Graduated-guardian collusion bound

Picks up the gap left open in probation-cosign-worked-example.md: what if the thief already controls a guardian who has finished probation?

Setup

• Roster: guardians A, B (honest, graduated), C (thief-controlled, graduated).
• Per-guardian grace floor = 2 × p99 outage, second-path confirmed, capped at the turn limit (cycle 62 learning). Honest ceiling here: 8h.
• Rules 1 and 2: a new guardian needs a quorum co-sign, then 30 days of probation, and adds freeze only when co-signed by a graduated guardian.

Attack

1. C co-signs enrollment of D (thief-controlled). Quorum is 2 of 3, so A or B must also sign. If neither does, D is never enrolled. Thief gains 0h.
2. Suppose an honest guardian signs by mistake. D serves probation and earns no freeze from its outages (rule 1).
3. After probation, D's freeze needs a graduated co-signer (rule 2). C signs. Now D's outage counts.

Bound

C could already have frozen the key by cutting itself off: up to its own floor, 8h. D adds at most D's floor (8h) on top. So the thief gets 16h, and that is only possible after an honest guardian made a mistaken quorum signature.

Closing it

Count co-signed freeze per co-signer, not per guardian: a freeze that C co-signs comes out of C's own floor. Then C plus every guardian C sponsors shares one 8h budget, and the thief gets 8h, the same as C alone. A collusion ring can't add more freeze than the guardians it already controls.

Still open: a thief who controls a quorum of graduated guardians already owns the roster, so no admission rule can help. That bound belongs to key creation.

Guardian admission protocol

Combines rule 1 (quorum co-sign plus 30-day probation) and rule 2 (only a graduated guardian's co-sign gives a new guardian freeze power) into one admission sequence. It also says what key creation has to fix in advance.

Sequence

1. Propose. A quorum of the current roster (2 of 3 here) signs an enrollment record naming the new guardian G and its sponsor S. S must have completed probation.
2. Probation (30 days). G can sign and observe. Its outages add no freeze. If S is removed during probation, G's probation resets.
3. Graduate. At day 30, G's outages begin to count toward freeze, but they are charged to S's budget (the fix from graduated-guardian-collusion-bound.md). S and every guardian S sponsored share one floor of 2 x S's p99 outage.
4. Earn its own budget. After G has sponsored nobody and kept its p99 history for a further 30 days, G gets its own floor, starting at the lower of S's floor and the roster median.

Thief's best case

What key creation must fix

The last row can't be handled by admission rules. At key creation, the owner commits to:

• a roster size floor N_min, so that a quorum always needs more than half of the guardians who were present at creation;
• an absolute freeze cap T_max (the turn limit), which no budget can exceed;
• a creation-set anchor: removing any creation-set guardian needs the owner's key, not just a quorum.

With these in place, a thief who captures a quorum still can't freeze for longer than T_max. They also can't remove honest creation-set guardians to make room for their own.

Still open

Step 4's 30-day "own budget" wait is set by hand. It should be derived from how long it takes to measure p99 with confidence.

Probation + co-sign: worked example

Applies rule 1 (quorum co-sign + 30-day probation, probation outages give no freeze) and rule 2 (post-creation guardian adds freeze only when co-signed by a guardian that has completed probation).

Setup

• Key created with guardians A and B. Each has a grace floor of 2 × its p99 outage: A = 6h, B = 8h. Turn limit = 24h.
• Honest freeze ceiling today: max(A, B) = 8h.

Attack

1. Thief steals the key and enrolls guardian T (thief-controlled).
2. Rule 1: enrollment needs a quorum of A and B to co-sign. The thief holds neither, so T is never enrolled. Freeze gained: 0h.
3. Suppose the thief tricks A into co-signing. T is still on probation for 30 days. The thief cuts T off at once. Rule 1: probation outages count toward no freeze. Freeze gained: 0h.
4. Suppose T finishes probation, then is cut off. Rule 2: T's outage adds freeze only if a guardian that has completed probation (A or B) co-signs the freeze. Honest A and B see their own path is up and refuse. Freeze gained: 0h beyond the honest 8h.

Result

The median-wait gap from cycle 62 closes: a new guardian never sets the wait by itself, so with two guardians the thief cannot buy one guardian's floor.

Remaining gap

If the thief controls a guardian that has completed probation, rule 2 lets it co-sign T's freeze. That is the same power the thief already had through that guardian, so the bound is unchanged, but the two outages now add, not overlap.