Quorum and Byzantine-tolerant confidence: counting independent witnesses

The question is never “how sure,” it’s “how many, how separate”

A single source telling you it is certain conveys nothing about whether the claim is true — the confidence and the content come from the same machinery. So a trustworthy system never asks one source how sure it is. It asks a different question: how many independent sources corroborate this, and could they have disagreed? Everything below is machinery for answering that question without being fooled.

Quorums and quorum intersection

A quorum is a minimum subset of nodes whose agreement counts as a decision. The point of requiring a subset rather than unanimity is liveness: you can decide while some nodes are slow or offline. The point of requiring a large enough subset is safety, and the safety property is quorum intersection — any two quorums must share at least one node in common.

Intersection is what prevents split-brain. If a “commit” quorum and a later “read” quorum are guaranteed to overlap, the overlapping node carries the committed value forward, so no two decisions can contradict. For simple crash faults with n nodes, majority quorums of ⌊n/2⌋ + 1 always intersect in at least one node. That one shared node is the entire safety argument.

Byzantine fault tolerance: when nodes lie

Crash-fault quorums assume an absent node is merely silent. The Byzantine generals problem asks the harder version: what if a node is actively malicious or arbitrarily broken — present, but telling different observers different things to manufacture false agreement?

To survive up to f such faulty nodes, intersection alone isn’t enough; any two quorums must overlap in more than f nodes, so the overlap still contains at least one honest node. Working that out gives quorums of size more than (n + f) / 2, which can only exist when n > 3f. The headline result: Byzantine agreement needs strictly more than two-thirds honest participants. Cross below that line and the liars control enough of every quorum to show one story to half the network and the opposite story to the other half — and both halves think they have a valid quorum.

Consensus versus corroboration

It’s tempting to reach for full consensus here, but consensus and corroboration answer different questions.

• Consensus produces one agreed value that every honest node commits to, total-ordered. It answers “what is the canonical state?”
• Corroboration accumulates independent evidence for a belief. It answers “how much should I trust this claim?”

Consensus is the right tool for the CRDT convergence layer, which guarantees every replica agrees on what was written. But agreeing on what was written says nothing about whether it’s true. Trust is a gradient, not a commit: it should rise as distinct witnesses corroborate and fall when they contradict. That is a corroboration problem, and it sits as a separate layer on top of convergence.

Why N copies is not N witnesses

The failure mode that breaks naive vote-counting is correlated error. Counting attestations only works if the attestors fail independently — if their errors aren’t correlated, two of them agreeing is unlikely to be coincidence. The moment one source’s output becomes another’s input, their agreement stops being evidence and becomes an echo: one claim counted twice.

The adversarial version is a Sybil attack — one actor spins up many identities so a single source casts many “independent” votes. Defeating it requires Sybil resistance: a cost or a cryptographic identity that makes each distinct witness provably distinct. Without it, an attacker simply manufactures a quorum. This is the same principle as the simple case — an agent re-reading its own note is the degenerate one-node Sybil — and it’s why source independence is the genuinely hard part of confidence. Counting is trivial; certifying that the things you counted are separate is the whole problem. Provenance has to be tracked so an echo is never mistaken for a second source; see the Merkle DAG provenance deep-dive for how that lineage is made tamper-evident.

Modeling confidence as independent attestation

Put together, the design rule is: model confidence as a function of independent, distinct attestations — never of self-assertion. A claim’s standing should climb when separate sources that could have disagreed arrive at it on their own, and when checkable outcomes bear it out; it should ignore a source repeating itself entirely.

This is exactly how HiveMind layers trust on its shared corpus. The corpus is append-mostly, fully replicated to every machine, and synced peer-to-peer, so the raw record converges on its own. On top of that, confidence is built by corroboration — the “two or three witnesses” rule — and no agent certifies its own truth. Because every device signs its writes with its own key, two agreeing sources are provably separate machines, not one node wearing two masks. The count means something because independence is enforced, not assumed. Confidence, in the end, is earned by independent witnesses — never declared by the witness about itself.

Frequently asked

Related