Skip to content

Mutual Entrainment Handshake

Protocol — instantiates Decentralized Phase Locking

A reciprocal, provenance-carrying exchange in which two peers confirm each other's identity and phase before either lets it move its own timing.

Most local coupling is passive — a unit watches whatever timing evidence drifts past and reacts. Mutual Entrainment Handshake makes the coupling explicit and accountable: two peers deliberately exchange their phase, each message carrying a timestamp, a freshness marker, and a signed provenance, and each side confirms the other before allowing the exchange to shift its own clock. Its defining move is that timing evidence is not merely observed but negotiated and authenticated — you learn not just a neighbor's phase but how old that reading is and whether the peer reporting it is who it claims to be. That is what lets a population prove its synchrony is genuinely peer-to-peer rather than a hidden common signal or a spoofed one. The handshake is the channel-and-trust layer; the size of the correction it triggers belongs to a separate coupling law.

Example

Two neighborhood microgrids, each holding its own local 60 Hz phase on its own inverters, want to tie together without a central dispatcher. Before closing the interconnect, each controller sends the other a signed message — its phase, its frequency, a timestamp — and waits for a matching reply. Each checks three things: the signature (is this really the peer?), the freshness (is the reading current, or a replayed old one?), and the offset (is it within a safe window to close on?). Only when both sides confirm all three do they begin bounded mutual correction and close the breaker. If a message arrives unsigned or stale — a possible spoof or a lagging link — the handshake aborts and the tie stays open. The two grids interlock as equals, and a forged "phase" from an untrusted source can't drag either one.

How it works

The handshake is a request–acknowledge exchange, not a broadcast. What distinguishes it from passive observation:

  • Provenance travels with the reading. Each exchanged phase carries its origin, its age, and a signature — so the receiver weighs this peer, this fresh rather than an anonymous number.
  • Reciprocity is confirmed, not assumed. Both peers acknowledge before either commits to correct; the "handshake" is the mutual commitment.
  • Unauthenticated or stale evidence is rejected at the door, before it can move a clock.

The correction magnitude itself is not computed here — the handshake hands a trusted, dated phase to whatever coupling law applies.

Tuning parameters

  • Freshness window — the maximum age a timing message may have before it's rejected. Tighter resists replay and stale-link errors but aborts more often under normal latency.
  • Authentication strength — plain messages, signed messages, or signed-with-nonce. Stronger resists spoofing and replay but adds handshake latency and compute.
  • Acknowledgment depth — one-way announce, two-way confirm, or multi-round. More rounds buy certainty at the cost of delay.
  • Provenance scope — how much identity and history each message carries, trading auditability against overhead.
  • Abort/backoff policy — how the pair behaves when a handshake fails, from immediate retry to widening the freshness window.

When it helps, and when it misleads

Its strength shows where peers are mutually distrustful, where links are unreliable, or where you must prove the coupling is conductor-free — the provenance trail is the audit. It is the natural front door when a spoofed or replayed timing signal would be dangerous.

Its failure modes are the price of that rigor. Pairwise handshaking scales poorly — full confirmation among many peers grows quadratically, so it is a front door, not the steady-state coupling. A too-tight freshness window causes chronic aborts under ordinary jitter. And it can breed false confidence: a valid signature proves identity, not that the peer's clock is correct — an authenticated-but-compromised peer passes the handshake cleanly. The discipline is to pair authentication of the sender with a plausibility check on the value, so a trusted peer reporting an implausible phase is still caught.[1]

How it implements the components

  • phase_observation_channel — the handshake is the channel: every exchanged reading arrives with its freshness and origin, so the receiver knows the phase, its age, and its source.
  • adversarial_timing_filter — the authentication and freshness gate rejects spoofed, replayed, or stale timing before it can influence a peer.

It does not compute the correction magnitude — the reciprocal coupling law and gain belong to Nearest-Neighbor Phase Nudging and adaptive_pulse_coupled_update — nor spread estimates across a wider graph, which is gossip_phase_averaging.

Notes

The handshake authenticates identity and provenance, not correctness. It proves you are talking to the real peer and that the reading is fresh — but a genuine peer with a bad clock will pass. That is why the adversarial timing filter checks the plausibility of the value, not only the credentials of the sender; the two guards catch different failures.

References

[1] A Sybil attack floods a peer-to-peer system with fake identities to gain disproportionate influence. Authenticated provenance is the standard defense against it — which is why the handshake ties every timing reading to a verifiable identity rather than trusting anonymous phase claims. ↩