Complete multi-epoch ownership across Autobahn layers (CON-358)

sei-tendermint/autobahn/types/block.go

@@ -139,12 +139,9 @@ func (b *Block) Header() *BlockHeader { return b.header }
 // Payload .
 func (b *Block) Payload() *Payload { return b.payload }
 
-// Verify validates the Block.
-func (b *Block) Verify(c *Committee) error {
-	if err := b.Header().Verify(c); err != nil {
-		return fmt.Errorf("header.Verify(): %w", err)
-	}
-	if got, want := b.Payload().Hash(), b.Header().PayloadHash(); got != want {
+// Verify checks the block's internal integrity.
+func (b *Block) Verify() error {
+	if got, want := b.payload.Hash(), b.header.payloadHash; got != want {
 		return fmt.Errorf("payload.Hash() = %v, want %v", got, want)
 	}
 	return nil

sei-tendermint/autobahn/types/committee_test.go

@@ -108,7 +108,7 @@ func TestLaneQCVerifyChecksWeight(t *testing.T) {
 func TestPrepareQCVerifyChecksWeight(t *testing.T) {
 	rng := utils.TestRng()
 	ep, keys := makeEpoch(rng)
-	vote := NewPrepareVote(ProposalAt(ep, View{EpochIndex: ep.EpochIndex(), Index: ep.RoadRange().First}))
+	vote := NewPrepareVote(ProposalAt(ep, View{EpochIndex: ep.EpochIndex(), Index: ep.RoadRange().First}, ep.FirstBlock()))
 
 	heavyOnly := NewPrepareQC([]*Signed[*PrepareVote]{
 		Sign(keys[0], vote),
@@ -128,7 +128,7 @@ func TestPrepareQCVerifyChecksEpochBinding(t *testing.T) {
 		return NewPrepareQC([]*Signed[*PrepareVote]{Sign(keys[0], NewPrepareVote(p))})
 	}
 
-	require.NoError(t, sign(ProposalAt(ep, View{Index: ep.RoadRange().First})).Verify(ep))
+	require.NoError(t, sign(ProposalAt(ep, View{Index: ep.RoadRange().First}, ep.FirstBlock())).Verify(ep))
 
 	wrongEpoch := newProposal(View{Index: ep.RoadRange().First, EpochIndex: ep.EpochIndex() + 1}, time.Time{}, nil, ep.FirstBlock())
 	require.Error(t, sign(wrongEpoch).Verify(ep))
@@ -144,7 +144,7 @@ func TestCommitQCVerifyChecksEpochBinding(t *testing.T) {
 		return NewCommitQC([]*Signed[*CommitVote]{Sign(keys[0], NewCommitVote(p))})
 	}
 
-	require.NoError(t, sign(ProposalAt(ep, View{Index: ep.RoadRange().First})).Verify(ep))
+	require.NoError(t, sign(ProposalAt(ep, View{Index: ep.RoadRange().First}, ep.FirstBlock())).Verify(ep))
 
 	wrongEpoch := newProposal(View{Index: ep.RoadRange().First, EpochIndex: ep.EpochIndex() + 1}, time.Time{}, nil, ep.FirstBlock())
 	require.Error(t, sign(wrongEpoch).Verify(ep))
@@ -156,7 +156,7 @@ func TestCommitQCVerifyChecksEpochBinding(t *testing.T) {
 func TestCommitQCVerifyChecksWeight(t *testing.T) {
 	rng := utils.TestRng()
 	ep, keys := makeEpoch(rng)
-	vote := NewCommitVote(ProposalAt(ep, View{EpochIndex: ep.EpochIndex(), Index: ep.RoadRange().First}))
+	vote := NewCommitVote(ProposalAt(ep, View{EpochIndex: ep.EpochIndex(), Index: ep.RoadRange().First}, ep.FirstBlock()))
 
 	heavyOnly := NewCommitQC([]*Signed[*CommitVote]{
 		Sign(keys[0], vote),
@@ -172,7 +172,7 @@ func TestCommitQCVerifyChecksWeight(t *testing.T) {
 func TestAppQCVerifyChecksWeight(t *testing.T) {
 	rng := utils.TestRng()
 	ep, keys := makeEpoch(rng)
-	vote := NewAppVote(NewAppProposal(ProposalAt(ep, View{EpochIndex: ep.EpochIndex(), Index: ep.RoadRange().First}), GenAppHash(rng)))
+	vote := NewAppVote(NewAppProposal(ProposalAt(ep, View{EpochIndex: ep.EpochIndex(), Index: ep.RoadRange().First}, ep.FirstBlock()), GenAppHash(rng)))
 
 	heavyOnly := NewAppQC([]*Signed[*AppVote]{
 		Sign(keys[0], vote),

sei-tendermint/autobahn/types/epoch.go

@@ -9,19 +9,25 @@ import (
 // EpochIndex is the epoch number.
 type EpochIndex uint64
 
-// RoadRange is an inclusive range of RoadIndex values [First, Last].
+// RoadRange is a half-open road range [First, Next).
 type RoadRange struct {
 	First RoadIndex
 	Next  RoadIndex
 }
 
+// EpochRange is a half-open epoch-index range [First, Next).
+type EpochRange struct {
+	First EpochIndex
+	Next  EpochIndex
+}
+
 // OpenRoadRange returns a RoadRange covering all road indices from 0.
-// Use in tests and genesis epochs where no upper bound is known yet.
 func OpenRoadRange() RoadRange { return RoadRange{First: 0, Next: utils.Max[RoadIndex]()} }
 
-// Has reports whether idx falls within this range.
 func (r RoadRange) Has(idx RoadIndex) bool { return r.First <= idx && idx < r.Next }
 
+func (r EpochRange) Has(idx EpochIndex) bool { return r.First <= idx && idx < r.Next }
+
 // Epoch holds the complete context for a single epoch.
 // Retrieved from the local Registry; never transmitted on the wire.
 type Epoch struct {

sei-tendermint/autobahn/types/epoch_test.go

@@ -8,6 +8,14 @@ import (
 	"github.com/sei-protocol/sei-chain/sei-tendermint/libs/utils/require"
 )
 
+func TestRoadRange_Has(t *testing.T) {
+	r := RoadRange{First: 10, Next: 13}
+	require.False(t, r.Has(9))
+	require.True(t, r.Has(10))
+	require.True(t, r.Has(12))
+	require.False(t, r.Has(13))
+}
+
 func TestEpochIsClosed(t *testing.T) {
 	rng := utils.TestRng()
 	a := GenSecretKey(rng).Public()

sei-tendermint/autobahn/types/lane_proposal.go

@@ -22,9 +22,9 @@ func NewLaneProposal(block *Block) *LaneProposal {
 // Block .
 func (m *LaneProposal) Block() *Block { return m.block }
 
-// Verify verifies that the LaneProposal is consistent with the Committee.
-func (m *LaneProposal) Verify(c *Committee) error {
-	return m.block.Verify(c)
+// Verify checks the proposal's internal integrity.
+func (m *LaneProposal) Verify() error {
+	return m.block.Verify()
 }
 
 // LaneProposalConv is a protobuf converter for LaneProposal.

sei-tendermint/autobahn/types/msg.go

@@ -188,11 +188,8 @@ func (m *Signed[T]) Sig() *Signature { return m.sig }
 // Key returns the key whish signed the message.
 func (m *Signed[T]) Key() PublicKey { return m.sig.key }
 
-// VerifySig verifies the signature of the message.
-func (m *Signed[T]) VerifySig(c *Committee) error {
-	if !c.HasReplica(m.sig.key) {
-		return fmt.Errorf("%q is not a replica", m.sig.key)
-	}
+// VerifySig verifies the cryptographic signature.
+func (m *Signed[T]) VerifySig() error {
 	return m.sig.key.key.VerifyWithTag(autobahnTag, m.hashed.hash[:], m.sig.sig)
 }
 
@@ -207,7 +204,10 @@ func (m *Hashed[T]) verifyQC(c *Committee, quorumWeight uint64, sigs []*Signatur
 		done[sig.key] = struct{}{}
 		weight += c.Weight(sig.key)
 		sm := &Signed[T]{hashed: m, sig: sig}
-		if err := sm.VerifySig(c); err != nil {
+		if !c.HasReplica(sm.Key()) {
+			return fmt.Errorf("%q is not a replica", sm.Key())
+		}
+		if err := sm.VerifySig(); err != nil {
 			return err
 		}
 	}

sei-tendermint/autobahn/types/proposal.go

@@ -125,16 +125,28 @@ func (v View) Next() View {
 	return v
 }
 
-// ViewSpec is the full local context for starting a view: justification QCs plus
-// the epoch active at that view. Epoch is required; View(), NextGlobalBlock(), and
-// NextTimestamp() panic if it is nil.
+// ConsensusSpec is the durable CommitQC tip paired with the epoch of the
+// RoadIndex that follows it. CommitQC is None before the first tip; until then
+// Epoch is genesis epoch 0 (and FirstBlock is the next global block). Consensus
+// advances with a spec verbatim.
+type ConsensusSpec struct {
+	CommitQC utils.Option[*CommitQC]
+	Epoch    *Epoch
+}
+
+// Index is the RoadIndex of the next view: CommitQC.Index()+1, or 0 if there is no tip.
+func (s ConsensusSpec) Index() RoadIndex {
+	return NextIndexOpt(s.CommitQC)
+}
+
+// ViewSpec is ConsensusSpec plus the TimeoutQC for the current view number.
+// Epoch is required; View(), NextGlobalBlock(), and NextTimestamp() panic if it is nil.
 type ViewSpec struct {
+	ConsensusSpec
 	// WARNING: currently we have implicit assumption that
 	// TimeoutQC.View().Index == CommitQC.Index.Next(),
 	// I.e. that TimeoutQC comes from the expected consensus instance.
-	CommitQC  utils.Option[*CommitQC]
 	TimeoutQC utils.Option[*TimeoutQC]
-	Epoch     *Epoch
 }
 
 // NextGlobalBlock returns the first global block number expected in the next proposal.
@@ -149,7 +161,7 @@ func (vs *ViewSpec) NextGlobalBlock() GlobalBlockNumber {
 
 // View is the view justified by vs.
 func (vs *ViewSpec) View() View {
-	idx := NextIndexOpt(vs.CommitQC)
+	idx := vs.Index()
 	if view := NextViewOpt(vs.TimeoutQC); view.Index == idx {
 		view.EpochIndex = vs.Epoch.EpochIndex()
 		return view
@@ -411,7 +423,7 @@ func (m *FullProposal) Verify(vs ViewSpec) error {
 			return fmt.Errorf("proposer %q, want %q", got, want)
 		}
 		// Verify the proposer's signature.
-		if err := m.proposal.VerifySig(c); err != nil {
+		if err := m.proposal.VerifySig(); err != nil {
 			return fmt.Errorf("proposal signature: %w", err)
 		}
 		// Do we have the required timeoutQC?