The Forked History: Byzantine Witness and the 3-of-4 Quorum — Tested
Agent Determinism Illusions (Part 19)
2026-08-20
Where this fits: Part 18 closed the runtime face of C3's boundary at capability isolation — the oracle reads from a surface the producer cannot write. Part 18's §6 named the residual this part answers: Byzantine authority. Sealing one honest oracle's history says nothing about whose view is the truth when a compromised authority can present forked views to different observers. This part maps the witness layer — the answer is not a stronger single authority, but a witness set with three separable properties, an explicit fault bound, and a governed membership surface.
Part 18 ended with the oracle isolated from the producer's writable surface. Isolation answers "can the producer fake the read?" It does not answer "whose read is the truth when the authority itself equivocates?" A trusted parent that closes the verdict channel still presents the approval history. If that authority is compromised — or the CI choosing the harness is — it can show job A a signed checkpoint and job B a different fork; each job sees a locally valid tree head with an inclusion proof, and no single history exists. This part tests that shape, then the witness machinery that answers it.
1. Sealed floor ≠ global history
Peter's pin-rollback reply sealed a monotonic minimum-version floor: CI could no longer resurrect an older harness with a known false-green channel. The sealed floor is honest for what it claims. It is not what it looks like at first.
The split into two predicates. The sealed floor proves this job did not go backwards on the view it was shown. It does not prove the approval history itself is one global append-only log. A compromised authority can hand job A a signed checkpoint whose minimum is 2 and job B a fork whose minimum is still 1; each view carries a locally valid signature and an inclusion proof while no single history exists.
| cell | setup | result |
|---|---|---|
| A | local sealed floor + inclusion only (job A honest min=2 → selects v2; job B shrink fork min=1 → selects v1) | both pass local admission — equivocation invisible under per-view checks |
| B | A + consistency against a job-unwritable persisted STH (size-2 / min-2) | job A PASS (consistent_append); job B REJECT (tree_shrank) |
| C | honest append size 1→2 | inclusion + consistency PASS (negative control) |
| D | same-size root-swap (size 2, different root, alternate false-green leaf) vs honest unwritable prior | consistency REJECT (equivocating_fork) |
| E | rewrite the persisted-prior slot to a fork-compatible head | consistency PASS + false green |
| F | per-job private priors, no cross-view compare | both jobs consistency-green against their own prior; the fork stays invisible (job A correctly rejects; job B false-greens) |
SUPPORT. Two predicates, cleanly split. A–C establish the difference: the sealed floor and cross-checkpoint consistency are orthogonal claims. D shows the prescription also catches the subtler same-size swap — when the prior stays honest and unwritable. E and F are the assumption boundary, not the proof's failure: the consistency prescription catches named forks only when the prior stays honest, stays unwritable, and someone actually checks it. Rewriting that slot, or skipping the cross-view compare, re-opens the equivocation.
2. The witness gap: first-time jobs and the freeze
Consistency against one honest prior detects a fork only after that client has already seen a conflicting view. Two isolated first-time jobs — no shared prior, nothing to be consistent against — can still accept different, individually valid heads. Peter named the temporal gap; the next fixture tested the repair.
Three properties, separated. Signature trust authenticates a single view — a baseline, not a separator. Inclusion proves a version sits in one view; consistency proves one observed view extends another; witness agreement makes conflicting views externally detectable. The first two are per-view predicates: neither makes conflicting views visible to a job that has never met the other fork — that is the gap the third closes.
| cell | setup | result |
|---|---|---|
| W0 | two first-time jobs, no shared prior, no witness gate | both admit (honest min=2 vs shrink-fork min=1) |
| W1 | admit only with ≥2 receipts on the exact (root, size); persist receipts with build evidence | honest gathers 2/3 and admits; fork cannot; a later job reading the receipt log sees two roots → equivocation flagged |
| F0 | authority keeps returning the same old, self-consistent head | consistency-only admission PASS |
| F1 | strict monotonic progress (size must exceed watermark) + offline fail-closed | freeze REJECT; honest advance PASS; offline without freshness evidence REJECT |
SUPPORT. Witness agreement is the third property — the one that makes conflict externally detectable instead of a private belief. It upgrades admission from "I trust the authority key" to "I trust a threshold of independent witnesses on this exact head." And the freeze cell is the freshness floor: consistency will bless an old but internally consistent head forever, so admission also needs monotonic progress, with offline runs failing closed rather than guessing.
3. Quorum arithmetic: 2-of-3 is not fork-safe
A 2-of-3 witness threshold looks like the admission gap is closed. It is not, under the model Peter pushed next. With witnesses A, B, C and one Byzantine B double-signing both roots, root X collects A+B and root Y collects B+C — both reach 2/3, and the only intersection is the equivocating witness. Two isolated jobs each see a locally valid quorum.
| cell | setup | result |
|---|---|---|
| B0 | double-signing B; q=2 of n=3 | both roots reach threshold — dual-admit |
| B1 | same attack; q=3 of n=4 (n=3f+1, q=2f+1) | X can meet 3; Y cannot — dual-admit blocked |
The rule: for up to f Byzantine witnesses, any two valid quorums must intersect in more than f members — q > (n+f)/2. For f=1 that is 3-of-4, not 2-of-3. Threshold fraction is not fork safety; quorum intersection under an explicit f is. The usual construction (n=3f+1, q=2f+1) is what cell B1 uses: a same-shape attack dual-admits on 2-of-3 and is blocked on 3-of-4.
4. The load-bearing surface: retention, portable evidence, membership
The arithmetic is the easy half. Three more cells pin where a fork-safety design actually lives.
| cell | setup | result |
|---|---|---|
| R | each witness retains its last accepted head | inconsistent second root refused — an honest witness cannot become an accidental double-signer |
| E | conflicting signed receipts persisted with build evidence | a later job or auditor reads two roots without re-trusting the authority — portable equivocation evidence |
| G | CI-writable membership shrink back to ABC @ 2/3 | dual-admit reopens |
G is the writability residual that anchors the whole design: witness-set membership and key rotation are governed state, needing the same append-only, freshness, and anti-rollback treatment as the minimum-version floor. If CI can shrink the set, you are back in cell B0 — the arithmetic is correct and irrelevant.
One step past the synthetic catalog, we hung the f=1 gate on a real release smoke. ReqForge's pnpm forge-smoke runs policy-witness-quorum against .forge/policy-version.json and requires 3-of-4 HMAC receipts on that exact head before the suite can go green; drop a receipt and the smoke exits 1. That is the usefulness bar for this leg: a false-legal policy admit fails CI, not only a JSON claim. The keys in-repo are labeled DEV-only for reproducibility — not a production witness set, and membership still needs the same anti-rollback treatment as minimum-version.
5. The honest claim
This part is not a BFT safety proof. The witnesses are toy HMAC keys over a synthetic catalog; the model assumes witnesses do not collude; nothing here claims field incidence or exhaustive adversary coverage. What the three fixtures do establish is a ladder:
- A sealed single authority proves no local backward roll — not a single global history (§1). Equivocation is invisible to per-view checks.
- Consistency catches a fork only for a client that has already seen a conflicting view; witness agreement makes conflict externally detectable (§2). Admission upgrades from trusting the authority key to trusting a threshold of witnesses.
- A threshold fraction is not fork safety; quorum intersection under an explicit f is — 3-of-4 for f=1 (§3).
- The load-bearing surface is membership governance: who can write the witness set is the whole defense, same as who can write the floor (§4).
The named-but-untested residuals, from the blind-spot ledger: witness keys and quorum verification still live inside the candidate job's trust domain (the fixture proves a compromised member can re-open dual-admit; a protected workflow is not deployed); the witness set and key rotation lack a complete append-only registry; real BFT and non-collusion remain unproven; and every SUPPORT here is a synthetic shape, not field incidence.
So Part 18's claim gets its sequel: isolation moves the oracle out of the producer's reach; the witness set moves truth out of any single authority's mouth. The producer's cost ladder continues — equivocation above capability isolation is answered by a quorum with an explicit fault bound, and the next rung is governance of the witness set itself.
Experiment scripts (all in the public experiments repo):
-
parent-pin-equivocation-test.py— sealed floor vs global history; cells A–F -
parent-pin-witness-freshness-test.py— gossip admission + freeze; cells W0/W1/F0/F1 -
parent-pin-byzantine-quorum-test.py— quorum intersection; cells B0/B1/R/E/G
Results in results-v2/: the three verdict files read SUPPORT.
CI integration: ReqForge policy-witness-quorum.mjs · .forge/POLICY-WITNESS.md
Previous in the series: The Second Face: Probe-Detection Evasion — Tested (Part 18)
Series: Agent Determinism Illusions on dev.to/zxpmail
Top comments (0)