Quorum

Implemented behavior

Each network configures threshold and a list of witnesses. The threshold must be between 1 and the number of configured witnesses. A confirmed attestation requires at least that many verified, distinct signers under the trust assumptions of the selected signature scheme.

For Ed25519, every signer is checked individually. Duplicate witness IDs, unknown IDs, invalid signatures, and fewer than threshold valid signatures are rejected. For BLS, the signer list must be distinct, meet the threshold, map to configured BLS public keys, and verify as one aggregate signature. Current BLS verification does not perform proof-of-possession checks, so the configured membership must come from a trusted key-registration process that authenticates each witness/key binding and requires PoP. Without that assumption, the listed distinct IDs and threshold count do not by themselves prove distinct witness participation. The gateway performs verification before persistence and the shared verifier repeats the check for clients.

The same configured threshold is used for signed tree heads. Federation has a separate threshold for distinct peer networks, and each peer can require its own minimum number of witness signatures.

There is no fixed threshold built into Witness. A common example is 2-of-3; the README recommends more than 50% (for example, 4-of-7) for production, but the operator chooses the actual value.

Assumptions

The security interpretation is “fewer than the threshold of signing keys will not collude or be compromised,” and the configured witnesses are meaningfully independent. Availability additionally assumes at least the threshold can be reached; an outage below threshold causes retries or failure, not a weakened attestation. For BLS, this interpretation also assumes trusted membership-key registration with proof-of-possession before keys enter the verification configuration.

Non-goals

Quorum is not Byzantine fault tolerance, consensus, or finality. It does not guarantee that honest witnesses agree on a single global history, prevent a threshold coalition from signing misleading data, or make a compromised gateway harmless. Federation and external anchors improve independent durability but do not change this boundary.

TODO — maintainer review

Publish an operator-facing threshold-selection rule that distinguishes safety, availability, and independence assumptions, and review whether “quorum” should be qualified as a signature-collection quorum throughout the documentation.