Skip to content

Parity & Fidelity Audit

Docs-site note (2026-06-25, refreshed 2026-07-16): This page is Vexor's honest self-assessment of how closely it tracks the canonical Solana clients at the byte level. It is written in the same spirit as the VexLedger cross-client fidelity section, extended to the whole validator. The discipline here is the point: every parity claim is grounded in source and live measurement, every known-open item is stated plainly, and deliberate deferrals are marked as deliberate with the reason. Claims that are designed-but-not-yet-proven are flagged so they read as roadmap, not as fact. The Agave anchor below is re-checked against each new Agave release as it ships — currently v4.2.0-beta.0, the newest testnet release.

Why this page exists

A second validator client is only useful to the network if it stays in line with the other validated clients — if it computes the same bank hash for the same block, encodes records the same way on the wire, and answers RPC the same way down to the byte. A client that drifts is worse than no second client: it splits the network.

So Vexor treats parity not as something to claim, but as something to continuously prove. This page lays out the methodology we use, the parity results that are proven today, and — just as importantly — the items that are still open or deliberately deferred. The credibility of the proven claims depends on being equally honest about the unproven ones.

The methodology — three-way ground-truth

Vexor's hardest rule for any consensus- or runtime-affecting behavior is that a doc, a memory, or an assumption is never enough. Code drifts from documentation; client versions drift from each other. So before any behavior is treated as "correct," it is ground-truthed against three independent sources:

# Source What it answers
1 The deployed binary's actual source What is really running and voting — not what a branch or a note claims. We read the source at the deployed commit, not the roadmap.
2 Agave — anchored to the newest testnet release (currently v4.2.0-beta.0) The canonical, byte-faithful target — the version the live testnet cluster runs. We read what Agave actually does, never our own idea of "canonical," and re-anchor this audit every time a new release ships.
3 Pinned Firedancer (cross-check) An independent second implementation of the same protocol — especially for consensus/runtime (cost model, replay, sigverify, snapshot).

The strongest possible signal is Agave == Firedancer: when two independent canonical implementations agree, that agreement is the specification, and Vexor matches it. When the two disagree, that is a stop signal — the discrepancy is resolved before any code is touched.

This is not theoretical process. It has caught real bugs that a single-source check would have missed — for example, a fix that was present on the serial execution path but had not been propagated to the live parallel/DAG paths (a latent divergence), and a confirmation that "execute every transaction regardless of cost" is canonical (Agave and Firedancer agree: per-transaction cost is an after-the-fact aggregate, not a gate). In each case, checking only one source would have meant fixing the wrong thing — or shipping a bug.

Proven parity — what is verified today

Each item below is held to a concrete bar: it is DONE only with one of (a) deployed and voting CURRENT bank-exact on live testnet, (b) offline-replay bank-exact against a cluster-attested chain, or (c) golden-vector / known-answer tests (KATs) for dormant or feature-gated code.

Bank-exact voting on live testnet

Vexor runs as a voting validator on the live testnet cluster and stays bank-exact — its computed bank hash matches the cluster's for every slot. This is the single strongest parity signal: the bank hash is a function of essentially all account and consensus state, so byte-exact voting under sustained live load is an end-to-end proof that replay, the runtime, the SVM, sysvars, fee/rent accounting, and rewards all match Agave.

Evidence (as of 2026-07-11): the node is deployed and voting CURRENT (not delinquent) on the public testnet cluster, earning ~98.7% of the maximum available vote credits (measured against the theoretical 16-vote/slot ceiling) — on par with the Agave reference node run alongside it for comparison. Live parity is re-checked after every deploy.

Beyond the live voting signal, every consensus-affecting change additionally has to clear an offline golden replay — 1992 canonical slots spanning a full epoch boundary, bank hashes byte-identical to the live cluster's — before it is ever deployed. This is the standing gate, not a one-time check.

Offline replay — golden-gate bank-exact

Because VexLedger persists shreds and can re-replay them with no network, every consensus-affecting change is replayed offline against a pinned range of canonical slots and must reproduce the cluster's bank hashes exactly before it is ever deployed. This proves the replay path is deterministic and cluster-faithful independent of any live timing.

Evidence: offline golden replay — 1992 canonical slots spanning a full epoch boundary, bank hashes byte-identical to the live cluster's (the standing pre-deploy gate).

Vote-instruction execution — byte-identical across live traffic

Vexor's vote-instruction execution is a from-scratch, Vexor-authored implementation built directly from Agave 4.2 semantics, shaped after Firedancer's zero-allocation, flat-buffer instruction handling, and is the sole, unconditional vote executor. It replaces an earlier Sig-derived reference component, which served as the differential-test oracle during development and has been fully removed from the tree (Stage 8, 2026-07-12).

Evidence: instruction-for-instruction differential comparison against 990,000+ real vote instructions captured from live epoch-boundary traffic — zero mismatches. The same sample shows the new path executing at ~1.9 µs per instruction versus ~8.9 µs for the path it replaces — 4.7× faster — with byte-identical output.

VexLedger — zero-drift interop audit

Every interop-load-bearing blockstore record was line-checked against the anchored Agave release's source across two independent passes, with a verdict of zero P0 drift:

  • Column-family names — every name byte-matches the anchored release's column.rs (exact snake_case; no typo, casing, or pluralization drift).
  • Key encoders — every interop key is big-endian with the correct field widths and tuple order. The classic width traps are all handled: erasure_meta.fec_set_index is u64 in the key while merkle_root_meta's is u32 (a 12-byte key, not 16); address_signatures is the full pubkey ++ slot ++ tx_index(u32 BE) ++ sig 108-byte tuple in order.
  • Value codecs — wincode for the meta family (SlotMetaV3, Index, ErasureMeta, MerkleRootMeta, FrozenHashVersioned) and protobuf for transaction_status and rewards — each matching the anchored release's column trait routing. Wrong codec would make the value unreadable cross-client; none is wrong.
  • RPC JSON renderers — the transaction-error, transaction-wire, meta, and protobuf renderers byte-match the anchored release's serde output, golden-locked by KATs (exact vector counts: see source).

Evidence: line-by-line source audit vs column.rs, blockstore_meta.rs, bit_vec.rs, confirmed_block.proto; consensus-/RPC-critical encoders carry golden KATs derived from the anchored release. Confidence: HIGH. See also VexLedger cross-client fidelity.

SVM crypto syscalls — golden-vector KATs

The cryptographic syscalls are verified byte-for-byte against canonical golden vectors, with the strongest signal (Agave == Firedancer) available because Firedancer's leaf-crypto C is byte-identical to the anchored Agave release:

  • bn254 / alt_bn128 group ops, compression, and poseidon — matched against Firedancer's fd_bn254 / fd_poseidon (which equal the anchored Agave release), with KAT coverage including the G2 byte-vectors.
  • ZK ElGamal proof program (confidential transfer, SIMD-0153) — a byte-faithful verifier; real Agave-prover proofs verify and corrupt proofs reject, with end-to-end handler KATs.
  • SIMD-0449 direct-account-pointers serializer — byte-exact against an Agave golden vector (dormant, feature-gated).

Evidence: KATs / golden vectors against Agave (and Firedancer where the C is shared).

sBPF interpreter — Firedancer parity

Vexor has its own sBPF virtual machine — a clean-room port (interpreter.zig, verifier, ELF loader, memory-region and v0/v1/v2/v3 layouts) — that executes bank-exact. Because it interprets, it is at parity with Firedancer, which also interprets; JIT is an Agave-only optimization, not a Firedancer gap, so "no JIT" is correctly not counted against parity here.

Evidence: bank-exact live execution + KATs; methodology note that interpreter == Firedancer's approach.

Honest caveats — known-open and deferred parity items

This section is the reason the section above is trustworthy. Nothing here is a current bank-hash divergence on the live voting path; each is stated with its real status.

Open (genuinely not done — but not an active divergence)

  • Gossip CRDS signature verification is not yet wired. The verifier exists (crds.zig has verify()), but the cluster-info ingest path (insert / push / pull) does not yet call it. This is security/citizenship hardening and a prerequisite for known-validator snapshot-trust enforcement — it is not a bank-hash divergence. It is the single clearest open item on the actionable list.

  • Snapshot-trust enforcement — only the final call site remains. The scaffolding (full-only-boot lt-hash guard, known-validator config wiring, the agreement module with KATs) is already in the deployed binary; what is missing is the gated post-load/pre-vote enforcement call on a live path. It is deliberately gated behind the CRDS sig-verify item above to be meaningful.

  • VexLedger RocksDB export tool is latent (by design). Vexor's blockstore is a native append-segment store (like Firedancer's, not RocksDB), so agave-ledger-tool cannot open the .seg files directly. The byte-primitives for an exportable RocksDB form — the value codecs and most key encoders — exist and are KAT-proven; what is unbuilt is the sig/pubkey export-key assembly and the directory writer. This is an unbuilt convenience surface, not a drift: there is no live name-keyed interop surface to break today, and the export, when built, is name- and codec-correct from day one. (See the VexLedger fidelity note.)

Deliberate deferrals (documented decisions, with reasons — not bugs)

  • Whole-block cost mark_dead on actual compute units is intentionally not added to the live replay path. A false positive would mark a good block dead and cause delinquency on the hottest consensus path — the same class of path that caused a delinquency once before. It is a latent, adversarial-only concern, protected by fork choice, and is a low-priority gated-future item rather than a live gap.

  • sBPF v4 is a watch-item, deliberately not implemented. The anchored Agave release has no enable_sbpf_v4 feature and rejects e_flags=4 — exactly as Vexor does. Implementing it now would mean accepting what Agave rejects, which is itself a divergence. The trigger to implement is a future Agave enable_sbpf_v4 activation. (Note: the "V4" work that was done — VoteState V4 / SIMD-0185 — is a different thing and is complete.)

Shipped but not yet incident-proven

  • The VexLedger real-time divergence alarm (auto-detect the first diverging slot and re-replay it, narrowing the divergence to one of the bank hash's four inputs) is armed live — wired onto the flight recorder, non-blocking, currently soaking in production. It has known-answer test coverage and a proven offline-replay engine underneath it, but has not yet fired against a real production divergence, so unlike the vote-rejection watch (which has a real-incident track record — see Incident Postmortems), its live catch-and-replay path is proven by design and test, not yet by an actual catch. See Reliability & Conformance.

The discipline as a differentiator

The parity tooling itself is part of what keeps Vexor in line — and is unusual among clients:

  • Golden-vector harness. A reusable harness extracts byte-exact reference vectors directly from Agave crate internals (behind Agave's unstable-API feature gates) and locks Vexor's output against them. This is how dormant, feature-gated code (serializers, syscalls, proof programs) is proven correct before a cluster ever activates it — parity is verified ahead of activation, not discovered after a divergence.

  • Offline-replay carrier forensics. Any rooted slot can be re-replayed offline, with no network, to reproduce the cluster's bank hash. When a divergence is suspected, this turns a normally multi-day forensic hunt into a bounded procedure: pin the carrier slot, discriminate block-vs-execution, and isolate the exact program / account / field — and crucially, gate the fix offline (the replay must reproduce the cluster's bank hash) before anything is deployed.

  • Ground every claim in source, not memory. The three-way rule is enforced precisely because docs, notes, and worklogs go stale and clients drift across versions. Every "it's correct" on this page traces to a read of the deployed source, the anchored Agave release's source, and (where it matters) the Firedancer source — not to a recollection.

The result is a validator whose parity is measured continuously and proven from source, with the open items held in plain sight rather than papered over. That honesty is the foundation the proven claims stand on.

Status summary (2026-07-11)

Area Status Basis
Voting bank-exactness (live testnet) ✅ Proven CURRENT in-cluster; ~98.7% of max vote credits (2026-07-11)
Offline replay parity ✅ Proven 1992/1992 golden-gate slots on every consensus change
Vote-instruction execution (Vexor-authored rewrite) ✅ Proven 990k+ live-instruction differential comparison, zero mismatches, 4.7× faster
VexLedger interop (names/keys/codecs/RPC JSON) ✅ Proven two-pass source audit + golden KATs vs anchored Agave release, zero drift
SVM crypto syscalls (bn254/poseidon/ZK/0449) ✅ Proven golden-vector KATs (Agave == FD where shared)
sBPF interpreter ✅ Parity bank-exact execution; == Firedancer's interpret model
Gossip CRDS sig-verify ⬜ Open wired-verifier exists, ingest call not yet made (not a divergence)
Snapshot-trust enforcement call site ⬜ Open scaffolding deployed; final gated call remains
VexLedger RocksDB export tool ⏳ Latent (by design) primitives proven; writer + sig/pubkey key assembly unbuilt
Whole-block cost mark_dead ⏸ Deferred (with reason) false-positive delinquency risk on hot path
sBPF v4 ⏸ Deferred (with reason) anchored Agave release rejects e_flags=4; implementing = accept-what-Agave-rejects
Real-time divergence alarm 🛠 Armed live non-blocking, soaking in production; not yet real-incident-proven