TTP EXTENSION · ROOT CURRENTNESS

Root authority is still temporal state.

The highest configured trust authority does not make every historical root record permanently reusable. Root currentness must be proven before consequence.

ROOT AUTHORITY ≠ TIMELESS AUTHORITY.

Rule

RECEIVE ROOT RECORD R
        ↓
AUTHENTICATE R
        ↓
VALIDATE ROOT-BOUND QUORUM + HEAD
        ↓
READ TRUSTED ROOT HIGH-WATERMARK H*
        ↓
R.epoch < H*.epoch ?
  ├─ yes → ROOT AUTHORITY ROLLBACK → HOLD
  └─ no
       ↓
R.epoch == H*.epoch
AND digest(R) != H*.digest ?
  ├─ yes → ROOT SAME-EPOCH CONFLICT → HOLD
  └─ no
       ↓
CURRENT ROOT AUTHORITY
       ↓
FENCED CONSEQUENCE

I123–I126

• I123 — ROOT AUTHORITY ≠ TIMELESS AUTHORITY.
• I124 — AUTHENTIC ROOT RECORD BELOW A TRUSTED ROOT HIGH-WATERMARK = ROOT-AUTHORITY ROLLBACK EVIDENCE.
• I125 — ROOT CURRENTNESS MUST BIND A MONOTONIC ROOT EPOCH AND ROOT-RECORD DIGEST BEFORE CONSEQUENTIAL AUTHORIZATION.
• I126 — A RETIRED ROOT RECORD MAY REMAIN HISTORICALLY VALID BUT MUST NOT REGAIN LIVE AUTHORITY AFTER A NEWER ROOT EPOCH IS OBSERVED.

Why both epoch and digest?

The epoch prevents backward movement. The digest prevents different same-epoch content from silently inheriting the trusted checkpoint.

Boundary

This rule assumes the root high-watermark itself has not been rolled back. Storage rollback and same-epoch root equivocation remain separate verification surfaces.