BFT Quorum Cryptography Specification

1. Overview

The BFT Quorum Cryptography subsystem is the mathematical and cryptographic foundation of every multi-agent decision in the DEFONEOS estate. It guarantees that no action with sovereign consequence can be taken by fewer than the declared quorum, that no quorum can be corrupted by fewer than f+1 colluding agents, and that every decision produces a single, verifiable, threshold-signed receipt.

Three cryptographic pillars:

• Threshold Ed25519 for human-owner and DEFONEOS-SEAL issuance (2-of-3 recovery).
• BLS12-381 signature aggregation for 33-agent council votes (compact, single 96-byte aggregate signature).
• Evidence-weighted quorum where each vote is scaled by the agent's evidence weight (care-score, ring assignment, recency).

2. Council Topology

2.1 33-Agent Composition

The DEFONEOS sovereign council is a fixed set of 33 agents. The composition is enforced at the substrate level — there is no runtime API to add or remove agents.

2.2 Key Generation (Distributed Key Generation — DKG)

The 33 BLS12-381 private key shares are generated via a 4-round Joint-Feldman DKG ceremony. Each agent holds one share; no agent ever holds the aggregate private key. The aggregate public key is published as the council's identity.

The DKG ceremony is re-run only on council composition change (which has never happened in the live estate).

3. Voting Thresholds

3.1 Standard Motions (BLS Aggregate Threshold)

3.2 Emergency Motions

For motions triggered under the emergency session protocol (T1-T8 triggers, see bft-council-emergency-session-protocol.html), the threshold drops to 17 of 33 with a 5-minute voting window and mandatory post-hoc ratification within 24 hours by standard quorum (23 of 33).

4. Evidence Weighting

A raw 1-of-1 vote is insufficient. Every vote is multiplied by the agent's evidence weight, which encodes: recency of evidence submission, ring assignment, and care-score.

For standard quorum, an agent's vote counts as w_i / Σ w_j of the quorum. If the sum reaches 23/33 = 0.697, the motion passes.

5. Threshold Ed25519 (Owner & Seal Issuance)

For the human-owner seat and DEFONEOS-SEAL issuance (where a single aggregate signature is undesirable due to key compromise blast radius), DEFONEOS uses 2-of-3 threshold Ed25519 via the GG20 protocol.

5.1 Key Shares

The owner's Ed25519 key is split into 3 shares, with one share held by:

• The owner (Nick) — MacBook Secure Enclave, biometric-gated.
• A 2-of-3 escrow service (UK Chartered Accountants firm).
• A cold encrypted USB in a UK bank safe deposit box.

Any 2 of the 3 shares can reconstruct the full signing key. No single custodian can sign alone.

5.2 Use Cases

6. Cryptographic Primitives

7. Vote Lifecycle & Receipt

Every vote goes through a 5-state lifecycle:

1. PROPOSED — a motion is filed with a unique motion_id (SHA-256 of payload + nonce).
2. OPEN — voting window opens (standard: 24h, emergency: 5min).
3. VOTING — agents submit BLS partial signatures with their evidence weight.
4. AGGREGATED — at threshold reach or window close, partials are aggregated into a single 96-byte BLS signature.
5. RECORDED — the aggregate signature + motion + voter list is written to the SIGIL ledger as one receipt.

8. Byzantine Fault Tolerance Analysis

DEFONEOS tolerates up to f = floor((n-1)/3) = 10 malicious or unresponsive council agents without losing safety or liveness.

8.1 Safety Invariant Proof

Two conflicting quorums of size 23 in a 33-agent council must intersect in at least 33 - 2×10 = 13 agents. Since the BLS verification ensures all 23 partial signatures are valid, and only honest agents produce valid signatures, two conflicting quorums cannot both be valid unless the cryptographic assumptions (discrete log hardness on BLS12-381) break. This is the standard PBFT safety argument.

9. Compliance Cross-Walk

10. Live Operational Status

11. Implementation Notes

11.1 Verification API

11.2 Key Rotation & Recovery

The 33-agent BLS keys rotate every 730 days via a 4-round DKG re-ceremony. The owner's 2-of-3 Ed25519 keys rotate every 90 days (DEK) with the cold-USB share rotating every 365 days (KEK). See escrow-key-rotation-procedure.html for full procedure.

11.3 Failure Modes

12. Anti-Patterns

• No "simple majority" 17/33 for any motion. Standard is 23/33.
• No multisig with a single custodian holding 2-of-2. Threshold must be 2-of-3+.
• No "owner can override quorum." Owner-seat activation requires 33/33 unanimous.
• No rolling window vote counting. Each motion is atomic.
• No "soft veto" — once threshold reached, motion passes. No second-pass revocation.
• No voting on red-line motions. The safe state rejects them at signature verification.

13. Sovereign Sign-Off