TRANSACTIONAL TRUST · VERIFIED #035

Both majorities were valid. They disagreed about reality.

Verified #034 showed that one witness can fork its history. #035 raises the bar: two different verifiers each obtain a locally valid 2-of-3 quorum certificate for incompatible authority heads at the same witness-set epoch and logical round.

LOCAL QUORUM ≠ GLOBALLY CONSISTENT QUORUM.

The split brain

witness set = {W1, W2, W3}
threshold = 2-of-3
set epoch = 1
round = 50

QC-A → H9
W1 + W2

QC-B → H7
W2 + W3

QC-A valid ✅
QC-B valid ✅
QC-A.head != QC-B.head

Each certificate independently satisfies the same local threshold policy.

Unsafe: isolated majority

verifier-B sees only QC-B
H7 authentic = true
QC-B valid = true
regional replica = R1 / generation 7 / ACTIVE

→ local_quorum_authorized_current_head
→ adoption rows = 1
→ HTTP 200
→ effect_count = 1

The arithmetic is correct. The view is incomplete.

Safe: quorum intersection

QC-A signers = {W1, W2}
QC-B signers = {W2, W3}
intersection = {W2}

W2 signed H9 at round 50
W2 signed H7 at round 50
both statements authentic = true

→ conflicting_quorum_certificates
→ adoption rows = 0
→ effects = 0

The safe verifier does not choose the more convenient majority. The overlapping contradictory signer turns the two local certificates into explicit global conflict evidence.

Quarantine and recovery

quarantine W2

old QC-A active signers = {W1}
→ below threshold

old QC-B active signers = {W3}
→ below threshold

round 51:
W1 + W3 → H9
→ fresh 2-of-3 certificate
→ adoption rows = 1
→ HTTP 200
→ exactly 1 effect

Conflict handling removes disputed authority without permanently freezing the system.

I99–I102

• I99 — Local quorum ≠ globally consistent quorum.
• I100 — Quorum certificate must bind witness-set identity, set epoch, logical round, head identity and distinct signers.
• I101 — Conflicting locally valid quorum certificates for the same set epoch and round require intersection/equivocation check and hold before consequence.
• I102 — Equivocating intersection members must be quarantined; resume only with a non-conflicting threshold certificate excluding quarantined authority.

Evidence

GitHub Actions run: 31616232956
Job: 94179611299
Benchmark SHA:
74076e8aab3aed95f3d52ecec8b8efd4f9504b9a
Artifact ID: 9149326423
Artifact digest:
sha256:4b41a442c86b03438df17fd8663a85d1609d2f33390ed73c6d73f3053660ceda
Score: 10/10

Boundary

The benchmark uses deterministic HMAC test identities and explicit cross-view comparison. It is not a production Byzantine consensus implementation, quorum-system proof, PKI design or safety certification. Dynamic membership, colluding threshold majorities, network delivery and reconfiguration remain separate verification surfaces.