Validators and the canonical ledger
The canonical ledger is operated by a named set of accredited institutions. Because consensus is deterministic replay, a validator's job is attestation and state-root publication, not leader election, and any outside party can check its work.
#Validator seats
The canonical ledger starts with five to nine seats: the network operator, partner banks, an exchange or custodian, and curated fintechs. Validators independently replay confirmed calls, publish per-block state roots, and co-sign network-level attestations under a t-of-n quorum, three of five at minimum.
There is no consensus ceremony and no slashing of bonded capital. Misbehaviour is handled by governance removal and contract termination, which is how accredited validator sets operate in production financial networks. Seats hold staked and vested XRB positions that governance can revoke, so a seat that attests something it cannot substantiate by replay loses a real economic position as well as its seat.
#Obligations
Each seat carries three obligations:
- Continuous replay and state-root publication.
- Operating network infrastructure: a Lightning hub or an observer-serving endpoint.
- Taking part in the quorum that admits subnets, issuers above the free tier, and AMM operators.
Seats are compensated from the validator emission pool, weighted by attested activity. See XRB and network economics.
#Accountability without trust
Permissioned seats attest to state they cannot falsify undetected, because any observer can replay the same public inputs and detect a divergent root at once. A dishonest quorum can disrupt the liveness of attestation, never the correctness of state. Validator attestations are also the first endpoint the network secures with post-quantum signatures. See Post-quantum security.