Decision required
The current verifier special-cases block number 0 and accepts it without normal signature/hash checks. The synced-block follow-up review found that direct sync/batch callers could theoretically apply a remote genesis block unless callers guarantee this is unreachable.
Required decision
Choose and document one fail-closed policy:
- Reject remote genesis application and require the configured local genesis; or
- Validate the remote genesis against a canonical genesis hash/configuration.
Acceptance criteria
- Policy is explicit in the consensus code/documentation.
- A regression test covers direct sync/batch ingress.
- No arbitrary remote genesis can be persisted.
This is separate from signer-membership filtering and vote domain binding (#987).
Decision required
The current verifier special-cases block number 0 and accepts it without normal signature/hash checks. The synced-block follow-up review found that direct sync/batch callers could theoretically apply a remote genesis block unless callers guarantee this is unreachable.
Required decision
Choose and document one fail-closed policy:
Acceptance criteria
This is separate from signer-membership filtering and vote domain binding (#987).