TRANSACTIONAL TRUST · VERIFIED #036

The quorum was valid. Its membership was no longer in charge.

Verified #035 made quorum consistency explicit. #036 attacks the authority configuration itself: after witness membership rotates from set-A / epoch 1 to set-B / epoch 2, the old W1+W2 quorum remains perfectly authentic under its historical membership — and is unsafe if a verifier mistakes that historical validity for current authority.

VALID QUORUM FOR AN OLD MEMBERSHIP ≠ CURRENT QUORUM AUTHORITY.

The rotation

M1:
set-A / epoch 1
W1 W2 W3
threshold = 2

M2:
set-B / epoch 2
W4 W5 W6
threshold = 2
successor_of = set-A

Both membership records authenticate. Rotation changes current authority; it does not erase the historical record.

The old quorum is still valid

QC-old-epoch1:
W1 + W2
set-A / epoch 1
membership_digest = digest(M1)
round = 60
H7 / generation 7

signatures valid ✅
2-of-3 satisfied ✅
QC valid under M1 ✅

Unsafe: historical membership becomes live authority again

validate QC-old against M1
H7 authentic = true
region-B = R1 / generation 7 / ACTIVE

→ historical_membership_quorum_authorized
→ adoption rows = 1
→ HTTP 200
→ effect_count = 1

The bug is not cryptographic. The verifier never resolved which witness set is currently authorized.

Safe: current membership dominates

QC-old:
set-A / epoch 1 / digest(M1)

current membership:
set-B / epoch 2 / digest(M2)

same_current_set = false
→ witness_set_authority_conflict
→ adoption rows = 0
→ effects = 0

Fresh current-set recovery

QC-current-epoch2:
W4 + W5
set-B / epoch 2
membership_digest = digest(M2)
round = 61
H9 / generation 9

→ current_membership_quorum_authorized
→ adoption rows = 1
→ HTTP 200
→ effect_count = 1
→ output = 30

I103–I106

• I103 — Valid quorum for an old membership ≠ current quorum authority.
• I104 — Quorum certificate must bind witness-set identity, set epoch, membership digest, threshold policy, round, head identity and distinct signers.
• I105 — Adoption must resolve current witness-set authority and reject superseded membership before consequence.
• I106 — Membership rotation requires fresh current-set quorum evidence; old members remain historical evidence, not live authority.

Evidence

GitHub Actions run: 31617000939
Job: 94182207065
Benchmark SHA:
d13b424e775e098fbbafa4461ea0f572f8fd7774
Artifact ID: 9149649881
Artifact digest:
sha256:827ead873af366a27a19958413887356079c5afc0d22bdfe9fff6f9ea6e6c459
Score: 10/10

Boundary

The benchmark uses deterministic HMAC identities and explicit membership records. It does not implement production PKI, membership governance, BFT reconfiguration or distributed membership propagation. A stale or replayed membership-authority view is a separate verification surface.