Transaction Gossip

NOOSChain transaction gossip is the first HTTP-based distributed mempool layer. It lets trusted nodes exchange pending canonical transactions before a consensus backend orders them into blocks.

Gossip is not consensus. A transaction is not trusted because a peer sent it. Every receiving node performs local mempool admission checks:

• canonical transaction hash verification
• Ed25519 signature verification
• signer identity resolution
• stale/duplicate nonce rejection
• finalized transaction rejection
• supported protocol and transaction type checks

The gossiped transaction object must carry the exact canonical signed envelope. createdAt inside that envelope is consensus-significant; DB insertion time is not. Accepted transactions persist transactions.envelope and transactions.canonical_created_at so later block sync and replay can verify the same bytes.

Nonce checks during gossip are pre-consensus checks only. They do not consume the nonce. The nonce is consumed only during deterministic block execution, after a transaction is included in a block.

HTTP Propagation

Peers send:

POST /transactions/gossip

with:

{
  "transaction": { "...": "canonical signed transaction" },
  "protocolVersion": 1
}

Accepted remote transactions are inserted into the local mempool and may be propagated to other active trusted peers. transaction_propagation tracks inbound and outbound peer edges so nodes avoid simple rebroadcast loops.

Node Authentication

Gossip routes require node authentication headers:

• x-noos-node-id
• x-noos-node-timestamp
• x-noos-node-signature

The signature covers a deterministic message derived from method, path, timestamp, and canonical request body hash. The receiver verifies that the node exists in nodes, that the node row is active, that the node is an active validator in governance state, that the timestamp is fresh, and that the node is configured as an active trusted peer.

This is infrastructure authentication, not user authentication.

Peer Scoring

Transaction gossip reports local peer-score events:

• valid accepted gossip records gossip_success
• bad node-auth records gossip_auth_failure when the peer can be identified
• invalid transaction gossip records gossip_invalid_transaction
• outbound HTTP failures record timeout or HTTP-error penalties

Quarantined or banned peers are not used for outbound gossip, and inbound gossip from disabled/quarantined/banned peers is rejected. This is local transport defense only and does not affect consensus membership.

Sync Interaction

Chain sync remains authoritative. If a block arrives through sync, finalized transactions are removed from mempool metadata. Pending transactions that become stale because of nonce progression are rejected at later admission/execution points.

Observer Nodes

Observer nodes reject transaction admission and transaction gossip with NODE_ROLE_READ_ONLY. They can still sync finalized blocks, verify/replay the chain, serve permitted reads, and backfill authorized availability-layer ciphertext. Gossip tests therefore use non-observer peers when the goal is to exercise pending transaction propagation.

Future Work

Future milestones can replace HTTP with libp2p, add peer reputation, spam controls, rate limits, encrypted peer channels, direct transaction-to-leader forwarding, and richer gossip flooding. The consensus boundary should remain: gossip exchanges signed transactions, consensus orders them, and execution mutates deterministic state.

TLS/mTLS

Transaction gossip supports HTTPS peer URLs through the shared NOOS_TLS_* client settings. mTLS may be required by the receiving node, but signed x-noos-node-* headers remain mandatory for trusted peer gossip.