Spun out of CIRISPersist#408 (the infra-does-not-vote pin, now durable in persist's verify_coord.rs module docs per #407). The open threat-model question: QUORUM_WRITE_THRESHOLD = ⌈2N/3⌉ is a PBFT quorum for Byzantine voters, but regions carry no agency — a Byzantine region cannot forge a signed revocation, only withhold one (an availability/liveness fault orthogonal to the signature layer). If regions are cooperating replicas rather than mutually-adversarial authorities, a plain replication majority may be the honest durability model and ⌈2N/3⌉ is over-specified. Decision wanted in FEDERATION_THREAT_MODEL §3.3.2 before CIRISPersist#143 wires enforcement (which must enforce replication durability, never a vote, at whatever ratio this decides). Refs: CIRISPersist#408, CIRISPersist#407, CIRISPersist#143, CIRISVerify#77.
Spun out of CIRISPersist#408 (the infra-does-not-vote pin, now durable in persist's
verify_coord.rsmodule docs per #407). The open threat-model question:QUORUM_WRITE_THRESHOLD = ⌈2N/3⌉is a PBFT quorum for Byzantine voters, but regions carry no agency — a Byzantine region cannot forge a signed revocation, only withhold one (an availability/liveness fault orthogonal to the signature layer). If regions are cooperating replicas rather than mutually-adversarial authorities, a plain replication majority may be the honest durability model and ⌈2N/3⌉ is over-specified. Decision wanted in FEDERATION_THREAT_MODEL §3.3.2 before CIRISPersist#143 wires enforcement (which must enforce replication durability, never a vote, at whatever ratio this decides). Refs: CIRISPersist#408, CIRISPersist#407, CIRISPersist#143, CIRISVerify#77.