TransitionAuditAuthentication

Required application/deployment-specific proof interpreters. There is no permissive implementation. Every method reads/verifies the original proof closure from evidence, authenticates it against independently installed deployment/schema/consensus trust, and returns recomputed facts. The returned products themselves are untrusted data, never signing capabilities.

source decodes every state blob, checks complete inventory and actual root, verifies schema/provenance/replay policy, source selection and non-ancestry, and establishes that the source write fence preceded snapshot selection. neverEnabled independently authenticates the entire historical signer and deployment roster, binary/configuration capabilities and every alternate key path; it must not copy the submitted roster as its scope of completeness. absence verifies independent rollback/non-ancestry/source evidence and the pre-baseline absence event, including unknown dates explicitly recorded by the attestation. Later loss fails even with a newly signed attestation. fence checks active durable key/write controls and the complete historical watermark, including already-issued subjects, on every invocation. A signed promise alone is insufficient. drain authenticates original subject and own durable deadline records before issuance, exact plan links, original finality/nonapplication and reconciled stores across the full signer scope. continuation verifies every historical proposal/QC/profile/state replay, original highQC/lockedQC/watermarks, all still-certifiable validator sets and the actual historical safe-vote rule for the selected continuation branch. restore authenticates the complete stopped-node consistency group, current promise/canonical-write histories and proposed preservation inventory.