Execution Witness Quorum
1. ABSTRACT
Proposes a quorum-based witnessing scheme in which multiple independent attestors confirm HSC execution before an obligation transitions to WITNESSED.
2. MOTIVATION
Single-witness execution, the current default, places significant trust in a single HSC's self-attestation. A quorum scheme would reduce the impact of any individual dishonest or malfunctioning cell.
3. TERMINOLOGY
Quorum — attestation from N of M independent witnesses associated with the destination domain, required before an obligation transitions to WITNESSED.
4. SPECIFICATION
Draft proposal: for obligations above a configurable notional threshold, require attestation from N of M independent witnesses associated with the destination domain before transitioning to WITNESSED. Exact quorum parameters, witness selection, and latency impact are unresolved.
5. INVARIANTS
Draft — exact quorum parameters (N, M) and witness selection criteria are unresolved and MUST be fixed before this proposal can advance to ACTIVE.
6. FAILURE CONDITIONS
An insufficient pool of independent witnesses in a destination domain blocks quorum formation; fallback behavior below quorum capacity is not yet specified.
7. SECURITY CONSIDERATIONS
Increasing witness count raises the cost of collusion but increases execution latency and requires a larger pool of independent witnesses per domain than currently exists in most simulated domains. Not yet adopted network-wide.
8. REFERENCE IMPLEMENTATION
The reference implementation is the NIL-0 simulation network. No production implementation of this proposal exists; behavior described here is normative for the simulation only.