docs: a design for a swarm kept by parties that don't trust each other

federation.md designs what the krebs registry needs of continuum: a
swarm several parties keep, any of them possibly malicious. Nothing of
it is built. It is a mode a swarm is started in: one that isn't
federated stays as it is.

* The parties, what an adversary can do, and what is promised to an
  honest node: only valid changes; the same document and the same
  resolved registry for the same changes; values signed by their users;
  one holder per name; a claim nobody takes once the root's node saw
  it; no waiting for anyone to write; and, with fewer than a third of
  the voters present malicious, decisions by two thirds of them. And
  what isn't: one history under a partition, a name never contested,
  decisions against a third, against keys stolen later, against a
  malicious voter on both sides of a long partition, or with half the
  voters gone; a swarm no forked actor splits.
* The design, on the strict policy. The policy is in the root. Users
  come by statements that only add; a user is its creation, its keys a
  tree, its nodes those it names. Vouching and the line; unvouching,
  with what exactly it takes back. A namespace per user. Names of
  declared kinds claimed, with rules and limits as data, some kept for
  a user without a claim. Of two claims out of each other's sight, one
  is late where its own side can be shown to have seen the other
  first; where that leaves not exactly one, the name is contested, and
  a release gives it up. Cuts: what a key signed outside a set of
  changes stops counting, whenever it shows up; a key is cut off by one
  above it only. Bans change what those who follow read, not what
  anyone takes.
* Decisions: votes signed by the voters, over days, by numbers the
  document holds and a decision changes. Who votes is in an epoch's
  root change: the root alone at first, then, with each remake, the
  users a root created, so nobody fills the votes without two thirds
  of those there agreeing. A time read from the document, by which
  those away for long don't count; a decision taken up by the voters'
  nodes while its votes run, and counting with two thirds of those
  present and more than half of all, so that honest voters never make
  two however long a partition lasts. The
  root's seat given anew by a decision, and what a root finds when it
  comes back. Remakes: the base is the decision's history, every node
  builds the snapshot from the registry as it resolves, statements are
  carried over, and what counted at the base is final. A change of
  policy as a fork each operator follows or not, as Bitcoin changes
  its rules; it may name who votes on its side, and is the way out
  for those a decision leaves behind.
* What every node judges and how the registry resolves, how a partition
  shows and how a side comes back, links along the line, tokens of
  one's own party only. Why the promises hold, the roads not taken,
  what members are trusted with then, what is continuum's and what the
  application's, 69 attacks with the tests that show them, the
  registry's layout with moving in and writing out, fourteen stages,
  and ten open questions with a choice for each.

future-work.md gets what the design leaves.

0 files changed, 0 insertions, 0 deletions