Consensus

Sigil finalises every block in a single MACA round and locks epochs under Tower (Casper FFG). The two layers compose to give per-block safety with long-range accountability.

​

MACA

MACA (Multi-Agent Consensus Algorithm) is a four-round Byzantine Fault Tolerant protocol. Under the happy path a block reaches finality at the end of round one.

​

Rounds

Where n is the active validator count and f = ⌊(n − 1) / 3⌋. MACA is BFT under f Byzantine validators.

​

Block producer selection

The block producer at height h is selected from the active set using a deterministic VRF over the randomness beacon from block h − 1. Selection is round-robin within a sub-epoch to prevent producer concentration.

​

Validator participation

Every active validator must:

• Sign prevotes and precommits within the round timeout (default 2 s per round).
• Apply the finalised block before proposing or voting on the next height.
• Maintain the publisher bond.

Missing a round costs nothing per occurrence. Missing more than 5% of rounds in a 24-hour window triggers downtime slashing.

​

Slashing

Equivocation (signing two prevotes or precommits at the same height) is provable from the validator’s own signatures. The slashing tx SlashEquivocation carries both signatures as proof and burns 5% of bonded stake. See economics.

​

Tower epoch finality

Every 1,000 blocks the active set executes a Tower (Casper FFG) commit. The Tower commit:

1. Identifies the highest justified checkpoint.
2. Locks a new finalised checkpoint at height prev + 1000.
3. Records the locked epoch in the durable state.

Tower finality cannot be reverted without a coordinated attack on more than one-third of stake. Tower’s accountable-safety property guarantees that any reorg of a finalised epoch yields signed evidence implicating the malicious validators. Such validators are slashed for their full bonded stake. The mainnet Tower implementation is in node/sigil-tower/src/tower.rs and is exercised by node/sigil-tower/tests/safety.rs.

​

What is finalised when

Wallets and explorers should treat the post-round-1 finality as transactional finality. RPC subscriptions emit consensus.finalised on every block and consensus.epoch_locked every 1,000 blocks.

​

Why not DAG, why not optimistic

A DAG consensus (Narwhal, Bullshark, Aleo’s snarkOS) offers higher throughput but partial ordering. Sigil’s primitive set assumes total ordering: a token mint must observe the previous burn, an auction finalise must observe the last bid. Total ordering is a hard requirement. Optimistic consensus (Ethereum-style probabilistic finality) requires applications to wait many blocks for “practical” finality. The compute marketplace, labor escrow, and recovery ceremony rely on per-block determinism; they cannot accept a window where a settled block might revert. The architectural decision is recorded in docs/launch/agent-03/dag-vs-bft-decision.md.

​

Liveness assumptions

MACA is live when:

• More than two-thirds of active validators are online and reachable.
• Network partitions do not isolate more than one-third of stake for longer than 15 seconds.
• Validators sync block tails through libp2p without persistent reorg.

If liveness breaks (e.g. a partition isolates 40% of stake), the network halts. Recovery is via:

• Automatic recovery once the partition heals.
• Operator-coordinated restart from the last finalised epoch.
• Tower-locked checkpoints used as the authoritative state during restart.

See incident runbooks for the operational recovery procedure.