TRANSACTIONAL TRUST · VERIFIED #031

The head looked fresh. It was forged.

A monotonic generation watermark only protects a verifier if the watermark itself is authentic. A forged lower head can make a stale regional authority replica appear current unless authenticity is checked before freshness.

The setup

real authority:
generation 8
R1 = REVOKED

stale region-B:
generation 7
R1 = ACTIVE

Origin emits an authenticated generation-8 head. The benchmark then mutates that signed payload back to generation 7 while keeping the generation-8 MAC.

Unsafe: trust the claimed number

regional generation = 7
claimed head = 7
R1 = ACTIVE
proof generation = 7

→ looks fresh
→ adoption rows = 1
→ HTTP 200
→ effect_count = 1
→ output = 30

The forged head does not authenticate. The unsafe verifier simply never checks.

Safe: authenticate before freshness

verify key id
verify authority namespace
verify canonical payload
verify MAC

→ authority_head_authentic = false
→ authority_head_authentication_failed
→ adoption rows = 0
→ effects = 0

Only after authentication may a verifier use the embedded generation as a freshness fence.

The authentic head restores the correct decision

authentic head generation = 8
region-B generation = 7

→ stale_authority_view
→ 0 rows
→ 0 effects

After propagation, region B converges to R1 / generation 8 / REVOKED and rejects the old proof. A fresh R2 proof with an authentic generation-9 head then succeeds with one effect.

I83–I86

• I83 — Freshness claim ≠ authentic freshness evidence.
• I84 — Authority head identity, domain, generation and content must be authenticated before they can fence consequence.
• I85 — Unauthenticated or tampered authority head → hold before regional freshness evaluation.
• I86 — Authentic head evidence can fence a stale replica, but authentic old-head replay requires an additional monotonicity mechanism.

DO NOT TRUST THE WATERMARK UNTIL YOU TRUST THE WATERMARK'S EVIDENCE.

Evidence

GitHub Actions run: 31605405137
Artifact ID: 9144883220
Artifact digest:
sha256:a9dd4504ae0f88f6caf5c2dc8dc896598515beed3ed4ebbbe2bdf5976b1a1d43
Score: 10/10

The HMAC fixture models authentication and tamper detection only. It is not a production PKI design or external safety certification. Replay of an older but authentic head is intentionally left for a separate benchmark.