LP-0013: Leaderless

Abstract

Two of Lux's core mechanisms — block finality and DEX matching — produce a result that any validator computes from the same inputs. There is no permanent proposer, no sequencer, no venue whose output others must trust. This LP states that invariant once.

Invariant

For both consensus finality and DEX matching:

No single node produces the result. Every validator derives the identical result from the same inputs, and the result is a value — not a place.

Why (first principles)

A single proposer is a liveness single-point-of-failure: if the node that must speak stalls, equivocates, or is censored, the system stalls with it. Lux hit exactly this — the "proposer-freeze" — and removed it.

The fix is to stop treating the result as something a privileged node emits and start treating it as something every node computes. A finality certificate is not a message one node authors; it is a value defined by the votes — "α distinct validators signed ACCEPT over this position, with >⅔ of stake." Any node holding those votes derives the same certificate. A trade fill is not a sequence one venue dictates; it is a pure function of the committed book and the block's orders. Any node replaying the block derives the same fills.

Once the result is a value, who assembles it is irrelevant to correctness. That is what makes the system leaderless: liveness no longer hinges on one node, and nobody can forge a result no honest node would recompute.

Enforcement — consensus

Finality is a quorum certificate, not a proposer's say-so. A follower verifies a gossiped block and broadcasts its signed ACCEPT vote to all validators; whichever node first collects α distinct verified votes assembles the cert and gossips it; every node finalizes on receipt. Finality never hinges on one node's inbound votes — "the proposer-freeze cannot recur" (consensus/engine/chain/quorum_topology.go:8-16).

Building the cert needs no secrets and no randomness: any node with the same α signed votes assembles the byte-identical cert — "leaderless, permissionless" (consensus/engine/chain/quorum_cert.go:41). The proposer-self-finality hole (force-accept on a lone self-vote) is deleted; the α-of-K quorum is the sole finality authority (LP-0110 §3).

Photon's VRF-weighted sampling (LP-0111) picks the round's poll committee for preference and liveness. It is not a finality leader — reading it as one rebuilds the bottleneck this invariant removes.

Enforcement — DEX

The DEX has no off-chain matcher, no sequencer, and no external venue. Matching is the D-Chain VM's state transition. The matcher runs in Verify, not at Accept, so every validator independently re-executes the block's orders against the committed book and derives the fills; a proposer that posts a book it did not honestly compute is rejected on the execution-root mismatch (dex/pkg/dchain/block.go:155). Execution is a pure function of (committed state, this block's txs) — deterministic, mint-free — so the fills, book rows, and root are values every validator recomputes, never a venue's word taken on trust.

Leaderless