Enum ConsensusMessage 

pub enum ConsensusMessage {
    Proposal {
        block: Box<Block>,
        proposer: String,
        round: u64,
        high_qc_view: u64,
        timeout_certificate: Option<Vec<u8>>,
        no_endorsement_certificate: Option<Vec<u8>>,
    },
    Vote {
        block_hash: Hash,
        voter: String,
        vote_type: VoteType,
        round: u64,
        height: u64,
        high_qc_view: u64,
        signature: Vec<u8>,
        public_key: Vec<u8>,
        bls_signature: Vec<u8>,
    },
    Commit {
        block_hash: Hash,
        signatures: Vec<Vec<u8>>,
    },
    Timeout {
        format_version: u8,
        view: u64,
        high_qc_view: u64,
        finalized_height: u64,
        voter: Address,
        signature: Vec<u8>,
        public_key: Vec<u8>,
    },
    NoEndorsement {
        format_version: u8,
        view: u64,
        voter: Address,
        signature: Vec<u8>,
        public_key: Vec<u8>,
    },
}

Consensus message types.

Uses serde’s default externally-tagged enum representation. See MessagePayload above for the rationale — #[serde(tag = "...")] is internally-tagged and incompatible with bincode 1.x.

Variants

Proposal

Block proposal.

timeout_certificate is Some(_) only when the leader is recovering from a view timeout — it carries the bincode-serialized tenzro_consensus::timeout::TimeoutCertificate (2f+1 timeout signatures from the previous view) so peers can verify the new view was legitimately abandoned (Jolteon safe_to_extend, DiemBFT v4 §3.5).

high_qc_view is the proposer’s local highest-Prepare-QC view at the moment of proposing (#171, Aptos SyncInfo pattern). Receivers adopt it if higher than their own to fast-forward the lagging-replica case. Must satisfy high_qc_view < block.header.view.

Fields

block: Box<Block>

proposer: String

round: u64

high_qc_view: u64

timeout_certificate: Option<Vec<u8>>

bincode-serialized tenzro_consensus::timeout::TimeoutCertificate, or None for the steady-state happy path.

no_endorsement_certificate: Option<Vec<u8>>

bincode-serialized tenzro_consensus::timeout::NoEndorsementCertificate. Carries f+1 no-endorsement signatures attesting that no Prepare-QC formed at the timed-out view (MonadBFT, arXiv:2502.20692). Some(_) is required when the leader is proposing a fresh block after a TC — receivers reject an unaccompanied fresh block. None for the steady-state happy path AND when the leader is reproposing the existing high-tip block (the parent-hash match suffices).

Vote

Vote on a proposal

Carries a hybrid (Ed25519 + ML-DSA-65) signature and the voter’s composite public key so peers can verify both legs without an out-of-band registry lookup. The two opaque blobs are bincode- serialized CompositeSignature / CompositePublicKey from tenzro_crypto::composite.

high_qc_view is the voter’s local highest-Prepare-QC view at the moment of voting (#171, Aptos SyncInfo). Bound into the vote’s signing payload — must match the bound on the inner Vote or signature verification fails.

Fields

block_hash: Hash

voter: String

vote_type: VoteType

round: u64

height: u64

high_qc_view: u64

signature: Vec<u8>

bincode-serialized tenzro_crypto::composite::CompositeSignature

public_key: Vec<u8>

bincode-serialized tenzro_crypto::composite::CompositePublicKey

bls_signature: Vec<u8>

Raw 96-byte BLS12-381 G2 signature over the canonical QC payload (TENZRO_QC_BLS: || vote_format_version || view || height || block_hash || vote_type). Aggregated by VoteCollectorinto the QC'sbls_aggregate`.

Commit

Commit message

Fields

block_hash: Hash

signatures: Vec<Vec<u8>>

Timeout

Pacemaker timeout broadcast (DiemBFT v4 §3.5).

Sent on local view-timer expiry. Receivers at a strictly lower view adopt view after verifying the sender’s hybrid signature — the signature is the cryptographic gate (DiemBFT v4 §3.5 process_remote_timeout); no numeric jump cap is applied, since stuck replicas may legitimately need to sync forward by many thousands of views. This is the backward-sync channel that prevents two honest replicas from drifting apart under partial synchrony.

The two opaque blobs are bincode-serialized CompositeSignature / CompositePublicKey from tenzro_crypto::composite, mirroring the Vote variant. Format version is pinned by tenzro_consensus::TIMEOUT_MSG_FORMAT_VERSION.

Fields

format_version: u8

view: u64

high_qc_view: u64

Highest Prepare-QC view this voter has observed (≤ view - 1). Aggregated by the receiver into the TC’s max_high_qc_view() so the next leader can compute the Jolteon safe_to_extend predicate.

finalized_height: u64

The sender’s highest finalized block height. Part of the signed payload. Receivers behind this height engage block-sync — the heal path for single-block finalization skew (one replica finalized via a Commit QC the others never received).

voter: Address

signature: Vec<u8>

bincode-serialized tenzro_crypto::composite::CompositeSignature

public_key: Vec<u8>

bincode-serialized tenzro_crypto::composite::CompositePublicKey

NoEndorsement

MonadBFT no-endorsement attestation broadcast (arXiv:2502.20692).

Sent on local view-timer expiry alongside the Timeout broadcast. Aggregated by the receiver into a NoEndorsementCertificate (f+1 signatures) which the next leader attaches to a fresh block proposal after the timed-out view. The f+1 threshold is the smallest set that guarantees at least one honest signer — and any honest signer would refuse to sign if it had observed a Prepare-QC at the timed-out view, so the NEC is unforgeable evidence that no QC formed.

The two opaque blobs mirror the Vote / Timeout variants — bincode- serialized CompositeSignature / CompositePublicKey. Format version is pinned by tenzro_consensus::NO_ENDORSEMENT_MSG_FORMAT_VERSION.

Fields

format_version: u8

view: u64

voter: Address

signature: Vec<u8>

bincode-serialized tenzro_crypto::composite::CompositeSignature

public_key: Vec<u8>

bincode-serialized tenzro_crypto::composite::CompositePublicKey

Trait Implementations

impl Clone for ConsensusMessage

fn clone(&self) -> ConsensusMessage

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConsensusMessage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ConsensusMessage

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ConsensusMessage

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.