Core System Architecture Part 58 — Anonymous Network Federation, Inter-Network Peering, Cross-Domain Trust & Privacy-Preserving Interoperability Architecture
SIAR — Secure, Local-First, Multi-Transport Communication Platform
Series: Core System Architecture
Part: 58
Status: Architecture specification
Primary language: Rust
Builds on: Core System Architecture Parts 34–57
Primary purpose: define how independently governed SIAR-compatible anonymous networks can discover one another, establish peering, exchange traffic, validate foreign trust, negotiate policy, preserve anonymity across domain boundaries, isolate failures, reconcile provider/payment capabilities, and avoid creating one globally linkable identity or governance system.
1. Purpose
A mature anonymous communication ecosystem should not require:
one global operator
one global directory
one global root key
one global marketplace
one global billing authority
Independent deployments may emerge:
community networks
enterprise/private networks
regional networks
research networks
NGO-operated networks
public SIAR networks
self-hosted federations
These networks may want interoperability.
Naive federation can create severe privacy and trust failures:
global user identifiers
transitive trust assumptions
shared route tracing
cross-domain account correlation
one federation authority becoming de facto global root
The governing principle is:
Federation must connect independently governed anonymity domains without erasing their trust boundaries, privacy policies, or identity separation.
2. Architectural Position
Domain A
│
├── local trust root
├── local providers
├── local policy
└── local identities
│
▼
Federation Boundary
│
├── peer discovery
├── trust validation
├── policy negotiation
├── route capability negotiation
└── settlement interoperability
│
▼
Domain B
3. Core Separation
Keep distinct:
local account identity
federation-scoped identity
domain trust root
foreign trust root
provider identity
peering identity
inter-domain route state
settlement identity
4. Non-Goals
Part 58 does not require:
global single sign-on
global account namespace
global provider catalog
global governance root
automatic trust inheritance
cross-network social graph sharing
5. Federation Domain
#![allow(unused)] fn main() { pub struct FederationDomainId(pub [u8; 32]); }
6. Domain Descriptor
#![allow(unused)] fn main() { pub struct FederationDomainDescriptor { pub domain_id: FederationDomainId, pub trust_bundle: GovernanceTrustBundle, pub federation_policy: FederationPolicyDescriptor, pub capabilities: FederationCapabilities, pub valid_until: Timestamp, pub signatures: DomainDescriptorSignatures, } }
7. Domain Independence
Each domain owns:
its trust roots
its provider governance
its policy
its pricing
its incident handling
its legal boundary
8. No Global Root
Hard rule.
9. Cross-Domain Trust
Trust is explicit.
10. Trust Modes
#![allow(unused)] fn main() { pub enum CrossDomainTrustMode { Untrusted, Pinned, Audited, Federated, } }
11. Untrusted
No federation traffic accepted.
12. Pinned
Local admin explicitly pins foreign trust bundle.
13. Audited
Foreign domain accepted based on verified audit/governance criteria.
14. Federated
Formal bilateral/multilateral agreement.
15. No Transitive Trust
Hard rule.
If:
A trusts B
B trusts C
it does not mean:
A trusts C
16. Trust Edge
#![allow(unused)] fn main() { pub struct FederationTrustEdge { pub local: FederationDomainId, pub remote: FederationDomainId, pub mode: CrossDomainTrustMode, pub policy: CrossDomainTrustPolicy, } }
17. Trust Graph
Local.
18. No Global Trust Graph Publication
Hard rule.
19. Peer Discovery
Domains need to discover peers.
20. Discovery Methods
manual pinning
signed federation catalog
DNS-like signed records
out-of-band exchange
governance-approved registry
21. Strict Mode Recommendation
Start with:
explicit pinned peers
22. Federation Catalog
Optional.
23. Catalog Principle
Lists domains, not users.
24. Domain Catalog
#![allow(unused)] fn main() { pub struct FederationCatalog { pub version: u64, pub domains: Vec<FederationDomainDescriptor>, pub signatures: CatalogSignatureBundle, } }
25. Catalog Trust
Trust signature issuer, not mirror.
26. Peer Identity
Inter-domain peering endpoint has dedicated identity.
27. Peer ID
#![allow(unused)] fn main() { pub struct FederationPeerId(pub [u8; 32]); }
28. Peer Identity Separation
Must not equal:
provider ID
operator payout ID
account ID
29. Peering Session
#![allow(unused)] fn main() { pub struct FederationPeeringSession { pub local_domain: FederationDomainId, pub remote_domain: FederationDomainId, pub peer_id: FederationPeerId, pub negotiated: FederationNegotiatedProfile, } }
30. Peering Authentication
Mutual.
31. Trust Bundle Verification
Each side verifies:
root
authority set
policy version
revocation freshness
32. Foreign Trust Freshness
Must satisfy local minimum.
33. Cross-Domain Policy
Local domain decides what foreign traffic is allowed.
34. Policy Object
#![allow(unused)] fn main() { pub struct CrossDomainTrustPolicy { pub allowed_services: BTreeSet<AnonymousServiceType>, pub minimum_privacy: PrivacyRoutingMode, pub require_audited_remote: bool, pub max_path_domains: u8, pub allow_settlement: bool, } }
35. Policy Merge
Most restrictive policy wins.
36. Local Hard Invariants
Always dominate.
37. Foreign Policy Cannot Lower Local Privacy Floor
Hard rule.
38. Federation Capability Negotiation
Possible capabilities:
mailbox federation
mixnet inter-domain routing
bulk transfer
private calls
provider discovery
payment settlement
39. Federation Capabilities
#![allow(unused)] fn main() { pub struct FederationCapabilities { pub mailbox: bool, pub mixnet_transit: bool, pub bulk_rendezvous: bool, pub private_realtime: bool, pub provider_catalog_exchange: bool, pub settlement: bool, } }
40. Negotiated Federation Profile
#![allow(unused)] fn main() { pub struct FederationNegotiatedProfile { pub protocol_version: ProtocolVersion, pub capabilities: FederationCapabilities, pub privacy_floor: PrivacyRoutingMode, } }
41. Negotiation Authentication
Required.
42. Downgrade Protection
Same principle as Part 52.
43. Inter-Domain Message Delivery
Scenario:
user in A
→ recipient in B
44. No Global Account ID
Hard rule.
45. Federation Addressing
Use opaque destination descriptor.
46. Federation Destination
#![allow(unused)] fn main() { pub struct FederationDestination { pub remote_domain: FederationDomainId, pub endpoint_capability: OpaqueFederatedCapability, } }
47. Endpoint Capability
Should not reveal:
global username
account key
device count
48. Contact Bootstrap
Cross-domain contact exchange can produce:
domain-scoped relationship capability
49. Federated Relationship ID
#![allow(unused)] fn main() { pub struct FederatedRelationshipId(pub [u8; 32]); }
Local-only.
50. Remote Domain Visibility
Remote peering layer should not learn local contact graph.
51. Inter-Domain Envelope
local E2EE payload
→ federation envelope
→ remote domain ingress
→ remote anonymous delivery
52. Federation Envelope
#![allow(unused)] fn main() { pub struct FederationEnvelope { pub version: ProtocolVersion, pub destination_domain: FederationDomainId, pub opaque_destination: Bytes, pub ciphertext: Bytes, } }
53. No Raw Local Account ID
Hard rule.
54. No Raw Remote Account ID
Hard rule.
55. Domain Boundary Metadata
Peering layer may learn:
domain A
domain B
traffic timing
traffic volume
This is a residual risk.
56. Traffic Shaping
Inter-domain links should support:
batching
padding
cover
where practical.
57. Cross-Domain Correlation Risk
If A and B collude:
timing correlation
volume correlation
possible.
58. Part 42 Integration
Must model federated adversary.
59. Multi-Domain Mix Route
Possible:
A → B → C
60. Maximum Domain Hops
Policy-bounded.
61. Why Bound
Avoid:
unbounded trust chain
latency explosion
policy ambiguity
62. Inter-Domain Mix Routing
Two models:
gateway peering
or
federated topology exchange
63. Initial Recommendation
Use gateway peering.
64. Why
Simpler trust boundary.
65. Gateway Peering
A internal mixnet
→ A federation gateway
→ B federation gateway
→ B internal mixnet
66. Cross-Domain Gateway ID
Separate.
67. Route Privacy
Each domain should know only:
adjacent federation relationship
not full end-to-end path if avoidable.
68. No Global Route ID
Hard rule.
69. Gateway Rotation
Short-lived federation session identifiers.
70. Mailbox Federation
Useful if recipient mailbox resides in B.
71. Deposit Flow
A sender
→ A anonymous transport
→ A federation gateway
→ B federation gateway
→ B mailbox provider
72. Mailbox Capability
Opaque to A beyond routing to B.
73. B Does Not Learn A User Identity
Hard rule.
74. Delivery ACK
Must be scoped.
75. Federated ACK
#![allow(unused)] fn main() { pub struct FederatedDeliveryAck { pub federation_message_id: FederationMessageId, pub status: FederatedDeliveryStatus, } }
76. Federation Message ID
Random per inter-domain delivery.
77. No Application MessageId Exposure
Preferred.
78. ACK Privacy
Does not include recipient identity.
79. Bulk Federation
Large encrypted object transfer.
80. Options
provider in A
provider in B
third neutral domain
81. Strict Mode
Prefer recipient-domain or independent provider.
82. Cross-Domain Object ID
Fresh.
83. No Shared Object ID Across Domains
Hard rule.
84. Realtime Federation
Private call across domains.
85. Signaling
Anonymous signaling via federation envelope.
86. Media
Possible:
relay in A + relay in B
87. Better Privacy
Multi-relay cross-domain path.
88. Peering Media Metadata
Residual timing/volume visible.
89. Direct Peer Media
Still forbidden in strict mode.
90. Federation Presence
Dangerous.
91. Recommendation
Do not federate global presence.
92. If Enabled
Use per-relationship scoped presence capability.
93. No Domain-Wide Presence Directory
Hard rule.
94. Federation Discovery
Global user search is high risk.
95. Initial Recommendation
No global people directory.
96. Cross-Domain Bootstrap
Use:
invite
QR
exact handle + domain
managed directory
97. Federated Handle
Could be:
handle@domain
but should be optional.
98. Exact Handle Search
Must be anti-enumeration.
99. Privacy Caveat
Stable handle introduces cross-domain linkability.
100. Maximum Anonymity
Prefer capability bootstrap over public handle.
101. Provider Federation
Domains may expose provider catalogs to peers.
102. Do Not Merge Blindly
Hard rule.
103. Foreign Provider Eligibility
Must pass local policy.
104. Foreign Provider Descriptor
Include source domain.
105. Descriptor Wrapper
#![allow(unused)] fn main() { pub struct FederatedProviderDescriptor { pub source_domain: FederationDomainId, pub descriptor: AnonymousProviderDescriptor, pub domain_attestation: DomainAttestation, } }
106. Local Trust Re-Evaluation
Required.
107. No Transitive Provider Trust
Hard rule.
108. Foreign Operator Diversity
Count operator independence across domains.
109. Same Cloud/ASN
Still relevant.
110. Federation Capacity
Part 49 can consume foreign capacity metadata.
111. Capacity Privacy
Only coarse.
112. No Per-User Capacity Requests
Hard rule.
113. Cross-Domain Payments
Complex.
114. Initial Recommendation
Keep settlement domain-local where possible.
115. Options
prepaid roaming credit
bilateral settlement
clearing house
116. Roaming Credit
User obtains credit usable in foreign domain without exposing local account.
117. Federated Credit
#![allow(unused)] fn main() { pub struct FederatedServiceCredit { pub issuer_domain: FederationDomainId, pub accepted_domain: FederationDomainId, pub resource: ResourceClass, pub amount: u64, pub proof: FederatedCreditProof, } }
118. Credit Privacy
Must not reveal communication identity.
119. Settlement Identity
Domain-level/operator-level only.
120. Bilateral Settlement
Domains settle aggregate usage.
121. Settlement Record
#![allow(unused)] fn main() { pub struct FederationSettlement { pub from_domain: FederationDomainId, pub to_domain: FederationDomainId, pub period: AccountingPeriod, pub service: AnonymousServiceType, pub amount: u64, } }
122. No User Mapping
Hard rule.
123. Clearing House
Future.
124. Risk
Clearing house could become global correlation point.
125. Recommendation
Avoid central clearing house initially.
126. Policy Federation
Domains do not inherit each other's policies.
127. Compatibility
Need intersection.
128. Effective Federation Policy
#![allow(unused)] fn main() { pub struct EffectiveFederationPolicy { pub services: BTreeSet<AnonymousServiceType>, pub privacy_floor: PrivacyRoutingMode, pub data_residency: FederationResidencyConstraint, pub settlement: bool, } }
129. Most Restrictive Intersection
Hard rule.
130. Jurisdiction Isolation
Part 55 applies across domains.
131. Cross-Border Flow
Explicit.
132. Domain Legal Profile
May advertise:
jurisdiction
residency guarantees
retention class
133. Claim Assurance
Self-declared vs audited.
134. Local Policy
Can reject foreign domain.
135. Federation Legal Isolation
A legal action in B should not automatically affect A.
136. Suspension Scope
B can:
stop peering
without shutting down A.
137. Domain Suspension
#![allow(unused)] fn main() { pub enum FederationPeerState { Active, Degraded, Suspended, Revoked, Retired, } }
138. Suspension Reasons
security
policy
legal
operator
compatibility
139. Failover
If B unavailable:
queue
alternate trusted domain
if policy allows.
140. No Untrusted Detour
Hard rule.
141. Federation Path Planning
#![allow(unused)] fn main() { pub trait FederationPathPlanner { fn plan( &self, source: FederationDomainId, destination: FederationDomainId, policy: &EffectiveFederationPolicy, ) -> Result<FederationPath, FederationError>; } }
142. Federation Path
#![allow(unused)] fn main() { pub struct FederationPath { pub domains: Vec<FederationDomainId>, } }
143. Path Constraint
Every edge explicitly trusted/eligible.
144. No Automatic Transitive Edge
Hard rule.
145. Domain Loop Prevention
Required.
146. Maximum Path Length
Policy-bound.
147. Loop Detection
#![allow(unused)] fn main() { pub struct FederationPathDigest(pub [u8; 32]); }
Internal, not user-visible.
148. Do Not Expose Full Path To Providers
Preferred.
149. Federation Routing Table
Local control-plane state.
150. No User Route History
Hard rule.
151. Domain Discovery Cache
Local.
152. Cache Expiry
Bounded.
153. Trust Bundle Revocation
If foreign root/authority compromised:
suspend peering
154. Foreign Emergency Policy
Does not automatically bind local domain.
155. But
May be considered when deciding peering safety.
156. Example
B blocks vulnerable protocol.
A should independently verify/decide.
157. Governance Federation
Possible exchange of signed advisories.
158. Advisory ≠ Authority
Hard rule.
159. Federation Advisory
#![allow(unused)] fn main() { pub struct FederationSecurityAdvisory { pub source_domain: FederationDomainId, pub subject: AdvisorySubject, pub severity: AdvisorySeverity, pub signature: DomainSignature, } }
160. Local Governance Decides
Always.
161. Domain Reputation
Can track:
peering reliability
policy compliance
security incidents
162. No Single Global Domain Score
Hard rule.
163. Local Federation Trust State
#![allow(unused)] fn main() { pub enum DomainTrustState { Unknown, Limited, Established, Suspended, } }
164. Evidence
Based on:
audit
history
incident handling
165. Cross-Domain Abuse
Example:
spam source from B into A
166. Enforcement
A can:
rate-limit B
suspend specific capability
suspend peering
167. No Need To Identify Global User
Hard rule.
168. Abuse Evidence
Scoped to domain boundary.
169. Domain-Level Quota
#![allow(unused)] fn main() { pub struct FederationQuota { pub remote_domain: FederationDomainId, pub resource: InfrastructureResource, pub limit: ResourceLimit, } }
170. Fairness
Prevent one domain from monopolizing another.
171. Bilateral Capacity
Can reserve.
172. Capacity Reservation
Scoped to domain pair, not user.
173. Federation Load Balancing
Among multiple peers/providers.
174. Weighted Random
Recommended.
175. Operator Diversity
Still applies.
176. Failure Isolation
A broken B should not cascade to A.
177. Bulkhead Pattern
Separate queues per remote domain.
178. Queue Isolation
#![allow(unused)] fn main() { pub struct FederationQueueKey { pub remote_domain: FederationDomainId, pub service: AnonymousServiceType, } }
179. Bounded Queues
Mandatory.
180. Backpressure
Per domain.
181. No Global Queue Collapse
Hard rule.
182. Retry
Jittered.
183. Circuit Breaker
Useful.
184. Federation Circuit State
#![allow(unused)] fn main() { pub enum FederationCircuitState { Closed, Open, HalfOpen, } }
185. Circuit Breaker Privacy
Domain-level only.
186. Disaster Recovery
Part 50 applies per domain.
187. Federated Continuity
Can fail over to another trusted domain if explicitly allowed.
188. No Hidden Federation Reroute
Hard rule.
189. Federation Observability
Safe aggregate:
peer health
queue depth
latency class
error class
settlement totals
190. Forbidden Federation Telemetry
No:
user pair
contact graph
global message ID
full cross-domain route
191. Cross-Domain Trace IDs
Forbidden.
192. Synthetic Probes
Use dedicated test identities.
193. Federation SLOs
Examples:
peering availability
delivery success
policy freshness
settlement timeliness
194. Privacy SLOs
Examples:
zero global user identifiers
zero transitive trust acceptance
zero cross-domain route tracing
195. Federation Upgrade Compatibility
Part 52 applies.
196. Domain Version Skew
Expected.
197. Compatibility Intersection
Required.
198. Upgrade Independence
Domains upgrade on own schedules.
199. No Federation-Wide Flag Day
Hard rule.
200. Peering Version Window
Current/previous where possible.
201. Federation Governance Agreement
Optional formal contract/policy.
202. Technical Representation
#![allow(unused)] fn main() { pub struct FederationAgreement { pub local_domain: FederationDomainId, pub remote_domain: FederationDomainId, pub policy_version: u64, pub trust_mode: CrossDomainTrustMode, pub services: BTreeSet<AnonymousServiceType>, pub signatures: BilateralSignatureBundle, } }
203. Bilateral Signatures
Each domain signs.
204. Agreement Expiry
Recommended.
205. Renewal
Explicit.
206. No Permanent Default Federation
Hard rule.
207. Federation Removal
Graceful when possible.
208. Retirement Flow
stop new traffic
drain queues
settle
retire peer
209. Immediate Revocation
For compromise.
210. Outstanding Messages
Remain queued locally or reroute through trusted alternative.
211. No Unsafe Forwarding After Revocation
Hard rule.
212. Federation Storage
Potential tables:
federation_domains
trust_edges
federation_agreements
peer_sessions
domain_quotas
federation_health
settlement_batches
213. Strong Consistency
Needed for:
trust edges
revocation
agreement state
214. Eventual Consistency
Okay for:
health
capacity
215. Federation Secrets
Peering keys scoped per domain pair.
216. No One Key Across All Peers
Hard rule.
217. Key Rotation
Independent per peer.
218. Peering Key Compromise
Suspend edge.
219. No Global Federation Re-Key
Unless root compromised.
220. Federation Security Threats
malicious peer
transitive trust confusion
route laundering
policy downgrade
cross-domain correlation
settlement fraud
domain Sybil
federation loop
221. Malicious Peer
Can inspect boundary metadata.
Cannot decrypt E2EE payload.
222. Route Laundering
Peer tries to send traffic through unapproved domain.
223. Defense
Explicit path policy.
224. Policy Downgrade
Authenticated negotiation + local floor.
225. Cross-Domain Correlation
Mitigate via:
padding
batching
cover
short-lived identifiers
226. Domain Sybil
Attacker creates many domains.
227. Defense
Trust is explicit/admission-based.
228. Federation Loop
Prevent via path/TTL.
229. Inter-Domain TTL
#![allow(unused)] fn main() { pub struct FederationHopLimit(pub u8); }
230. Maximum
Small.
231. No User-Controlled Arbitrary Domain Path
Hard rule.
232. Account Portability Across Domains
Part 57 applies.
233. Move vs Federation
Different.
234. Account Move
User migrates primary domain.
235. Federation
User remains in A and communicates with B.
236. Move Flow
export durable state
→ import in B/self-hosted
→ rebind providers
→ optionally retain continuity proof
237. Continuity Proof
Optional.
238. Privacy Tradeoff
Proof links old/new domain identity.
239. Strict Migration
Allow fork/new identity instead.
240. User Choice
Required.
241. Federation UI
Normal user should see minimal.
242. Example
This contact is on another network.
243. Advanced View
Can show:
remote domain
trust level
privacy floor
244. No Raw Trust Graph
Hard rule.
245. Warning
If remote domain weaker:
This network does not meet your required privacy level.
246. No "Connect Anyway" In Hard Strict Policy
Hard rule.
247. Enterprise Federation
Useful for:
organization A ↔ organization B
248. Managed Federation
May use:
approved domain list
contractual trust
249. Still No Global User Namespace
Hard rule.
250. Community Federation
Can use:
invite-based peer agreement
251. Public Federation
Later stage.
252. Initial Recommendation
Start:
bilateral federation
pinned domains
gateway peering
mailbox delivery
explicit service allowlist
253. Federation Service Trait
#![allow(unused)] fn main() { pub trait FederationService { fn peer( &self, remote: FederationDomainDescriptor, ) -> Result<FederationPeerId, FederationError>; fn suspend( &self, peer: FederationPeerId, ) -> Result<(), FederationError>; } }
254. Trust Service
#![allow(unused)] fn main() { pub trait FederationTrustService { fn evaluate( &self, local: FederationDomainId, remote: &FederationDomainDescriptor, ) -> Result<DomainTrustState, FederationError>; } }
255. Envelope Router
#![allow(unused)] fn main() { pub trait FederationEnvelopeRouter { fn route( &self, envelope: FederationEnvelope, policy: &EffectiveFederationPolicy, ) -> Result<FederationRouteResult, FederationError>; } }
256. Agreement Store
#![allow(unused)] fn main() { pub trait FederationAgreementStore { fn active( &self, remote: FederationDomainId, ) -> Result<Option<FederationAgreement>, FederationError>; } }
257. Settlement Interface
#![allow(unused)] fn main() { pub trait FederationSettlementService { fn settle( &self, period: AccountingPeriod, peer: FederationDomainId, ) -> Result<FederationSettlement, FederationError>; } }
258. Federation Error Taxonomy
#![allow(unused)] fn main() { pub enum FederationError { DomainUntrusted, TrustBundleInvalid, AgreementMissing, AgreementExpired, CapabilityMismatch, PrivacyFloorUnsatisfied, PeerSuspended, HopLimitExceeded, SettlementUnavailable, PolicyConflict, RevokedPeer, Internal, } }
259. Testkit
Need multi-domain simulator.
260. Scenarios
A↔B
A↔B↔C
B compromised
policy conflict
version skew
settlement outage
domain partition
provider failure
261. No-Transitive-Trust Test
A trusts B.
B trusts C.
A must not accept C automatically.
262. Peering Revocation Test
B revoked.
Traffic stops safely.
263. Policy Floor Test
B offers weaker privacy.
A rejects.
264. Mailbox Federation Test
A sender delivers to B recipient without exposing account IDs.
265. Cross-Domain ACK Test
ACK does not reveal recipient identity.
266. Loop Test
A→B→A rejected.
267. Hop Limit Test
Excess path rejected.
268. Provider Import Test
Foreign provider re-evaluated locally.
269. Settlement Replay Test
Duplicate batch rejected.
270. Upgrade Skew Test
A current, B previous.
Works if compatible.
271. Federation Failure Isolation Test
B outage does not saturate A.
272. Abuse Test
Spam from B rate-limited at domain boundary.
273. Privacy Correlation Test
Inter-domain timing/volume analyzed in Part 42 simulator.
274. Fuzzing
Fuzz:
domain descriptor
agreement
federation envelope
trust bundle
settlement record
275. Property Tests
Properties:
no foreign policy can reduce local hard privacy floor
no route uses untrusted domain edge
no transitive trust without explicit local approval
no user/global account ID in federation envelope
276. Formal Verification Targets
Strong candidates:
trust-edge evaluation
path construction
policy intersection
peering state machine
277. TLA+ Candidate
Multi-domain trust/path behavior under partition/revocation.
278. Kani Candidate
Hop-limit and explicit-edge validation.
279. Loom Candidate
Concurrent peering revocation + message routing.
280. Performance Tests
Measure:
federation envelope processing
peering handshake
policy evaluation
cross-domain queue throughput
281. Scale Tests
Synthetic:
10 domains
100 domains
1000 domains
without assuming full mesh.
282. Full Mesh
Not scalable.
283. Sparse Trust Graph
Expected.
284. Hierarchical Federation
Avoid unless trust semantics remain explicit.
285. Hub Risk
A popular federation hub could become correlation point.
286. Anti-Hub Policy
Prefer multiple peers.
287. Domain Diversity
Can be selection input.
288. No Mandatory Central Federation Broker
Hard rule.
289. Observability
Safe metrics:
active peer count
federation delivery success
queue health
agreement expiry
290. Forbidden Metrics
No:
user pair
global message identity
cross-domain contact graph
291. Transparency
Can publish:
which domains are formally federated
trust mode
agreement status
if policy allows.
292. Private Federation
Enterprise/community may keep peer list private.
293. Federation Governance
Part 53 controls local approval.
294. Foreign Governance
Observed, not authoritative.
295. Legal Integration
Part 55 controls:
jurisdiction
residency
cross-border legality
296. Privacy Integration
Part 56 can expose remote-domain privacy summary.
297. Recovery Integration
Part 57 handles migration/portability.
298. Economics Integration
Part 54/47 handle bilateral compensation/credits.
299. Resource Integration
Part 49 handles inter-domain quotas/capacity.
300. Reliability Integration
Part 50 handles peer/domain failure.
301. Upgrade Integration
Part 52 handles version skew.
302. Security & Privacy Invariants
Mandatory:
1. No global root of trust is required for federation.
2. Trust is explicit per domain edge and never automatically transitive.
3. Federation envelopes contain no global user/account identifiers.
4. Local hard privacy/security policy always dominates foreign policy.
5. Foreign provider/catalog data is re-evaluated locally before use.
6. No global cross-domain route identifier exists.
7. Peering and settlement identities are distinct from user/provider runtime identities.
8. Legal action or failure in one domain does not automatically propagate to unrelated domains.
9. Federation queues, quotas, and circuit breakers isolate failures per domain.
10. Cross-domain settlement remains aggregate and does not reveal user communication identity.
11. Strict mode never routes through an untrusted or privacy-ineligible federation edge.
12. Domain migration continuity proofs are optional because they create linkability.
303. Recommended Crate Layout
crates/
├── siar-federation-core/
├── siar-federation-domain/
├── siar-federation-trust/
├── siar-federation-agreement/
├── siar-federation-peering/
├── siar-federation-routing/
├── siar-federation-envelope/
├── siar-federation-mailbox/
├── siar-federation-settlement/
├── siar-federation-observability/
└── siar-federation-testkit/
304. siar-federation-core
Owns:
domain IDs
peer IDs
policy types
errors
305. siar-federation-domain
Domain descriptors/catalog.
306. siar-federation-trust
Trust-edge verification.
307. siar-federation-agreement
Bilateral/multilateral agreement state.
308. siar-federation-peering
Authenticated peer sessions.
309. siar-federation-routing
Cross-domain path planning.
310. siar-federation-envelope
Opaque federated transport envelopes.
311. siar-federation-mailbox
Inter-domain mailbox delivery.
312. siar-federation-settlement
Aggregate cross-domain settlement.
313. siar-federation-observability
Privacy-safe federation metrics.
314. siar-federation-testkit
Multi-domain simulator.
315. Initial Production Scope
Implement first:
explicit FederationDomainId
pinned foreign trust bundles
bilateral federation agreements
gateway-to-gateway peering
mailbox federation
opaque federation envelopes
explicit service allowlists
no transitive trust
local policy intersection
domain-level quotas
circuit breakers
aggregate settlement
privacy-safe federation observability
Then add:
multi-domain routed federation
federated provider catalogs
roaming anonymous credits
audited federation registries
private federation discovery
multi-party federation settlement
316. Definition of Done
Part 58 is complete when:
- federation domains have independent trust roots and governance
- cross-domain trust is explicit and non-transitive
- peering identities are separate from user/provider identities
- signed federation agreements and expiry are defined
- inter-domain envelopes carry opaque destination capabilities
- mailbox federation works without exposing global account identity
- gateway peering preserves local/remote anonymity boundaries
- provider/catalog import is locally re-evaluated
- policy intersection uses the most restrictive applicable rules
- inter-domain capacity/quota/fairness boundaries are explicit
- aggregate settlement works without user mapping
- jurisdiction/legal boundaries remain domain-scoped
- failure, suspension, revocation, and circuit-breaker semantics isolate domains
- migration vs federation vs identity fork are distinct
- version skew, path loops, abuse, settlement, privacy, fuzz, and formal tests are specified
317. Final Architecture
DOMAIN A
local root / local policy / users
│
▼
FEDERATION GATEWAY
│
explicit trust edge
│
▼
FEDERATION GATEWAY
│
▼
DOMAIN B
local root / local policy / users
Federation safety model:
independent trust roots
+
explicit bilateral trust
+
opaque destination capabilities
+
policy intersection
+
domain-level failure isolation
+
aggregate settlement
not:
merge all domains into one global identity, governance, and routing system
318. Final Principle
Federation should create interoperability without centralization.
The correct model is:
independent domains
+
explicit trust edges
+
non-transitive policy
+
privacy-preserving peering
+
local enforcement
This architecture lets SIAR-compatible networks interoperate while preserving independent governance, jurisdiction, provider, identity, and privacy boundaries across the wider ecosystem.