TTP EXTENSION · WITNESS-SET CURRENTNESS

A quorum is only as current as the membership authority behind it.

A historical quorum certificate can remain completely authentic after membership rotation. Consequential authorization therefore requires a second proof: the certificate must still bind the currently authorized witness set.

VALID QUORUM FOR AN OLD MEMBERSHIP ≠ CURRENT QUORUM AUTHORITY.

Required binding

QUORUM CERTIFICATE
  ↓
witness-set id
set epoch
membership digest
threshold policy
logical round
head identity
distinct signers

Currentness rule

AUTHENTICATE QC
      ↓
RESOLVE CURRENT MEMBERSHIP M_now
      ↓
COMPARE
- set identity
- set epoch
- membership digest
- threshold policy
      ↓
current?
  ├─ no → witness_set_authority_conflict
  │        → HOLD / 0 CONSEQUENCE
  └─ yes
       ↓
CHECK QUORUM CONSISTENCY
       ↓
CHECK HEAD + AUTHORITY VIEW + PROOF
       ↓
CURRENT OWNER ADOPTS
       ↓
FENCED COMMIT
       ↓
PROVE MEMBERSHIP → QC → HEAD → EFFECT

I103–I106

• I103 — Valid quorum for an old membership ≠ current quorum authority.
• I104 — Quorum certificate must bind witness-set identity, set epoch, membership digest, threshold policy, round, head identity and distinct signers.
• I105 — Adoption must resolve current witness-set authority and reject superseded membership before consequence.
• I106 — Membership rotation requires fresh current-set quorum evidence; old members remain historical evidence, not live authority.

Disposition

On membership mismatch, do not reinterpret the old certificate as false. Preserve it as historical evidence, reject it as live authority, resolve the current membership and obtain a fresh current-set quorum before consequence.

Boundary

This rule does not define production PKI, membership governance, dynamic BFT reconfiguration, synchrony assumptions or key lifecycle. It defines one evidence invariant: the quorum membership that authorizes consequence must be current at consequence time.