From e9813db05f2cc8590b785639a3c41ba60812909a Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 18:23:04 +0000 Subject: strict: no strict remake of a swarm strict already Review 2, N2: nothing checked that a strict remake's base wasn't strict already. In a strict swarm the registry, the policy and the bans change only as a user who may change them signs; a strict remake committed by a majority of members, each with keys of its own, could drop any of them (unban, remove managers, empty userSigned and the sealed declarations), and the honest minority would follow. A node now takes a strict remake (proposing or voting) only in a swarm not strict yet: turning strict is done once, by a remake; after it, by signatures. --- docs/access.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 03b70b8..d1f69e1 100644 --- a/docs/access.md +++ b/docs/access.md @@ -407,7 +407,9 @@ registry, the policy and the bans change only as a user who may change them sign ### Turning a swarm strict -A running swarm turns strict through a remake of its own kind, `strict`: compaction +A running swarm turns strict through a remake of its own kind, `strict`, once (a swarm +strict already takes none: its registry, policy and bans change by their users' +signatures, not by a majority of members): compaction that keeps, at the places values are signed (the registry, `_continuum/access`, the bans, the paths listed in `userSigned`), only the values an operator looked over and signed, and sets the strict policy. What was written after its base reaches the new -- cgit v1.3.1