
}
|
||
|
||
#[test]
|
||
fn candidate_vdf_init_changes_on_each_input() {
|
||
let t_r = [0x11; 32];
|
||
let cba = [0x22; 32];
|
||
let node_id: NodeId = [0x33; 32];
|
||
let base = candidate_vdf_init(&t_r, &cba, &node_id);
|
||
assert_ne!(base, candidate_vdf_init(&[0xFF; 32], &cba, &node_id));
|
||
assert_ne!(base, candidate_vdf_init(&t_r, &[0xFF; 32], &node_id));
|
||
assert_ne!(base, candidate_vdf_init(&t_r, &cba, &[0xFF; 32]));
|
||
}
|
||
|
||
// ---------- compute_expiry_window ----------
|
||
|
||
#[test]
|
||
fn compute_expiry_window_three_tau2() {
|
||
// [C-1] SSOT: candidate_expiry_windows читается из ProtocolParams (60_480 = 3τ₂ at genesis)
|
||
let p = mt_genesis::genesis_params();
|
||
assert_eq!(p.candidate_expiry_windows, 3 * p.tau2_windows);
|
||
assert_eq!(p.candidate_expiry_windows, 60_480);
|
||
assert_eq!(compute_expiry_window(100, p), 100 + 60_480);
|
||
assert_eq!(compute_expiry_window(0, p), 60_480);
|
||
}
|
||
|
||
// ---------- selection_slots + is_selection_window ----------
|
||
|
||
#[test]
|
||
fn selection_slots_admission_divisor_130() {
|
||
// [C-1] SSOT: admission_divisor читается из ProtocolParams (130 at genesis)
|
||
let p = mt_genesis::genesis_params();
|
||
assert_eq!(p.admission_divisor, 130);
|
||
// active = 0 → max(1, 0) = 1 (защита от division/zero edge)
|
||
assert_eq!(selection_slots(0, p), 1);
|
||
// 130 → 130/130 = 1; max(1, 1) = 1
|
||
assert_eq!(selection_slots(130, p), 1);
|
||
// 1300 → 10
|
||
assert_eq!(selection_slots(1300, p), 10);
|
||
// 1% rule sanity: 100k active → 100k/130 ≈ 769 slots
|
||
assert_eq!(selection_slots(100_000, p), 100_000 / 130);
|
||
}
|
||
|
||
#[test]
|
||
fn selection_slots_at_least_one() {
|
||
// max(1, ...) гарантирует ≥ 1 slot для bootstrap (genesis with 1 node)
|
||
let p = mt_genesis::genesis_params();
|
||
for active in [0u64, 1, 50, 129] {
|
||
assert_eq!(selection_slots(active, p), 1, "active={}", active);
|
||
}
|
||
}
|
||
|
||
#[test]
|
||
fn is_selection_window_every_336() {
|
||
// [C-1] SSOT: selection_interval читается из ProtocolParams (336 at genesis)
|
||
let p = mt_genesis::genesis_params();
|
||
assert_eq!(p.selection_interval, 336);
|
||
assert!(!is_selection_window(0, p)); // window 0 — особый случай (нет selection)
|
||
assert!(!is_selection_window(1, p));
|
||
assert!(!is_selection_window(335, p));
|
||
assert!(is_selection_window(336, p));
|
||
assert!(!is_selection_window(337, p));
|
||
assert!(is_selection_window(672, p));
|
||
assert!(is_selection_window(336 * 100, p));
|
||
}
|
||
|
||
// ---------- selection_sort_key + rank_candidates_for_selection ----------
|
||
|
||
#[test]
|
||
fn selection_sort_key_deterministic() {
|
||
let t_r = [0x11; 32];
|
||
let cba = [0x22; 32];
|
||
let node_id: NodeId = [0x33; 32];
|
||
assert_eq!(
|
||
selection_sort_key(&t_r, &cba, &node_id),
|
||
selection_sort_key(&t_r, &cba, &node_id)
|
||
);
|
||
}
|
||
|
||
#[test]
|
||
fn rank_candidates_canonical_order() {
|
||
// Sort by sort_key asc — input order не влияет.
|
||
let mut p1 = CandidatePool::new();
|
||
p1.insert(sample_candidate(0x10, 100));
|
||
p1.insert(sample_candidate(0x20, 100));
|
||
p1.insert(sample_candidate(0x30, 100));
|
||
|
||
let mut p2 = CandidatePool::new();
|
||
p2.insert(sample_candidate(0x30, 100));
|
||
p2.insert(sample_candidate(0x10, 100));
|
||
p2.insert(sample_candidate(0x20, 100));
|
||
|
||
let r1 = rank_candidates_for_selection(&p1, &[0xAA; 32], &[0xBB; 32]);
|
||
let r2 = rank_candidates_for_selection(&p2, &[0xAA; 32], &[0xBB; 32]);
|
||
// Same sort_keys derived → same order
|
||
let keys1: Vec<Hash32> = r1.iter().map(|(k, _)| *k).collect();
|
||
let keys2: Vec<Hash32> = r2.iter().map(|(k, _)| *k).collect();
|
||
assert_eq!(keys1, keys2);
|
||
// Sorted asc
|
||
for w in keys1.windows(2) {
|
||
assert!(w[0] <= w[1]);
|
||
}
|
||
}
|
||
|
||
// ---------- required_vdf_length / Adaptive VDF ----------
|
||
|
||
#[test]
|
||
fn required_vdf_length_no_active_returns_tau2() {
|
||
// Genesis edge case: no active nodes
|
||
assert_eq!(required_vdf_length(5, 0, 20_160), 20_160);
|
||
}
|
||
|
||
#[test]
|
||
fn required_vdf_length_below_threshold_returns_tau2() {
|
||
// pressure_permille ≤ 10 (1%) → base τ₂
|
||
// 5 pending / 1000 active = 5 permille (= 0.5%, < 1%)
|
||
assert_eq!(required_vdf_length(5, 1000, 20_160), 20_160);
|
||
// 10 pending / 1000 active = 10 permille = 1% (boundary, ≤ 10)
|
||
assert_eq!(required_vdf_length(10, 1000, 20_160), 20_160);
|
||
}
|
||
|
||
#[test]
|
||
fn required_vdf_length_above_threshold_scales() {
|
||
// 20 pending / 1000 active = 20 permille (2%, > 10)
|
||
// → required = τ₂ × 20 / 10 = τ₂ × 2 = 40_320
|
||
assert_eq!(required_vdf_length(20, 1000, 20_160), 40_320);
|
||
// 100 pending / 1000 active = 100 permille = 10%
|
||
// → required = τ₂ × 100 / 10 = τ₂ × 10
|
||
assert_eq!(required_vdf_length(100, 1000, 20_160), 201_600);
|
||
}
|
||
|
||
// ---------- nr_sort_key ----------
|
||
|
||
#[test]
|
||
fn nr_sort_key_deterministic() {
|
||
let t_r = [0x11; 32];
|
||
let cba = [0x22; 32];
|
||
let pubkey = [0x33; PUBLIC_KEY_SIZE];
|
||
assert_eq!(
|
||
nr_sort_key(&t_r, &cba, &pubkey),
|
||
nr_sort_key(&t_r, &cba, &pubkey)
|
||
);
|
||
}
|
||
|
||
#[test]
|
||
fn nr_sort_key_changes_on_each_input() {
|
||
let t_r = [0x11; 32];
|
||
let cba = [0x22; 32];
|
||
let pubkey = [0x33; PUBLIC_KEY_SIZE];
|
||
let base = nr_sort_key(&t_r, &cba, &pubkey);
|
||
assert_ne!(base, nr_sort_key(&[0xFF; 32], &cba, &pubkey));
|
||
assert_ne!(base, nr_sort_key(&t_r, &[0xFF; 32], &pubkey));
|
||
assert_ne!(base, nr_sort_key(&t_r, &cba, &[0xFF; PUBLIC_KEY_SIZE]));
|
||
}
|
||
|
||
// ---------- Cross-distinctness of similar hash compositions ----------
|
||
|
||
#[test]
|
||
fn distinct_domains_for_three_hash_compositions() {
|
||
// selection_sort_key, candidate_vdf_init, nr_sort_key все принимают (timechain, cba, identity).
|
||
// Domain separators различают:
|
||
// selection_sort_key: "mt-selection"
|
||
// candidate_vdf_init: "mt-candidate-vdf-init"
|
||
// nr_sort_key: "mt-nodereg-sort"
|
||
let t_r = [0x11; 32];
|
||
let cba = [0x22; 32];
|
||
let node_id: NodeId = [0x33; 32];
|
||
let pubkey = [0x33; PUBLIC_KEY_SIZE];
|
||
|
||
let sel = selection_sort_key(&t_r, &cba, &node_id);
|
||
let vdf = candidate_vdf_init(&t_r, &cba, &node_id);
|
||
let nr = nr_sort_key(&t_r, &cba, &pubkey);
|
||
|
||
assert_ne!(
|
||
sel, vdf,
|
||
"selection vs candidate-vdf-init domains must differ"
|
||
);
|
||
assert_ne!(
|
||
vdf, nr,
|
||
"candidate-vdf-init vs nodereg-sort domains must differ"
|
||
);
|
||
assert_ne!(sel, nr, "selection vs nodereg-sort domains must differ");
|
||
}
|
||
|
||
// ---------- Static API invariants ----------
|
||
|
||
#[test]
|
||
fn record_size_positive() {
|
||
const _: () = assert!(NODE_REGISTRATION_SIZE > 0);
|
||
const _: () = assert!(NODE_REGISTRATION_SIZE == 5344);
|
||
}
|
||
|
||
#[test]
|
||
fn admission_divisor_one_percent_cap() {
|
||
// 1% / 100 = 1/100; admission_divisor = 130 даёт ≤ ~0.77% per event
|
||
// (130 ≥ 100 чтобы slots = 1% или меньше). [C-1] SSOT: значение читается
|
||
// из ProtocolParams, не hardcoded const.
|
||
let p = mt_genesis::genesis_params();
|
||
assert!(p.admission_divisor >= 100);
|
||
}
|
||
|
||
#[test]
|
||
fn selection_interval_factors_into_tau2() {
|
||
// selection_interval = 336 ≤ τ₂ = 20_160 (60×336 = 20_160). [C-1] SSOT:
|
||
// значение читается из ProtocolParams, не hardcoded const.
|
||
let p = mt_genesis::genesis_params();
|
||
assert!(p.selection_interval < p.tau2_windows);
|
||
assert_eq!(p.tau2_windows % p.selection_interval, 0);
|
||
}
|