Can a quorum of honest validators certify an invalid transition?

Classical state machine replication and Byzantine fault-tolerant consensus already assume the worst about a bounded set of participants: they may coordinate, collude, equivocate and send adversarial messages. What the guarantee then leans on is everyone outside that set. Those participants must correctly implement the protocol's transition or validation semantics. "The Honest Quorum Problem" (2607.16109) points out that a reasoning validator breaks exactly that premise without breaking anything else.

The paper's example makes it concrete. An operator proposes widening a deployment service account from read-only inspection to write authority over a production namespace. Several reasoning validators inspect the same request, state snapshot, policy context and evidence. Each authenticates correctly, receives the same request digest, signs the expected message, answers before the timeout and does not equivocate. A quorum approves. The transition still crosses the intended control-plane isolation boundary, so the system commits a semantically invalid action. Every protocol check passed; the application invariant did not survive.

The paper names the individual failure an epistemic fault: an authenticated, responsive, correctly signed, non-equivocating participant endorses a semantically invalid transition. It names the collective phenomenon the Honest Quorum Problem. The definitional move is the important one. Here "honest" means protocol-compliant, not semantically correct, and the two come apart for a reasoner in a way they never do for a deterministic replica running the transition function. This is a weaker partition than the honest/Byzantine split: the danger is not a colluding minority but compliant participants who may be wrong together.

The consequence, in the paper's words, is that agreement alone does not establish semantic certificate validity or execution safety. A quorum can produce a well-formed certificate for an invalid transition, and any verifier that only checks the certificate's form will accept it. Agreement is evidence that the protocol ran, not evidence that the answer is right.

The obvious rejoinder is that more validators or a higher quorum threshold would fix it. That only works if validator errors are independent, which the paper argues they need not be (see Can a quorum of validators really provide independent judgment?).

What the excerpt does not give. The inbox excerpt is the abstract, one introduction paragraph and the discussion. It refers to threshold theorems in Section 6 but gives none of their conditions or numbers, and reports no experiments with real agentic validators. Read this note as the problem statement and definitions, not as evidence of how often epistemic faults occur.