Reputation & Scarcity

Two cost lines

An attacker facing this rung is buying one of two things, and the two are defended by different machinery.

The first is a position inside a delegation graph you already authorized: more depth, more fan-out, more spend, a replayed hop, a route to somewhere the plan did not name. That line is bounded by fields inside signatures, checked by a pure function on every admission. Defending it costs the operator nothing per request beyond the verification, and breaking it requires forging a signature rather than outspending a budget.

The second is influence over a coordination signal: pheromone deposits, reputation feeds, the inputs that shape which peer gets picked next. That line is bounded economically, and economics move rather than eliminate cost. It is the softer of the two and the rest of this page spends most of its length there, because it is where an honest analysis has something to admit.

What the signed structure bounds

Six bounds carry the structural line. Each is enforced in chio-swarm-authority or in the chio-runtime-core admission path, each has a signed negative fixture behind it, and each stops somewhere specific.

The size of the graph you signed

Depth and fan-out are separate fields, and neither alone bounds how much work a graph can authorize. Together they do. The task count a signed graph can hold is the size of a fan-out-ary tree of that height, and because both numbers live inside the signature, an attacker who wants a larger one needs a different signature.

# D = maxDepth, F = maxFanout, both fields of the signed task graph.
# The verifier rejects any node with depth > D and any parent with
# more than F outgoing edges. Every non-root task names exactly one
# parent and that edge must exist, so the parent pointers form an
# F-ary tree of height at most D. Fan-in edges into a join spend the
# same fan-out budget, which makes the bound conservative.

tasks_max = (F^(D+1) - 1) / (F - 1)    for F > 1
tasks_max = D + 1                      for F = 1

# Worked: D = 3, F = 4  ->  85 tasks.
#         D = 4, F = 4  ->  341 tasks.
#         D = 3, F = 8  ->  585 tasks.
#
# Spend is bounded separately and additively: the sum of every
# allocation ceiling must not exceed the pool's totalUnits, whatever
# the task count.

The practical consequence is that recursion depth is a policy dial an operator sets once, at issuance, in a field an attacker downstream cannot touch. That is a stronger property than a runtime recursion limit, which lives in the process that is already executing the attacker’s work.

What the structure does not bound

• A compromised pinned key. Every artifact verifies against the caller-supplied trusted witness issuer key set. One compromised key in that slice forges graphs, continuations, witnesses, routes, epochs, and terminal receipts alike. The structural bounds constrain a planner, not a signer.
• Issuance. The crate ships mint_* and sign_* constructors as fixture helpers. No production code path in the workspace calls them. Whatever decides that a delegation should be authorized in the first place is the operator’s, and this rung says nothing about it.
• A delegate that stays inside scope. Attenuation proves that a child capability is a subset of its parent. It does not judge the subset. An attacker who obtains a legitimately narrowed capability and uses exactly it produces a clean bundle every time.
• Settlement. The budget pool reconciles declared units against declared units in one currency string. It bounds what a graph is authorized to spend, and it is the Economy area that answers what actually moved.
• Anything outside the conformance surface. spec/PROTOCOL.md section 6.4.2 states the covered surface explicitly and calls it bounded. Listing or exporting swarm evidence does not widen runtime authority.

The soft line: coordination signals

Coordination signals are the read path. A deposit does not authorize an action; it weights a choice. That is why the defence here is economic rather than structural, and why the honest answer is a cost curve rather than a bound.

Four mechanisms ship in chio-pheromone, and each raises a named error rather than silently downweighting.

• Per-kernel passport cap. ceil(sqrt(active_peers_in_treaty)) distinct passport keys per origin kernel, per window, per treaty, per subject class. Exceeding it raises sqrt_n_passport_cap_exceeded.
• Per-window token bucket. A scarcity bucket keyed by reputation epoch, window, treaty, and subject class, capped at the admission record’s token_capacity. Exceeding it raises rate_limit_exhausted.
• Per-pair source cap. max_deposits_per_pair bounds how many deposits one kernel and passport pair contributes to one subject class in one window. Exceeding it raises diversity_cap_exceeded. It bounds volume from a single source. It makes no claim about whether two sources are independent.
• Newcomer discount and observation cost. A newcomer age-discount horizon, with a spec default of N = 8 epochs, plus an observation-cost commitment that is required by default for any subject class the ladder manifest declares destructive. The commitment is verified against a signed, revocable verifier root with a leaf and inclusion check, so signing without originating has to forge a telemetry chain rather than assert one.

Downstream, chio-reputation weights an eight-metric LocalReputationScorecard (boundary pressure, resource stewardship, least privilege, history depth, specialization, delegation hygiene, reliability, incident correlation) and exposes a discrete tier_0 through tier_3 ladder. tier_3 requires a composed score at or above 0.90, a per-feed minimum on every feed, and evidence from at least two distinct feeds counted by feed id. That last clause is the Sybil gate: many deltas from one feed cannot reach the top tier.

The sqrt(N) cancellation

The passport cap is the mechanism most often mistaken for a Sybil deterrent. It is not one, and the pheromone spec says so in writing. The algebra is short enough to show.

Let P be the number of honest peers, K the per-pair deposit cap per window, and S = ceil(sqrt(P + A)) the per-kernel passport cap. An adversary running A distinct operator organizations presents A * S passports, because the cap binds per origin kernel rather than globally.

# Adversarial mass fraction
f = A * S / (P * K + A * S)

# Safety condition f < 0.30, approximating sqrt(P + A) ~ sqrt(P)
# for A << P:
A * S < 0.30 * (P * K + A * S)
A_max ~= (3/7) * P * K / ceil(sqrt(P))

# Adversary spends C per passport and runs S passports per org:
B_min ~= A_max * S * C
      ~= (3/7) * P * K / ceil(sqrt(P)) * ceil(sqrt(P)) * C
      ~= (3/7) * P * K * C

# sqrt(N) cancels. The cap reduces passports per org; the adversary
# stands up O(sqrt(P)) orgs to compensate. The dollar threshold does
# not move.

The cap is a cost-shifter, not a cost-reducer, and tightening it to log(N) would buy nothing. The reasons it is nonetheless mandatory are forensic. It forces the attacker’s operator-organization admissions onto the federation handshake surface, where they are visible artifacts an out-of-band governance process can sanction. It stops a single compromised kernel from mass-minting passports without leaving a footprint. Operator-organization admission is a harder budget line to scale than key issuance, because shell entities, registered agents, roster fees, and audited financials all price per organization rather than per key.

Adversary cost model

Everything below this heading is docs-team modelling. It exists to make the shape of the cost curve arguable, not to be quoted as a Chio figure. It is deliberately conservative: it credits no reputation weighting, no revocation gossip latency, and no arena replay scoring, all of which favor the defender.

Order of effect, same caveat: the substrate caps shift roughly 6x to 12x of cost over the bare baseline, a newcomer multiplier of 2x to 4x times an observation-cost multiplier around 3x. The scorecard and tier ladder compound on top of that and resist closed-form modelling, because the distinct-feed gate at tier_3 hits Sybil clusters directly rather than continuously. Arena replay compounds again. The closed form captures only the first layer.

Where the bound stops holding

Three attacks are defended imperfectly on the signal line. Each is written down rather than papered over, and each escalates out of the protocol layer.

Sustained majority collusion

Cheng and Friedman (PODC 2005) and Fang et al. (USENIX 2020) both show that no symmetric weighting survives once more than roughly half of effective passport mass, not peer count, is adversarial under a coordinated strategy. Mitigation is exogenous: bilateral handshake admission has to keep effective adversarial mass low enough that the weighting still means something.

• Tighten handshake admission per treaty. Require a published roster source rather than operator-mediated key exchange for treaties whose action classes sit at or above a receipt-backed destructive floor.
• Audit operator-organization admissions out of band on a published cadence. A governance sanction against an issuing organization collapses every passport admitted under it at once.
• Accept only roster sources whose admission gates have published appeals and revocation processes, so the upstream anchor is itself contestable.

Slow drift below sensor noise

Generated deposits can be made indistinguishable from honest ones inside any single window. Arena replay catches them only where arena coverage overlaps the mimicked subject class. Residual loss in uncovered classes has to be accepted and budgeted rather than assumed away.

• Expand arena coverage on a published cadence, and declare uncovered subject classes explicitly in the ladder manifest so consumers can weight their queries accordingly.
• Require observation-cost commitments on destructive classes without exception. Mimicry then has to forge a telemetry chain that survives the leaf and inclusion check, which is the m_oc multiplier above.
• Lean on the incident-correlation and reliability metrics and the discrete tier gate, so a slow-drift attacker has to hold a high tier across many windows and clear the distinct-feed gate before its deposits carry full weight.

Friendly re-issuance across organizations

If two distinct operator organizations cooperate to re-issue passports for sanctioned operators, no in-band function detects it. Out-of-band governance is the only recourse, and the case has to be brought against the issuing organization rather than the passport.

• Publish an operator-organization admission audit cadence per treaty and bind it into the ladder manifest, so an anomalous spike in admissions becomes a triggering event rather than a discovery.
• Hold roster issuers to a published key-rotation cadence and appeals process, so re-issuance against a sanctioned operator surfaces in audit logs the issuer cannot suppress.
• Track which operator organizations are admitted to multiple rosters and report the overlap as a routine line, not a one-off investigation.

References

• Cheng and Friedman, “Sybilproof reputation mechanisms,” PODC 2005. Cited in the sqrt(N) derivation and the sustained-majority residual.
• Hoffman, Zage, and Nita-Rotaru, “A Survey of Attack and Defense Techniques for Reputation Systems,” ACM CSUR 2009. The taxonomy underpinning the cost model.
• Fang et al., “Local Model Poisoning Attacks to Byzantine-Robust Federated Learning,” USENIX 2020. Cited alongside Cheng and Friedman in the sustained-majority residual.
• Rung context: Swarm Overview for the artifacts and claims the structural bounds are checked against, and Pheromone Store for the deposit format the signal line operates on.