The gap. The v6.8.0 membership-change (verify_accord_membership_change, #95) requires the prior roster's strict-majority quorum to authorize any roster change. That's correct for normal grow/shrink/swap — but it deadlocks under catastrophic loss: if a 3-holder accord loses 2 holders (e.g. a plane crash), the lone survivor cannot reach the prior 2/3 to shrink to 1/1, to swap in the dead holders' spares, or to recruit new holders. The accord becomes permanently unusable exactly when recovery is most needed. Distributing spares does not fix it — activating a dead holder's spare is itself a supersedes needing the prior quorum.
(Note: M-of-N degenerate end-states like 1/1, 2/2 are valid and intentionally allowed — strict-majority 2·M > N. The problem is not the end state; it's that there is no authorized path to reach it once the prior quorum is gone.)
Required: a recovery path that bypasses the unreachable prior quorum — grounded, not ad-hoc (it is a deliberate quorum-bypass on kill-switch membership, so it needs adversarial review + constitutional grounding before any code).
Candidate mechanisms to evaluate:
- Steward-attested recovery (recommended starting point). The 3 regional stewards (us/eu/apac) already §6-cross-attest the accord identities and are the upstream trust root the accord is rooted in (per the fractal-self framing: cross-attestations are upstream of self-attestation). On proof of holder loss, a steward quorum co-signs a recovery
supersedes in place of the dead prior quorum. Reuses the existing trust structure; no new principal. Open Qs: steward threshold (2-of-3?), what counts as "proof of loss," does the recovered roster require re-attestation.
- Timelock + survivor + public broadcast. A below-quorum survivor proposes a recovery; a mandatory delay + public CEG broadcast window lets anyone object; absent a valid objection it takes effect. Trades latency + transparency for availability. Open Qs: delay length, who can veto, replay/grief resistance.
- Pre-signed conditional recovery (dead-man's switch). Holders pre-sign conditional supersedes that activate on attested death/incapacity. Fragile (pre-commits to a future roster), but quorum-faithful.
Likely outcome: (1) as the primary, possibly with (2) as a transparency wrapper. None should ship without: a written constitutional basis (this is a §9 governance change), an explicit entrenchment-preservation proof (recovery must not let a steward quorum weaken the accord or seize it — only restore a working roster), and an adversarial review on par with #91/#95.
Blocks nothing in v6.8.0 (normal ops work); this is the resilience gap. Related: #95 (membership change), CIRISServer#41/#61 (gate). Raised by the maintainer (the plane-crash scenario).
The gap. The v6.8.0 membership-change (
verify_accord_membership_change, #95) requires the prior roster's strict-majority quorum to authorize any roster change. That's correct for normal grow/shrink/swap — but it deadlocks under catastrophic loss: if a 3-holder accord loses 2 holders (e.g. a plane crash), the lone survivor cannot reach the prior 2/3 to shrink to1/1, to swap in the dead holders' spares, or to recruit new holders. The accord becomes permanently unusable exactly when recovery is most needed. Distributing spares does not fix it — activating a dead holder's spare is itself asupersedesneeding the prior quorum.(Note: M-of-N degenerate end-states like
1/1,2/2are valid and intentionally allowed — strict-majority2·M > N. The problem is not the end state; it's that there is no authorized path to reach it once the prior quorum is gone.)Required: a recovery path that bypasses the unreachable prior quorum — grounded, not ad-hoc (it is a deliberate quorum-bypass on kill-switch membership, so it needs adversarial review + constitutional grounding before any code).
Candidate mechanisms to evaluate:
supersedesin place of the dead prior quorum. Reuses the existing trust structure; no new principal. Open Qs: steward threshold (2-of-3?), what counts as "proof of loss," does the recovered roster require re-attestation.Likely outcome: (1) as the primary, possibly with (2) as a transparency wrapper. None should ship without: a written constitutional basis (this is a §9 governance change), an explicit entrenchment-preservation proof (recovery must not let a steward quorum weaken the accord or seize it — only restore a working roster), and an adversarial review on par with #91/#95.
Blocks nothing in v6.8.0 (normal ops work); this is the resilience gap. Related: #95 (membership change), CIRISServer#41/#61 (gate). Raised by the maintainer (the plane-crash scenario).