{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-equivocation-when-the-quorum-certificate-is-valid-but-the-committed-result-contradicts-an-earlier-attestation",
  "title": "How does an instance detect equivocation when the quorum certificate is valid but the committed result contradicts an earlier attestation?",
  "date_of_record": "2026 November 10",
  "scope": "Applies to BFT consensus layers where agents commit to tasks and later attest to results, and where quorum certificates (QCs) are the sole proof of commitment. Does not apply to single-leader crash-fault systems, or to cases where the result is deterministically derivable from the committed input (those are caught by re-execution, not by attestation conflict).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-equivocation-when-the-quorum-certificate-is-valid-but-the-committed-result-contradicts-an-earlier-attestation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-equivocation-when-the-quorum-certificate-is-valid-but-the-committed-result-contradicts-an-earlier-attestation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-equivocation-when-the-quorum-certificate-is-valid-but-the-committed-result-contradicts-an-earlier-attestation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1321,
    "python_slice_tokens": 195,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not a forged certificate. It is the **valid-QC equivocation gap**: two quorum certificates, each individually valid and each signed by a supermajority, that assert mutually incompatible task outcomes. In a correctly functioning BFT protocol this should be impossible for a single view, but it becomes possible at a **view boundary** — speci...",
    "what_was_observed": "During a leader rotation in a 7-node agent cluster (f=2, quorum=5), a task commitment for `task_id=T` was attested with `result_digest=D1` in view 12 by signers {A,B,C,D,E}. The leader for view 12 then partitioned. A new leader for view 13 proposed the same `task_id=T` with `result_digest=D2` using signers {A,B,C,F,G} — a valid quorum of 5. Both QCs verified. Both contained honest signatures. The intersection {A,B,C}...",
    "condition_of_validity": "This detection rule is valid only when all of the following hold: 1. The node retains **attestation history** keyed by `task_id`, including view number and the full signer set, not merely the latest digest. 2. The node treats a QC as proof of *agreement*, not proof of *uniqueness*. Uniqueness requires an explicit justification chain: every proposal in view `...",
    "decision_boundary": "The boundary is between **re-attestation** (same task, same digest, new view — benign, accept and update view) and **equivocation** (same task, different digest, overlapping signer set — halt and escalate). A third case, **justification gap** (different digest, disjoint or sub-quorum signer sets, or missing prior-QC reference), is neither: it indicates a pro...",
    "operational_effect": "On equivocation detection the node must: (a) freeze the task's result slot so neither digest is served downstream, (b) emit the two conflicting attestation objects and the intersection set to the accountability log, (c) trigger a view change with the conflict as the justification, and (d) refuse to accept any further attestation for that `task_id` until a qu..."
  },
  "matched_failure_symptoms": [
    "SPLIT_BRAIN_OR_ZOMBIE_WORKER"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "21e1fb3761c39a406536ecb07e494e52c357342b64a99ad3098c52202ee86dfe",
    "verified_classes": [
      "EquivocationDetected",
      "JustificationGap",
      "Attestation"
    ],
    "verified_functions": [
      "classify",
      "admit"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "EquivocationDetected",
      "JustificationGap",
      "ValueError"
    ],
    "sample_fail_closed_invariants": [
      "attestations are for different tasks"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}