access: a node judges its own changes before they leave

The API checks the path a request asks for; the rules judge everything
the change does. Where they disagreed, the honest node's change was
refused by every other node, and with signatures required the node was
refused as a whole. The plan had both gates run the same judgement.

Under a policy, each change a node makes (its own writes and those
through the API) is now judged by rules::judge as receivers will judge
it, before it is signed or sent; one every node would refuse is rolled
back (the document forked at the heads before it, same actor: the
change never left) and the request refused with 403 (StoreError::
Refused). rules::judge_held, judging a change the document holds,
moves from swarm::refusals to access::rules for both.

The simulations that play a member past its own checks write with a
helper that bypasses them (forge).

Review finding 3 (the same judgement at both gates).

1 files changed, 6 insertions, 0 deletions

diff --git a/docs/access.md b/docs/access.md
index 3bc824b..f533c5f 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -235,6 +235,12 @@ stays as it is, wherever it comes from later (a joining node catching up, say).
   a node, below). So a node registers before anything else it writes, through the API
   or its own: a change refused stays out with every change built on it.
 
+A node judges each change it makes the same way before it leaves, its own writes and
+those through the API alike: one every node would refuse is rolled back, never
+written, and the request refused (`403`, saying why). So a write the API's checks let
+through (they look at the path asked for, the rules at everything the change does)
+can't cut its node off.
+
 With `"signatures": "required"`, a change also needs a signature by the node it names
 ([`api.md`](api.md), Signed changes): every node then signs every change it makes, and
 one no signature vouches for yet waits, with whatever builds on it, until one does