From 40ee439f36e2afb3c978d0214dd6b8319dfa9642 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 21:51:14 +0000 Subject: remake: a strict remake of a strict swarm isn't followed Review 3, R3: 1186 kept honest nodes from proposing or voting for a strict remake of a swarm strict already, but a majority of members, each with keys of its own, could still commit one, and switch and catchup followed it without asking what kind of remake made the epoch: the registry, policy and bans of a strict swarm changing by a member majority, the honest minority following. A node now refuses to switch to such an epoch (its document's policy strict, the remake's kind strict), and catchup refuses to rejoin one whose chain of epochs holds a strict remake after the swarm was strict (as the old document is, or once a remake since made it so). access.md says so. --- src/remake/switch.rs | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'src/remake/switch.rs') diff --git a/src/remake/switch.rs b/src/remake/switch.rs index bd40d72..df3fcc8 100644 --- a/src/remake/switch.rs +++ b/src/remake/switch.rs @@ -192,6 +192,18 @@ async fn switch( let translator = request .translator() .ok_or_else(|| format!("unknown remake kind {:?}", request.kind))?; + // A strict remake of a swarm strict already, committed by a majority of members + // anyway: not followed (`vote::strict_taken`, `catchup`). + if request.kind == "strict" + && host + .read_doc(|doc| crate::access::policy::of(doc).strict()) + .await + { + return Err( + "a strict remake of a swarm strict already: its registry changes by its users' signatures; not followed" + .to_owned(), + ); + } let late_translator = translator.clone(); let superseded = host.superseded(); let previous = request.previous; -- cgit v1.3.1