TRANSACTIONAL TRUST · VERIFIED #039

The recovery was signed. Then the recovery authority created two recoveries.

Verified #038 used an independent recovery authority to resolve a membership fork. #039 attacks that assumption: the same recovery issuer signs two different epoch-3 resolutions for the same preserved dispute, and each branch carries a locally valid quorum.

AUTHENTIC RECOVERY RECORD ≠ UNIQUE RECOVERY HISTORY.

The recovery fork

R3-A:
issuer = membership-recovery-authority-demo-key-v1
set-D / epoch 3
W10 W11 W12 / threshold 2
resolves = [M2-A, M2-B]
authentic ✅
digest = sha256:96ba32f2...

R3-B:
same issuer
set-E / epoch 3
W13 W14 W15 / threshold 2
same dispute set
authentic ✅
digest = sha256:fc503419...

Both recovery worlds validate

QC-A = W10 + W11 → H9
valid under R3-A ✅

QC-B = W13 + W14 → H9
valid under R3-B ✅

Unsafe isolation

verifier sees only R3-B + QC-B
R3-B authentic = true
QC-B valid = true
H9 authentic = true

→ isolated_recovery_branch_authorized
→ adoption rows = 1
→ HTTP 200
→ effect_count = 1

Safe cross-view guard

same recovery issuer = true
same recovery epoch = 3
same dispute set = true
both authentic = true
different resolution digest = true

→ recovery_authority_equivocation_detected
→ R3-A effects = 0
→ R3-B effects = 0
→ quarantine recovery issuer

The verifier does not choose whichever recovery arrived first. The recovery conflict is itself evidence.

Recovery from recovery

R4:
issuer = independent governance-resolution authority
set-F / epoch 4
W16 W17 W18 / threshold 2

binds = [digest(R3-A), digest(R3-B)]

QC-final = W16 + W17 → H9

→ recovery_equivocation_resolved_by_governance_epoch4
→ adoption rows = 1
→ HTTP 200
→ effect_count = 1

I115–I118

• I115 — Authentic recovery record ≠ unique recovery history.
• I116 — Same recovery authority + same recovery epoch + same dispute set + different authentic resolution digests = equivocation evidence.
• I117 — Recovery-authority equivocation must hold all disputed resolution branches and quarantine the issuer before consequence.
• I118 — Recovery from recovery-equivocation requires a higher-epoch independent resolution binding every conflicting recovery digest.

Evidence

GitHub Actions run: 31619761478
Job: 94191344408
Benchmark SHA:
fbb8d596e526785676b10f5c0dcf3d666d0cae3f
Artifact ID: 9150741985
Artifact digest:
sha256:14f960e31edaabab4e599910387685cdf6dca51cd89cda995a0d6ebe29384677
Score: 10/10

Boundary

The benchmark uses deterministic HMAC identities and an explicit governance-resolution authority. It does not implement production PKI, voting, consensus finality, transparency logs or key revocation.