# Federation > Allocator announce-and-listen, nested local-to-regional domains, missing-announcement conservative clearing, and partition that does not trip unrelated members. - Repository: g2tf-org/g2tf-standards - GitHub: https://github.com/g2tf-org/g2tf-standards - Human docs: https://grok-wiki.com/public/docs/g2tf-org-g2tf-standards-436ba3f3e0ff - Complete Markdown: https://grok-wiki.com/public/docs/g2tf-org-g2tf-standards-436ba3f3e0ff/llms-full.txt ## Source Files - `architecture/federation.md` - `architecture/allocation-domains.md` - `architecture/failsafe-model.md` - `specs/g2p/spec.md` - `specs/gcap/spec.md` - `members/allocator.md` --- --- title: "Federation" description: "Allocator announce-and-listen, nested local-to-regional domains, missing-announcement conservative clearing, and partition that does not trip unrelated members." --- Grid 2 federation is the **Allocator ↔ Allocator** pattern in `architecture/federation.md`: peer Allocators exchange G2P **Federation Announcements** across coupled zones, then each runs local GCAP against **its own domain’s Grid 1 custodian constraints**. Domains do not command one another. The living files (`architecture/federation.md`, `specs/g2p/spec.md` §3.3, `specs/gcap/spec.md` §2, `members/allocator.md`) are **26.0-draft / Draft — seeking input**; the announcement **message schema is not specified**. RFC #1 (`rfcs/grid-2-rfc-1.pdf`, Protocol Interactions and §Extensible System-Wide Architecture) is the archival source. Evolution happens in the living specs, not in the RFC. Two “partition” rules coexist and must not be collapsed. Missing **peer** announcements force **conservative local clearing**. Stale **Grid 1 constraint inputs** or a **partition of the Allocator from its own Members** force **no clearing** and Member fallback. See [Failsafe model](/failsafe-model). ## Two interaction patterns Every protocol interaction is one of these two. There is no third control plane. | Pattern | Direction | What is exchanged | Who decides | |---|---|---|---| | **Member ↔ Allocator** | In-zone | Service Descriptors in; per-class `commit-%`, Buffer committed dispatch, Source committed take out | Local GCAP | | **Allocator ↔ Allocator** | Coupled zones | Federation Announcements (announce-and-listen) | Each Allocator, from **its** Grid 1 custodians | Member ↔ Allocator is specified in G2P §3.1–3.2 / §3.4 and GCAP. Allocator ↔ Allocator is G2P §3.3 plus the federation MUST/MUST NOT set below. Allocation decisions stay anchored in Grid 1 inputs (zone capacity, transmission constraints, target reserves, optional DLR / distribution factors). Peer announcements **inform**; they never become the authority. Design style in the living architecture: autonomous domains with BGP-style cross-awareness. Domains announce, listen, and clear locally. ## Nested constraint domains A **Grid 2 Allocation Domain** is the set of Member Elements cleared by a common Allocator (or Allocator hierarchy) against a common Grid 1 constraint set. Nesting is: `local transmission congestion zone → utility / balancing authority → regional RTO/ISO` An Allocator’s associated scope is a constraint domain at **any** level: transmission line → utility load zone → RTO region. A regional system operator MAY additionally provision capacity constraints to a regional Allocator. Authority remains with Grid 1 custodians; the protocol does not mint authority. ```text Regional Constraint Domain ──────────────── Allocator(s) ├── Utility "A" Constraint Domain ───────── Allocator(s) │ └── Local Constraint Domain ─────────── Allocator(s) │ ├── Large Load A1 (Use Member) │ ├── Large Load A2 (Use Member) │ └── Storage A1 (Buffer Member) ├── Utility "B" Constraint Domain ───────── Allocator(s) │ └── Local Constraint Domain ─────────── Allocator(s) │ ├── Large Load B1 (Use Member) │ └── Storage B1 (Buffer Member) ├── Supply (Source Member, regional) └── Storage (Buffer Member, regional) ``` The smallest on-ramp is **one host utility + one flexible load**. Federation is how that local domain later couples to sister utility and regional domains. Commercial terms stay outside the protocol. A Member present in overlapping local + regional domains is an **open item**. ```mermaid flowchart TB subgraph regional["Regional constraint domain"] RA["Regional Allocator(s)"] RS["Regional Source / Buffer Members"] subgraph utilA["Utility A domain"] AA["Utility A Allocator(s)"] subgraph locA["Local constraint domain"] LA["Local Allocator(s)"] U1["Use A1"] U2["Use A2"] B1["Buffer A1"] end end subgraph utilB["Utility B domain"] AB["Utility B Allocator(s)"] subgraph locB["Local constraint domain"] LB["Local Allocator(s)"] U3["Use B1"] B2["Buffer B1"] end end end TO["Grid 1 custodians\nTO constraints; RSO MAY add regional capacity"] TO --> LA TO --> LB TO --> AA TO --> AB TO --> RA LA <-->|"G2P §3.3 Federation Announcement"| AA LB <-->|"G2P §3.3 Federation Announcement"| AB AA <-->|"G2P §3.3"| RA AB <-->|"G2P §3.3"| RA ``` ## G2P Federation Announcement G2P v26.0-draft defines **four** per-interval message families. Federation is family **3.3**. | Family | Path | Role in federation | |---|---|---| | §3.1 Service Descriptor | Member → Allocator | In-zone requests/offers only | | §3.2 Commitment | Allocator → Member | Local clearing output; missing/stale → Member fallback | | **§3.3 Federation Announcement** | **Allocator ↔ Allocator** | Coupled-zone announce-and-listen | | §3.4 Response / Telemetry | Member → Allocator | Verified self-dispatch; not an inter-Allocator control | Required announcement identity (schema still TBD in G2P): Domain that originated the announcement. Element IDs are open; G2P recommends a domain-scoped hierarchical ID mirroring this nesting. All G2P families are bound to the one-minute clock unless noted. Interval phase alignment across federated domains (common epoch vs per-domain clocks) is open. Quantities at the coupled boundary. Whether this is **boundary headroom only** or **per-class aggregates** is an open item. G2P §6 currently requires authentication on **Service Descriptors and Commitments**. Federation Announcement authentication, replay protection, PKI, and NERC CIP mapping are **not** specified. Transmission-level deployments are expected on private networks. Wire format, encoding, version negotiation, and conformance vectors are listed under G2P “To be specified.” G2P §3.2 Commitments MUST identify interval, domain, and the **clearing-inputs version**. GCAP SHOULD publish (in-domain) the input digest each Commitment was computed against. Peer announcements are a GCAP input; they MUST NOT appear as a way to rewrite local Grid 1 limits. ## GCAP: how a peer announcement is used Each interval, GCAP clears against exactly three input classes: 1. **Grid 1 constraints** from the domain’s custodians (required): zone production capacity, transmission constraints, target reserves; optionally distribution factors and DLR dynamics. 2. **Member Service Descriptors** in-zone (G2P §3.1). 3. **Peer-Allocator announcements** across coupled zones (G2P §3.3). Peer announcements **MAY add boundary headroom** and **MUST NOT relax local constraints**. An Allocator MUST clear only against constraints provisioned by **its own** domain’s Grid 1 custodians. Clearing order is unchanged by federation: headroom → Buffers (before any load curtailment) → DESP C → B → A, proportional within class. Outputs remain per-class `commit-%`, Buffer committed dispatch, and Source committed take for **the coming interval only**. ## Normative federation rules | Rule | Binding text | Implementer consequence | |---|---|---| | Local authority | MUST clear only against own-domain Grid 1 custodian constraints | Peer data is advisory capacity at the boundary, not a substitute limit | | Carry path | Federation announcements MUST be carried via G2P | No out-of-band Allocator-to-Allocator control channel is specified | | Identity | MUST identify announcing domain, interval, and coupled-boundary quantities | Drop or reject announcements that cannot be bound to those three | | Missing peer announcement | MUST clear **conservatively** as if the coupled boundary contributes **no additional headroom** | Do not invent imported capacity; do not stall the local interval | | Peer partition | MUST degrade to independent local operation | Partition between peer Allocators MUST NOT prevent local clearing | | Unrelated members | MUST NOT trigger Member fallback in **unaffected** domains | A sister-domain outage is not a local failsafe event | | Stale Grid 1 inputs / domain partition | Allocator MUST NOT clear | Members that miss a Commitment fall back per element (Use / Buffer / Source) | ```mermaid sequenceDiagram participant MA as Domain A Members participant AA as Allocator A participant G1A as Domain A Grid 1 custodians participant AB as Allocator B participant MB as Domain B Members Note over MA,MB: One-minute interval N G1A->>AA: Provision local and regional constraints MA->>AA: G2P 3.1 Service Descriptors AB-->>AA: G2P 3.3 Federation Announcement alt Announcement present and usable AA->>AA: GCAP: MAY add boundary headroom; MUST NOT relax local limits else Required peer announcement missing AA->>AA: Conservative clear: boundary headroom = none end AA->>MA: G2P 3.2 Commitment for interval N AA-->>AB: G2P 3.3 Federation Announcement Note over MB: Domain B continues independently if A is partitioned ``` ## Partition and failsafe (do not trip unrelated members) Treat these as different faults. ### Peer-Allocator partition (federation plane) - Required §3.3 announcements for a coupled boundary do not arrive. - Allocator A still has fresh **local** Grid 1 inputs and in-zone descriptors. - A **MUST** still clear, treating imported boundary headroom as **zero**. - Members in A that receive a timely Commitment **MUST NOT** be pushed into fallback solely because B is unreachable. - Members in B follow B’s own local rules. Partition at the A–B coupling does not cascade. ### Domain partition or stale constraint inputs (Allocator failsafe) From `members/allocator.md`, GCAP §5, and `architecture/failsafe-model.md`: - If the Allocator’s **constraint inputs are stale**, or **the domain is partitioned** from the conditions needed to clear, the Allocator **MUST NOT clear**. - Members that do not receive a current-interval Commitment MUST treat themselves as in fallback (Use → Grid 1 firm limit / manual curtailment; Buffer → standalone Grid 1 schedule, no Grid 2 support commitment; Source → Grid 1 interconnection baseline). All transitions MUST honor agreed ramp rates. - Fallback MUST be locally determinable. It MUST NOT require reaching a remote peer. RFC #1’s Protocol Interactions table states Allocator failsafe as “Stale/partitioned → no clearing.” The living federation file **narrows** that for **peer** loss: missing announcements are conservative clearing, not a domain-wide withhold. Whole-pool fallback ramp sizing still binds **each** domain independently. Federation does not move that obligation to the regional parent. Active/standby Allocator redundancy per domain is an open item. ## Adopt locally, then federate RFC #1 §Phased Adoption and `architecture/design-principles.md`: | Phase | Name | Federation surface | |---|---|---| | **0** | Shadow Mode | Run the stack as a dry run; track commitments; execute only the Grid 1 baseline | | **1** | Local Vertical Integration | Groups of large loads, transmission owners, and LSEs prove the domain inside existing rules | | **2** | Regional Federation | Peer entities running the same spec interoperate; inter-domain advertisements and policy | Phase 2 **milestone criteria** are explicitly open in `architecture/federation.md`. Provision Grid 1 constraints from the transmission owner. Clear one Allocator against in-zone Members. No peer announcements required. See [Minimum viable domain](/minimum-viable-domain) and [Provision constraint inputs](/provision-constraint-inputs). Exchange and track G2P Commitments. Physical dispatch stays on the Grid 1 baseline until the domain is ready to honor `commit-%`. Each Allocator continues to clear against **its** custodian limits. Import at most announced boundary headroom. If the peer is silent, clear as if that boundary adds nothing. Drop the peer announcement path. Confirm local Commitments still publish and that Members in the live domain do **not** enter fallback. Confirm the isolated peer’s Members follow **that** domain’s own stale/missed-Commitment rules only. ## Open items (do not invent) `architecture/federation.md`, G2P, GCAP, and `architecture/temporal-position.md` leave these unspecified: - Announcement payload: boundary headroom only vs per-class aggregates - G2P §3.3 message schema, wire format, and state machines - Loop prevention and path attributes in multi-level hierarchies - Inter-domain policy (who may import whose headroom) - Phase 2 milestone criteria - Interval phase alignment across federated domains - Hierarchical element-ID format - Overlapping-domain membership (local + regional) - Allocator redundancy (active/standby) - Authentication requirements specific to Federation Announcements ## Next Nested domains, transmission-owner authority, voluntary membership. Deterministic clearing, federation broadcasts/listens, withhold-on-stale. Element fallbacks, interval-only commits, locally determinable revert. Four message families including §3.3 Federation Announcement. Peer announcements as inputs that must not relax local limits. Required Grid 1 set and the no-relax-from-peers rule. Dry-run now; Phase 2 federation only after local proof.