Chio/Docs

LearnActors & Federationnew

Federation & Swarms

Federation coordinates separate kernels. Swarms use signed, decaying signals for coordination that does not require consensus.

Federation and Swarm Coordination

Federation applies when one Chio deployment cooperates with another organization's deployment. The two kernels have separate operators and no assumed trust relationship. Swarms address a different problem: many agents may produce coordination signals more frequently than a consensus protocol should settle them. The governance ladder classifies cross-organization actions and provides a route from a pheromone signal to a signed receipt when an action becomes consequential. See the Trust Model for the zero-ambient-authority stance both rest on.

Bilateral Co-Signing

Two kernels can independently commit to the same canonical action with a DualSignedReceipt. This bilateral DSSE envelope carries both organizations' signatures over one canonical payload. It is implemented in the chio-federation crate.

chio.bilateral-cosign-invocation.v1 is an in-toto working-group proposal. It represents two organizations jointly committing to an action, whereas a single-signer attestation represents one signer's statement. The proposal is not a finalized standard.

The Governance Ladder

The configured action classes map to five rungs: observation, guarded, receipt_backed, partition_contingency, and maintenance. Higher rungs require additional checks before the action can proceed.

RungWhat it costs
observationVisibility only. No action commitment and no counterparty signature required.
guardedLocal guard checks apply, but still no cross-org signature required.
receipt_backedThe action is not considered settled until it produces a signed receipt.
partition_contingencyPermitted only under a contingency plan the peers pre-negotiated for a network partition.
maintenanceReserved for operations that change the federation relationship.

During the handshake, two kernels reconcile their configured ladders into a co-signed LadderIntersection. If the ladders assign different treatment to an action class, the peers reject that class.

FROST quorum signing is unsupported

FROST threshold signatures would provide n-of-m co-signing for action classes that require a quorum. Chio does not implement FROST signing. The ladder specifies quorum-required classes, but they cannot currently be signed.

Optional iroh Transport

ADR-0014 identifies iroh as a federation transport. It uses QUIC and domain-separated endorsements so a key authenticated for one transport context cannot be reused for another context.

Feature-gated transport

iroh is built and tested behind the --features iroh Cargo feature. It is not included in the default build. A CI check verifies that the feature does not enter that build.
bash
cargo build --features iroh

iroh authenticates a transport key. Authorization, treaty scope, quorum, and revocation checks run above the transport. Changing or disabling iroh does not move those checks.

Pheromone Signals for Swarms

The chio-pheromone crate provides PheromoneDeposit, a signed swarm signal that decays over time. It is intended for coordination that does not require consensus.

Deposits accumulate, decay exponentially, and expire after their concentration drops below a configured floor:

rust
// s(t) = confidence * 2^(-elapsed / half_life)
fn concentration(confidence: f64, elapsed: f64, half_life: f64) -> f64 {
    confidence * 2f64.powf(-(elapsed / half_life))
}

Each deposit is signed with the depositing agent's PASSPORT signing key. It is not an Agent Passport credential, and the kernel does not sign it. query_concentration returns a peer-weighted, decayed sum of live deposits for a claim. The query does not require a consensus round.

Signal and Receipt Paths

Pheromone deposits are signed, decaying signals for swarm coordination. Receipt-backed governance records signed commitments for consequential actions. The governance ladder identifies when an action requires the latter path.

Pheromone signals are not reputation inputs

The pheromone deposit cap requires new operator-organization admissions for deposits above the cap. It does not eliminate the cost of a Sybil swarm or independently provide Sybil resistance. Reputation scoring uses signed receipts as inputs. A pheromone signal is not an Agent Passport credential or supporting record.

Possible Multi-Operator Sharing

Cross-organization finding and status feeds are a potential use of the iroh transport. A shared transport could allow one organization to share a finding with another, subject to federation policy. See the Cognition Market for the proposed market model.

Next Steps

PreviousTrust ModelNextModel Cards