feat: bump consensus v1.25.1 (proposer fix) + genesis v1.12.19 (#120)

luxfi/consensus v1.25.0 → v1.25.1
  Proposer-self-accept gap on nova multi-node finality: the proposer of
  block B was never marking B locally accepted because manager.applyQbit
  re-derived peer Chits via a second blk.Verify() call which most VMs
  (notably PlatformVM CreateChainTx) are not idempotent under, flipping
  every Chits into synthetic Accept=false. Fix tags the proposer's own
  pending entry with IsOwnProposal=true and short-circuits the re-verify
  in handleVote — peer Chits now count as the genuine Accepts they are.

luxfi/genesis v1.12.15 → v1.12.19
  Decomplected: pkg/genesis/security/ is a nested module (own go.mod,
  tagged pkg/genesis/security/v1.12.19) that owns SecurityProfile
  verification — the only file in luxfi/genesis that imports
  luxfi/consensus. The rest of pkg/genesis stays consensus-dep-free.

  API change: pin.Resolve() → genesissecurity.ResolveProfile(pin).
  ErrSecurityProfileHashMismatch and ErrSecurityProfileInvalidID also
  moved to the security submodule. Updated node/node.go and
  node/security_profile_test.go to match.

Build: GOWORK=off go build ./...  clean (linker warnings about accel
  static lib path are pre-existing host-config noise, not a regression).
Vet:   GOWORK=off go vet ./...    clean (the cevm_e2e_test.go
  sync/atomic.Bool copy warning is pre-existing on v1.27.24 main).
Tests: ./consensus/... pass, ./genesis/... pass, ./node/...
  TestApplySecurityProfile_* pass. ./vms/platformvm/txs/fee L1-validator
  failures are pre-existing on v1.27.24 main and unchanged.

Devnet fixture (~/work/lux/genesis/configs/devnet/genesis.json) parses
clean: networkID=3, 5 initialStakers, canonical evmAddr/utxoAddr only.

go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/huin/goupnp v1.3.0
 	github.com/jackpal/gateway v1.1.1
 	github.com/jackpal/go-nat-pmp v1.0.2
-	github.com/luxfi/consensus v1.25.0
+	github.com/luxfi/consensus v1.25.1
 	github.com/luxfi/crypto v1.19.15
 	github.com/luxfi/database v1.18.3
 	github.com/luxfi/ids v1.2.10
@@ -131,7 +131,8 @@ require (
 	github.com/luxfi/constants v1.5.7
 	github.com/luxfi/container v0.0.4
 	github.com/luxfi/filesystem v0.0.1
-	github.com/luxfi/genesis v1.12.15
+	github.com/luxfi/genesis v1.12.19
+	github.com/luxfi/genesis/pkg/genesis/security v1.12.19
 	github.com/luxfi/geth v1.16.98
 	github.com/luxfi/go-bip39 v1.1.2
 	github.com/luxfi/lattice/v7 v7.1.0

go.sum

@@ -268,8 +268,8 @@ github.com/luxfi/compress v0.0.5 h1:4tEUHw5MK1bu5UOjfYCt4OKMiH7yykIgmGPRA/BfJTM=
 github.com/luxfi/compress v0.0.5/go.mod h1:Cc1yxD2pfzrvpO32W2GDwLKff+CylHEvzZh2Ko8RSIU=
 github.com/luxfi/concurrent v0.0.3 h1:eJyv1fhaC0jMLMw6+QS774cUmp7GK+ouMgvLCqnC7cc=
 github.com/luxfi/concurrent v0.0.3/go.mod h1:Aj/FR5NpM0cB2P4Nt3+tz9+dV6V+LUW4HuMgSjwq5hw=
-github.com/luxfi/consensus v1.25.0 h1:ak82ufqeklLJGQMCizxx5agiwLkjbrnrk7kFezvEtZo=
+github.com/luxfi/consensus v1.25.1 h1:bOj7DDKxCTXZITO73qCNBCjlfdjkuW2iEvrCY1W4W7o=
-github.com/luxfi/consensus v1.25.0/go.mod h1:jkKzKyIgg/JqaEumxZOJd9ofWM3pXnVVLlQp+3qo9SM=
+github.com/luxfi/consensus v1.25.1/go.mod h1:jkKzKyIgg/JqaEumxZOJd9ofWM3pXnVVLlQp+3qo9SM=
 github.com/luxfi/constants v1.5.7 h1:a1tCMdxd+pClPMIPOaI9vcYGNy6cQIc2rubac2Trc0k=
 github.com/luxfi/constants v1.5.7/go.mod h1:z+Wc7skybZAA+xuBWNcmtv402S/BFqixL+FiSQXPg8U=
 github.com/luxfi/container v0.0.4 h1:BXhF82WyfqVP5mjlNcr7tP0Fcnvl0Ap1rkiu+rq5XuM=
@@ -286,8 +286,10 @@ github.com/luxfi/filesystem v0.0.1 h1:VZ6xMFKaAPBW/ddlMsDnI2G0VU1lV5rYaVcW5d+KwE
 github.com/luxfi/filesystem v0.0.1/go.mod h1:OQVSU6XNwqrr1AI+MqkID2taHUclx7NYmmr3svgttec=
 github.com/luxfi/formatting v1.0.1 h1:ZnE1rAdEUds9yAegdVdGDOBGN6hLMPOv6E03Fp8IEYo=
 github.com/luxfi/formatting v1.0.1/go.mod h1:mYzNf5DJOiqSSKUPzNj5dKy4tstFbN3pZlkI5716eKc=
-github.com/luxfi/genesis v1.12.15 h1:Q1I7ZsvJ2DdaQTo8939whSjS7LaEjVaKLcpfbJQZy80=
+github.com/luxfi/genesis v1.12.19 h1:GwwbWOhiLcDJyM/17nI0s/sDaXN+PcZk9kjHYL9EFTo=
-github.com/luxfi/genesis v1.12.15/go.mod h1:D0uksf3ID3Syb4FU7EE77OU+yaU5zHSsUoUS5Ev8D/E=
+github.com/luxfi/genesis v1.12.19/go.mod h1:SoSMZgvGMXAzYN7c7a6DYomR4JnyHIouHpyzTi+WM0k=
+github.com/luxfi/genesis/pkg/genesis/security v1.12.19 h1:UjlMWUfoMB8P/VyxeSupz5klWcfpRYgjT6eulVju8K8=
+github.com/luxfi/genesis/pkg/genesis/security v1.12.19/go.mod h1:68FLxDptmJ3fYYwS6jGIYkoa0NWMWzYhTpusf0FMeDg=
 github.com/luxfi/geth v1.16.98 h1:w187TtKuGStf3tm2bshuHVKBv2Frjx0lT54kQVXyNHA=
 github.com/luxfi/geth v1.16.98/go.mod h1:6kEzSExdk9CPQDPXALt6P3HfQqBq7KF1Jrrv9gBpxbU=
 github.com/luxfi/go-bip32 v1.0.2 h1:7vFbb+Wr4Z499q2tuCLdd7wWjtn8sH+HWBlx76mhH9Y=

node/node.go

@@ -32,6 +32,7 @@ import (
 	"github.com/luxfi/database"
 	"github.com/luxfi/database/prefixdb"
 	genesiscfg "github.com/luxfi/genesis/pkg/genesis"
+	genesissecurity "github.com/luxfi/genesis/pkg/genesis/security"
 	"github.com/luxfi/ids"
 	"github.com/luxfi/log"
 	"github.com/luxfi/math/set"
@@ -1035,7 +1036,7 @@ func (n *Node) applySecurityProfile(pin *genesiscfg.SecurityProfile) error {
 		return nil
 	}
 
-	profile, err := pin.Resolve()
+	profile, err := genesissecurity.ResolveProfile(pin)
 	if err != nil {
 		return fmt.Errorf("genesis SecurityProfile failed to resolve: %w", err)
 	}

node/security_profile_test.go

@@ -11,6 +11,7 @@ import (
 
 	consensusconfig "github.com/luxfi/consensus/config"
 	genesiscfg "github.com/luxfi/genesis/pkg/genesis"
+	genesissecurity "github.com/luxfi/genesis/pkg/genesis/security"
 	"github.com/luxfi/log"
 )
 
@@ -82,7 +83,7 @@ func TestApplySecurityProfile_HashMismatchRejected(t *testing.T) {
 	if err == nil {
 		t.Fatal("applySecurityProfile accepted a wrong-hash pin")
 	}
-	if !errors.Is(err, genesiscfg.ErrSecurityProfileHashMismatch) {
+	if !errors.Is(err, genesissecurity.ErrSecurityProfileHashMismatch) {
 		t.Errorf("applySecurityProfile returned %v; want wrap of ErrSecurityProfileHashMismatch", err)
 	}
 	if n.SecurityProfile() != nil {
@@ -103,7 +104,7 @@ func TestApplySecurityProfile_UnknownProfileIDRejected(t *testing.T) {
 	if err == nil {
 		t.Fatal("applySecurityProfile accepted an unknown ProfileID")
 	}
-	if !errors.Is(err, genesiscfg.ErrSecurityProfileInvalidID) {
+	if !errors.Is(err, genesissecurity.ErrSecurityProfileInvalidID) {
 		t.Errorf("applySecurityProfile returned %v; want wrap of ErrSecurityProfileInvalidID", err)
 	}
 }