diff options
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 25 |
1 files changed, 24 insertions, 1 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 32d688b..a511093 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1687,7 +1687,29 @@ operationally. ### 7.6 Federation (MHP) -Peer hubs exchange directory rows and revocations. The trust rules: +> **Federation is closed in the code, and every MHP route refuses with a stated +> 503.** `federation.FEDERATION_ENABLED` is the only thing that decides it — a +> constant rather than a setting, because a switch in an admin panel invites an +> operator to turn on something that has never worked between two machines. +> `/v1/hub/info` reports it, since the `mhp_version` beside it would otherwise +> be a claim this hub does not honour. +> +> The reason is not the design below. It is that **nothing has ever run it**: +> two hubs have never completed one authenticated request between them +> (**AV14** — the issuer signed with a key bound before it was loaded and named +> itself after the reference deployment whatever it was called, and the verifier +> named no audience for the `aud` the issuer sets). Both were found by reading, +> and both stood for a month behind a green suite, because a second +> implementation of a peer proves the protocol and nothing about two machines — +> the sentence §12 already writes about a second implementation of the client. +> It re-opens when a second hub has been stood up and the exchange run both +> ways. +> +> What the closure does not touch: the public directory still reads whatever +> `federated_groups` holds, which is nothing, because nothing can arrive. + +Peer hubs exchange directory rows and revocations. The trust rules, which hold +when it re-opens: - a pushed row's **source is bound to the signer**, not taken from the payload; - the **token audience is checked**; @@ -2758,6 +2780,7 @@ account recovery, and the Windows port through packaging. | — | Tier 3 roster attestation (§3.3) | | — | Playlists (§9.10) | | — | Android client | +| — | **Federation between two hubs.** The protocol is written and switched off in the code (§7.6); what is not built is one run between two machines | ### 15.3 Open, and why each is where it is |