TTP EXTENSION · MEMBERSHIP AUTHORITY EQUIVOCATION

One epoch must not have two authentic membership histories.

SAME AUTHORITY + SAME MEMBERSHIP EPOCH + DIFFERENT AUTHENTIC MEMBERSHIP DIGESTS = EQUIVOCATION EVIDENCE.

A signature proves who issued one membership record. It does not prove the issuer did not sign another incompatible record for the same epoch. Consequential authorization therefore needs cross-view consistency, not only local signature validity.

Required comparison

• membership namespace
• issuer identity / key authority
• set epoch
• predecessor membership digest
• membership digest
• set identity and members
• threshold policy

Decision rule

AUTHENTICATE MEMBERSHIP M
        ↓
LOOK FOR AUTHENTIC PEER VIEW M_peer
AT SAME NAMESPACE + EPOCH
        ↓
same issuer?
same epoch?
same predecessor?
different membership digest?
        ↓
all true?
  ├─ yes → membership_authority_equivocation_detected
  │        → quarantine issuer
  │        → hold all disputed branches
  │        → 0 consequence
  └─ no
       ↓
CHECK MEMBERSHIP CURRENTNESS / ANTI-ROLLBACK
       ↓
VALIDATE QUORUM + HEAD + AUTHORITY VIEW
       ↓
FENCED CONSEQUENCE

Recovery

fork digests = [A, B]
        ↓
fresh higher epoch
        +
non-equivocating recovery authority
or explicit governance resolution
        +
bind A and B explicitly
        +
fresh quorum
        ↓
resume

I111–I114

• I111 — Same authority + same membership epoch + different authentic membership digests = equivocation evidence.
• I112 — Authentic membership record ≠ unique membership history.
• I113 — Membership-authority equivocation must hold all disputed branches and quarantine the equivocating issuer before consequence.
• I114 — Recovery requires a fresh higher-epoch membership from non-equivocating authority or explicit governance resolution binding all conflicting branch digests.

Failure disposition

membership_authority_equivocation_detected
→ no branch selection
→ no adoption
→ no external effect
→ preserve both records
→ quarantine issuer
→ obtain explicit higher-epoch resolution

This rule does not define production PKI, BFT reconfiguration, governance voting, transparency-log architecture or consensus finality. It defines the evidence invariant that same-epoch authentic membership forks must fail closed.