[Copilot]

This PR adds the Phase 2 Crown consensus PoC as an isolated native C++ state machine over abstract BlockID values, without touching Bitcoin block production, fork choice, validation, or live P2P. It implements deterministic PROPOSE -> PREVOTE -> PRECOMMIT -> COMMIT execution for the static four-validator set, including NIL handling, round changes, locking, valid-round semantics, and Byzantine vote detection.

• Consensus engine

  • adds a one-height, event-driven engine under src/crown/consensus/
  • models height, round, step, locked_block, locked_round, valid_block, and valid_round
  • emits internal commit decisions and equivocation evidence instead of integrating with chainstate or networking

• Proposal and vote types

  • adds minimal signed Proposal and Vote types for abstract BlockID consensus
  • reuses Phase 1 validator identity, public keys, and voting power
  • enforces proposer identity/rotation, canonical signing hashes, and validator signature verification
  • treats NIL as an explicit consensus value for both prevotes and precommits

• Safety rules

  • implements exact >2/3 voting-power quorum using existing Phase 1 helpers
  • adds Tendermint-style locking and valid-round behavior for later-round proposal handling
  • detects prevote/precommit equivocation per validator/height/round/type and prevents double counting
  • adds a local double-sign guard so a validator signer will not intentionally emit conflicting votes for the same round

• Deterministic simulation coverage

  • adds an in-process 4-validator simulator to exercise delivery order, dropped messages, partitions, timeouts, and Byzantine votes
  • covers the key PoC scenarios: 4/4 and 3/4 commit paths, 2/4 no-commit, proposer timeout, invalid proposals, NIL quorums, equivocation, lock retention, valid-round transitions, 3/1 and 2/2 partitions, and message-order permutations
  • asserts the core safety invariant that honest engines never commit different block ids at the same height

• Documentation and patch surface

  • adds focused Phase 2 documentation describing the state machine, message formats, quorum rules, safety semantics, simulator model, and deferred production concerns
  • records the patch surface explicitly as new Crown-owned modules plus minimal build/test wiring

Proposal proposal{
    .height = m_state.height,
    .round = m_state.round,
    .proposer_id = m_local_signer->validator_id,
    .block_id = block_id,
    .valid_round = valid_round,
};

Vote vote{
    .type = VoteType::PREVOTE,
    .height = m_state.height,
    .round = m_state.round,
    .validator_id = m_local_signer->validator_id,
    .block_id = std::nullopt, // explicit NIL
};

[defunctec]

@copilot Continue the interrupted Phase 2 consensus-safety review on this existing PR.

The previous session stopped because the Copilot usage limit was reached.

IMPORTANT:

• Do NOT restart Phase 2.
• Do NOT recreate completed work.
• Do NOT reset or revert the existing branch.
• Continue from the current PR branch and preserve all existing commits.
• Commit 3f1f119 contains work completed before the interruption.

First:

1. inspect the current branch HEAD and git status;
2. review the existing Phase 2 implementation and the changes already made by the interrupted safety-review session;
3. determine exactly which parts of the requested safety review remain unfinished.

Then continue ONLY the unfinished work.

The safety review remains focused on Tendermint-style consensus correctness, specifically:

• proposal valid_round handling
• prevote decision rules
• locking
• lock retention
• legitimate lock change/unlock
• valid_block / valid_round handling

• 2/3 prevote handling

• 2/3 precommit handling

• NIL handling across rounds
• conflicting-commit safety under partitions, delayed messages and round changes

Compare the implemented behavior against established Tendermint-style safety semantics.

Add adversarial regression tests for any missing cases discovered.

Do NOT add new protocol features.

Do NOT modify:

• Bitcoin block production
• PoW
• fork choice
• chainstate
• mempool
• wallet
• Script
• net_processing / live consensus P2P

At completion:

• run the relevant Phase 1 and Phase 2 tests;
• report any safety corrections made;
• report all new adversarial tests;
• confirm the no-conflicting-commit invariant still holds;
• commit and push all work to this existing PR branch;
• report the final remote HEAD SHA.

Do not begin Phase 3.

[Copilot]

@copilot Continue the interrupted Phase 2 consensus-safety review on this existing PR.

The previous session stopped because the Copilot usage limit was reached.
...

Addressed in 7faba2f.

I completed the remaining safety-review work by fixing late cross-round quorum handling so delayed precommit quorums from an earlier round can still drive a commit after a validator has advanced rounds, without weakening locking or double-sign protections.

Added adversarial regressions for:

• late precommit quorum after round change still commits the earlier-round value
• partition-heal convergence where the delayed side catches up to the already-committed value

Re-ran the relevant Crown and directly affected upstream test suites, and the no-conflicting-commit invariant still holds. Remote HEAD is 7faba2f9a3a1352c51abe254ede6056d33408661.