Field note
One Epoch Leader From a Bonded Set—Selected by iVRF, Not a VDF
An epoch needs an aggregator to collect private Actions, build the recursive proof, and submit the new roots to Ethereum. A permanent operator would be a permanent censorship point. An unconstrained race would duplicate expensive proving and make leadership ambiguous.
The Architecture of Record resolves this with an untrusted bonded-aggregator set and a hash-based, stake-weighted indexed VRF. The selected leader changes from epoch events, not from a wall-clock job.
What the bond does
The bond defines membership and economic exposure. It does not make the aggregator trusted with private values or protocol semantics. A selected aggregator receives opaque Action material, and the epoch proof must still satisfy the same verification rules.
Forced inclusion and checkpoint-demand paths address censorship or inactivity. They are observable recovery transitions at the L1 boundary, not hidden retries inside the protocol machine.
The hash-based lottery
Think of each aggregator locking a set of lottery tickets in a sealed box before the epoch. The box is a Merkle root, and each ticket comes from the aggregator's secret nk. The settled epoch chooses which ticket is checked, while the aggregator's bond sets its winning threshold.
The winner reveals that ticket and its Merkle path. Anyone can hash both again and check the result. This is the indexed VRF: a verifiable hash lottery without an elliptic-curve VRF. The number of tickets and how long a set may be reused still need analysis and deployment measurements.
Why the design says “no VDF”
A verifiable delay function seems attractive: force sequential work, then use the output as delayed randomness. The source architecture rejects the available families for two independent reasons.
Class-group and other unknown-order-group VDFs depend on group-order hardness that Shor's algorithm undermines. That conflicts with a protocol core deliberately avoiding curve and factoring assumptions. Algebraic VDF proposals have also faced attacks on their assumed sequential latency, and Ethereum did not adopt the earlier VDF direction.
A VDF would additionally introduce a time-driven component into an architecture whose transitions are event-driven. The target therefore does not use “single bonded aggregator plus VDF rotation.” It uses one selected leader per epoch from a bonded set, with hash-based iVRF selection and explicit inclusion recovery.
This is a research-grade part of the design, not a solved commodity module. Its security proof, stake weighting, key lifetime, adversarial abort behavior, and forced-inclusion economics remain deployment gates.