TTP EXTENSION · AUTHORITY HEAD AUTHENTICITY

Freshness claim ≠ authentic freshness evidence.

A generation watermark cannot safely prove authority-view currentness until the exact head statement that carries it has been authenticated.

Canonical rule

RECEIVE AUTHORITY HEAD H
↓
AUTHENTICATE
- trusted signer / key
- authority namespace
- canonical payload
- integrity / signature
↓
authentic?
├─ no → HOLD / REJECT HEAD
└─ yes
   ↓
EXTRACT AUTHENTICATED GENERATION G
   ↓
COMPARE REGIONAL VIEW >= G
   ├─ no → STALE AUTHORITY VIEW → HOLD
   └─ yes
      ↓
   CHECK RULE STATUS / DIGEST / GENERATION
      ↓
   CHECK PROOF + SCOPE
      ↓
   CURRENT OWNER ADOPTS
      ↓
   FENCED COMMIT
      ↓
PROVE HEAD AUTHENTICITY → VIEW CURRENTNESS → PROOF AUTHORITY → EFFECT

I83–I86

• I83 — Freshness claim ≠ authentic freshness evidence.
• I84 — Authority head identity, domain, generation and content must be authenticated before they can fence consequence.
• I85 — Unauthenticated or tampered authority head → hold before regional freshness evaluation.
• I86 — Authentic head evidence can fence a stale replica, but authentic old-head replay requires an additional monotonicity mechanism.

Minimal decision

IF head.authentication_valid
AND head.authority_domain_is_expected
THEN
  use head.generation as freshness fence
ELSE
  hold before evaluating replica freshness

THEN IF regional_generation < authenticated_head_generation
  hold as stale_authority_view

AUTHENTICATE FIRST. COMPARE FRESHNESS SECOND.

Boundary

Verified #031 uses a deterministic HMAC-SHA256 test fixture to isolate tamper detection. The protocol does not require a particular cryptographic primitive. Authentic-but-old head replay remains a separate currentness problem.