Federation: how Cookwala works with no centre
Status: draft, 2026-10-04 (RFC-0006). The founder's picture was a beehive: no central command, yet harmony and recovery. This page says what that means in practice.
1. Nodes #
| Node | What it serves | Who runs one |
|---|---|---|
| Catalog | /.well-known/cookwala.json, recipes, vocabularies, rule packs, keys, feeds | a recipe publisher, a food-bank network, a university, a device maker, cookwala.ai |
| Registry | /v1/registry.json: pointers to catalogs, collections, devices, packs, benchmarks | anyone; cookwala.ai runs one |
| Hub | the Core API for a kitchen, local safety limits, the household context | every kitchen; works offline |
| Mirror | republishes other nodes' signed items unchanged | anyone who wants resilience in their region |
A static folder is a valid catalog. A phone with the CSV templates is a valid humanitarian participant at level H0.
2. Feeds, not commands #
Nodes publish signed feeds: recalls, anonymous incidents, registry changes, key records. Other nodes poll what they trust and may republish it. Nothing is pushed into a kitchen; a kitchen pulls when it is online and keeps working when it is not.
3. Verify against the issuer, never the relay #
A recall that arrives through a mirror is only as good as the issuer's signature. A hub resolves the issuer's KeyRecord from the issuer's own discovery document or did:web and verifies the body byte for byte. The mirror's key proves nothing about the content; a mirror that edits a recall breaks the signature. Profile vectors in conformance/profiles/federation.json show the three cases.
4. Trust lists #
Each hub keeps a list of catalogs and registries it trusts, with their keys and a priority. A node may suggest peers (federation.peers); the hub decides. cookwala.ai is one entry on such a list, not a root.
5. Freshness #
Registry entries carry a status and a publication time; recalls carry an issue time; household facets carry a validity. Stale items are re-fetched or dropped. Nothing is trusted because it is old, nothing is deleted silently: withdrawn entries stay as tombstones.
6. History #
Event logs with witnessed checkpoints (Core section 5) make rewrites detectable without a blockchain: a second party counter-signs the head of the log, and a later rewrite no longer matches. Public anchoring of checkpoint heads is optional and is a founder decision (docs/research/BACKSTORY.md section 4.7).
7. Three nodes that interoperate #
- A food-bank network runs a registry of its kitchens and donors, a catalog of its rule packs adapted to national law, and an SMS gateway. It lists itself in the cookwala.ai directory or not; its data never has to leave its country.
- A device maker runs a catalog of its capability documents and safety-limit packs, publishes conformance reports, and polls the recall feeds of the catalogs its customers use.
- A university lab runs a catalog of benchmark recipes and execution logs (with consent), mirrors the vocabularies, and publishes its own vectors.
None of them needs cookwala.ai to be online.
8. What is not built #
A central orchestrator, a central identity provider, a token, a blockchain. The Mission profile's quorum decisions and orchestrators stay optional and experimental.