Graph Verification

A child task is admitted, then revalidated before dispatch

Runtime admission resolves the stored bundle, compares the request’s evidence and route bindings with it, and runs the verifier at the live admission time.

The checks run in a fixed order: bundle, evidence references, route, authority, continuation, then the remaining admission gates. Route data comes from the caller’s metadata at admission and from the recorded chio_runtime.verified_swarm_route_metadata at revalidation. Bridge, protocol target, and selected route are compared in that order as exact, case-sensitive strings, and a mismatch refuses with chio_swarm_authority_rejected before the continuation is touched.

A single-use continuation id moves through unused, reserved, consumed, released, and unknown. A refusal before dispatch releases the reservation, so the token can be presented again. Presentations that share one coordinated store compete for the same marker before policy evaluation, and the loser is refused with chio_swarm_continuation_replay. When the consume returns an error or panics, the hook refuses the request, releases the treaty continuation it already took, and leaves the swarm id in place; inspect the stored marker before presenting the token again.

Read more in Continuation Tokens and Route Plans.

Six bindings turn a task graph into checked authority for each child

An authority bundle ties the signed graph to its delegation witnesses, continuation tokens, route and join receipts, budget pool, revocation epoch, and terminal graph receipt. Admission verifies those bindings together.

1. Signed graph limits. One root, acyclic, every edge target at exactly its parent’s depth plus one, with depth arithmetic that refuses overflow. The maxDepth and maxFanout ceilings sit inside the graph signature. Recursive task depth belongs to the delegation graph, never to cluster membership.
2. Per-hop attenuation witnesses. Each graph edge carries exactly one witness chain, with capability-digest and scope-hash continuity hop to hop, expiry checked against bundle time, a pinned issuer, and a machine-checked scope-subset proof.
3. A conserved budget pool. The pool splits across child tasks at fan-out and is reclaimed at fan-in. Each allocation’s reserved, active, consumed, released, and reversed units sum exactly to its ceiling; the ceilings sum to at most the pool total; the terminal graph receipt reconciles its rollup against the declared allocations.
4. Single-use continuations. A child runs only against a signed continuation token binding the graph digest, the parent or join receipt, the route plan, the budget allocation, the revocation epoch id and root hash, a session anchor, and a nonce. A token is single_use or resumable; the runtime reserves a single-use id in its admission store, and resumable tokens skip that step.
5. Task-level revocation. A signed epoch lists revoked subjects and revoked task ids with a validity window, and its root hash is bound into every continuation token. A stale epoch, or a revoked task anywhere in the graph, refuses the whole bundle.
6. Joint authorization. Two kernels sign one canonical body, so either organization verifies the chain without trusting the other alone. Action classes the governance ladder marks quorum-required escalate to a threshold signature over a pinned roster.

At the application level, a delegable grant states its ceilings as delegation: { depth: 2, fanout: 4 } on fork.grant, and children receive narrower grants within them.

Read more in Bilateral Co-Sign and Governance Ladder.

One verifier, nine schemas, and a signed negative for each refusal

chio-swarm-authority exposes a single entry point that fails closed. It holds no state and performs no I/O: every fact comes from the bundle or from the caller’s trusted witness key set, and the clock arrives as a field on the bundle.

pub fn verify_swarm_authority_bundle(
    bundle: &SwarmAuthorityBundle,
    trusted_witness_issuer_keys: &[PublicKey],
) -> Result<SwarmAuthorityVerifierReport, SwarmAuthorityError> {

Three callers reach it. chio-runtime-core calls it from the trusted pre-dispatch admission hook; chio-proof-room calls it on the untrusted-input public proof path; chio-cli calls it on the swarm arm of chio proof verify. An empty trusted key set refuses the bundle before any artifact is read, and a bundle with an empty continuation-token or witness-chain role is refused whole.

The schemas live under spec/schemas/chio-swarm/v1/, and eight of the nine artifacts carry a registered claim in spec/registries/proof-manifest.v1.json. The 11 signed negatives that chio proof fixture generate recursive-runtime-swarm --with-negatives writes each name the claim they break, the base fixture they mutate, and the failure code the proof room must produce, so a regression that accepts a broken bundle fails a test. The admission reference a swarm-bound dispatch binds to is fixed by spec/PROTOCOL.md section 6.4.2, Swarm Authority Runtime Admission.

The proof-room scenario accepts one bundle and refuses nine for their named reasons

The fixture bundles and their trust ship inside the installed chio, so the doctor needs no checkout and no setup. It verifies the valid bundle and replays every negative, and each must fail for its declared reason.

$ chio proof doctor --scenario swarm-authority

chio proof doctor swarm-authority
  [passed] swarm_recursive_delegation: transaction passport verified
  [passed] swarm_stale_continuation: transaction passport rejected
  [passed] swarm_budget_allocations_exceed_pool: transaction passport rejected
  [passed] swarm_graph_cycle: transaction passport rejected
  [passed] swarm_join_parent_set_mismatch: transaction passport rejected
  [passed] swarm_replayed_continuation_nonce: transaction passport rejected
  [passed] swarm_revoked_task: transaction passport rejected
  [passed] swarm_stale_route_plan: transaction passport rejected
  [passed] swarm_route_plan_mismatch: transaction passport rejected
  [passed] swarm_witness_child_scope_mismatch: transaction passport rejected
verdict: passed

You should see ten checks pass, nine of them refusals. A refusal reports passed when the bundle failed for the reason the scenario named: each entry in SWARM_AUTHORITY_CHECKS carries an expected_error substring, and a bundle refused for anything else reports failed for the wrong reason with both strings.

Build and verify a bundle yourself in Swarm Authority, which carries the downloadable Rust project and a kernel with swarm admission installed.

A broken binding stops the child before its tool runs

Bundle checks refuse with these codes in metadata.chio_runtime.failure_code, before the tool handler is called.

• missing_chio_swarm_authority_bundle: the referenced bundle is absent from the admission store.
• chio_swarm_authority_ref_mismatch: an evidence id, digest, or continuation route reference differs from the stored bundle.
• chio_swarm_authority_rejected: route metadata or authority verification fails.
• chio_swarm_continuation_replay: the selected store already reserved the single-use token id.
• chio_swarm_continuation_store_unsupported: the store lacks continuation consumption, so admission refuses the request.

The verifier checks nonce uniqueness within one bundle. Across bundles the store tracks single-use token ids, so a new token id that reuses an earlier bundle’s nonce passes the store check.

Read more in Swarm Denial Codes, which maps every verifier message to the check that produces it.

Verification bounds structure and authority, under keys the caller pins

An authority report is evidence about the supplied bundle at its evaluation time. Every signed artifact verifies against a key in the slice the caller passed, so the ceilings inside the graph signature bind the planner who signed them. The embedding host issues bundles with the crate’s issuance and budget lifecycle helpers and stores them for admission, and dispatch still depends on the live check.

The checks cover declared structure and authority: scope, depth, fan-out, budget arithmetic, route, expiry, and revocation. They judge no task’s intent, and a structurally valid bundle still faces the other admission rules. Budget conservation reconciles declared units against declared units; settlement is recorded by the Economy mechanisms. Reputation and the cost of a position in the swarm are the subject of Reputation and Scarcity.

Conformance covers recursive-delegation positive fixtures, generated malformed graph, budget, epoch, route, and terminal-rollup cases, and edge-dispatch checks for MCP, A2A, ACP-Client, OpenAI function-call execution, and OpenAPI bridge dispatch, as spec/PROTOCOL.md lists them. Listing or exporting swarm evidence leaves runtime authority unchanged.

Next: follow one scenario end to end