screen: a signature vouches for its change and what it builds on

Review finding 5: vouching by (actor, seq) isn't bound to a hash. A
member can make a change under another member's actor at a seq that
member's signature covers. The change is then taken as vouched, and if
it breaks a rule, the honest member is refused as a whole and logged as
the one whose own change broke the rules.

A signature now vouches for its change and the changes of its actor it
builds on: in the document, as before; among received changes, those
it reaches through the batch's dependencies. A received change under an
actor at a seq whose change the document holds (a signature verified up
to it) is a fork: refused as forged, never as its actor's node's, not
told back in REFUSALS, and logged with the peer that brought it.

1 files changed, 3 insertions, 0 deletions

diff --git a/src/swarm/sync.rs b/src/swarm/sync.rs
index ef2c1b3..ffdbf07 100644
--- a/src/swarm/sync.rs
+++ b/src/swarm/sync.rs
@@ -661,6 +661,9 @@ pub(crate) async fn handle_sync(
                             )?;
                             refused_again = outcome.refused_again;
                             roots = outcome.roots;
+                            if outcome.forged > 0 {
+                                tracing::warn!(peer = %peer, forged = outcome.forged, "A peer brought changes forged under another node's actor: refused");
+                            }
                         }
                         sync.receive_logged(doc, message, log)
                     })();