Falcon PL

Falcon PL is a quantum-safe participation ledger. Settlement is a single hash-linked chain: one parent, one height, one hash. Falcon Consensus elects a packer from bonded seats, requires a 4-of-6 committee certificate to commit, and skips a silent packer so the height can still close. Every transaction, vote, and seal is Falcon-512. The native unit FPL pays security, liquidity, collateral, and rail work under one set of rules.

This paper specifies the system. It covers the ledger and roles, the agreement protocol, how a validator joins and leaves, the cryptographic binding, the supply and epoch economy, native markets and rails, and the attack surfaces those pieces create — with the defence that sits on each one. It is a description of the protocol, not a changelog.

A ledger that people will still trust in twenty years has to settle one history, pay the people who actually run it, and survive a world where classical signatures fail. Many fast chains leave validators unpaid, park most of the supply with a company, or plan to “add post-quantum later.” A certificate DAG can gossip well and still fail the operator test: there is no single tip a wallet can name.

Falcon PL takes the other shape. The chain is ordered. Participation is the product. FPL is the unit that measures who packed, who checked, who provided liquidity, who watched a rail, and who may claim at epoch payday. Signatures are Falcon-512 from height 1. Ninety-eight percent of supply sits in a keyless protocol treasury and leaves only through published emission rules.

Honest seats share one parent hash, one height, and one state root. Time is loosely synchronised: pack and progress timeouts are wall-clock, but the lottery seed is the committed tip, not a clock. The public wire is a persistent peer mesh. Admin mutations do not travel on that wire.

A seat is eligible for the lottery only if it is bonded, not jailed, and answering the mesh liveness channel. Bond is a slash target and a lottery ticket. It is not an interest rate. The committee at each height is six frozen seats: one packer and five checkers. A ledger becomes *the* ledger when four of those six have signed it. Confirmation beyond that is a separate hard quorum of the bonded set and does not replace the certificate.

• Adversary: any number of unbonded peers, plus a minority of bonded stake that may go silent, lie, or double-sign.
• Network: partial synchrony for liveness (progress timeout). Safety does not wait on a clock — it waits on a 4-of-6 certificate.
• Crypto: every security-critical object is Falcon-512. There is no classical signing path for accounts, votes, or seals.
• This paper describes the protocol as implemented. It is not a published BFT theorem.

State is an account map plus protocol objects (bonds, epoch pots, pools, loans, rail tips). A ledger is a signed body of transactions that takes one state root to the next. Height increases by one. The parent hash is the previous body hash. The next header carries the parent’s 4-of-6 certificate, so uniqueness is on the chain, not only in peer memory.

ledger_n+1.parent      = hash(ledger_n)
ledger_n+1.parent_cert = QC_4of6(ledger_n)
ledger_n+1.state_root  = apply(state_n, txs)

Transactions are sequenced per account. The mempool is gossiped and size-capped. Empty bodies are rejected: a packer who has nothing applicable must not seal. Fees escalate with mempool utilisation (1× / 2× / 4× / 8× / 16× the base minimum). Half of each fee is burned; the rest enters the validator pot at epoch settle.

Falcon Consensus is a bonded-committee protocol. Stake seats a deterministic lottery. A small frozen committee commits the block. A skip certificate walks a dead packer. Post-quantum signatures bind every vote and seal.

At each height the eligible set is the bonded, non-jailed seats. The lottery seed is a hash of network id, height, committed tip, certified skips, and the eligible set. Integer reduction against total bond ranks packers. Honest nodes that share a tip compute the same ranking. Mesh pongs are pack permission, not election: an offline bonded seat is not selected.

eligible = bonded ∧ ¬jailed
seed     = H(network_id ‖ height ‖ tip_hash ‖ skips ‖ eligible)
rank     = lottery(seed, bonds)          # same tip ⇒ same #1, #2, …
committee = freeze(packer #1 + 5 checkers)
commit   = 4 distinct committee signatures
skip     = 4-of-6 after progress timeout, then next rank packs

The winner packs applicable mempool transactions under a 1,000 ms budget and proposes a non-empty body. Every full node verifies parent, height, packer identity, Falcon-512 seal, transaction signatures, and the resulting state root. Soft votes pipeline the body; the height commits when four committee members have signed. The next ledger records that certificate as parent_cert. Height 1 has no parent certificate.

If the winner is silent, the committee issues a skip (same 4-of-6 bar). View-change redraws the committee from the new view seed so a dead packer cannot pin the height. The same packer cannot reseal a second body at that height. Conflicting live proposals keep the first valid body; the chain does not rewind the tip to resolve them.

Users never join consensus. Operators do. The registry grows only through genesis and confirmed Bond transactions. A Hello must not invent a lottery seat. A joiner must not pack while it is behind the mesh tip.

1. Generate a Falcon-512 identity.
2. Fund the account and submit Bond (≥ 1,000 FPL).
3. Wait until that Bond is packed — the registry now includes the seat.
4. Start the node with --join against published seeds.
5. If tip = 0 or lag ≥ 2,048: pull a join-snap from an archive
   (tip state + 128 ledgers). Snapshots are not a live feed.
6. Close the residual gap with certified NeedLedgers.
7. Pong at the mesh tip. Only then is the seat lottery-eligible.
8. To leave: RequestUnbond → 14-day cooldown → CompleteUnbond.

Catch-up is two stages on purpose. A join-snap is a point-in-time copy of tip state plus a short certified tail, served only by nodes that advertise the archive role. Residual ledgers after that snap apply without re-verifying every historical Falcon signature; live packing still verifies every transaction. Light validators keep 128 ledgers in memory. They follow gossip. They are not fed the tip by the archive after they are live.

Classical signatures (ECDSA, Ed25519) will not remain adequate for multi-decade financial infrastructure. Falcon PL uses Falcon-512 lattice signatures — NIST-aligned, hash-and-sign — for account transactions, consensus votes, and ledger seals, from genesis, not as a later migration.

• Domain-separated payloads for LedgerOk, SkipPacker, ViewChange, and OnlineSetVote.
• Voter identity must match the key. Empty, unknown, jailed, or unbonded voters do not count.
• Local, deterministic verification. No external signing service on the consensus path.
• Public binaries refuse development HMAC keys unless --allow-dev-crypto is set.
• Admin commands ride a unix socket (mode 0600), not the public TCP wire.

Treasury funds leave only through protocol epoch emission. There is no human withdrawal key. Emission follows Continuous Inflationary Decline: a declining share of remaining treasury (first claimable epoch 30 bps). On public parameters the epoch is 7 days. Epochs 1–7 emit nothing so the mesh can stabilise. Claims are pull-based.

PoPL is how the protocol pays useful work. It is not how the protocol chooses the next ledger. Lottery win alone does not pay. Empty seals do not exist. An idle bond earns nothing.

presence_i = slots_active_i / 168
weight_i   = work_i × presence_i          # 0 if work_i = 0
pay_i      = min(cap, pot × weight_i / Σ weight)

A watcher heartbeat fills the current presence slot and adds zero work. Opening a tab is not a job. Self-written credit is not in the public transaction set. Unfilled LP and watcher remainder returns to the validator pot.

Native FPL sits beside represented assets from hardcoded rails. Value enters by lock-on-source, mint-on-Falcon, against protocol headers and deposits — not a federated mint authority as the end state. Once on the ledger, capital can sit in pools, supply lending markets, serve as collateral, or trade against FPL and stables.

Supported rails are genesis- or governance-listed. Arbitrary user-added bridges are not a day-one path. Public mint of native FPL remains epoch settlement only.

Every mechanism above creates a surface. This section lists the surfaces the protocol is designed against, and the rule that answers each one.

What the protocol does not claim: a formal safety proof under asynchrony, immunity to a majority of bonded stake, or that the current JSON-TCP mesh is a finished peer-discovery layer. Those are engineering and research tasks, not hidden by this list.

The pack budget is a maximum packing window (1,000 ms), not a fixed close clock. A ledger holds at most 128 transactions. When there is work and the committee is live, the tip can advance in a few hundred milliseconds. When there is no work, the chain does not mint empty height.

Verify cost, committee fan-out, and host memory dominate before the signature scheme itself becomes a law of nature. Resource exhaustion (RAM) is a capacity limit, not a second history. Throughput claims above a measured keep-up are envelopes and are not used as product numbers.

Bonded validators may propose bounded parameter changes. Hard rules — supply cap, keyless treasury, and core consensus safety — are not available for casual amendment. Class B money-rule changes take an amendment and notice of at least one epoch.

The live pre-public beta is network 2300. It is a genesis of this protocol, not a mainnet, and not a cash market. Mainnet follows a published ceremony, freeze pin, and external audit.