fix(leios): voting mechanics to match musashi

[wolf31o2]

Closes #2821

---

Summary by cubic

Aligns Leios voting with the Musashi prototype: everyone-votes committee, BLS POP ciphersuite, votes sign the announcing ranking-block hash, and local prototype votes are diffused with the correct RB context end-to-end.

• New Features

  • Prototype mode: every non-zero-stake pool votes, ordered by stake ascending; voter IDs follow that order. Vote keys are derived from the pool cold-key hash via DerivePrototypeVoteSigningKey, and signatures are verified against the derived G2 public key; added ValidatePrototypeEbCertificate.
  • Vote and certificate flow: ChainSync records RB announcements; the manager queues early votes and emits exactly one local prototype vote per RB after EB acquisition (new leios.vote_emitted event); leios.eb_quorum now includes the announcing RB hash for certificate context.
  • Crypto: switched vote DST to the BLS POP ciphersuite; prototype votes sign the announcing RB hash; legacy 4-field votes remain decode-compatible. Added a fixed Musashi test vector to pin message/DST.
  • Plumbing and networking: the pipeline tracks certificates by announcing RB hash and surfaces it to forging; forger/adapters propagate RB hash, and ParentLeiosAnnouncement now returns both RB and EB hashes; the node enables PrototypeMode and routes leios.vote_emitted to LeiosNotify; LeiosVotes handler adds HandlePrototypeVote and ObserveAnnouncement; LeiosNotify can enqueue/send/receive 3-field prototype votes and handles per-connection delivery. Deps: bump github.com/blinklabs-io/gouroboros to v0.188.0.

• Migration

  • Block producers: no action needed; the vote key is derived from the pool ID. If leiosVoteSigningKeyFile is set, it must match the derived key or startup will fail—remove or replace it.

^{Written for commit c025947. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

@wolf31o2, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 9 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a2415e3a-9401-406a-9ecd-3515679ffe95

📥 Commits

Reviewing files that changed from the base of the PR and between 0a62e9b and c025947.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (25)

• ARCHITECTURE.md
• go.mod
• ledger/forging/forger.go
• ledger/forging/forger_test.go
• ledger/leios/bls.go
• ledger/leios/bls_test.go
• ledger/leios/certificate.go
• ledger/leios/committee.go
• ledger/leios/committee_test.go
• ledger/leios/doc.go
• ledger/leios/event.go
• ledger/leios/keys.go
• ledger/leios/keys_test.go
• ledger/leios/manager.go
• ledger/leios/manager_test.go
• ledger/leios/pipeline.go
• ledger/leios/pipeline_test.go
• node_forging.go
• node_forging_test.go
• node_leios.go
• ouroboros/chainsync.go
• ouroboros/leios_forge_serve_test.go
• ouroboros/leios_vote_handler.go
• ouroboros/leiosnotify.go
• ouroboros/leiosvotes_test.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/leios-votes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

1 issue found across 17 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="ledger/leios/bls.go">

<violation number="1" location="ledger/leios/bls.go:28">
P3: Musashi compatibility is not exercised: round-trip tests share `LeiosVoteDST`, so an incorrect ciphersuite string still passes locally while peers reject votes. Add a fixed Musashi signature/vector test covering `PrototypeVoteMessageBytes` and verification.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: Musashi compatibility is not exercised: round-trip tests share LeiosVoteDST, so an incorrect ciphersuite string still passes locally while peers reject votes. Add a fixed Musashi signature/vector test covering PrototypeVoteMessageBytes and verification.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At ledger/leios/bls.go, line 28:

<comment>Musashi compatibility is not exercised: round-trip tests share `LeiosVoteDST`, so an incorrect ciphersuite string still passes locally while peers reject votes. Add a fixed Musashi signature/vector test covering `PrototypeVoteMessageBytes` and verification.</comment>

<file context>
@@ -23,11 +23,9 @@ import (
-const LeiosVoteDST = "CIP-0164-LEIOS-VOTE-BLS12381G1_XMD:SHA-256_SSWU_RO_"
+// LeiosVoteDST is the proof-of-possession ciphersuite used by
+// cardano-crypto-leios' minSigPoPDST.
+const LeiosVoteDST = "BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_POP_"
 
 // Vote signatures follow the BLS MinSig variant on BLS12-381: signatures
</file context>

[cubic-dev-ai]

All reported issues were addressed across 26 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>