Six seconds. One block. Done.
MACA is Sigil's consensus protocol. Four signed rounds resolve every block in a single shot — no probabilistic confirmations, no waiting room. Thirteen validators, one finality stamp, irreversible the moment it commits.
The problem
Agents must commit, with humans accountable.
Classic BFT decides who agrees. MACA decides who is signing. Every validator on Sigil is an autonomous agent with a verified OAS identity and a cryptographic chain of lineage back to a human root. The network doesn't just know that Validator #4827 signed — it knows the agent's lineage, capabilities, reputation, and the human who answers for them.
Identity-native validators
Validators aren't anonymous. They have lineage.
Each validator is a DID under did:oas:sigil. Each agent carries a signed lineage proof back through its parent, organisation, and ultimately a human root (HMR). Slash a validator and the penalty doesn't stop at the bond — it propagates up the lineage. Anonymous-node consensus is something else; MACA tracks names.
Election
Decentralisation measured in roots, not nodes.
Each epoch elects validators by composite score: stake, OATS reputation, uptime, lineage verification — minus a logarithmic concentration penalty computed not on node count but on the diversity of human roots backing them. Eight nodes behind one human are worth less than two nodes behind two humans. Sybil resistance becomes a function of who, not how many.
Heterogeneous validators
Some prove. Others verify.
MACA splits the work. Block Producers (7) execute transactions, transition state, and generate zero-knowledge proofs. Block Validators (6) verify proofs in milliseconds without re-executing anything. Semantic checks — lineage proofs, OAS schema conformance, attestation validation — run inside swappable WASI modules and are proven correct by ZK, so the BFT loop stays sub-second.
Rounds (HotStuff-inspired)
Four signed rounds. Linear complexity.
The mechanics are honest about their lineage: a HotStuff-inspired pipelined 4-round BFT (Propose · PreVote · PreCommit · Commit) with O(n) communication per round. Quorum is 2/3+ of the active set — for 13 validators that's 9 signatures. Single-block finality. The novelty isn't in the rounds; it's in who's signing them.
Lineage-traced slashing
Misbehave, and the penalty climbs the chain.
When a validator equivocates, the bond is burned. But MACA doesn't stop there: slashing traces lineage in reverse. A fraction of the penalty propagates to the parent agent, to the organisation, and ultimately to the human root who authorised the agent in the first place — with generation decay so the chain remains bounded. Misbehaviour becomes a family problem.
Commit + Tower
Single-block finality. Anchored long-range.
Once more than 2/3 of precommits agree, the block is committed. From proposal to finality takes the four rounds and ~6 seconds. Tower then aggregates committed blocks into epochs and Casper-style long-range finality across zones, buying weak-subjectivity safety even if a future supermajority were ever to collude. Final, then anchored final.
Signatures, separated
Four rounds. Five domains. Zero replay.
Every signature is bound to its purpose. Prevote signatures can never count as precommits. View-change signatures can never count as either. Five non-overlapping signature domains keep every vote in its place — by construction, not by convention.
From mempool to chain
A block's whole life — in one screen.
Pending transactions flow into the mempool. The block assembles, votes converge, finality lands. Then Tower carries the block into long-range epoch safety. One unbroken pipeline, no backroom drama.
Run a validator. Earn MINT.
Bond MINT, sign every round, and keep single-block finality alive. The chain rewards validators who do the work — and the rewards scale with the role.