pub trait CorrectValidator { }Expand description
Definition (Correct validator). A validator is correct in an execution if every
signature it produces was produced by an unmodified build of this code, driven through the
public entry points of linera_core::worker::WorkerState, with a private key no other party
holds. A validator that is not correct is faulty, and may sign anything at any time,
including contradictory statements.
This is what licenses the arguments in crate::manager::proof::voting: for a correct
validator, “it signed a validation vote for B in round r” implies its
ChainManager state satisfied the guards on the path that
produces such a vote, because that path is the only one that can produce it
(VoteConstructionSites).
Note this is a statement about signing, not about availability. A correct validator may be
slow or unreachable without becoming faulty, and in particular it may crash at any time and
restart, losing whatever it had not yet persisted. Crash-recovery, not fail-stop, is the
model: before GST crashes may be arbitrarily frequent and restarts arbitrarily slow; after
GST, recovery is bounded by linera_core::proof::assumptions::BoundedRecovery.
That is what makes DurablePersistence load-bearing rather than hygienic. A validator that
signed a vote and crashed before saving it would, on restart, have no record of having voted —
and could vote again in the same round, breaking
OneValidationVotePerRound. That
is a safety failure, not a lost message, and it is why the persistence obligation is stated
as a condition of correctness rather than as an implementation detail.