Protocol Tests

Six validation tests from Agave source — Feb 2026

T1 — First Vote at Epoch Boundary

Question: Can a validator that has never voted under a new key start producing blocks from slot 0?

A validator warming up for 2 epochs has zero vote history under the new keys. A zero-history tower has no lockouts — it can vote immediately. The leader schedule is stake-based — no liveness requirement.

Agave citation: runtime/src/leader_schedule_utils.rs — leader_schedule() uses bank.epoch_vote_accounts(epoch), a stake snapshot, not live state.

Result: PASS. Validator votes from slot 0 with zero history. No warm-up votes required.

T2 — The Permission Model

Question: What can the voter do, and what can it not do?

The voter key (held by the operator) can sign votes — and nothing else.

Marinade's withdrawer can rotate the voter at any time, regardless of what the current voter is.

Agave citation: programs/vote/src/vote_state/mod.rs — verify_authorized_signer() checks signers.contains(authorized)

Result: PASS/FAIL-expected. Voter cannot withdraw or update identity. Withdrawer unilaterally controls all authority rotation.

T3 — Two Signers Required for Identity Update

Question: Can Marinade update the node identity unilaterally, or does the current operator need to co-sign?

Identity updates require two signatures: the vote account withdrawer (Marinade) AND the current node identity (operator). This prevents unilateral identity theft but requires coordination during rotation.

Agave citation: programs/vote/src/vote_instruction.rs — update_validator_identity() checks both vote_account.withdrawer and current_identity.

Result: PASS/FAIL-expected. Two signatures required. Backplane must deliver new identity keypair to outgoing operator OR Marinade must hold both keys temporarily during handoff.

T4 — Vote Authority Rotation: 2-Epoch Delay

Question: How long does it take for a new voter key to become active?

Vote authority updates take 2 epochs to take effect. Submit in epoch N−1 → active in epoch N+1.

Epoch N−1  │  Marinade submits vote-authorize tx  ←── HARD DEADLINE
Epoch N    │  Incoming validator warms up (outgoing still votes)
Epoch N+1  │  New voter active

If the transaction lands in epoch N instead of N−1, the new voter won't be active until epoch N+2 — one full epoch of downtime.

Agave citation: programs/vote/src/vote_state/mod.rs — authorize() sets epoch_credits offset for activation.

Result: PASS. Backplane must enforce hard deadline: transaction lands in epoch N−1 or rotation fails.

T5 — Identity Rotation: 2-Epoch Leader Schedule Delay

Question: When does a new node identity appear in the leader schedule?

Leader schedules are computed 2 epochs in advance. Submit identity update in epoch N−1 → new identity appears in the epoch N+1 schedule.

Epoch N−1  │  Marinade submits identity update tx  ←── HARD DEADLINE
Epoch N    │  Incoming validator warms up (not in schedule yet)
Epoch N+1  │  New identity in leader schedule

If the identity update lands in epoch N, the new identity won't appear in the leader schedule until epoch N+2.

Agave citation: runtime/src/leader_schedule_utils.rs — leader_schedule() reads vote accounts from 2 epochs prior.

Result: PASS. Both vote authority AND identity must land in epoch N−1 for epoch N+1 activation. Single deadline, two transactions.

T6 — Gossip + Turbine Cache Convergence

Question: How long does it take for the network to recognize a new identity?

Gossip propagates new identity in ~500ms (measured from mvines demo). Turbine routing cache has 5s TTL — worst case 10s for full network convergence.

At epoch boundary, the new validator joins gossip during warmup (epoch N). By the time it goes live (epoch N+1), turbine peers have already cached the new identity. Handoff completes in <90 seconds end-to-end.

Agave citation: turbine/src/broadcast_stage/standard_broadcast_run.rs — turbine peer cache TTL hardcoded at 5 seconds.

Result: PASS. Gossip + turbine converge well inside the epoch boundary window. No slots missed due to network propagation.

Research Provenance

Source: Deep research Feb 2026 (20260206_virtual_validator/): 6 notes, 1 spec, 3 critiques. Validation via Anza client source analysis, gossip architecture review, tower BFT mechanics.

References