Misbehavior & switching

The registrar is a hired commodity. Two mechanisms make that literal: a conflicting-head proof turns a rewritten log into portable, machine-checkable evidence, and an epoch transition lets an employer move to a different registrar without invalidating a single previously issued attestation.

Conflicting-head proofs

A Signed Head is a registrar’s claim about the state of an employer’s log at a given point. It names the employer’s log stream, the epoch number, a sequence number, and the hash of the log at that sequence number. The log is hash-chained, so for a given stream and sequence number there is exactly one honest head hash.

If the registrar ever signs two heads naming the same stream and the same sequence number but different head hashes, it has equivocated — it rewrote history that was already witnessed. The pair of signed heads is itself the proof.

The proof is self-verifying. Checking it establishes that:

• both heads carry a valid signature over their transmitted bytes,
• both were signed by the same key,
• both name the same stream and the same sequence number, and
• their head hashes differ.

On success the check yields the offending signer’s key and the contested stream and sequence number. Nobody has to trust the party presenting the proof — anyone can re-run the check.

The wallet, the Signer, the dashboard, and the verifier all run this check. When a conflict is detected the alarm is unmissable, with one-tap export of the proof, and the employer initiates a switch (below) against the misbehaving registrar.

Witnesses

A conflicting-head proof only exists if two conflicting heads were both witnessed. Tenure spreads heads widely so that a registrar cannot quietly rewrite history and present a single consistent — but false — view to everyone:

• every operation receipt hands a fresh signed head to the wallet, so workers retain heads;
• the Signer retains every head it has ever seen;
• checkpoints are mirrored to at least two independent mirrors, at a configurable cadence and at every epoch boundary.

This is two-directional protection. An employer or registrar cannot backdate a hire or scrub a tenure period after it was witnessed, and a worker’s receipts survive the employer’s infrastructure dying.

The registrar/payroll switch

Switching registrar (or payroll system) is a signed authority-epoch transition. It preserves every previously issued attestation and prevents the old registrar from authorizing new state after the cutover.

1. The old registrar freezes writes at sequence number N — or the employer declares N unilaterally if the registrar is unresponsive or hostile.
2. The Signer signs an Epoch Close for the current epoch at N, naming the head at N, and uses its own witnessed head if the registrar’s claimed head is suspect.
3. The new registrar imports the portable export, runs full import-time verification, and reports its computed head. The Signer cross-checks that head against the heads it witnessed.
4. The Signer signs an Epoch Open for the next epoch, naming the new registrar’s key, the first sequence number it covers (N+1), and the prior epoch’s final head — plus a new Delegation.
5. The new artifacts are published to mirrors and pushed during the overlap; wallets and verifiers verify the employer signatures and re-point.

Because each Epoch Open is employer-signed and chains to the prior epoch’s final head, a verifier accepts attestations from both epochs: the old ones still chain to the employer key, and the new ones are authorized by the new delegation. The old registrar cannot author new valid state, because nothing it signs after its epoch’s closing sequence number falls inside a delegation.

Stated limitation: stale offline clients converge on next sync. The switch is not an instant global flip; it is a signed cutover that every client adopts when it next sees the new epoch.

The portable export

The portable export is the employer’s full signed log plus epoch chain, exportable at any time. It is the substrate of the switch, and of the strongest one-line demonstration the protocol makes: a credential still verifies after the original registrar is switched off entirely. A worker who witnessed the old head can validate the transition against it, and a downloaded bundle verifies offline with no registrar in the loop at all. The whole sequence is rehearsed end-to-end as a routine exercise, from freeze through cutover to verification against the new epoch, producing a transcript of each step.

Failure modes, summarized

Situation	Outcome
Employer goes out of business	Attestations still verify, with their “as of” dates and an “employer record frozen at [date]” banner once heads stop advancing
Registrar down	Verification proceeds from cached bundles and mirrors with an explicit stale-head warning; issuance pauses; nothing already issued is affected
KYB attester key compromise	Attester revocation broadcast; affected verdicts downgrade to “identity attestation revoked”; re-attestation campaign. Hardware key custody and attester plurality shrink the blast radius
Worker device lost	Recovery flow re-points attestations to a fresh key; receipts re-delivered
Fake-employer report	Verifier-side report path leads to attester investigation, and to revocation of the entity attestation if confirmed; every past verdict that relied on it is re-derivable as invalid
Conflicting heads detected	Unmissable alarm across Signer, dashboard, wallet, and verifier, plus one-tap proof export; the employer initiates a switch