RAGBAZ / river / Nostoi
Copies, separate custody and agreeing observations provide different kinds of assurance. Nostoi makes their failure states explicit.
published · Updated 2026-10-05
01 Nostoi
Suppose a history is rewritten and the new head is copied to two more places. Every copy agrees, and every copy was written by whoever performed the rewrite. Agreement between them carries no information about whether the rewrite happened.
Copies can improve availability and protect against some storage failures. Their value against a malicious rewrite depends on whether one authority can replace all of them. Replica count and independent custody therefore belong in different columns of the assessment.
02 Nostoi
Separate administrators, credential scopes, providers and retention controls can reduce common failure paths. None makes an observer incorruptible. Two regions in one account may still share the same administrator and credentials; different providers may still depend on one publisher host or one compromised operator.
Nostoi anchors to several destinations with per-destination credentials, and separates the credential that publishes from the one that verifies, alongside an independently selected trusted checkpoint key. A reader can therefore ask a sharper question than is-this-stored: who could have written this, and who checked it.
03 Nostoi
Nostoi's fan-out verifier is not a majority-vote protocol. Readable destinations must agree on the chain, format, sequence and digest; conflicting tuples produce exit 4. No usable destination is a failure. If at least one confirms the chain and the others are unavailable rather than conflicting, verification can succeed with an explicit reduced-assurance warning.
That policy separates a contradiction from an outage. It also means success alone does not imply that every configured destination was checked. A deployment requiring a minimum number of independent witnesses must enforce that requirement in its operational policy; it should not infer it from the exit code.
04 Nostoi
An investigator wants to know whether a record existed before a disputed change. A single retained head answers that for a window that ends when the holder's copy is rewritten. Independent anchors extend that window, and make it harder for one party to unwrite its own history.
These observations can make a rewrite detectable relative to a retained checkpoint. They do not automatically identify the person who changed it, authenticate the original event, or establish legal admissibility. Attribution and a defensible time of observation need additional evidence.
A conversation, not a sales funnel
Ask a question, tell us what you need, offer a contribution or simply show your support. RAGBAZ is a software studio working toward kindness, mutual cooperation and the good of all beings.
Prefer email? ragbaz@proton.me