When a validator encounters an enter it can not interpret with certainty, the protected response is to reject it — to not make a greatest guess and hope each different validator guesses the identical approach. Lithosphere builds this fail-closed precept into its consensus-critical invariants straight.
Each consensus system finally encounters an enter it was not explicitly designed to deal with — a malformed subject, an edge case in an encoding scheme, a price on the boundary of what the specification anticipated. What a community does with that enter is among the extra consequential design selections in its safety mannequin, and the 2 choices usually are not symmetric in threat. A system can select to make a best-effort interpretation of the ambiguous enter and proceed, or it may reject the enter outright and require it to be resubmitted in an unambiguous kind. The primary possibility is extra permissive. It’s also the one which creates the circumstances for consensus failure.
The danger with best-effort interpretation will not be that any single validator will get it mistaken in isolation — a well-implemented validator will often interpret an ambiguous enter persistently with its personal logic. The danger is that totally different validator implementations, and even totally different cases of the identical implementation operating on totally different {hardware} or underneath totally different circumstances, could not interpret the identical ambiguous enter identically. If validator A interprets an edge-case enter a technique and validator B interprets the identical enter a distinct approach, the 2 validators derive totally different state from the identical knowledge — which is exactly the situation that causes a community to fork. The paradox doesn’t must be exploited by an attacker to trigger hurt. It solely must exist and be encountered.
Lithosphere’s strategy is to deal with ambiguous inputs as invalid by design moderately than as inputs to be interpreted. That is acknowledged as one of many community’s core consensus-critical invariants: ambiguous inputs fail closed. A transaction, message, or state replace that can’t be interpreted with certainty underneath the community’s canonical serialization guidelines is rejected moderately than processed underneath a greatest guess. This removes the paradox from the validator’s resolution fully — there is no such thing as a interpretation step to probably diverge on, as a result of inputs that might require interpretation usually are not accepted within the first place.
The trade-off this creates is a deliberate one. A fail-closed system will generally reject inputs {that a} extra permissive system would have processed efficiently, as a result of the paradox in these inputs occurred to not trigger a sensible drawback this time. That’s an appropriate value. The choice — a system that processes ambiguous inputs and depends on validators taking place to interpret them persistently — is playing the community’s consensus integrity on a coincidence holding throughout each validator, each time, indefinitely. Rejecting an occasionally-valid-but-ambiguous enter is a minor inconvenience. A consensus fork brought on by inconsistent interpretation is a systemic failure.
This precept turns into extra consequential as Lithosphere’s execution floor expands. A community supporting a single, easy transaction format has a restricted variety of locations the place ambiguity can come up. A community supporting multi-VM execution, a number of cryptographic algorithms together with each classical and post-quantum schemes, cross-chain message codecs, and agent-generated transactions has a significantly bigger floor the place an edge case might theoretically be interpreted two alternative ways by two totally different validators. Fail-closed as a standing precept means every new functionality added to the stack inherits the identical self-discipline: outline what’s legitimate exactly, and reject all the pieces that falls exterior that exact definition, moderately than making an attempt to deal with each potential enter gracefully.
The choice philosophy — settle for what you possibly can, interpret generously, deal with edge instances as they arrive up — is widespread in software software program, the place a mishandled edge case produces a bug report moderately than a fork. Consensus-critical infrastructure doesn’t get that margin. Lithosphere’s fail-closed invariant displays an understanding that on this particular layer of the stack, being strict about what’s legitimate will not be extreme warning. It’s the solely method to assure that each validator, given the identical enter, reaches the identical conclusion each time.
