GOVP mesh · opt-in network

Evidence held by more than its issuer.

The GOVP mesh is a cross-trust system among its users. An issuer signs the original record. Independent nodes observe it, preserve it and sign their own receipts. Anyone can then recompute how much independent corroboration exists.

See the running example →Trust model

No central registryOffline witness receiptsSybil collapseSplit-view detection

00 / Reproducible test

Three WordPress nodes. One deliberate contradiction.

This is not a fictional customer story. It is the HTTP mesh scenario included with GOVP Public Evidence 2.38.2. It starts three isolated WordPress installations and exercises the production plugin endpoints.

Executable scenario · Docker Compose + WordPress + HTTP

01
Three independent identities
node-a:8091, node-b:8092 and node-c:8093 each install the plugin and generate a different Ed25519 key.
02
An agreed starting point
A signed consortium manifest registers all three members at epoch 1. A asks B and C for /mesh/head; both signed heads match. Result: two agreements, no alarm.
03
C receives a conflicting view
C accepts another valid manifest at the same epoch but with a different expiry, producing a different manifest hash. The signature is valid; the history is incompatible.
04
A detects and attributes the split
A sends both peer heads to /mesh/reconcile. The response raises alarm: true and identifies node-c. The two signed heads are the portable evidence.
05
B goes offline
The test stops B and repeats reconciliation. A still responds correctly with the remaining peer: absence reduces available corroboration but does not stop the mesh.

mesh-scenario.shexpected output

HONEST STATE
reconcile(a)
alarm        false
agreements   [node-b, node-c]

SPLIT VIEW
reconcile(a)
alarm        true
culprit      node-c
reason       same epoch, different hash

NODE DOWN
stop node-b
reconcile(a) responds
mesh         remains operational

Every conclusion above is derived from signed protocol inputs. No Gemacode API supplies the verdict.

What this test proves—and what it does not.

It demonstrates signed membership, agreement, split-view detection, attribution and tolerance of an unavailable peer over real HTTP. It does not prove that a published claim is true or that these three test containers represent three independent organizations.

01 / Roles

No node gets to play every role.

The protocol separates an issuer’s declaration from a third party’s observation. Both are signed, but they assert different things.

IssuerSigns the claim

Publishes a GOVP-1 record binding an artifact, identity, domain and metadata.

ObserverSigns what it saw

Fetches the published artifact, recomputes its hash and issues a portable witness receipt.

CustodianKeeps a surviving copy

Preserves records and receipts so verification does not depend on the issuer remaining online.

VerifierRecomputes the evidence

Checks signatures, identity binding, hashes, membership, revocation and corroboration.

ConsortiumDefines a closed trust group

Uses signed k-of-n manifests, monotonic epochs and Merkle membership proofs.

GemacodeDoes not award the score

Maintains reference software. The inputs and verdict remain independently recomputable.

02 / Automatic flow

Publish once. Be observed by others.

A participating node can discover evidence, observe it and exchange receipts without turning Gemacode into a clearing house.

01Publish

The issuer exposes identity, discovery index, record and revocation state under its own domain.

02Discover

Peers obtain deterministic targets from the registry or discover opt-in nodes through myGOVP.

03Observe

The observer fetches the public artifact through a guarded request and canonicalizes it independently.

04Receipt

It signs URL, hash, time, GOVP-ID, nonce and optional registry epoch with its own Ed25519 key.

05Exchange

Receipts are submitted, retained and exposed with the evidence for later offline verification.

The observer never signs the issuer’s claim as true.

It signs a narrower fact: “I observed these bytes at this URL at this time.” That distinction keeps corroboration honest.

03 / Witness receipt

A portable act of observation.

A receipt is useful even after both sites disappear. It contains the observer’s public key and a signature over a deterministic body with its own domain separator.

Read the protocol

Observer: Domain identity and Ed25519 public key.
Observed fact: Canonical URL, observed SHA-256 and GOVP-ID.
Time: Observer-declared observation time; an external timestamp can strengthen it.
Uniqueness: A random nonce prevents identical observations from collapsing into one receipt.
Membership: Optional registry root, epoch and Merkle proof bind the observer to a consortium.
Verification: Observation hash plus Ed25519 signature, checkable offline.

04 / Sybil resistance

One operator cannot become a crowd.

GOVP reports both raw observers and effective independent groups. Related nodes collapse when their observable signals covary.

100 receipts from the same hand still count as one effective group.

Signals can include key, declared owner, receiving IP block, ASN, registrar and other observer-stamped context. The exact grouping remains inspectable.

Raw countn = 100

How many valid signed receipts exist.

Collapsedn_eff = 1

How many meaningfully independent groups remain.

ThresholdMinimum = 3

The default strong-corroboration threshold, configurable by profile.

05 / Verdict

A result anyone can recalculate.

The mesh does not sell a central reputation number. It publishes signed inputs and deterministic rules.

State	Condition	Meaning
UNWITNESSED	No valid independent receipt	The issuer signature may be valid, but no third-party observation is present.
WITNESSED	n_eff ≥ 1	At least one effective observer signed what it saw.
CORROBORATED	n_eff reaches the profile threshold	Multiple effective groups observed consistent evidence.
CONFLICT	Valid receipts disagree on the relevant artifact	The disagreement is retained and exposed, not averaged away.

06 / Gossip

A split view leaves evidence.

Nodes announce signed heads. If two valid announcements carry the same epoch but different manifest hashes, peers raise an alarm and can assemble a non-repudiable equivocation proof.

Signed head

Domain, epoch, manifest hash, announcement time and node key.

Peer check

The announcing key must match the registry entry for that domain.

Compare

Same epoch and same hash means agreement. Different hash means equivocation.

Prove

Two threshold-signed conflicting manifests become a portable proof.

07 / Honest limits

The mesh cannot invent independence.

It makes independence measurable and inflation detectable. It does not create genuine third parties where none participate.

It strengthens

Custody beyond the issuer.
Independent observation.
Detection of correlated witnesses.
Evidence of incompatible network views.
Survival through exported receipts and bundles.

It cannot guarantee

The truth of the issuer’s statement.
That every observer is organizationally independent.
Availability if every copy is deleted.
External time without a timestamp anchor.
Physical authenticity without a separate bridge.