Hi bytemaster, and BitShares crew. I was just at the CoinSummit conference & met Brian who suggested that I look into BitShares.

My primary concern is in determining whether the TaPoS would work as promised, and it looks like some answers are here.

Suppose someone with 1 share, holds it for 1 year, and then creates a fork with 100,000 CDD.   In reality there is only 1 share worth of support for that fork.   The rest of the 99,999 CDD is voting for the global consensus on the first 99,999 blocks prior to the fork.

This significantly raises the bar for an attacker.   Worst case, everyone on average moves their funds once per year.  This means that the average votes cast per block is 40 BTS.  To produce a chain that is 12 blocks longer (1 hour) would require 480 BTS to tie the honest chain.

So I take it that there are about 4 million BTS in total. (~100K blocks in a year * 40 BTS per block).
It sounds like you determine the honest chain by some algorithm like this: Given that you are on an honest block, the next honest block is the block with the most votes.

Now the attack isn't actually guaranteed even when an attacker has 2500 BTS.  Honest nodes would recognize an attempted fork when there was no perceived loss of network connectivity.   Someone with a lot at stake (say an exchange, a day trader, etc) would not want a fork under any circumstances if they could help it.   These players could secure the network (and their recent trades) by moving a 1000 BTS per block to themselves.   This would increase the cost of an attack significantly.

It sounds like the short term security of the chain (proof against double-spends) is determined by how many BTS are available for signing by internet connected hot-wallets that are ready to jump in when a malicious blockchain-fork is detected. Exchanges can't do this with their cold wallet private keys, but they could with hot wallet keys which would amount to maybe 2000 BTS per major exchange. Let's say that in the worst case, 10,000 BTS is available for reactive signing to secure the honest chain. Then, anyone with more than 10,000 BTS can launch an attack. If BTS equaled BTC in market cap, that is around $15M?

Furthermore, based on the first quoted line above, an attack can be continuous, so a larger sustained attack would require people to keep funds that would have been in cold storage on a hot wallet.