roots: an epoch's root pinned, and named in every handshake

Review 2, N7, the care it raised: a joining node's empty document took
as the first epoch's root whatever dependency-less change came first,
from whichever peer it joined through; the first epoch's ID is all
zeros, so nothing pinned it. A remake's epoch has its ID, the snapshot
change's hash, which the rules hold its root to.

* Every node names its epoch's root in HELLO and HELLO_REPLY (the
  epoch's ID for a remake's, its genesis change for the first; wire
  version 45). A node whose document starts from another root of the
  same epoch refuses the handshake, logging it: another history under
  the swarm's ID, a forged root or a genesis started again.
* A joining node with an empty document takes as its root only the one
  it was given (--genesis-root, new), else the one its peers name, and
  none while they name different ones (access::screen::RootPin, kept
  in Screening across documents): one peer hands it another root only
  if it is all the joiner hears, or never, with --genesis-root. A root
  refused is listed with the refused, what builds on it with it.
* The genesis node logs the root (`The swarm's root`); GET
  /admin/epochs shows it (`root`).

A genesis started again under a remembered swarm ID used to merge with
the nodes of it still running; they now refuse it (another root), and
the docs say to join them with seeds instead.

The epoch's identity stays as it is (generation 0 all zeros): records
and epoch metadata name it so, and every comparison of epochs with
them.

1 files changed, 14 insertions, 1 deletions

diff --git a/src/config/mod.rs b/src/config/mod.rs
index 0352832..f6d3e15 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -180,6 +180,13 @@ pub(crate) const OPTIONS: &[OptionSpec] = &[
         "With bootstrap-users: their SSH keys, as authorized_keys lines (ssh-ed25519 <base64> [comment], named by the comment), recorded in their entries: to log in by key and sign values (docs/access.md), so a swarm can be strict from its start.",
     ),
     option(
+        "genesis-root",
+        Kind::Text,
+        "HASH",
+        None,
+        "The hash of the swarm's genesis change (hex, as its genesis node logs it and GET /admin/epochs shows it): joining with an empty document, the only root this node takes. Without, the one its peers name, none while they name different ones (docs/access.md).",
+    ),
+    option(
         "strict-keys",
         Kind::List,
         "KEY,[KEY...]",
@@ -219,7 +226,7 @@ pub(crate) const OPTIONS: &[OptionSpec] = &[
         Kind::Flag,
         "BOOL",
         Some("false"),
-        "Start a new swarm, as its genesis node, instead of joining one through seeds. Every start with it starts another new swarm: drop it once the swarm exists, and give the node seeds instead. Can't be combined with seeds. With a --state-file that remembers a swarm, it starts that swarm again instead (empty; nodes of it still running merge with this one).",
+        "Start a new swarm, as its genesis node, instead of joining one through seeds. Every start with it starts another new swarm: drop it once the swarm exists, and give the node seeds instead. Can't be combined with seeds. With a --state-file that remembers a swarm, it starts that swarm again instead (empty, from a new root, which nodes of it still running refuse: to join them, give seeds).",
     ),
     option(
         "force",
@@ -601,6 +608,7 @@ pub(crate) struct Settings {
     pub(crate) bootstrap_users: Vec<String>,
     #[serde(default)]
     pub(crate) bootstrap_keys: Vec<String>,
+    pub(crate) genesis_root: Option<String>,
     #[serde(default)]
     pub(crate) strict_keys: Vec<String>,
 
@@ -881,6 +889,11 @@ impl Settings {
         {
             bail!("{why}");
         }
+        if let Some(root) = &self.genesis_root
+            && crate::swarm::roots::parse(root).is_none()
+        {
+            bail!("genesis-root: {root:?} isn't a change hash (64 hex digits)");
+        }
         if let Some(why) = self
             .strict_keys
             .iter()