TTP EXTENSION · MEMBERSHIP AUTHORITY CURRENTNESS

Authentic membership is not enough. Authority history must not move backward.

A witness-membership record may remain perfectly authentic after a successor configuration takes over. The verifier therefore needs monotonic evidence of which membership epoch it has already trusted.

AUTHENTIC MEMBERSHIP RECORD ≠ CURRENT MEMBERSHIP AUTHORITY.

Decision rule

RECEIVE MEMBERSHIP M + QUORUM QC
        ↓
AUTHENTICATE M
        ↓
READ TRUSTED MEMBERSHIP CHECKPOINT C
        ↓
M.epoch < C.epoch?
  ├─ yes → membership_authority_rollback_detected
  │         → HOLD / 0 CONSEQUENCE
  └─ no
        ↓
M.epoch == C.epoch?
  ├─ yes → REQUIRE SAME SET ID + DIGEST + THRESHOLD
  └─ no  → REQUIRE AUTHENTIC FORWARD LINEAGE
            BEFORE ADVANCING C
        ↓
VALIDATE QC AGAINST CURRENT M
        ↓
CHECK QUORUM CONSISTENCY
        ↓
CHECK AUTHORITY HEAD / VIEW / PROOF
        ↓
FENCED CONSEQUENCE

Required bindings

• membership namespace;
• witness-set identity;
• monotonic set epoch;
• membership digest;
• exact member identities;
• threshold policy;
• predecessor / successor lineage evidence;
• issuance generation when relevant.

I107–I110

• I107 — Authentic membership record ≠ current membership authority.
• I108 — Membership currentness must bind to a monotonic set-epoch / membership-digest checkpoint or equivalent anti-rollback evidence.
• I109 — Authentic membership below the trusted membership high-watermark must fail closed before consequence.
• I110 — Fresh current-membership quorum evidence is required to restore live authority after rotation.

Failure disposition

membership_authority_rollback_detected
→ preserve trusted high-watermark
→ no adoption
→ no external effect
→ resolve current membership
→ require current-set quorum evidence

Boundary

This rule does not define production membership governance, PKI, BFT reconfiguration, transparency logs or distributed checkpoint witnesses. It defines the narrower safety invariant: membership authenticity must be combined with monotonic currentness evidence.