Read and understand how and why court configurations are set up the way they are then use the attack simulator to see how well the configs resists attacks.
Application settings
Requesting applications have two modes to configure the court: Automatic Mode for the recommended completely attack resistant court configuration or Manual Mode so they can configure the court in anyway to suit the unique, opinionated and unpredictable needs of customers.
DemoThemis sizes the court for you.
DEMOTHEMIS3The requesting application sizes the court itself.
YOUR APP3The application-side dials, fixed before a case is accepted.
YOUR APP5The protocol side no application can reach.
DEMOTHEMIS5The complete finite appeal panel configuration route and this schedule are locked together when the case is accepted.
3 jurors does not keep the modeled attack return negative. 5 jurors is the least costly option that keeps the credible attack uneconomic, holds expected corruption loss within $100, clears the quality and formation floors, and is fully funded. The separate 25% systemic-compromise stress is diagnostic and does not size this value-bounded court.
Thresholds, formation, on-demand replacements, and available capacity update with the selected court.
The full current-stage fee must be paid before jurors are drawn.
Juror work is priced from qualified supply, demand, workload, complexity, and response time. An application may authorize payment from escrow or another source, but it cannot reduce the live quote.
| Initial fee / escrow value | Guidance |
|---|---|
| Up to 5% | Ideal |
| Above 5% to 10% | Healthy |
| Above 10% to 20% | High but supported |
| Above 20% | External funding or no Automatic Mode draw |
The 20% limit applies only to the initial escrow contribution. Appeals are funded separately and cannot repeatedly deduct from the underlying escrow. With no escrow, the full fee is prepaid and no artificial percentage is shown.
The appeal panel configuration route is set before the first draw. Automatic Mode uses a published proportional appeal panel configuration route: a $1,000 case can start with one senior juror and appeal once to three fresh senior jurors; larger or riskier cases continue through wider rungs only when their economics require it. Manual Mode follows the appeal panel configuration route the requesting application precommitted. Neither mode can choose or reroll its jurors.
The one-roll rule
Set number of jurors available, % of juror pool corrupted by an attacker, and number of jurors per panel, and see how many random selections of juries it will take for the panel to be successfully captured by an attacker.
Protocol security floor
A one- or three-person microcase draws only from the senior-qualified cohort because each individual vote carries more quality weight. Every 31-seat draw also uses a private proof of long service. Seniority costs an honest juror nothing but takes an attacker years to fake. Projected fee-driven retention may disqualify a configuration, but it cannot inflate the frozen cohort used to claim security.
The ceiling
The biggest courts split into several 31-person panels with no shared jurors, and the ruling goes to whatever answer gets the most votes among the panels (1 panel = 1 vote). One panel gone wrong cannot decide or block a case alone. Capture odds are computed from the mechanics as they actually work. For example, the math accounts for the juror pool shrinking as jurors become unavailable, whether they are seated on another panel in the same case or served in an earlier appeal round of it. Past a certain size, extra seats in one panel add little safety, because a bad random draw is vanishingly rare and the bigger danger left is one room failing together through pressure or shared error. Splitting the court targets exactly that risk: the attacker must capture several independent rooms at once, cannot choose where their jurors land, and any luck in one panel drains their strength from the rest.
For example, with the assumptions set in the lab above, Automatic Mode keeps a $50m case in a single 31-juror panel, moves it to three panels of 31 near $60m, and to five panels of 31 near $90m. That is 93 and 155 voting seats. Only the value at stake and the cost of a credible attack drive that climb; the separate 25% systemic-compromise test never pushes a low-value case into these sizes. Every seat adds juror work, juror pay, and fee, and each one has to be filled from the eligible pool, so the quote covers all of them. If a drawn juror drops out, the draw continues from the same random sequence the case started with and takes the next unused position, so nobody sits on standby. If any stage, now or on appeal, lacks enough fresh eligible jurors to fill every seat, that stage is unavailable rather than quietly made smaller.
There is a real limit: bigger panels cannot repair a cohort whose attacker selection weight approaches 50%, and several panels cannot cure evidence that makes everyone wrong together. Pool health and shared-evidence quality remain separate admission checks.
Disputes
Automatic Mode appeals redraw at the next wider stage. A Manual Mode court follows its own precommitted appeal panel configuration route, which may repeat a panel size but always draws fresh jurors. Once a juror serves on a dispute, every later panel and appeal excludes them. The appeal service fee is the sum of panel work and delay compensation. The security target is capture odds times the stake; only any amount above the service fee is locked as a separate security bond.
An appeal begins only when its full precommitted quote is funded before the deadline. One contributor or many may fund it. If the goal expires short, every contribution is refunded and no jury starts. Once fully funded, the service fee pays the new panel and credits delay compensation under the case's precommitted rule. If the appeal succeeds, the escrowed security bond returns to contributors pro-rata; if it fails, only that security bond enters the reward pool.
Before acceptance, every case fixes a finite appeal panel configuration route, an initial appeal-funding window of up to one year, and a reduction of at least 15% for each later window. It may also keep every window open for at least 24 hours. These windows measure time available to fund appeals, not juror selection or deliberation. When a window expires without an appeal, or the appeal panel configuration route ends, the ruling becomes final; attached escrow, if any, settles.
Shown time is appeal-funding time. The terminal court is final immediately because no later appeal exists.
No deadline, and no final ruling or completed settlement held hostage.
The appeal funding quote
The capture target is probability times stake, not the whole stake. A ten-million-dollar case does not automatically require a ten-million-dollar security bond. In a wide pool, a small bloc almost never wins a panel majority, so the non-refundable service fee can already exceed the anti-re-roll target and no extra security is needed.
An Automatic Mode case starts at its proportional court and can buy only the next precommitted stage: 1 → 3 → 5 → 7 → 15 → 31 → 3 × 31 → 5 × 31. The $1,000 microcase appeal panel configuration route ends after its fresh three-person appeal. A Manual Mode case follows the next stage in its precommitted appeal panel configuration route. Either may use escrow or return only a signed ruling. Every quote identifies its funding source and destination: contributors fund all new panel work and delay compensation once, while separately escrowed security principal supplies the success refund or failure forfeiture.
Robustness game
Pressure DemoThemis from every angle and watch six independent protections respond. Automatic Mode sizes against the value and cost of a credible attack; a separate 25% coalition remains visible as a systemic stress test, not a universal low-value sizing gate.
Attack economics
Choose a benchmark, change the conditions, or remove one required protection. Robust means credible attacks have negative expected return, expected corruption loss stays inside the published budget, and every operating floor holds.
What the game shows
Demand funds participation, random panels resist control, private ballots block proof of any single vote, live checks weaken rentals, pending pay prices careless work, and shared case evidence protects decision quality. Within one dispute, every parallel panel and appeal is disjoint: once a juror serves, they can never be drawn again for that dispute or any of its appeals. Later independent answers add confirmation when available. Robustness comes from the stack, not from any single switch.