ObolNetwork · pinebit · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026
diff --git a/README.md b/README.md
@@ -43,6 +43,7 @@ targets `v1.7.1`): some specified behaviors landed after `v1.7.1`:
 | ------------------------------------------------------------------ | -------------------- |
 | `MsgSync.nickname` field (DKG sync)                                 | `v1.9.0`             |
 | Deterministic (genesis-derived) eager double linear round deadlines | `v1.9.0`             |
+| Extended 1.5s proposer round-1 timeout (`proposal_timeout`)         | `v1.9.0`             |
 | Linear round timer subsequent-round timeout fix                     | unreleased (`v1.11.0` RCs) |
 | QBFT DECIDED-resend rate limit and message size/count limits        | unreleased (`v1.11.0` RCs) |
 | Preferred priority protocol ID `/charon/priority/2.0.0`             | unreleased (`main`)  |

diff --git a/charon_anchor.json b/charon_anchor.json
@@ -83,6 +83,12 @@
       "first_charon_release": "v1.9.0",
       "spec": "docs/dv-spec/consensus.md"
     },
+    {
+      "name": "Extended 1.5s proposer round-1 timeout (proposal_timeout)",
+      "first_charon_release": "v1.9.0",
+      "spec": "docs/dv-spec/consensus.md",
+      "note": "The behaviour itself is older (charon #3739) but sat behind the alpha proposal_timeout feature flag; v1.9.0 (charon #4296) enabled it by default. The timer_deadlines vectors assume it is enabled."
+    },
     {
       "name": "Linear round timer subsequent-round timeout fix",
       "first_charon_release": null,

diff --git a/consumers/README.md b/consumers/README.md
@@ -7,7 +7,7 @@ executes them: a suite nobody runs is a document, not a test.
 | Consumer | Status | Location |
 | --------------------------------- | ---------------------------------------------- | ----------- |
 | Charon (Go) | All 9 suites, 314 subtests, verified at anchor `6054bcb2` | [`go/`](go) |
-| Pluto (Rust) | Not written yet | — |
+| Pluto (Rust) | All 9 suites checked against pluto `67088a2` — 2 FAIL (`qbft_hashing`, `cluster_hashing`), rest PASS, ABSENT-OK, or UNREACHABLE; see plans/pluto-conformance.md | [rust/](rust) |
 
 These files live here rather than in Charon because this repository cannot merge
 into Charon. They are laid out to mirror Charon's own tree, so placing them is a
@@ -81,3 +81,45 @@ produced by Charon and then published, so a failure means Charon has moved away
 from the protocol every other implementation was told to implement. The
 regeneration path is deliberately not automatic — see the spec's
 `test_vectors/README.md`.
+
+## Pluto consumer
+
+`rust/` is a standalone Cargo package that path-depends on a pluto checkout
+placed as a sibling of this repository (`../pluto` relative to
+`distributed-validator-specs/`, i.e. `../../../pluto` from `consumers/rust/`).
+Unlike the Go consumer, nothing is copied into pluto and pluto is never
+modified — the harness reads pluto's crates in place.
+
+### Running it
+
+```bash
+# pluto checked out as a sibling of this repo (default: ../pluto)
+cd consumers/rust && cargo test
+```
+
+Vectors are read from `../../test_vectors/` at test time (no vendoring), or
+from `SPEC_VECTORS_DIR` when set (same variable as the Go consumer), for
+running against an unreleased build without moving files around.
+
+### Verdicts
+
+All nine published suites were run against pluto commit `67088a2`. This is a
+snapshot of one pluto commit, not a continuously tracked target: `PASS` means
+pluto reproduced every case the vector covers at that commit; `ABSENT-OK` and
+`UNREACHABLE` are not passes — they record, respectively, a divergence excused
+by pluto's charon-v1.7.1 parity pin, and a coverage gap where no public pluto
+API reaches the behaviour at all. Full per-case detail, findings, and pluto
+file:line citations are in `plans/pluto-conformance.md`'s Results table and
+Findings section.
+
+| Suite | Verdict |
+| --- | --- |
+| `secp256k1_signatures` | PASS (2/2) |
+| `qbft_hashing` | **FAIL** — 23/25 cases agree; 2 pinned divergences (prost omits default-valued protobuf map-entry key/value fields that charon's Go marshaler always emits) |
+| `bls_threshold` | PASS (all 5 groups) |
+| `cluster_hashing` | **FAIL** — pluto rejects charon-legitimate JSON shapes (`operators: null`, an absent `partial_deposit_data`, and a masked third gap on `timestamp`) |
+| `priority_scoring` | PASS (18/18) |
+| `timer_deadlines` | `round_timeout_nanos` PASS **only with `ProposalTimeout` explicitly enabled** (9 PROPOSER/round-1 cases diverge under pluto's default config — ABSENT-OK, ladder entry "Extended 1.5s proposer round-1 timeout (proposal_timeout)"); `deadline_nanos` ABSENT-OK; `duty_start_delay_nanos` UNREACHABLE |
+| `qbft_msg_limits` | `counts`: 5 MATCH + 6 ABSENT-OK; `wire_size`: 4/4 MATCH |
+| `qbft_decided_resends` | ABSENT-OK (pluto has no DECIDED-rebroadcast limiter) |
+| `parsigex_sender_binding` | `cases` ABSENT-OK; `peer_map` UNREACHABLE |
diff --git a/consumers/rust/.gitignore b/consumers/rust/.gitignore
@@ -0,0 +1,2 @@
+/target
+Cargo.lock
diff --git a/consumers/rust/Cargo.toml b/consumers/rust/Cargo.toml
@@ -0,0 +1,40 @@
+[package]
+name = "spec-vectors-pluto"
+version = "0.1.0"
+edition = "2024"
+publish = false
+description = "Runs the spec's test_vectors/ suites against a pluto checkout at ../../../pluto"
+
+[dependencies]
+serde_json = "1.0"
+hex = "0.4.3"
+
+[dev-dependencies]
+crossbeam = "0.8.4"
+cancellation = "0.1.0"
+pluto-k1util = { path = "../../../pluto/crates/k1util" }
+pluto-core = { path = "../../../pluto/crates/core" }
+pluto-consensus = { path = "../../../pluto/crates/consensus" }
+pluto-crypto = { path = "../../../pluto/crates/crypto" }
+pluto-cluster = { path = "../../../pluto/crates/cluster" }
+pluto-eth1wrap = { path = "../../../pluto/crates/eth1wrap" }
+pluto-priority = { path = "../../../pluto/crates/priority" }
+pluto-p2p = { path = "../../../pluto/crates/p2p" }
+pluto-featureset = { path = "../../../pluto/crates/featureset" }
+pluto-parsigex = { path = "../../../pluto/crates/parsigex" }
+pluto-eth2api = { path = "../../../pluto/crates/eth2api" }
+pluto-eth2util = { path = "../../../pluto/crates/eth2util" }
+pluto-testutil = { path = "../../../pluto/crates/testutil" }
+rand = { version = "0.8", features = ["std_rng"] }
+k256 = { version = "0.13.4", features = ["ecdsa", "sha256"] }
+prost = "0.14"
+prost-types = "0.14"
+tokio = { version = "1", features = ["macros", "rt", "rt-multi-thread", "time", "sync", "test-util"] }
+tokio-util = "0.7.11"
+futures = "0.3"
+async-trait = "0.1.89"
+chrono = "0.4"
+libp2p = { version = "0.56", features = ["noise", "tokio", "yamux"] }
+
+[patch.crates-io]
+multistream-select = { path = "../../../pluto/third_party/multistream-select" }
diff --git a/consumers/rust/rust-toolchain.toml b/consumers/rust/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.95.0"
+components = ["rustfmt", "clippy"]
diff --git a/consumers/rust/src/lib.rs b/consumers/rust/src/lib.rs
@@ -0,0 +1,33 @@
+//! Loader for the spec's test_vectors/ suites.
+//!
+//! Vectors are read from `../../test_vectors/` relative to this package, or from
+//! `SPEC_VECTORS_DIR` when set. `load_suite` refuses a file whose `suite` field
+//! does not match the requested name, so a stray copy cannot silently substitute.
+
+use std::path::PathBuf;
+
+pub fn vectors_dir() -> PathBuf {
+    match std::env::var_os("SPEC_VECTORS_DIR") {
+        Some(dir) => PathBuf::from(dir),
+        None => PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../test_vectors"),
+    }
+}
+
+pub fn load_suite(name: &str) -> serde_json::Value {
+    let path = vectors_dir().join(format!("{name}.json"));
+    let raw =
+        std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
+    let suite: serde_json::Value =
+        serde_json::from_str(&raw).unwrap_or_else(|e| panic!("parse {}: {e}", path.display()));
+    assert_eq!(
+        suite["suite"],
+        name,
+        "suite field mismatch in {}",
+        path.display()
+    );
+    suite
+}
+
+pub fn unhex(s: &str) -> Vec<u8> {
+    hex::decode(s).unwrap_or_else(|e| panic!("bad hex {s:?}: {e}"))
+}