Federation and trust
Selected peers, signed envelopes, and bounded convergence.
Explicit peer selection
Federation is disabled by default. Operators select peers, pin their keys, configure federation agreements and scopes, and provision a signing identity. Federation is not an unauthenticated network-wide broadcast.
Signed peer messages
Sync and federated discovery use SignedFederationEnvelope with message kind, sender/recipient, nonce, time bounds, and signed payload. These routes use peer-envelope verification rather than an ordinary bearer session. Lack of an OpenAPI bearer security entry does not mean that unsigned peer messages are accepted.
Conflict resolution
Incoming signatures must verify before conflict resolution. Among valid candidates, the policy prefers a matching locally confirmed anchor, then higher sequence, then lexically lower canonical digest. An unconfirmed external claim is not a confirmed local anchor.
Partial results
Federated discovery is bounded and returns metadata about participating or failing peers. A partial response is not a complete network snapshot. Monitor lag, circuit breakers, peer status, and agreement validity; see federation operations.
Source authority
This page describes the checked-in implementation, not the availability of a public registry.
mars-server/src/federation/envelope.rsmars-server/src/federation/service.rsmars-server/src/federation/policy.rsmars-server/src/federation/discovery.rs