[glue] Verify Reshare Epoch Artifacts on Demand - #4364
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
commonware-mcp | 6ddcbf2 | Aug 19 2026, 11:55 PM |
Benchmark resultsRegressions: ✅ `qmdb::merkleize/v=any::unordered::fixed::mmr k=10000 ch=false s=true cc=true` (2/2 gates passed)
✅ `qmdb::merkleize/v=current::ordered::fixed::mmb chunk=256 k=10000 ch=false s=true cc=true` (2/2 gates passed)
Baseline commit(s): |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
2de33c4 to
467bf3d
Compare
Deploying monorepo with
|
| Latest commit: |
6ddcbf2
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://651743b4.monorepo-eu0.pages.dev |
| Branch Preview URL: | https://cl-precompute-artifacts.monorepo-eu0.pages.dev |
# Conflicts: # glue/src/dkg/reshare/actor/dealing.rs # glue/src/dkg/reshare/actor/inclusion.rs # glue/src/dkg/tests/mocks.rs
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c9b981a. Configure here.
patrick-ogrady
changed the title
Codecov Report❌ Patch coverage is @@ Coverage Diff @@
## main #4364 +/- ##
==========================================
+ Coverage 95.52% 95.57% +0.05%
==========================================
Files 610 611 +1
Lines 276780 277515 +735
Branches 6646 6655 +9
==========================================
+ Hits 264381 265237 +856
+ Misses 10208 10113 -95
+ Partials 2191 2165 -26
... and 41 files with indirect coverage changes Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
patrick-ogrady
left a comment
patrick-ogrady
left a comment
There was a problem hiding this comment.
Won't call glue::dkg ready for primetime yet but this is definitely a step forward.
|
Post-merge note: this PR also fixes a security-relevant final-block validation gap in reshare follower mode. Previously, EpochInfoResponse::Following delegated final-block verification to the wrapped application even though the follower could not independently reconstruct the epoch artifact. That allowed a follower to approve boundary metadata it had not validated. The merged behavior keeps verification pending instead, so the node can learn the outcome from external finalization without producing a completed application verdict for unverified epoch metadata. |
2 participants
Summary
Adversarial behavior
The epoch determines the boundary height, while the typed ancestry head determines fork identity. Inclusion derives the boundary parent from that ancestry and rejects missing, unexpected, gapped, or truncated chains. A malicious leader cannot force verification of every growing dealer-log prefix, and a malicious host cannot provide an independent canonical fanout key.
Finalization completes any admitted speculative waiter before reconstructing the canonical artifact. Speculative verification, caches, and queued requests remain phase-local and reconstructable after restart; wire and storage formats are unchanged.
Validation
just test -p commonware-gluejust test --profile slow -p commonware-glue reshare_e2e_state_syncjust clippy -p commonware-gluejust check-fmtjust check-stabilityCloses #4300