1.1 Separation of responsibilities
PoTB determines effective validator weight. Weighted VRF sampling uses that weight to select a committee and producer. BFT finality fixes one transaction order. The execution engine separately verifies the resulting state transition.
These responsibilities MUST remain separate interfaces. A faster executor cannot gain consensus weight, a producer cannot commit unverified adaptive measurements, and the consensus state machine must not depend on worker scheduling.
Validator participation is open to operators who satisfy the network's hardware and protocol requirements. Mainnet targets powerful validators: a minimum of 12 CPU cores at 2.8 GHz or higher, 128 GB RAM, and 1 TB NVMe storage; the recommended configuration is 24 cores at 2.8 GHz or higher, 256–512 GB RAM, and 2 TB NVMe. Testnet and local development have a separate minimum of 8 cores, 16 GB RAM, and 50 GB free disk space. See validator requirements for deployment profiles and calibration. Hardware establishes an operating baseline; it does not directly increase PoTB weight, selection probability, or voting power.
1.2 PoTB weight
Each epoch derives an effective non-negative fixed-point weight from finalized evidence:
effective_weight = policy(time_score, behavior_score, trust_score, penalties, caps)
Exact scoring constants are chosen per network rather than fixed here: the live PoTB profile commits epoch length, initial weight, age increment, and maximum weight in its genesis configuration. Calibration and independent review still inform the values a public network should adopt. Weight computation MUST use checked integer or specified fixed-point arithmetic. A tie MUST be resolved by canonical validator identity bytes.
PoTB is an anti-Sybil heuristic, not a proof that coordinated ownership is impossible. Time, trust graphs, network diversity, and correlation analysis can all be manipulated. Documentation and user interfaces MUST not claim otherwise.
1.3 Weighted VRF committee selection
For each height, eligible validators evaluate a VRF over a domain-separated input containing at least:
chain_id || epoch || height || parent_finality_randomness || role
A proof is valid only when it verifies under the registered validator key and exact protocol domain. Eligibility probability is proportional to effective PoTB weight. Selection MUST:
- verify every VRF proof;
- reject zero-weight, banned, duplicate, and ineligible identities;
- rank eligible outputs with a specified weighted transformation using integer arithmetic;
- use canonical identity bytes as the final tie-breaker;
- select without replacement;
- commit the selected committee and weights in consensus data.
The implemented suite is RFC 9381 ECVRF-EDWARDS25519-SHA512-TAI with complete-roster, weighted sampling without replacement. Canonical proofs, context domains, unbiased rejection sampling and rotation are specified in document 28. Genesis-v2 daemon activation is specified in document 40; independent review remains separate work.
1.4 Partial rotation
The active committee persists across heights. At each height, a deterministic replacement count is computed from the configured rotation ratio, initially approximately 10%. Retained members preserve continuity; replacement seats come from current weighted VRF results.
Safety rules:
- rotation is computed from finalized parent state only;
- no identity occupies more than one seat;
- the outgoing committee finalizes the transition to the next committee;
- committee roots are included in proposal and vote signing bytes;
- parameter changes activate only at an epoch boundary after finalization.
Ten percent is a starting target, not a production constant. Tests must evaluate churn, overlap safety, liveness, and adversarial weight concentration.
1.5 Producer selection and pipelining
The producer is selected from the active committee with a separately domain-separated VRF role. While height h is voting, eligible producers may prepare height h + 1 using the latest safe snapshot and mempool view. Preparation is speculative: it MUST be discarded or replayed if the finalized parent, capacity, committee, or transaction order differs.
No proposal for h + 1 becomes vote-eligible before h is finalized. Pipelining saves preparation time; it does not relax height ordering.
1.6 Fast BFT finality
Each height may contain multiple timeout-driven rounds. A round has:
- proposal — the designated producer publishes an ordered block proposal;
- prevote — members vote for a valid proposal or nil;
- precommit — members lock after observing a prevote quorum and vote for the locked block or nil;
- finalize — a valid precommit certificate makes the block irreversible.
A quorum is voting power strictly greater than two thirds:
quorum(total) = floor(2 * total / 3) + 1
Votes bind chain, height, round, phase, block hash or nil, and committee root. A node MUST persist anti-equivocation decisions before transmitting a proposal, prevote, or precommit. Two different signed values for the same identity, height, round, and phase form slashable evidence.
Lock, unlock, timeout, and certificate rules are implemented by the local BFT guard and explored exhaustively at one height by the bounded formal model. A single normative state-machine specification covering every height and committee change is still to be written.
1.7 Consensus/execution decoupling
Consensus validates proposal structure, availability, transaction identities, declared resource bounds, and ordering. It need not wait for all local execution optimizations before exchanging votes, but a node MUST NOT finalize or commit a state root it cannot verify.
The proposal commits:
- ordered transaction root;
- parent state root;
- expected post-state and receipt roots;
- resource usage and active capacity;
- active committee root.
Execution operates against an immutable parent snapshot and produces receipts plus state diffs. The commit stage publishes diffs only after the BFT certificate and execution commitments both validate.
1.8 Pipeline
Stages overlap across heights:
height h: propagation -> prevote -> precommit -> execution check -> commit
height h + 1: prepare/reconstruct -> speculative execution
height h + 2: transaction prefetch
Implementations may overlap execution earlier when safe. The externally visible rule remains simple: transaction order comes from consensus, execution results come from deterministic validation, and canonical state changes only in the commit stage.
Implemented authentication boundary
Version-1 vote and certificate formats implement committee commitments, registered Ed25519 verification, isolated round/phase accounting, and independent weighted precommit quorum verification. The local BFT guard implements prevote/precommit locks and timeout events, persisting lock metadata and signing decisions atomically through a protected durable journal. Signed proposal authentication, monotonic timers, and a reference round-robin participant operate in the certified fixed-committee network. The separate default local demonstration mode still simulates finality. Double-vote evidence and offline candidate scoring are implemented and tested. The separate live PoTB profile activates canonical evidence inclusion, capped age weights and incumbent-quorum admission; the offline scoring workbench does not change those rules. Verified weighted VRF selection and explicit genesis-v2 rotating committee activation are implemented; a proof of distributed liveness remains open. Membership must come from trusted finalized state. DemonstrationSampler is not a verified weighted VRF implementation.
1.9 Safety assumptions and open work
No proof yet exists of PoTB anti-domination, sampler fairness, BFT safety under rotating weighted committees, or liveness under partial synchrony. Bounded delivery-fault simulations cover both rotating profiles, and the bounded formal model exhausts agreement, lock safety, weighted accountability, and bounded-round decision at one height. Remaining work is unbounded formal modeling across heights and committee changes, broader Byzantine and churn simulations, VRF selection analysis, timeout calibration, and independent review.