# Federation and evidence guide Complete local Rust examples for Chio's public Federation & Compliance documentation. Apache-2.0. Rust 1.94.1; dependencies are locked in Cargo.lock. ## Build Extract this project anywhere. Cargo fetches its immutable public Chio dependencies: ```sh cd federation-guide cargo run --locked --bin handshake ``` Install Git, Rust/rustup, and a C/C++ toolchain. CLI workflows on the documentation pages additionally require Chio, jq, and OpenSSL. The first build compiles the kernel and its dependencies; subsequent examples reuse that build. Debug symbols and incremental compilation are disabled to reduce disk use. ## Run a mechanism Run these from this project directory. Programs that write files refuse to overwrite a run directory. Move an existing directory aside before repeating its workflow. ```sh cargo run --locked --bin handshake cargo run --locked --bin quorum -- quorum-report.json cargo run --locked --bin treaty cargo run --locked --bin packet cargo run --locked --bin revocation cargo run --locked --bin oversight -- approve cargo run --locked --bin oversight -- deny cargo run --locked --bin evidence cargo run --locked --bin activation cargo run --locked --bin open_admission cargo run --locked --bin reputation cargo run --locked --bin authority cargo run --locked --bin directory ``` `oversight` without an argument prompts for a local reviewer decision. Captured runs supply the decision explicitly. Invalid choices exit nonzero without dispatch. `quorum` accepts a report filename and returns nonzero for a rejected report. - `handshake`: expected peer key, addressed signed envelope, local nonce consumption, unknown-key and old-envelope refusals. Nonce state is process-local. - `quorum`: validator plus receiver policy floor and listing-digest agreement. The bundled report has declared ages, not newly authenticated network observations. - `treaty`: fresh signed manifests, pinned scope and intersection, admitted action, and changed-manifest refusal. Files in `treaty-inputs/` support the direct CLI steps. - `packet`: all five hash-only verifier inputs in `packet-inputs/`. The valid binding remains **unresolved**, since declared DSSE hashes are not supplied signed bytes. These are explicit illustrative artifacts, not execution or settlement evidence. - `revocation`: full subject-set/root comparison, freshness, monotone installation, and a real kernel refusal with the handler count unchanged. Local in-memory authority. - `oversight`: approval request, signed choice, action binding, once-only resolution, conditional kernel dispatch, and operator revocation. Local reviewer key/store. - `evidence`: two real allowed calls, one real denial, SQLite receipts, checkpoint batch size one, and `evidence-run/window.json`. No external service is contacted. - `activation`: contract validation of the reference activation exchange, then three refusals (no local activation, no manual review, unsupported schema). No trust is activated. - `open_admission`: reference policy validation, unslashable-bond refusal, two signed registry records and two evaluation requests under `open-admission-run/`. The page's transcript evaluates them against a local trust service. - `reputation`: reference clearing validation, duplicate-issuer refusal, no-local-weighting refusal, unsupported-schema refusal. - `authority`: profile, keys, request, and pins under `authority-inputs/`; issuance, checkpoint, and trust bundle in-process, then the same three through the CLI on the page; three refusals. - `directory`: signed directory bundle, verified once, refused three ways (version floor, validity window, untrusted key). The bundle is written to `directory-run/bundle.json`. The host implementation is in `src/lib.rs`. Read it before adapting the examples: keys and several admission stores are process-local even though receipts persist. The local review tool records its result in memory; its invocation count is checked. An approval refusal is retained as a signed reviewer decision, not mislabeled as an executed tool receipt. ## Transport examples The five complete Iroh examples live in the pinned public source checkout: ```sh git clone https://github.com/backbay-labs/chio.git chio-source cd chio-source git checkout 5b8bec41d32f3838b880576fe6123c983ecebf8d cargo run --locked -p chio-federation-transport-iroh --example admission_gate cargo run --locked -p chio-federation-transport-iroh --example pheromone_exchange cargo run --locked -p chio-federation-transport-iroh --example revocation_catchup cargo run --locked -p chio-federation-transport-iroh --example bilateral_cosign cargo run --locked -p chio-federation-transport-iroh --example fanout_gossip ``` They use local endpoints and deterministic example keys. Read the upstream examples README for receiver-adapter and direct-revocation reply boundaries. These local exchanges do not qualify a durable, partition-tolerant production mesh. ## Collect and review evidence Use the direct CLI commands on the Evidence Workflow section of the public docs. Reuse the exact `since`/`until` in `window.json` for export and samples. The example window is the current run, not a historical assessment period. A full Q1 2026 UTC window is inclusive from `1767225600` through `1775001599` when selecting an existing production store; this program does not manufacture historical records. Verify the package before review. Compare its signer with an independently trusted key. Assign an owner, document scope/applicability, and record gaps for each selected framework requirement. Cryptographic verification is a separate result from that operator assessment. Do not treat an empty or incomplete package as positive evidence. ## Retention Run `cargo run --locked --bin retention` in a fresh working directory. This installs a retention configuration, creates a checkpointed receipt, then explicitly archives it using a local demonstration cutoff. Verify the archive with the CLI workflow on the Colorado page. This exercises archival now; it does not establish a production retention schedule.