How consensus is calculated

The rules that turn a pile of signed measurements into one state per region.

This page describes the shape of the calculation. The exact weights live in the probe network's own implementation and change as it learns; what does not change is the set of rules below, because they are what the results mean.

1. Discard what cannot be trusted

Results whose signature does not verify are dropped, not down-weighted. So are results from workers that are suspended, below the supported version floor, or silent at the time the batch would have been taken.

This happens first because everything after it assumes the inputs are attributable.

2. Group by target and by place

Measurements are grouped by what was measured and where from. Each group is resolved on its own before anything is combined, which is what makes a regional breakdown possible rather than a global number sliced afterwards.

3. Weight by independence, not by count

This is the rule that matters most. Ten workers behind one upstream are not ten vantage points: they share a path, so when that path breaks they all fail together and they all agree. Counting them as ten would let a single upstream's problem outvote the rest of the world.

Measurements are therefore weighted by how independent they are: different networks and different regions count for more than more machines in the same place. A provider's status page reports how many independent networks and workers a figure came from, which is the reader's version of the same information.

4. Weight by track record

A worker that has agreed with well-established consensus over a long period counts for more than one enrolled yesterday. This is not a loyalty scheme: it is the only defence against a worker enrolled specifically to skew a verdict, which would otherwise be as influential as an honest one from its first measurement.

It also means a new worker's influence grows over time rather than arriving all at once. See How workers contribute to monitoring.

5. Require a floor before publishing

If the weighted evidence does not clear a minimum, the result is not enough data rather than a low-confidence verdict. There is no partial credit, and no "probably healthy".

6. Summarise worst-first

Where a group of results has to become one state, the worst state wins rather than the average. A continent with one country in outage is not "mostly operational": for the people in that country it is an outage, and an average would report the experience of nobody.

The same rule applies down the timeline: a week containing an outage day is an outage week.

What this cannot do

Consensus cannot detect a failure nobody measured. If no worker is in a region, that region's problems are invisible here, and the page says the region is uncovered rather than implying it is fine. The cure for a blind spot is a worker in it.