From d322e7d4aa41d94232113cb7680cec1d65a11b0c Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: access: members refused as a whole With signatures required, a member whose own change broke a rule is refused as a whole: sent nothing, shown in /peers (refused), in stats (sync.refusedPeers) and on the dashboard, until a change of its is taken again or the epoch changes. Auth plan M6 (diverged standing). --- docs/access.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 567cebd..31efe4e 100644 --- a/docs/access.md +++ b/docs/access.md @@ -238,7 +238,15 @@ change stays out, and so does whatever builds on it; the node logs it (`Refused change`) and lists the last thousand (`GET /admin/refused`). Offered again, as its writer's node keeps offering what is never taken, it is refused by its hash, not judged or logged again, and a peer offering nothing else is answered later each time, up to a -minute apart. A change whose +minute apart. + +With signatures required, a member whose own change broke a rule (its signature proves +it its own) is refused as a whole: every node sends it nothing more, as all it commits +from then on builds on what was refused, and logs it once. It shows in `GET /peers` +(`refused`, with the change and why), in `/admin/stats` (`sync.refusedPeers`) and on the +dashboard. A node that only passed a refused change on isn't: the committer is, whoever +brought it. It lasts until a change of the member's is taken again (it rejoined and +writes anew), or the epoch changes; forgetting or banning it is the operators'. A change whose dependencies haven't come yet waits for them. What it doesn't do yet: -- cgit v1.3.1