Alarm
Purpose
The record of the system catching a lie. The swarm cannot be prevented from misbehaving — it is outside the trust boundary — but it can be caught: tamper-evidence is not tamper-prevention, and the alarm is the evidence, raised on the member's device where nothing can suppress it. A substitution alarm says the record forked — two group revisions claiming the same parent, where a lineage is a chain and only the founder mints. An impossible delivery alarm says a key arrived for an epoch its recipient was never let into — something upstream lied. Tampering is a recognised kind the baseline does not raise: with content-addressed cells an altered unit is simply a different unit, so what would be tampering surfaces instead as a missing timeline entry; the kind is kept for the transport and trust evolutions that can raise it.
Attributes
- kind: is one of "substitution", "impossible delivery", "tampering" that names what was caught
- subject: is
Textthat names what the alarm concerns — a lineage, a key id, a sub - evidence: is
Textthat carries what was seen — the proof itself, never a paraphrase
Invariants
- The kind is recognised.
Scenarios
A substitution alarm over a forked lineage
Given: kind "substitution", subject "g-7421", and evidence "g-7421.4 and g-7421.4b both name parent g-7421.3" When: an Alarm is created Then: it is accepted as a substitution alarm concerning "g-7421" carrying that evidence
An impossible-delivery alarm over a misdirected key
Given: kind "impossible delivery", subject "k-0264", and evidence "delivery for karin.dahl; revision g-7421.4 does not name her" When: an Alarm is created Then: it is accepted as an impossible-delivery alarm concerning "k-0264"
An unrecognised kind is rejected
Given: kind "weather", subject "g-7421", and evidence "unseasonal rain" When: an Alarm is created Then: the creation is rejected because the kind is not recognised