access: signatures required

"signatures": "required": a change counts only once a signature by its
committer vouches for it, and waits until then; every node then signs
every change it makes.

Auth plan M6.

1 files changed, 3 insertions, 1 deletions

diff --git a/docs/api.md b/docs/api.md
index c2b9cb4..5d94fac 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -261,7 +261,9 @@ A change left unsigned, such as a metric written many times a second, is vouched
 by the node's next signed one: with `--sign-every 1s` (the default), the node signs its
 latest change at most a second after it if nothing signed it before, so every change is vouched
 for within a second, at one signature a second at most; `--sign-every all` signs every
-change as it is made, and `--sign-every none` signs only those above.
+change as it is made, and `--sign-every none` signs only those above. A swarm whose policy requires
+signatures ([`access.md`](access.md), Changes judged on every node) has every change
+signed as it is made, whatever `--sign-every` says.
 Signatures travel with sync messages: a node passes on, for each node's writes, the
 latest signature it checked, and checks one it receives once it holds the change (a
 signature costs about 30 µs to check, and one per node and run vouches for the rest).