G-006 — Adopt R-215 Gossip Discipline

Status: drafted → reviewed → accepted → closed.
Author: driver-claude
Date: 2026-05-06

1. Job of this gate

Original platform §3.2 defined PEER_EXCHANGE and ENVELOPE_GOSSIP without bootstrap pinning, peer diversity, anti-eclipse cross-checks, or anti-entropy repair. Per audits/manthan-platform-review.md §7-F2, §7-F10: this is eclipse-attack-vulnerable from minute one.

G-006 adopts research/genesis-gossip.md (R-215) as the gossip-discipline foundation, and adds the Manthan-specific anti-entropy repair primitives that R-215 deliberately left to deployments.

Gossip is NOT used by the MVP wedge (G-001). This gate's deliverable matters from Phase 3 onward.

2. Adopted from R-215 (verbatim)

R-215 specifies three layers; Manthan adopts all three:

2.1 Layer 1 — CT-log query endpoint

Every conformant Manthan-Herald MUST support GET /trace_genesis/<trace_id> returning all candidates per R-215 §3.1. The reference Herald already does this in spirit; G-006 makes it normative for Manthan deployments.

2.2 Layer 2 — Cross-log gossip

Heralds SHOULD propagate (trace_id, envelope_id) tuples via:

DNS-TXT at _herald-trace.<trace_id>.<log-domain>
P2P gossip via MWP INVENTORY frames (per G-005)
Cross-publication of peer logs' STH digests

2.3 Layer 3 — Joiner discipline

A new joiner observing a non-genesis envelope E MUST query at least two independent Manthan-Heralds for /trace_genesis/<E.trace> before pinning a genesis. Verifiers configurable to query 3+ for high-stakes traces.

3. Manthan additions on top of R-215

3.1 Bootstrap seed trust

A Manthan node bootstraps from a seed list: a signed JSON document declaring the well-known Heralds the deployment trusts on day-0.

Format:

{
  "version": "manthan-bootstrap-1",
  "issued_at": <Unix seconds>,
  "valid_until": <Unix seconds, ≤ 90 days>,
  "seeds": [
    {
      "sigil": "sigil:...",
      "endpoint": "https://herald.example.org/",
      "charter_url": "https://herald.example.org/charter",
      "jurisdiction": "EU/IE",
      "ownership_cluster": "independent_foundation"
    },
    ... ≥ 3 seeds, MUST span ≥ 2 jurisdictions and ≥ 2 ownership clusters ...
  ],
  "issuer_sigil": "sigil:bootstrap-authority...",
  "signature": { "alg": "ed25519", "sig": "<hex>" }
}

Issued by a bootstrap authority: a long-term sigil whose pubkey is shipped with the Manthan node software (analogous to TLS root CAs). Updated quarterly; new seed lists supersede old ones if signed by the same bootstrap-authority sigil and have higher issued_at.

Diversity requirement. A bootstrap list with all seeds in one jurisdiction or one ownership cluster is non-conformant per audits/systemic-risk-matrix.md SR-001. Joiners MUST refuse to bootstrap from a single-jurisdiction list.

3.2 Peer diversity policy

After bootstrap, a Manthan node maintains a peer set. Peers learned via PEER_EXCHANGE are accepted only if:

They have a Charter signed within the last 12 months (per [EXT §3.5] freshness rule).
The current peer set's diversity, after adding this peer, satisfies:
No more than 50% of peers from one jurisdiction.
No more than 50% of peers from one ownership cluster.
At least 1 peer from a non-aligned jurisdiction (where "aligned" is operator-defined).
The peer's claimed Patina (per G-003) is independently computable from the CT log, and the diff between its self-reported Patina and the local-Herald-computed Patina is < 10%.

Peers failing diversity policy are kept as fallback candidates but not used for active gossip.

3.3 Anti-eclipse cross-checks

Before trusting any envelope received via gossip:

Verify against the joiner's pinned root-of-trust per R-215 layer 3.
For state-significant envelopes (birth, molt, deprecation, lineage_endorsement), confirm the SIP is observable from ≥2 independent Heralds in the joiner's peer set.
Periodically (every 6 hours), refresh the latest STH from each peer; alert on STH divergence (forked-log signal).

If <2 independent Heralds confirm a state-significant envelope, the receiving node treats it as unverified-pending-quorum and queues it; if quorum is not achieved within 24h, the envelope is dropped and a warning surfaced per AC-6.

3.4 Anti-entropy repair

Even with healthy gossip, peers' local views drift. Manthan adds three primitives:

3.4.1 Inventory exchange

Periodic (every hour, jittered by hash(sigil) mod 3600s):

INVENTORY frame
  payload := {
    "log_id":           <bytes>,
    "tree_size":        <uint64>,
    "sth_digest":       <32 bytes>,
    "trace_summaries":  [
      { "trace_id": <bytes>, "leaf_count": <uint>, "latest_envelope_id": <bytes> },
      ...
    ]
  }

Allows peer to identify traces it doesn't have or has staler views of.

3.4.2 Hash-range or Merkle summaries

For deeper diff, peers exchange Merkle subtrees over their envelope sets. Format borrowed from lib/herald-ct-log/src/merkle.ts.

3.4.3 GET_ENVELOPES by hash/range

GET_ENVELOPES.payload := {
  "log_id":           <bytes>,
  "envelope_ids":     [ <bytes>, ... ]   (max 256 per request)
}

Reply is a ENVELOPE_GOSSIP batch.

3.4.4 CT checkpoint reconciliation

When two peers disagree on STH at the same tree_size, both query the other's claimed STH from the log directly (bypassing gossip). If divergence persists, the log is forked; both peers stop accepting envelopes from that log per [EXT §2.5].

4. TTL and dedupe parameters (closes §7-F14)

TTL: 8 hops max. Frames carry a ttl: uint8 field; decremented at each gossip hop; dropped at 0.
Dedupe cache: Per envelope-id, LRU sized to expected_throughput × TTL × 2. Default: 100K entries (~3.2 MB at 32 bytes/entry).
Per-peer rate cap: Token bucket: 100 envelopes/sec sustained, 1000 burst, per direction.

5. Acceptance criteria

[x] R-215 layers 1-3 adopted as Manthan's gossip foundation.
[x] Bootstrap seed-list spec with diversity requirements (§3.1).
[x] Peer diversity policy quantified (§3.2).
[x] Anti-eclipse cross-check rule (§3.3).
[x] Anti-entropy repair primitives (§3.4): inventory, Merkle, GET_ENVELOPES, CT-checkpoint reconciliation.
[x] TTL/dedupe parameters quantified (§4).

6. What G-006 does NOT cover

Implementation. Phase 3.
DHT/Kademlia. Out of v0.2 scope.
Cross-protocol gossip (e.g., Matrix, IPFS). Out of scope.

7. Sign-off

[x] drafted → this document
[x] reviewed → against research/genesis-gossip.md (R-215 entire), [EXT §2.5], [EXT §3.3], [EXT §3.5], audits/systemic-risk-matrix.md SR-001/SR-002/SR-009
[x] accepted → R-215 verbatim adoption + Manthan-specific quantifications
[x] closed → G-006 closed; implementation Phase 3

— G-006 closed, 2026-05-06.

G-006 — Adopt R-215 Gossip Discipline