downsize 69%

docs/rfcs/2026-08-01-group-governance-related-work.md

@@ -1,4 +1,4 @@
-# Related work for democratic groups: what we borrow, what we reject, and what the literature says we cannot have
+# Related work: democratic groups
 
 Companion to `2026-08-01-group-governance.md`. Each section states a result, then what the governance design does with it.
 
@@ -26,7 +26,7 @@ Our protocol has that exact shape. Accumulating signed votes is monotonic and I-
 
 **What we do with it.** Where Kleppmann & Howard would reach for consensus on the winner, we substitute a deterministic total order (mandate order, computed from canonical certificate bytes) and accept that members who have seen different certificate sets can disagree until they exchange them. This buys implementability at the cost of agreement, which §1 says is the only trade available.
 
-**Where we fall short of the model, and it is worth fixing.** Strong eventual consistency requires that state be a function of the *set of updates received*. Our ranking obeys this (the RFC pins all three ranking components to canonical bytes precisely so the order is identical at every member), but our *acceptance* does not: whether a certificate is applied depends on the votes a member happens to hold locally, via the union rule at challenge-window close. Two members with the same certificates and different local vote sets can diverge permanently. This is the "knife-edge divergence" the RFC already documents, but the literature frames it more sharply than the RFC does: it is the design's one deviation from SEC, and it is avoidable in principle by making acceptance, like ranking, a pure function of the certificate. That would trade the anti-vote-withholding defence for convergence. The RFC should state this trade explicitly rather than presenting the union rule as free.
+**Where we fall short of the model, and it is worth fixing.** Strong eventual consistency requires that state be a function of the *set of updates received*. Our ranking obeys this (the RFC pins all three ranking components to canonical bytes precisely so the order is identical at every member), but our *acceptance* does not: whether a certificate is applied depends on the votes a member happens to hold locally, via the union rule at challenge-window close. Two members with the same certificates and different local vote sets can diverge permanently. This is the "knife-edge divergence" the RFC already documents, but the literature frames it more sharply than the RFC does: it is the design's one deviation from SEC, and it is avoidable in principle by making acceptance, like ranking, a pure function of the certificate. That would trade the anti-vote-withholding defence for convergence.
 
 ## 3. Duelling admins: the specific problem, and why we are not solving it the usual way
 
@@ -87,5 +87,3 @@ Our version chain is a reconfiguration sequence, and there is a positive result
 We adopt: consensus-number analysis as the justification for revisable finality (Frey/Gestin/Raynal); I-confluent vote aggregation with a non-consensus decision rule (Kleppmann & Howard); majority-certificate authority in place of seniority ranking (motivated by Dougal's critique); an authenticated hash-linked membership log with witness-based enfranchisement, following the hash-DAG approach Matrix and Keyhive use and Byzantine causal broadcast (Kleppmann & Howard); epoch-style versioning without a serializer (MLS, minus its Delivery Service); flickering-tolerant membership (as DCGKA does); authenticated membership events (Rösler et al.); simple majority of votes cast (May's theorem), with procedural rather than arithmetic protection against the zero-nay case; and social-only accountability (PeerReview's framing, without Casper's stake).
 
 We reject: anti-flickering revocation semantics (consensus number *N*); a finality arbiter (ERA) or delivery-service serializer (MLS), both of which reintroduce a trusted chokepoint; fixed participation quorums (abstention incentives, and DAO turnout empirics) and adaptive quorum biasing (scale-invariant minority capture, and a safety assumption that holds only where a standing opposition class exists); ballot secrecy (incompatible with self-authenticating certificates); social-graph Sybil defence (wrong graph, wrong scale, for v1); and fork consistency as a goal (we repair forks rather than making them permanent).
-
-Two places where the literature suggests the RFC is currently weaker than it needs to be: acceptance is not a pure function of received updates, which is a real deviation from strong eventual consistency and the root of knife-edge divergence (§2); and the temporal rules in the witnessed chain are backdating mitigations of the kind ERA classifies as insufficient without an arbiter, so their contribution should be described as raising cost rather than establishing a bound (§3).