@zanii/federation

Cross-ledger interop — what makes Zanii a protocol, not a service. A single transparency log has one residual trust assumption: the operator could show different histories to different people (a split view). Federation removes it, entirely client-side and offline-verifiable.

npm install @zanii/federation @zanii/core @zanii/witness

import { createWitnessPolicy, verifyFederatedSth, gossipOnce, buildEquivocationProof, verifyEquivocationProof } from '@zanii/federation';

// 1. The log publishes its own bar: "my checkpoints count only when M of these
//    named, independent witnesses co-sign them." Signed by the log's key.
const policy = createWitnessPolicy(
  { logId: log.did, witnessDids: [regulator.did, enterprise.did, competitor.did], minWitnesses: 2, createdAt: now },
  logKey,
);

// 2. Enforce it: origin signature + M DISTINCT recognised co-signatures.
//    Co-signatures from unknown DIDs are ignored, not trusted.
const r = verifyFederatedSth(sth, cosignatures, policy);
r.ok; r.valid_witnesses;

// 3. Gossip: fetch the checkpoint from several vantage points and compare.
//    Honest operation is boring — every view agrees.
const g = await gossipOnce(log.did, ['https://ledger.zanii.agency', 'https://mirror.example']);
if (!g.ok && g.equivocation) {
  // The artifact this package exists for: two validly signed STHs from the SAME
  // log key, SAME tree size, DIFFERENT roots. No innocent explanation.
  verifyEquivocationProof(g.equivocation);  // anyone re-checks it offline
}

Python: from zanii.federation import create_witness_policy, verify_federated_sth, gossip_once, ... — byte-identical JCS objects and hashes.

Why the equivocation proof matters

Everything else in a transparency log punishes rewriting history (consistency proofs, anchoring). Equivocation is the one remaining lie: maintain two internally consistent histories and show each victim only theirs. The proof is self-contained — two signatures, one key, one size, two roots — so a court or regulator needs no access to the log, no trust in Zanii, and no cryptographer to check what it means: the log signed two contradictory statements.

The limit, stated up front

Federation proves consistency between views, not completeness of coverage: a split view is caught only when the diverging checkpoints reach two parties who compare (gossip), and a witness policy is only as independent as its witnesses. What becomes impossible is quiet equivocation — lying to everyone identically forever is the only lie left, and anchoring already prices that one. Differing tree sizes across vantage points are NOT equivocation (could be honest growth between fetches) — run @zanii/monitor for append-only checking.