Add QuorumIntersectionChecker mission - #422
Merged
jayz22 merged 1 commit intoAug 11, 2026
Merged
Conversation
jayz22
force-pushed
the
add-quorum-intersection-checker-mission
branch
from
August 10, 2026 23:13
d67949c to
0939058
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an end-to-end mission validating stellar-core’s V2 quorum intersection checker during a live quorum-set change.
Changes:
- Adds checker configuration, HTTP parsing, metrics, and runtime CoreSet reconfiguration.
- Introduces and registers the six-validator quorum-intersection mission.
- Adds unit tests and mission documentation.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
src/FSLibrary/StellarStatefulSets.fs |
Updates live CoreSet ConfigMaps. |
src/FSLibrary/StellarNetworkCfg.fs |
Replaces CoreSet options safely. |
src/FSLibrary/StellarMission.fs |
Registers the mission. |
src/FSLibrary/StellarKubeSpecs.fs |
Generates individual peer ConfigMaps. |
src/FSLibrary/StellarCoreSet.fs |
Adds checker options and explicit-key construction. |
src/FSLibrary/StellarCoreHTTP.fs |
Parses checker results and metrics. |
src/FSLibrary/StellarCoreCfg.fs |
Emits checker configuration. |
src/FSLibrary/MissionQuorumIntersectionChecker.fs |
Implements the live-network mission. |
src/FSLibrary/FSLibrary.fsproj |
Includes the mission in compilation. |
src/FSLibrary.Tests/Tests.fs |
Tests configuration and parsing behavior. |
doc/missions.md |
Documents the mission. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Verifies stellar-core's V2 quorum intersection checker on a live 6-node network: an intersection-critical bridge validator is restarted with its quorum-set threshold relaxed from requiring both inner sets to either, splitting the configuration into two disjoint quorums. The mission asserts the split is detected live (exact potential_split via /quorum on the never-restarted side; scp.qic metrics on the restarted bridge, which cannot report via /quorum until some run has found intersection good), that the severed side provably keeps its stale pre-split verdict, and that no node crashes or restarts. Supporting changes: - per-core-set QUORUM_INTERSECTION_CHECKER config flags (V2 + limits) - MakeLiveCoreSetWithKeys for core sets with caller-supplied keys - in-place core set reconfiguration (ConfigMap replace + options swap) - /quorum intersection info and scp.qic metric helpers on Peer
jayz22
force-pushed
the
add-quorum-intersection-checker-mission
branch
from
August 10, 2026 23:18
0939058 to
16af8f7
Compare
graydon
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
MissionQuorumIntersectionChecker, which verifies stellar-core's V2 quorum intersection checker on a live network (plus the config and HTTP plumbing the mission needs).The mission runs six validators: a bridge requiring BOTH of two inner sets (2-of-3
{v0,v1,v2}, 2-of-3{v3,v4,v5}), a strict 3-of-3 left pair, and a self-sufficient 3-of-4 right trio. Phase 0 verifies the network enjoys quorum intersection and that the checker flags the bridge as intersection-critical. The bridge is then restarted with its threshold relaxed to EITHER (100% → 50%), creating two disjoint quorums in configuration. The mission asserts: the split is detected live (exactpotential_splitvia/quorumon the never-restarted side;scp.qiccounters on the restarted bridge, since core withholds/quorumresults from a node whose first run already sees a split), the severed pair keeps its frozen pre-split verdict, and no node crashes or restarts.Why
The quorum intersection checker is a safety-critical diagnostic, but nothing exercised it end-to-end against a real quorum-set change on a running network. The topology guarantees the second quorum can never assemble live (the severed pair deadlocks on each other), so the mission observes detection without ever forming an actual fork. Verified end-to-end on a test cluster.