Model 2 — Overview (Recommended)¶
This is the winning model
Model 2 is the recommended Centurion Phase-1 topology: 48 validators across six provider-diverse failure domains, surviving 52 / 52 protected scenarios at a risk-adjusted net value of 86.52 CTN/yr.
Winning topology¶
| Site | Role | Validators |
|---|---|---|
| AWS_A | combined EL + CL + VC | 8 |
| AWS_B | combined EL + CL + VC | 8 |
| AWS_C | combined EL + CL + VC | 8 |
| GCP_A | combined EL + CL + VC | 8 |
| GCP_B | combined EL + CL + VC | 8 |
| HOME | VC-only | 8 |
Beacon dependency graph: every AWS/GCP/HOME validator client points to all five AWS and GCP beacon endpoints. The optimizer selected two GCP combined nodes (not GCP VC-only), because VC-only GCP nodes preserve AWS beacon dependency and fail AWS-beacon-degradation cases.
Why 48 validators is optimal¶
The binding constraint is not capital — the foundation principal supports up to 64 validators — but robust finality under protected critical double failures. At 48 validators, stake is evenly spread as 8 across each of 6 failure domains. Losing any protected two-domain pair removes 16 validators and leaves 32 active, exactly the hard 2/3 threshold for 48. Single failures leave 40 active, above the preferred 72% operational target of 35.
A 49th validator would force some protected pair to lose 17 validators, leaving 32 active against a threshold of 33 — so the topology would no longer satisfy the protected double-failure finality constraints.
Risk-adjusted economics¶
- Gross expected annual validator rewards: 184.32 CTN
- Annual infrastructure cost: $7,200 / 28.80 CTN
- Annual capital opportunity cost: 46.08 CTN
- Principal required: 1,536 CTN
- Risk-adjusted annual net value: 86.52 CTN
Unsafe AWS-only layouts can show a higher raw net value because they use less infrastructure, but they fail required protected scenarios and are not feasible recommendations under the robust safety constraints. See the Tradeoff Table and Economics.
Scenario survival¶
The recommended topology survived 52 / 52 protected scenarios, including no failure, every single AWS/GCP/HOME host failure, HOME power/internet loss, individual beacon endpoint failures, individual VC-group and full-node failures, AWS node + HOME failure, AWS node + GCP node failure, two AWS regions down, GCP_A + GCP_B unavailable, AWS region down + remote VC partition from AWS beacons, AWS beacon endpoint degradation, and GCP provider-wide failure at hard finality.
Residual evaluated-but-not-claimed risks: AWS provider-wide failure (24 active / 48, below threshold 32), shared CL/EL client bug across all full nodes, and bad config pushed to all AWS core nodes or all nodes. These require client diversity and deploy discipline, not more validators.
Where to go next¶
- Diagram — full ASCII architecture, beacon mesh, finality ladder, and economics.
- Final Report — the complete narrative and per-scenario tables.
- Model 2 Reports — optimizer summary, scenario matrix, tradeoff table, economics.
Provenance¶
Model 2 was produced by a Gurobi-first fixed-role MILP optimizer (SciPy/HiGHS fallback, recorded as solver=scipy-highs because gurobipy was unavailable at run time), with a 13-test suite covering finality thresholds, beacon reachability, AWS-only beacon dependency, GCP fallback, failure-domain aggregation, capital enforcement, and recommended scenario survival (pytest -q → 13 passed).