Skip to content

CIP-0164 | Voting consistent with implementation + complete parameter list - #1250

Open
ch1bo wants to merge 18 commits into
cardano-foundation:masterfrom
cardano-scaling:leios
Open

CIP-0164 | Voting consistent with implementation + complete parameter list#1250
ch1bo wants to merge 18 commits into
cardano-foundation:masterfrom
cardano-scaling:leios

Conversation

@ch1bo

@ch1bo ch1bo commented Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Aggregate update since #1196, collecting PRs from our fork: cardano-scaling/CIPs#31, cardano-scaling/CIPs#33, cardano-scaling/CIPs#34, cardano-scaling/CIPs#36.

  1. Key registration, rotation and voting, consistent with the implementation

    Prototyping the stake-based committee in cardano-node / ouroboros-consensus found things CIP-0164 | Replace wFA^LS committee with stake-based committee selection #1196 left open or specified differently from what was buildable:

    • Key Registration and Rotation (new subsection of Votes and Certificates), plus Pool Registration in Appendix B: the bls_key field, its mandatory proof of possession, keyless seats, and epoch-boundary activation aligned to VRF-key rotation.
    • Vote Structure: votes are cast on announcing_rb_hash, not on (slot_no, endorser_block_hash).
    • Votes and Certificates CDDL in Appendix B, and Certificate Validation: brought in line with the above and with the implementation. Worth a close read, this drops fields from both structures.
    • Committee Selection: pins the tie-break and the fewer-pools-than-N_c case, both of which an implementation has to decide because voter_id and the certificate bitfield are positional.
    • Node-to-Client: certifying ranking lblocks reuse the ranking_block CDDL so existing clients work unchanged; merged_block is gone (CIP-5: script prefixes extension #31).
  2. A complete parameter list, as a basis for the parameter discussion

    Tables 3 and 7 now list the full set of Leios parameters under consistent names, each with a suggested value. The values are a discussion basis, not settled numbers. Two changes worth attention:

    • committeeSize (N_c) replaces the cumulative-stake target, resolving the TODO CIP-0164 | Replace wFA^LS committee with stake-based committee selection #1196 left on under-representation. See Committee Structure for why a seat count is sound here, and Choosing the committee size (with Table 7a, mainnet coverage at epoch 649) for how to pick it.
    • New parameter: maximum reference script size per endorser block (S_EB-ref), the EB analogue of Praos maxRefScriptSizePerBlock.
    • Fixed the timing parameters to use seconds instead of slots as they need to be independent of slot length and capture diffusion times.

    Choosing the quorum threshold is new too, and bounds τ from both sides rather than just from below.

    Cleanup folded in: consistent naming and matching order across both tables, the RB max size row dropped as an existing Praos parameter, one duplicated row and two typos removed.


(rendered updated document + updated summary "Committee Validation")

perturbing and others added 15 commits April 28, 2026 07:49
make non-persistent vote depend on Praos nonce
Resolves the TODO on under-representation: that risk was specific to
wFA^LS local sortition, which sampled the stake distribution, so
stake-based truncation can be governed by a direct committeeSize (N_c)
rather than a cumulative-stake target.

Adds guidance for choosing both voting parameters, including realized
coverage per seat count from current mainnet stake (epoch 649, where P99
is 890 pools).

Also mentions the equal-stake tie-break to ascending pool ID, since seat
indices are positional in voter_id and the certificate bitfield.
This is required analogously for Praos blocks to bound the loaded bytes
through reference scripts when validating transactions.
Also drop the RB max body size as it's a known parameter and other
existing ones are currently not in these tables
* Introduce max reference script size for EBs

This is required analogously for Praos blocks to bound the loaded bytes
through reference scripts when validating transactions.

* Rename protocol parameters to be more consistent

Also drop the RB max body size as it's a known parameter and other
existing ones are currently not in these tables

* Fix table 7
Also replace the dropped $S_RB$ symbol with maxBlockBodySize in the mempool
sizing formula, since the RB size row was removed from the parameter tables.
The prose moved votes onto announcing_rb_hash but the CDDL still carried
slot_no and endorser_block_hash. Match the implementation, where a vote is
{announcing_rb_hash, voter_id, signature} and a certificate is {signers,
aggregated_signature} with the announcing RB taken from chain context.
@ch1bo ch1bo linked an issue Aug 20, 2026 that may be closed by this pull request
8 tasks
@rphair rphair changed the title # CIP-164 | Voting consistent with the implementation, and a complete parameter list CIP-0164 | Voting consistent with implementation + complete parameter list Aug 20, 2026

@rphair rphair left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @ch1bo as before for keeping this maintained while the project develops. My gut feeling is that such PRs should always be merged soon (cc @Ryun1 @perturbing) when they reflect work that has already achieved consensus through implementation itself.

  • So first: please post if I am wrong about assuming you would be happy this was merged right away... vs. having a public discussion about the proposed changes.
  • Even if you'd be happy to put it through now, editors generally ask for at least one "second" from the project to approve the changes (please tag some if not covered below; cc primary author @will-break-it).

Also authors of these still-open PRs & their reviewers might look out for inconsistencies, duplicated changes & merge conflicts:

Comment thread CIP-0164/README.md
@rphair rphair added Update Adds content or significantly reworks an existing proposal State: Triage Applied to new PR afer editor cleanup on GitHub, pending CIP meeting introduction. Category: Consensus Proposals belonging to the `Consensus` category. labels Aug 20, 2026
@ch1bo

ch1bo commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator Author

@rphair I put this PR up to fix things we encountered, but also as a discussion basis for the parameter list. I want to give it at least 2 weeks for discussion here and in the various parameter working groups.

ch1bo added a commit to IntersectMBO/cardano-ledger that referenced this pull request Aug 27, 2026
Following the latest parameter list of cardano-foundation/CIPs#1250:

- leiosCommitteeSize instead of stake coverage

- timing parameters named a bit more consistently and they are measured
in milliseconds instead of slots -> this also avoids the bump in
cardano-base (within this branch)

- maxEndorserBlockSize (S_EB) and maxEndorserBlockTxsSize (S_EB-tx):
dropping any notion of Header or Body to avoid confusion. These names
also align with the message definitions (`LeiosBlock` and
`LeiosBlockTxs`) that are sent through the network and that are also
bounded by these parameters.
ch1bo added a commit to IntersectMBO/cardano-ledger that referenced this pull request Aug 27, 2026
Following the latest parameter list of cardano-foundation/CIPs#1250:

- leiosCommitteeSize instead of stake coverage

- timing parameters named a bit more consistently and they are measured
in milliseconds instead of slots -> this also avoids the bump in
cardano-base (within this branch)

- maxEndorserBlockSize (S_EB) and maxEndorserBlockTxsSize (S_EB-tx):
dropping any notion of Header or Body to avoid confusion. These names
also align with the message definitions (`LeiosBlock` and
`LeiosBlockTxs`) that are sent through the network and that are also
bounded by these parameters.

# Conflicts:
#	eras/dijkstra/impl/src/Cardano/Ledger/Dijkstra/PParams.hs
#	eras/dijkstra/impl/testlib/Test/Cardano/Ledger/Dijkstra/Examples.hs
#	eras/mary/impl/cardano-ledger-mary.cabal
#	libs/cardano-ledger-core/CHANGELOG.md
ch1bo added a commit to IntersectMBO/cardano-ledger that referenced this pull request Aug 27, 2026
Following the latest parameter list of cardano-foundation/CIPs#1250:

- leiosCommitteeSize instead of stake coverage

- timing parameters named a bit more consistently and they are measured
in milliseconds instead of slots -> this also avoids the bump in
cardano-base (within this branch)

- maxEndorserBlockSize (S_EB) and maxEndorserBlockTxsSize (S_EB-tx):
dropping any notion of Header or Body to avoid confusion. These names
also align with the message definitions (`LeiosBlock` and
`LeiosBlockTxs`) that are sent through the network and that are also
bounded by these parameters.

# Conflicts:
#	eras/dijkstra/impl/src/Cardano/Ledger/Dijkstra/PParams.hs
#	eras/dijkstra/impl/testlib/Test/Cardano/Ledger/Dijkstra/Examples.hs
#	eras/mary/impl/cardano-ledger-mary.cabal
#	libs/cardano-ledger-core/CHANGELOG.md
ch1bo added a commit to IntersectMBO/cardano-ledger that referenced this pull request Aug 27, 2026
Following the latest parameter list of cardano-foundation/CIPs#1250:

- leiosCommitteeSize instead of stake coverage

- timing parameters named a bit more consistently and they are measured
in milliseconds instead of slots -> this also avoids the bump in
cardano-base (within this branch)

- maxEndorserBlockSize (S_EB) and maxEndorserBlockTxsSize (S_EB-tx):
dropping any notion of Header or Body to avoid confusion. These names
also align with the message definitions (`LeiosBlock` and
`LeiosBlockTxs`) that are sent through the network and that are also
bounded by these parameters.
ch1bo and others added 2 commits August 31, 2026 10:41
Co-authored-by: Robert Phair <rphair@cosd.com>
L_hdr, L_vote and L_diff each derive from a network propagation time, which is
wall clock, so denominating them in slots coupled Leios timing to slotLength.
Follow the genesis slotLength precedent (CIP-9) and give them in seconds; the
feasible values are unchanged because mainnet's slotLength is one second.

This also requires precising the chain inclusion rule 3 to round up to
the next slot when determining a cert is valid to include in an RB.

@rphair rphair left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed as a valid & update at the CIP meeting today... with @ch1bo planning to get some specialist team feedback this week. I've personally noted to editorially review this (likely approving, if no dispute) in around 1 week to ensure this stays on track for Last Check at the next CIP meeting unless any problem / unresolved discussion emerges.

p.s. this was also confirmed not to have any dependencies with the 2 concurrent (1 live, 1 draft) Leios CIP PR threads I linked above: although these were mainly referenced in hope the advocates & reviewers of these PRs will also be interested in reviewing this one.

@rphair rphair added State: Confirmed Candiate with CIP number (new PR) or update under review. and removed State: Triage Applied to new PR afer editor cleanup on GitHub, pending CIP meeting introduction. labels Sep 1, 2026
ch1bo added a commit to IntersectMBO/cardano-ledger that referenced this pull request Sep 2, 2026
Following the latest parameter list of cardano-foundation/CIPs#1250:

- leiosCommitteeSize instead of stake coverage

- timing parameters named a bit more consistently and they are measured
in milliseconds instead of slots -> this also avoids the bump in
cardano-base (within this branch)

- maxEndorserBlockSize (S_EB) and maxEndorserBlockTxsSize (S_EB-tx):
dropping any notion of Header or Body to avoid confusion. These names
also align with the message definitions (`LeiosBlock` and
`LeiosBlockTxs`) that are sent through the network and that are also
bounded by these parameters.
ch1bo added a commit to IntersectMBO/cardano-ledger that referenced this pull request Sep 2, 2026
Following the latest parameter list of cardano-foundation/CIPs#1250:

- leiosCommitteeSize instead of stake coverage

- timing parameters named a bit more consistently and they are measured
in milliseconds instead of slots -> this also avoids the bump in
cardano-base (within this branch)

- maxEndorserBlockSize (S_EB) and maxEndorserBlockTxsSize (S_EB-tx):
dropping any notion of Header or Body to avoid confusion. These names
also align with the message definitions (`LeiosBlock` and
`LeiosBlockTxs`) that are sent through the network and that are also
bounded by these parameters.
ch1bo added a commit to IntersectMBO/cardano-ledger that referenced this pull request Sep 2, 2026
Following the latest parameter list of cardano-foundation/CIPs#1250:

- leiosCommitteeSize instead of stake coverage

- timing parameters named a bit more consistently and they are measured
in milliseconds instead of slots -> this also avoids the bump in
cardano-base (within this branch)

- maxEndorserBlockSize (S_EB) and maxEndorserBlockTxsSize (S_EB-tx):
dropping any notion of Header or Body to avoid confusion. These names
also align with the message definitions (`LeiosBlock` and
`LeiosBlockTxs`) that are sent through the network and that are also
bounded by these parameters.

@rphair rphair left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK @ch1bo after #1250 (review) I am guessing that your team meeting(s) last week did not turn up any problems with this update, since none were posted... and that the Ledger commits linked above would have attracted some revisions to this update if anything were incorrect here.

  • Therefore I think this update is acceptable by default but please post if you want to hold back from Last Check at our next CIP meeting in a week's time: https://hackmd.io/@cip-editors/143
  • If there are still items under consideration & any feedback came from these meetings (or your own work) please post here so editors & other Leios reviewers can follow this as needed.

@rphair rphair added State: Last Check Review favourable with disputes resolved; staged for merging. and removed State: Confirmed Candiate with CIP number (new PR) or update under review. labels Sep 8, 2026
@ch1bo

ch1bo commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@rphair Correct, nothing came up and I pointed to this PR in multiple groups since it was opened 3 weeks ago. We should be able to merge it on our next CIP editor call

@rphair
rphair requested review from Ryun1 and perturbing September 10, 2026 16:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Category: Consensus Proposals belonging to the `Consensus` category. State: Last Check Review favourable with disputes resolved; staged for merging. Update Adds content or significantly reworks an existing proposal

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Revise CIP after prototyping

5 participants