Summary / RFC
The maximally-autonomous federation in #2 should be permissionless and open: any institution that sees value can run a Warden node at its own premises and join the federation on the go. This issue specifies that membership layer and the emergent decentralization it produces.
This is not a bolt-on — it is the federation simply inheriting the protocol's own permissionlessness (and it matches our standing principle that the protocol is open, no exclusive partnerships). It is also what turns the autonomous design from "N nodes for which we synthesized independence" into "a living network whose independence becomes real as it proves useful."
Companion to #2 (autonomous federation / "no surviving controller"). #2 defines how nodes are born ownerlessly; this issue defines how the federation grows and stays decentralized over time.
The two-layer model
The flywheel from the institutional concept reappears — but opt-in and organic, not recruited/sold. Security grows as a byproduct of usefulness. Philosophically cleaner too: institutions are peers who join because the protocol earned it, not customers we onboard.
The trajectory (emergent decentralization)
autonomous keeper bootstrap → organically decentralized as institutions opt in → mature, self-sustaining, permissionless federation
Keeper-spun nodes can remain as a neutral permanent floor, or fade as genuine members take over. The honesty boundary: the guarantee is emergent over the journey. At any moment the strength is only as good as the current active set's real independence — bootstrap-strong early, very strong when many independent institutions across many jurisdictions participate. We claim what is true now, never the mature state on day one (same Version A→B discipline, expressed as a trajectory).
What "join on the go" actually requires
1. Dynamic / proactive secret re-sharing (hard requirement)
A threshold key is shared among a fixed set at DKG time. Admitting a new node means the existing members re-share the secret to a new (k, n′) set without ever reconstructing the key, and a threshold of current members must cooperate to admit the newcomer. Well-studied (proactive / dynamic secret sharing, CHURP-class), but it is a real protocol requirement: join-on-the-go is cryptographic churn, not "spin up a box and you're in." The same machinery handles members leaving / dying, and it is what makes the re-genesis cliff in #2 disappear (the federation continuously migrates itself).
2. Admission must be rule-based and immutable — never discretionary
The trap: if someone decides who may join, that someone is a governor, and we have reintroduced the governance surface we swore off (root invariant: zero protocol-/operator-layer governance). So admission criteria must be fixed in the immutable contract at deploy time — permissionless by rule, not by gatekeeper. Example rule shape: stake X + attest distinct hardware/jurisdiction + complete re-sharing → admitted.
3. Open join SHARPENS sybil-resistance (it does not remove it)
If anyone can join, an adversary can try to join with many nodes to reach a colluding/compellable threshold. So open membership makes the #2 sybil problem more central, not less. Proposed mixed admission policy:
- Identity-evident institutions → admitted on public reputation / real-world identity (their independence is self-evident).
- Anonymous / keeper nodes → admitted on stake + attestation + diversity proofs (distinct hardware, vendor, jurisdiction).
4. Churn safety
Membership churn must not be weaponizable:
- Mass-leave must not be able to drop the active set below
k and freeze delivery (violating "delivery is inevitable").
- Mass-join must not be able to dilute the set with correlated nodes to manufacture a colluding threshold.
- (k, n) must adapt safely as n changes; re-sharing cadence and admission rate-limits are part of the design.
Open questions
- Re-sharing protocol choice: CHURP / dynamic proactive secret sharing — which scheme, what cost per membership change, what liveness assumptions during churn?
- Immutable admission rule: what exact, externally-verifiable predicate admits a member without any discretionary gatekeeper?
- Mixed sybil policy: how do identity-evident institutions and anonymous keeper nodes coexist under one admission contract? Different tiers? different weights?
- Churn-attack bounds: rate-limits, minimum dwell time, bonding/slashing to make mass-leave and dilution-join uneconomic?
- (k, n) adaptation: how do thresholds scale as the federation grows from a handful of keeper nodes to many institutions, preserving both "no sub-threshold read/suppress" and "delivery is inevitable"?
- Emergent-strength disclosure: how do we surface to users/verifiers the current active set's real independence, so the claim always matches the present composition (D-031)?
- Floor policy: do keeper-spun bootstrap nodes stay as a permanent neutral floor, or sunset once organic membership crosses a threshold?
Honesty guardrails (carry into any spec/copy)
- The guarantee is emergent — only as strong as the current active set's genuine independence. Never claim the mature state early.
- Claim readability ("only for whom it is written" = who can read it), never metadata-invisibility (D-031). Open membership does not hide the existence/recipients/timing of a sealed delivery.
- Permissionless by rule, not by gatekeeper — admission logic is immutable; no discretionary curation, or we have recreated governance (root invariant;
docs/developer/protocol-family.md §9).
- No fiat references — wei/ETH-native ("stake X", "prepaid horizon" are illustrative, not fiat figures).
- This is operator/membership-layer autonomy. It must not introduce protocol-layer governance — the contracts stay immutable, zero-governance.
References
(Cross-references from working memory — confirm before relying on them.)
Summary / RFC
The maximally-autonomous federation in #2 should be permissionless and open: any institution that sees value can run a Warden node at its own premises and join the federation on the go. This issue specifies that membership layer and the emergent decentralization it produces.
This is not a bolt-on — it is the federation simply inheriting the protocol's own permissionlessness (and it matches our standing principle that the protocol is open, no exclusive partnerships). It is also what turns the autonomous design from "N nodes for which we synthesized independence" into "a living network whose independence becomes real as it proves useful."
The two-layer model
The flywheel from the institutional concept reappears — but opt-in and organic, not recruited/sold. Security grows as a byproduct of usefulness. Philosophically cleaner too: institutions are peers who join because the protocol earned it, not customers we onboard.
The trajectory (emergent decentralization)
Keeper-spun nodes can remain as a neutral permanent floor, or fade as genuine members take over. The honesty boundary: the guarantee is emergent over the journey. At any moment the strength is only as good as the current active set's real independence — bootstrap-strong early, very strong when many independent institutions across many jurisdictions participate. We claim what is true now, never the mature state on day one (same Version A→B discipline, expressed as a trajectory).
What "join on the go" actually requires
1. Dynamic / proactive secret re-sharing (hard requirement)
A threshold key is shared among a fixed set at DKG time. Admitting a new node means the existing members re-share the secret to a new (k, n′) set without ever reconstructing the key, and a threshold of current members must cooperate to admit the newcomer. Well-studied (proactive / dynamic secret sharing, CHURP-class), but it is a real protocol requirement: join-on-the-go is cryptographic churn, not "spin up a box and you're in." The same machinery handles members leaving / dying, and it is what makes the re-genesis cliff in #2 disappear (the federation continuously migrates itself).
2. Admission must be rule-based and immutable — never discretionary
The trap: if someone decides who may join, that someone is a governor, and we have reintroduced the governance surface we swore off (root invariant: zero protocol-/operator-layer governance). So admission criteria must be fixed in the immutable contract at deploy time — permissionless by rule, not by gatekeeper. Example rule shape:
stake X + attest distinct hardware/jurisdiction + complete re-sharing → admitted.3. Open join SHARPENS sybil-resistance (it does not remove it)
If anyone can join, an adversary can try to join with many nodes to reach a colluding/compellable threshold. So open membership makes the #2 sybil problem more central, not less. Proposed mixed admission policy:
4. Churn safety
Membership churn must not be weaponizable:
kand freeze delivery (violating "delivery is inevitable").Open questions
Honesty guardrails (carry into any spec/copy)
docs/developer/protocol-family.md§9).References
warden/CLAUDE.md,docs/developer/protocol-family.md§9 (no new governance surface).(Cross-references from working memory — confirm before relying on them.)