TRANSACTIONAL TRUST · VERIFIED #034

The witness was independent. Its history was not unique.

Verified #033 used an external witness to recover trust history after checkpoint storage rollback. #034 attacks that assumption: the same witness signs two different authenticated children at one witness sequence and parent, giving isolated verifiers two locally valid realities.

INDEPENDENT WITNESS ≠ CONSISTENT WITNESS.

The fork

WA42:
witness-A / seq 42 / generation 7

WA43-good:
witness-A / seq 43
parent = digest(WA42)
generation = 9
MAC valid ✅

WA43-fork:
witness-A / seq 43
parent = digest(WA42)
generation = 7
MAC valid ✅

Both sequence-43 statements authenticate under the same witness identity, but their statement digests differ. They cannot both occupy one linear history.

Unsafe: isolated verifier

local checkpoint = 7
H7 authentic = true
WA43-fork authentic = true
regional replica = R1 / generation 7 / ACTIVE

→ witness_authorized_current_head
→ adoption rows = 1
→ HTTP 200
→ effect_count = 1

No signature fails. The verifier simply cannot see the other branch.

Safe: gossip exposes the contradiction

same witness_id = true
same witness_seq = 43
same parent = true
both authentic = true
statement digests differ = true

→ witness_equivocation_detected
→ adoption rows = 0
→ effects = 0
→ quarantine witness-A

The verifier does not choose the more permissive branch. The fork itself becomes first-class trust evidence.

Recovery

witness-B:
generation 9
head_digest = digest(H9)
MAC valid ✅

checkpoint:
7 → 9
reason = checkpoint_reconstructed_from_independent_witness

H7 after recovery:
7 < 9
→ authority_head_rollback_detected

After region B synchronizes to R2/generation 9, authentic H9 plus the non-conflicting witness-B statement succeeds exactly once.

I95–I98

• I95 — Independent witness ≠ consistent witness.
• I96 — Authentic witness statement ≠ unique witness history.
• I97 — Same witness sequence + same parent + different authentic content = equivocation evidence.
• I98 — Equivocating witness must be quarantined; reconstruct trust from non-conflicting independent evidence before consequence.

Evidence

GitHub Actions run: 31615206797
Job: 94176189614
Benchmark SHA:
6021d88d946e1e91b54a8c64b4bd8c1ed2f48668
Artifact ID: 9148905171
Artifact digest:
sha256:05b958a9d258fbdc8dfd5c0d5680782ce01f12ee66c486b315299471913b0036
Score: 10/10

Boundary

The benchmark uses deterministic HMAC identities and explicit cross-view comparison. It does not implement production PKI, gossip transport, transparency logs, Byzantine consensus or a universal quorum policy. Multi-witness disagreement and conflicting majorities remain separate verification surfaces.