Skip to main content
The aggregator is a stateless coordination service. It does not have any signing authority; it cannot mint, burn, or move PRL on its own.

​
What it does

  • Collect signatures. P-256 signatures keyed by proposal_id come in from the validator quorum. Invalid signatures, and signatures from unknown validators, are rejected.
  • Pre-flight checks. Before forwarding to the signing quorum, the aggregator runs multi-RPC consistency checks, per-validator rate limits, an output-address whitelist, and a circuit breaker that pauses forwarding on consistency failures.
  • Forward at threshold. At 3-of-4 it forwards to the TEE-enforced signing quorum (Privy) with the three validator signatures as authorization.
  • Assemble + broadcast. It assembles the resulting Pearl / Solana transaction, verifies it locally against the validator-attested intent, and broadcasts to the right chain.
  • Emit lifecycle events. Each transition fires through sig_event_publisher and the sqs_publisher → SQS → NacreScan ingester so the explorer’s intent timeline stays current with the on-chain state.
Two to three aggregator instances run in parallel. Validators POST to all of them; whichever reaches threshold first broadcasts.

​
Crate layout

The aggregator is split into a library plus a binary entry plus two broadcaster impls; the binary composes them at startup via a CompositeBroadcaster that routes on the proposal’s ProposalKind.
CrateRole
nacre-sig-aggregatorLibrary: signature collection, pre-flight checks, lifecycle event publisher, broadcaster trait.
nacre-sig-aggregator-binBinary entry; wires the library against the concrete broadcasters at boot.
nacre-pearl-broadcasterBroadcaster impl for Pearl ProposalKinds — Cold Reserve sweep, redemption broadcast.
nacre-solana-broadcasterBroadcaster impl for Solana ProposalKinds — mint_deposit, complete_redemption, claim_cold_reserve_utxo.