TTP EXTENSION · WITNESS HISTORY

Witness Consistency / Equivocation Rule

A witness can be independent from verifier storage and still fork the history it presents. Before witness evidence can anchor checkpoint recovery or consequential authorization, its history must be consistency-checked across views.

INDEPENDENT WITNESS ≠ CONSISTENT WITNESS.

Decision rule

RECEIVE WITNESS STATEMENT W
        ↓
AUTHENTICATE W
        ↓
BIND witness_id + sequence + parent + head_digest
        ↓
GOSSIP / CROSS-CHECK WITNESS VIEW
        ↓
conflicting authentic statement
for same witness sequence + parent?
  ├─ yes → witness_equivocation_detected → HOLD
  │          ↓
  │      QUARANTINE WITNESS
  │          ↓
  │      RESOLVE NON-CONFLICTING INDEPENDENT EVIDENCE
  │          ↓
  │      RECONSTRUCT TRUST CHECKPOINT
  └─ no
        ↓
VERIFY WITNESS → HEAD → CHECKPOINT CURRENTNESS
        ↓
VERIFY AUTHORITY VIEW / RULE / PROOF
        ↓
CURRENT OWNER ADOPTS
        ↓
FENCED COMMIT
        ↓
PROVE WITNESS CONSISTENCY → CHECKPOINT → HEAD → EFFECT

Why authenticity is not enough

A valid signature or MAC proves that the witness issued a statement and that its bytes were not modified. It cannot prove that the same witness did not issue a different incompatible statement for the same logical history position.

I95–I98

• I95 — Independent witness ≠ consistent witness.
• I96 — Authentic witness statement ≠ unique witness history.
• I97 — Same witness sequence + same parent + different authentic content = equivocation evidence.
• I98 — Equivocating witness must be quarantined; reconstruct trust from non-conflicting independent evidence before consequence.

Direct fork evidence

same witness_id
+ same witness_seq
+ same parent digest
+ both statements authentic
+ different statement digests
= witness_equivocation_detected

Recovery

equivocation detected
→ preserve both signed branches
→ HOLD
→ quarantine conflicted witness
→ resolve policy-approved non-conflicting evidence
→ reconstruct checkpoint
→ re-run authority-head currentness
→ only then resume consequence

Boundary

Verified #034 models gossip by explicitly presenting two signed statements to one verifier and recovers from a second non-conflicting witness. Production systems may require transparency logs, quorum witnesses, consensus, hardware roots or another independently justified consistency mechanism. Conflicting witness majorities remain an open verification surface.