FEDER
ATED

Multiple sovereign operators each run their own local stack, sharing only what they explicitly choose. The wider model is the sum of what each side opens up. Each side keeps what it doesn't.

Federation · topology

How federation works here

Sovereign sides	Each operator runs their own local stack. No central authority sees both sides; what's shared is what each side chooses to share.
By grant	Federation is opened only when the operator grants it. The default for every site is local.
Scoped	Grants carry explicit scopes — observations, model updates, work offers, settlement. Nothing crosses outside its scope.
Cross-witness	Sibling operators can attest each other's claims, when they choose to. Trust is a deliberate act, not a configuration default.
Fail-soft	If the federation link is down or a peer is unreachable, every side keeps running locally. Federation is additive, never a single point of failure.

Sovereign sides composing by grant · never by default

Start a deployment ────►