Governance Ladder

Five modes

Most cross-org coordination is Observation (cheap, no joint signature). Only the destructive minority requires Receipt-backed bilateral co-signing.

Per-action-class fields

The manifest declares, per action class:

• mode: Observation, Guarded, Receipt-backed, Partition-contingency, Maintenance.
• destructive: boolean. Destructive must be at or above the declared destructive_floor.
• cross_org_visibility.
• evidence_required.
• co_sign: none, bilateral_if_cross_org, bilateral_required, or n_of_m.
• partition_fallback (optional): with lease_kind, blast_radius_cap, and TTL.
• consistency_model: crdt-commutative, totally-ordered, or quorum-required.

Consistency model

Bilateral trees prove N parties signed but not that they signed consistently. A and B can co-sign credential X’s revocation at t=10 while B and C co-sign continued use of X at t=11, with both receipts independently valid. The fix is to declare consistency at the action-class level.

• crdt-commutative: deposits and observations whose merge is commutative and absorbs divergence. Bilateral trees are sufficient; partition-divergent co-signs converge automatically on reconnect.
• totally-ordered: actions that require a hash-chained ordering anchor (workflow steps, sequential capability grants). Bilateral trees plus an anchor reference catches divergence. Requires consistency_anchor set to hash-chain or chio-anchor.
• quorum-required: destructive actions that mutate shared state. The spec’s declared signature shape is a FROST-aggregated quorum signature over a canonical body, with quorum scope declared in co_sign_quorum and consistency_anchor: "frost-quorum". FROST aggregation is not yet implemented; the quorum tag is validated as a string today.

A ladder manifest that declares a destructive class as crdt-commutative is rejected at handshake (validation rule ladder.consistency_underspecified).

Full manifest example

A complete manifest spans the three consistency models. The ladder below mixes a CRDT-commutative pheromone deposit class, a totally-ordered capability grant, and a quorum-required revocation. Signature blocks are elided for brevity; in production the manifest body is signed under chio.federation.governance-ladder-manifest.v1#/$defs/signature.

schema: chio.federation.governance-ladder-manifest.v1
manifest_id: blueteam.cybersec.ladder.2026-05-04
participant_id: did:chio:blueteam-soc
domain: cybersec
ladder_version: 1.0.0
modes:
  - observation
  - guarded
  - receipt_backed
  - partition_contingency
  - maintenance
default_unmapped_mode: receipt_backed
destructive_floor: receipt_backed
ladder_refusal_policy:
  on_unknown_class: fall_back_to_default
  on_intersection_empty: refuse
  on_floor_disagreement: refuse
  on_alias_conflict: refuse

action_classes:
  # CRDT-commutative: stigmergic deposit, no anchor required
  - id: whisker.pheromone_deposit
    title: Whisker pheromone deposit
    mode: observation
    destructive: false
    cross_org_visibility: treaty_only
    evidence_required: [listing]
    co_sign: none
    consistency_model: crdt-commutative

  # Totally-ordered: capability grant, parent-hash chained
  - id: tom.capability_grant
    title: Tom capability grant (sequential)
    mode: receipt_backed
    destructive: false
    cross_org_visibility: treaty_only
    evidence_required: [trust_activation, workflow_receipt]
    co_sign: bilateral_required
    consistency_model: totally-ordered
    consistency_anchor: hash-chain

  # Quorum-required: cross-issuer credential revocation
  - id: pouncer.revoke_credential
    title: Pouncer RevokeCredential (cross-issuer)
    mode: receipt_backed
    destructive: true
    cross_org_visibility: federated
    evidence_required: [trust_activation, passport_presentation, anchor_epoch]
    co_sign: n_of_m
    co_sign_quorum: { n: 2, m: 3, scope: treaty }
    consistency_model: quorum-required
    consistency_anchor: frost-quorum
    partition_fallback:
      lease_kind: narrow_destructive
      blast_radius_cap: { unit: credential, max: 1 }
      ttl_secs: 600

signature:
  signer_key: ed25519:0x9c7b3f...
  alg: ed25519
  value: 0x7e2b1f3a...c104

The destructive_floor field binds the floor below which a class may not declare destructive: true. A manifest that violates the floor is rejected at handshake with ladder.destructive_downgrade. The partition_fallback on the revocation class is structurally permitted by the schema but forbidden at execution time for quorum-required classes (a quorum signature cannot be assembled under partition by definition); the block is retained here to illustrate the field shape.

Co-signed intersection record

At handshake, the two participants’ manifests are reconciled into a co-signed chio.federation.ladder-intersection.v1 record pinned to the FederationPeer record. The intersected mode is the higher-intensity of the two ladders per class, the intersected co_sign is the strictest, and the intersected consistency_model is the strictest (quorum-required > totally-ordered > crdt-commutative). Treaty scope only authorises classes present in the intersection.

schema: chio.federation.ladder-intersection.v1
intersection_id: int.blueteam-vs-treasury.2026-05-04
treaty_scope: treaty:cross-domain.incident-response.v1
left_manifest:
  manifest_id: blueteam.cybersec.ladder.2026-05-04
  participant_id: did:chio:blueteam-soc
  ladder_version: 1.0.0
  sha256: 5b41362bc82b7f3d56edc5a306db22105707d01ff4819e26faef9724a2d406c9
right_manifest:
  manifest_id: treasury.financial.ladder.2026-05-04
  participant_id: did:chio:treasury-cfo
  ladder_version: 1.0.0
  sha256: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
destructive_floor: receipt_backed
intersected_classes:
  - intersected_id: shared.deposit
    left_id: whisker.pheromone_deposit
    right_id: market.bid_publish
    mode: observation
    co_sign: none
    consistency_model: crdt-commutative
    alias_collapsed_from: []
  - intersected_id: shared.revocation
    left_id: pouncer.revoke_credential
    right_id: credentials.passport_revoke
    mode: receipt_backed
    co_sign: n_of_m
    consistency_model: quorum-required
    alias_collapsed_from:
      - cybersec.pouncer.revoke_credential
      - compliance.credentials.passport_revoke
produced_at: 1746710400
co_signature:
  left:
    signer_key: ed25519:0x9c7b3f...
    alg: ed25519
    value: 0x7e2b1f3a...
  right:
    signer_key: ed25519:0x4d5a92...
    alg: ed25519
    value: 0xb2c58e91...

Aliases collapse same-semantic classes published under different names across domains. If both sides declare cross-references and the references contradict, the handshake fails with ladder.alias_conflict. Classes present on only one side fall back to the other side’s default_unmapped_mode only when both refusal policies agree on fall_back_to_default; otherwise they drop from the treaty surface.

Verifier-owned workflow classes

Two action classes are layered over any participant profile by the verifier, not the participant, to compose a workflow package out of the pairwise vendor intersections above. Both are guarded and non-destructive.

• workflow.grant_issue: the verifier accepts one workflow grant as the parent of several pairwise vendor intersections.
• workflow.aggregate_publish: the verifier accepts a vendor co-signed aggregate workflow receipt as the workflow-level evidence object.

A strict Chio verifier trust bundle MUST include these product-owned class names. A non-strict manifest MAY carry a deployment-specific alias, but the alias does not satisfy strict workflow-package verification unless verifier-owned policy maps it to the product-owned class.

Validation rules

Every named rule below MUST be enforced by participants and surfaced verbatim in the governance finding it raises so a third party can replay the dispute deterministically. These are the spec-normative codes; the shipped chio-federation treaty path raises its own chio_federation_ladder_* equivalents.

Amendments

A published manifest is changed only by a co-signed amendment amendment record, schema chio.federation.governance-ladder-amendment.v1. Its change_kind is one of upgrade_only, mixed, or downgrade_only.

An upgrade_only amendment raises a class’s intensity (mode, co_sign, or consistency_model) and needs only the author’s self_signature plus federation-gossip notification; peers MUST adopt by rotation_deadline. A mixed or downgrade_only amendment — one that lowers any of those fields, removes a partition_fallback cap, widens cross_org_visibility, or weakens destructive_floor — MUST carry a peer_co_signatures entry from every peer with an active intersection referencing the manifest. A missing signature rejects with ladder.amendment_downgrade_unsigned; an amendment whose prior_manifest_sha256 is no longer current at any active peer rejects with ladder.amendment_stale.

Cross-domain example

A cybersec org (Blueteam SOC) and a finance org (Treasury) federate to coordinate response to a compromised payment-issuing agent. Both publish manifests. The cybersec ladder declares pouncer.revoke_credential as receipt_backed / n_of_m / quorum-required with a 2-of-3 FROST quorum. The finance ladder declares credentials.passport_revoke as receipt_backed / bilateral_required / totally-ordered with a chio-anchor.

Each side declares the other’s id under aliases. The intersection artefact takes the strictest co_sign (n_of_m 2-of-3 wins over bilateral_required), the strictest consistency model (quorum-required wins over totally-ordered), and the higher floor (receipt_backed on both sides, identical). The intersected class lands at shared.revocation with FROST quorum required and alias_collapsed_from listing both source ids. Treasury’s side runs the FROST signing-key share ceremony for that class even though its own ladder did not require it; the intersection rules climb, never descend.

For an observation-only class (cybersec whisker.pheromone_deposit vs finance market.bid_publish) the intersection lands at observation / none / crdt-commutative with no anchor. No joint signature is needed for the steady-state cross-domain telemetry exchange; only the destructive minority pays the FROST coordination cost.