Consensus is the word peer-to-peer systems reach for when they need a group to agree on something. For a room (a chat space, a shared directory, a multiplayer game), the temptation is to reach for Raft, because Raft is the consensus algorithm people actually understand. Then the deployment reality arrives: your “servers” are laptops that sleep, browsers that close, peers behind NATs that drop in and out. Raft’s assumptions do not survive contact with that.
Valhalla’s room layer shows both the reasoning and the result. It uses real Byzantine consensus (Malachite, a Tendermint-family engine), but only where consensus is actually needed, with a private validator set, and with a durable journal between the engine’s decision and any acknowledgement. The interesting part is not which algorithm was picked. It is what the system decided consensus was for, and what it refused to let a certificate mean.
what consensus is for here
The first thing the workspace does is shrink the problem. The blockchain architecture plan (kb/plans/valhalla-blockchain-architecture.md) has a table that asks, for each claim, what primitive it needs and whether a global chain is required. Signatures, receipts, “these peers saw the same result,” membership changes: none of those need a worldwide order. Only two do: “this voucher has not been spent twice” (and only within its spending domain) and “every participant agrees on one worldwide order.” Everything else stays as signed evidence.
So what the rooms nodes run consensus on is narrow: a shared room directory (the registry of rooms, their records, their admitted state) where the validators are a known, private set. Chat messages do not go through consensus. Neither do social records, discovery hits, or attention notifications. The thing being agreed is a sequence of batches that mutate the registry, and the thing being agreed about is small enough that a handful of validators can decide it.
why raft can’t run on a room
Raft assumes three things a room of peers cannot promise.
Stable membership. Raft’s cluster is a fixed set; adding a server is a joint-consensus operation that itself requires the cluster to be alive. A room’s members are whoever is online. Valhalla’s rooms do not even try: the validator set is private and configured, not derived from who showed up.
A leader with a durable log. Raft’s leader owns the log for its term; followers trust its ordering and replicate it. A peer that sleeps mid-term, a partition that isolates the leader, a follower whose disk is a browser’s IndexedDB. Raft’s model has no room for “the leader is a laptop that closed.” Tendermint-family consensus replaces the leader’s authority with rounds of voting: proposers rotate, validators prevote and precommit, and a value commits when more than two-thirds of voting power signs it. No single peer’s durability is load-bearing.
Crash-fault, not Byzantine. Raft assumes failed nodes stop: they do not lie. A peer-to-peer room cannot assume that. A validator that signs two conflicting precommits is not crashed; it is adversarial. BFT consensus exists precisely for this: the quorum threshold (>2/3 voting power) tolerates up to a third of the set being wrong in any way: crashed, partitioned, or actively malicious.
what was chosen instead
The implementation is vhalla-rooms-node: Malachite engines (pinned to a specific commit of circlefin/malachite, the arc-malachitebft-* crates) on libp2p networking, deciding vhalla-rooms-consensus batches. The engine runs the full Tendermint stack: proposals stream in parts, validators prevote and precommit by round, and a CommitCertificate collects the signatures that crossed the quorum.
The part that is not the engine is the boundary around it. vhalla-rooms-consensus is the adapter between the engine’s Decided/Finalized events and the durable application state, and its rule is stated in the crate doc: the acknowledgement is emitted only after the journal commit and the store publishes succeed. The engine decides; the adapter decides whether the decision is durable. A certificate is a claim about a quorum. It is not, by itself, a commit.