@ibgib/space-gib 0.0.6 → 0.0.8

package/README.md

@@ -51,3 +51,23 @@ You can attach the VS Code debugger directly to the Node.js process running insi
 1. The server runs with the `--inspect=0.0.0.0:9229` flag.
 2. `docker-compose.yml` maps port `9229` to your host machine.
 3. Use the VS Code launch configuration `Docker: Attach to Space-Gib` to attach breakpoints.
+
+---
+
+## 🛡️ Long-Term Decentralized Security & Threat Modeling
+
+As `space-gib` transitions from the V1 single-server model to a fully decentralized, peer-to-peer architecture, the following security threats (inherently mitigated by the centralized nature of V1) must be addressed:
+
+### 1. The Revocation Sync Gap (Stale Parent State)
+*   **The Threat**: In a multi-peer network, if a user revokes a delegate keystone on Peer A (evolving $K_{\text{domain}}$ to remove the delegate), Peer B may not immediately sync the revocation frame. If an attacker presents the compromised delegate to Peer B before it syncs the parent's latest state, Peer B will accept it.
+*   **Decentralized Mitigation**: Peers must require cryptographic proof of freshness (epochs, sequence checks) or query a quorum of sync space hubs to verify $K_{\text{domain}}$'s latest tip before executing high-value operations.
+
+### 2. Cross-Origin Identity Federation (Same-Origin Policy Limitations)
+*   **The Threat**: Browser Same-Origin Policy (SOP) isolates IndexedDB and local storage by domain. If a user stores their primary identity keys on `space-gib.localhost` (Site A), script running on a different client app origin `other-ibgib-app.localhost` (Site B) cannot access Site A's IndexedDB to sign claims.
+*   **Relationship to Sync Remotes**: While `ibgib`'s sync protocol allows Site B to act as a Git-like remote that we push to and pull from via network requests, the SOP limitation applies to the browser *frontend* client running on Site B. To boot a local repository on Site B that can interact with the remote, Site B needs its own local delegate keys.
+*   **Decentralized Mitigation**: We must establish a secure cross-origin handshake (e.g., standardizing a redirect/popup or postMessage flow) where Site A authenticates the user and securely transfers a restricted, site-scoped delegate keystone to Site B's local IndexedDB. Once Site B has this delegate, it can sync natively with other peers.
+
+
+## Future Enhancements & Todo
+
+*   **Notification Broadcast System**: Implement a secure notification broadcast system to alert the user immediately via UI notifications when any challenge pool modification or administrative evolution occurs on their identity keystone.