feature: full chain validation with support for forks

Cargo.toml

···
 [package]
 name = "atproto-plc"
-version = "0.1.0"
+version = "0.2.0"
 authors = ["Nick Gerakines <[e-mail]>"]
 edition = "2024"
 rust-version = "1.90.0"
···
 [[bin]]
 name = "plc-audit"
 path = "src/bin/plc-audit.rs"
+required-features = ["cli"]
+
+[[bin]]
+name = "plc-fork-viz"
+path = "src/bin/plc-fork-viz.rs"
 required-features = ["cli"]
 
 [profile.release]

src/bin/README.md

···
-# plc-audit: DID Audit Log Validator
+# AT Protocol PLC Command-Line Tools
+
+Command-line tools for working with AT Protocol PLC (Public Ledger of Credentials) DIDs.
+
+## Tools
 
-A command-line tool for fetching and validating DID audit logs from plc.directory.
+### plc-audit: DID Audit Log Validator
 
-## Features
+Validates the cryptographic integrity of a DID's audit log from plc.directory.
+
+#### Features
 
 - 🔍 **Fetch Audit Logs**: Retrieves complete operation history from plc.directory
 - 🔐 **Cryptographic Validation**: Verifies all signatures using rotation keys
···
 - 📊 **Detailed Output**: Shows operation history and final DID state
 - ⚡ **Fast & Reliable**: Built with Rust for performance and safety
 
-## Installation
+#### Usage
 
 ```bash
-cargo build --release --features cli --bin plc-audit
+# Basic validation
+cargo run --bin plc-audit --features cli -- did:plc:z72i7hdynmk6r22z27h6tvur
+
+# Verbose mode (show all operations)
+cargo run --bin plc-audit --features cli -- did:plc:z72i7hdynmk6r22z27h6tvur --verbose
+
+# Quiet mode (VALID/INVALID only)
+cargo run --bin plc-audit --features cli -- did:plc:z72i7hdynmk6r22z27h6tvur --quiet
+
+# Custom PLC directory
+cargo run --bin plc-audit --features cli -- did:plc:example --plc-url https://custom.plc.directory
 ```
 
-The binary will be available at `./target/release/plc-audit`.
+---
 
-## Usage
+### plc-fork-viz: Fork Visualizer
 
-### Basic Validation
+Visualizes forks in a DID's operation chain, showing which operations won/lost based on rotation key priority and the 72-hour recovery window.
 
-Validate a DID and show detailed output:
+#### Features
+
+- 🔀 **Fork Detection**: Identifies competing operations in the chain
+- 🔐 **Priority Analysis**: Determines which rotation key signed each operation
+- ⏱️ **Recovery Window**: Applies 72-hour recovery window rules
+- 📊 **Multiple Formats**: Tree, JSON, and Markdown visualization
+- 🎨 **Color Coding**: Green for canonical operations, red for rejected
+
+#### Usage
 
 ```bash
-plc-audit did:plc:z72i7hdynmk6r22z27h6tvur
+# Basic fork visualization
+cargo run --bin plc-fork-viz --features cli -- did:plc:ewvi7nxzyoun6zhxrhs64oiz
+
+# Verbose mode (detailed operation info)
+cargo run --bin plc-fork-viz --features cli -- did:plc:ewvi7nxzyoun6zhxrhs64oiz --verbose
+
+# Show timestamps and recovery window calculations
+cargo run --bin plc-fork-viz --features cli -- did:plc:ewvi7nxzyoun6zhxrhs64oiz --timing
+
+# Show full DIDs/CIDs
+cargo run --bin plc-fork-viz --features cli -- did:plc:ewvi7nxzyoun6zhxrhs64oiz --full-ids
+
+# Output as JSON
+cargo run --bin plc-fork-viz --features cli -- did:plc:ewvi7nxzyoun6zhxrhs64oiz --format json
+
+# Output as Markdown
+cargo run --bin plc-fork-viz --features cli -- did:plc:ewvi7nxzyoun6zhxrhs64oiz --format markdown
 ```
 
-### Verbose Mode
+#### Output Formats
 
-Show all operations in the audit log:
+**Tree Format** (default):
+```
+Fork at operation referencing bafyre...abc123
+  ├─ 🔴 ✗ CID: bafyre...def456
+  │  Signed by: rotation_key[1]
+  │  Reason: Invalidated by higher-priority key[0] within recovery window
+  └─ 🟢 ✓ CID: bafyre...ghi789
+     Signed by: rotation_key[0]
+     Status: CANONICAL (winner)
+```
 
-```bash
-plc-audit did:plc:z72i7hdynmk6r22z27h6tvur --verbose
+**JSON Format**:
+```json
+[
+  {
+    "prev_cid": "bafyre...",
+    "winner_cid": "bafyre...",
+    "operations": [...]
+  }
+]
 ```
 
-Output includes:
-- Operation index and CID
-- Creation timestamp
-- Operation type (Genesis/Update)
-- Previous operation reference
+**Markdown Format**:
+| Status | CID | Key Index | Timestamp | Reason |
+|--------|-----|-----------|-----------|--------|
+| ✅ Winner | bafyre...ghi789 | 0 | 2025-01-15 14:30:00 | Canonical operation |
+| ❌ Rejected | bafyre...def456 | 1 | 2025-01-15 10:00:00 | Invalidated by higher-priority key[0] |
 
-### Quiet Mode
+#### Fork Resolution Rules
 
-Only show validation result (useful for scripts):
+1. **Rotation Key Priority**: Keys are ordered by array index (0 = highest priority)
+2. **Recovery Window**: 72 hours from the first operation's timestamp
+3. **First-Received Default**: The operation received first wins unless invalidated
+4. **Higher Priority Override**: A higher-priority key can invalidate if:
+   - It arrives within 72 hours
+   - Its key index is lower (e.g., key[0] beats key[1])
+
+#### Example: No Forks
 
 ```bash
-plc-audit did:plc:z72i7hdynmk6r22z27h6tvur --quiet
-```
+$ cargo run --bin plc-fork-viz --features cli -- did:plc:ewvi7nxzyoun6zhxrhs64oiz
 
-Output: `✅ VALID` or error message
+🔍 Analyzing forks in: did:plc:ewvi7nxzyoun6zhxrhs64oiz
+   Source: https://plc.directory
 
-### Custom PLC Directory
+📊 Audit log contains 5 operations
+
+✅ No forks detected - this is a linear operation chain
+   All operations form a single canonical path from genesis to tip.
+```
 
-Use a custom PLC directory server:
+#### Example: Fork Detected
 
 ```bash
-plc-audit did:plc:example --plc-url https://custom.plc.directory
-```
+$ cargo run --bin plc-fork-viz --features cli -- did:plc:z7x2k3j4m5n6 --timing
 
-## What is Validated?
+🔍 Analyzing forks in: did:plc:z7x2k3j4m5n6
+   Source: https://plc.directory
 
-The tool performs comprehensive validation:
+📊 Audit log contains 8 operations
+⚠️  Detected 1 fork point(s)
 
-1. **DID Format Validation**
-   - Checks prefix is `did:plc:`
-   - Verifies identifier is exactly 24 characters
-   - Ensures only valid base32 characters (a-z, 2-7)
+📊 Fork Visualization (Tree Format)
+═══════════════════════════════════════════════════════════════
 
-2. **Chain Linkage Verification**
-   - First operation must be genesis (prev = null)
-   - Each subsequent operation's `prev` field must match previous operation's CID
-   - No breaks in the chain
+Fork at operation referencing bafyre...abc123
+  ├─ 🔴 ✗ CID: bafyre...def456
+     │  Signed by: rotation_key[1]
+     │  Timestamp: 2025-01-15 10:00:00 UTC
+     │  Reason: Invalidated by higher-priority key[0] within recovery window
+     │
+  └─ 🟢 ✓ CID: bafyre...ghi789
+     │  Signed by: rotation_key[0]
+     │  Timestamp: 2025-01-15 14:00:00 UTC
+     │  Status: CANONICAL (winner)
 
-3. **Cryptographic Signature Verification**
-   - Each operation's signature is verified using rotation keys
-   - Genesis operation establishes initial rotation keys
-   - Later operations can rotate keys
+═══════════════════════════════════════════════════════════════
+📈 Summary:
+   Total operations: 8
+   Fork points: 1
+   Rejected operations: 1
 
-4. **State Consistency**
-   - Final state is extracted and displayed
-   - Shows rotation keys, verification methods, services, and aliases
+🔐 Fork Resolution Details:
+   Fork 1: Winner is bafyre...ghi789 (signed by key[0])
+```
 
-## Exit Codes
+---
 
-- `0`: Validation successful
-- `1`: Validation failed or error occurred
+## Building & Installation
 
-## Example Output
+### Build Both Tools
 
-### Standard Mode
+```bash
+cargo build --bins --features cli --release
+```
 
+### Install to ~/.cargo/bin
+
+```bash
+cargo install --path . --features cli
 ```
-🔍 Fetching audit log for: did:plc:z72i7hdynmk6r22z27h6tvur
-   Source: https://plc.directory
 
-📊 Audit Log Summary:
-   Total operations: 4
-   Genesis operation: bafyreigp6shzy6dlcxuowwoxz7u5nemdrkad2my5zwzpwilcnhih7bw6zm
-   Latest operation: bafyreifn4pkect7nymne3sxkdg7tn7534msyxcjkshmzqtijmn3enyxm3q
+Then use directly:
+```bash
+plc-audit did:plc:ewvi7nxzyoun6zhxrhs64oiz
+plc-fork-viz did:plc:ewvi7nxzyoun6zhxrhs64oiz
+```
 
-🔐 Validating operation chain...
+---
+
+## Common Workflows
+
+### Workflow 1: Validate and Check for Forks
+
+```bash
+# First validate the audit log
+$ plc-audit did:plc:ewvi7nxzyoun6zhxrhs64oiz
 ✅ Validation successful!
 
-📄 Final DID State:
-   Rotation keys: 2
-     [0] did:key:zQ3shhCGUqDKjStzuDxPkTxN6ujddP4RkEKJJouJGRRkaLGbg
-     [1] did:key:zQ3shpKnbdPx3g3CmPf5cRVTPe1HtSwVn5ish3wSnDPQCbLJK
+# Then check for forks
+$ plc-fork-viz did:plc:ewvi7nxzyoun6zhxrhs64oiz
+```
 
-   Verification methods: 1
-     atproto: did:key:zQ3shQo6TF2moaqMTrUZEM1jeuYRQXeHEx4evX9751y2qPqRA
+### Workflow 2: Export Fork Data
 
-   Also known as: 1
-     - at://bsky.app
+```bash
+# Export as JSON for analysis
+$ plc-fork-viz did:plc:ewvi7nxzyoun6zhxrhs64oiz --format json > forks.json
 
-   Services: 1
-     atproto_pds: https://puffball.us-east.host.bsky.network (AtprotoPersonalDataServer)
+# Generate Markdown report
+$ plc-fork-viz did:plc:ewvi7nxzyoun6zhxrhs64oiz --format markdown > FORK_REPORT.md
 ```
 
-### Verbose Mode
+### Workflow 3: Monitor DIDs
+
+```bash
+#!/bin/bash
+# Monitor a DID for changes and forks
+DID="did:plc:ewvi7nxzyoun6zhxrhs64oiz"
 
-Shows detailed operation information:
+# Validate
+if plc-audit $DID --quiet; then
+  echo "✅ DID is valid"
 
+  # Check for forks
+  plc-fork-viz $DID --format json > /tmp/forks.json
+
+  if [ -s /tmp/forks.json ]; then
+    echo "⚠️ Forks detected!"
+    plc-fork-viz $DID
+  fi
+else
+  echo "❌ DID validation failed!"
+  exit 1
+fi
 ```
-📋 Operations:
-   [0] ✅ bafyreigp6shzy6dlcxuowwoxz7u5nemdrkad2my5zwzpwilcnhih7bw6zm - 2023-04-12T04:53:57.057Z
-       Type: Genesis (creates the DID)
-   [1] ✅ bafyreihmuvr3frdvd6vmdhucih277prdcfcezf67lasg5oekxoimnunjoq - 2023-04-12T17:26:46.468Z
-       Type: Update
-       Previous: bafyreigp6shzy6dlcxuowwoxz7u5nemdrkad2my5zwzpwilcnhih7bw6zm
-   ...
-```
+
+---
+
+## Understanding Fork Visualization
+
+### Symbols
+
+- 🌱 Genesis operation (creates the DID)
+- 🟢 ✓ Canonical operation (winner)
+- 🔴 ✗ Rejected operation (lost the fork)
+- ├─ Fork branch (more operations follow)
+- └─ Final fork branch
+
+### Rejection Reasons
+
+1. **"Invalidated by higher-priority key[N] within recovery window"**
+   - A higher-priority rotation key signed a competing operation within 72 hours
 
-## Error Handling
+2. **"Higher-priority key[N] but outside 72-hour recovery window (X hours late)"**
+   - A higher-priority key tried to invalidate but arrived too late
 
-The tool provides clear error messages:
+3. **"Lower-priority key[N] (current winner has key[M])"**
+   - This operation was signed by a lower-priority key and can't override
 
-### Invalid DID Format
-```
-❌ Error: Invalid DID format: DID must be exactly 32 characters, got 18
-   Expected format: did:plc:<24 lowercase base32 characters>
-```
+---
 
-### Network Errors
-```
-❌ Error: Failed to fetch audit log: HTTP error: 404 - Not Found
-```
+## Troubleshooting
 
-### Invalid Signature
-```
-❌ Validation failed: Invalid signature at operation 2
-   Error: Signature verification failed
-   CID: bafyrei...
-```
+### Error: "Invalid DID format"
+DID must follow format: `did:plc:<24 lowercase base32 characters>`
 
-### Broken Chain
-```
-❌ Validation failed: Chain linkage broken at operation 2
-   Expected prev: bafyreiabc...
-   Actual prev: bafyreixyz...
-```
+### Error: "Failed to fetch audit log"
+- Check internet connection
+- Verify DID exists on plc.directory
+- Try `--plc-url` for custom PLC directories
 
-## Use Cases
+### No forks detected but expected
+- The DID may have a linear operation chain
+- All operations were submitted sequentially without conflicts
 
-- **Audit DID History**: Review all changes made to a DID over time
-- **Verify DID Integrity**: Ensure a DID hasn't been tampered with
-- **Debug Issues**: Identify problems in operation chains
-- **Monitor DIDs**: Automate validation in scripts or monitoring systems
-- **Security Analysis**: Investigate suspicious DID activity
+---
 
 ## Technical Details
 
-The validator:
-- Uses `reqwest` for HTTP requests to plc.directory
-- Implements cryptographic verification with P-256 and secp256k1
-- Validates ECDSA signatures using the `atproto-plc` library
-- Supports both standard and legacy operation formats
+**plc-audit** validates:
+1. DID format (prefix, length, base32 encoding)
+2. Chain linkage (prev references)
+3. Cryptographic signatures (ECDSA with P-256/secp256k1)
+4. State consistency
 
-## JavaScript/WASM Version
+**plc-fork-viz** implements:
+1. Fork detection (multiple operations with same prev CID)
+2. Rotation key index resolution
+3. Priority-based fork resolution
+4. 72-hour recovery window enforcement
 
-A JavaScript implementation using WebAssembly is also available. See [`wasm/README.md`](../../wasm/README.md) for details.
+Both tools use:
+- `reqwest` for HTTP requests
+- `atproto-plc` library for cryptographic operations
+- `clap` for command-line parsing
 
-### Quick Start
+---
 
-```bash
-# Build WASM module
-cd wasm && ./build.sh
+## See Also
 
-# Run the tool
-node plc-audit.js did:plc:z72i7hdynmk6r22z27h6tvur --verbose
-```
+- [AT Protocol PLC Specification](https://atproto.com/specs/did-plc)
+- [Fork Resolution Implementation Report](../../FORK_RESOLUTION_REPORT.md)
+- [Implementation Summary](../../IMPLEMENTATION_SUMMARY.md)
+- [Library Documentation](../../README.md)
 
-The JavaScript version provides the same functionality and output format as the Rust binary, making it suitable for:
-- Cross-platform deployment (runs anywhere with Node.js)
-- Web applications and browser extensions
-- Integration with JavaScript/TypeScript projects
-- Smaller binary size (~200KB WASM vs 1.5MB native)
+---
 
 ## License
 

src/bin/plc-audit.rs

···
 //! This binary fetches DID audit logs from plc.directory and validates
 //! each operation cryptographically to ensure the chain is valid.
 
-use atproto_plc::{Did, Operation};
+use atproto_plc::{Did, Operation, OperationChainValidator, PlcState};
 use clap::Parser;
 use reqwest::blocking::Client;
 use serde::Deserialize;
···
         println!();
     }
 
-    // Validate the operation chain
+    // Detect forks and build canonical chain
     if !args.quiet {
-        println!("🔐 Validating operation chain...");
+        println!("🔐 Analyzing operation chain...");
         println!();
     }
 
-    // Step 1: Validate chain linkage (prev references)
+    // Detect fork points and nullified operations
+    let has_forks = detect_forks(&audit_log);
+    let has_nullified = audit_log.iter().any(|e| e.nullified);
+
+    if has_forks || has_nullified {
+        if !args.quiet {
+            if has_forks {
+                println!("⚠️  Fork detected - multiple operations reference the same prev CID");
+            }
+            if has_nullified {
+                println!("⚠️  Nullified operations detected - will validate canonical chain only");
+            }
+            println!();
+        }
+
+        // Use fork resolution to build canonical chain
+        if args.verbose {
+            println!("Step 1: Fork Resolution & Canonical Chain Building");
+            println!("===================================================");
+        }
+
+        // Build operations and timestamps for fork resolution
+        let operations: Vec<_> = audit_log.iter().map(|e| e.operation.clone()).collect();
+        let timestamps: Vec<_> = audit_log
+            .iter()
+            .map(|e| {
+                e.created_at
+                    .parse::<chrono::DateTime<chrono::Utc>>()
+                    .unwrap_or_else(|_| chrono::Utc::now())
+            })
+            .collect();
+
+        // Resolve forks and get canonical chain
+        match OperationChainValidator::validate_chain_with_forks(&operations, &timestamps) {
+            Ok(final_state) => {
+                if args.verbose {
+                    println!("  ✅ Fork resolution complete");
+                    println!("  ✅ Canonical chain validated successfully");
+                    println!();
+
+                    // Show which operations are in the canonical chain
+                    println!("Canonical Chain Operations:");
+                    println!("===========================");
+
+                    // Build the canonical chain by following non-nullified operations
+                    let canonical_indices = build_canonical_chain_indices(&audit_log);
+
+                    for idx in &canonical_indices {
+                        let entry = &audit_log[*idx];
+                        println!("  [{}] ✅ {} - {}", idx, entry.cid, entry.created_at);
+                    }
+                    println!();
+
+                    if has_nullified {
+                        println!("Nullified/Rejected Operations:");
+                        println!("==============================");
+                        for (i, entry) in audit_log.iter().enumerate() {
+                            if entry.nullified && !canonical_indices.contains(&i) {
+                                println!("  [{}] ❌ {} - {} (nullified)", i, entry.cid, entry.created_at);
+                                if let Some(prev) = entry.operation.prev() {
+                                    println!("      Referenced: {}", prev);
+                                }
+                            }
+                        }
+                        println!();
+                    }
+                }
+
+                // Display final state
+                display_final_state(&final_state, args.quiet);
+                return;
+            }
+            Err(e) => {
+                eprintln!();
+                eprintln!("❌ Validation failed: {}", e);
+                process::exit(1);
+            }
+        }
+    }
+
+    // Simple linear chain validation (no forks or nullified operations)
     if args.verbose {
-        println!("Step 1: Chain Linkage Validation");
+        println!("Step 1: Linear Chain Validation");
         println!("================================");
     }
 
     for i in 1..audit_log.len() {
-        if audit_log[i].nullified {
-            if args.verbose {
-                println!("  [{}] ⊘ Skipped (nullified)", i);
-            }
-            continue;
-        }
-
         let prev_cid = audit_log[i - 1].cid.clone();
         let expected_prev = audit_log[i].operation.prev();
 
···
     }
 
     // Build final state
-    let final_entry = audit_log.iter().filter(|e| !e.nullified).last().unwrap();
+    let final_entry = audit_log.last().unwrap();
     if let Some(_rotation_keys) = final_entry.operation.rotation_keys() {
         let final_state = match &final_entry.operation {
             Operation::PlcOperation {
···
                 services,
                 ..
             } => {
-                use atproto_plc::PlcState;
                 PlcState {
                     rotation_keys: rotation_keys.clone(),
                     verification_methods: verification_methods.clone(),
···
                 }
             }
             _ => {
-                use atproto_plc::PlcState;
                 PlcState::new()
             }
         };
 
-        {
-            if args.quiet {
-                println!("✅ VALID");
+        display_final_state(&final_state, args.quiet);
+    } else {
+        eprintln!("❌ Error: Could not extract final state");
+        process::exit(1);
+    }
+}
+
+/// Detect if there are fork points in the audit log
+fn detect_forks(audit_log: &[AuditLogEntry]) -> bool {
+    use std::collections::HashMap;
+
+    let mut prev_counts: HashMap<String, usize> = HashMap::new();
+
+    for entry in audit_log {
+        if let Some(prev) = entry.operation.prev() {
+            *prev_counts.entry(prev.to_string()).or_insert(0) += 1;
+        }
+    }
+
+    // If any prev CID is referenced by more than one operation, there's a fork
+    prev_counts.values().any(|&count| count > 1)
+}
+
+/// Build a list of indices that form the canonical chain
+fn build_canonical_chain_indices(audit_log: &[AuditLogEntry]) -> Vec<usize> {
+    use std::collections::HashMap;
+
+    // Build a map of prev CID to operations
+    let mut prev_to_indices: HashMap<String, Vec<usize>> = HashMap::new();
+
+    for (i, entry) in audit_log.iter().enumerate() {
+        if let Some(prev) = entry.operation.prev() {
+            prev_to_indices
+                .entry(prev.to_string())
+                .or_default()
+                .push(i);
+        }
+    }
+
+    // Start from genesis and follow the canonical chain
+    let mut canonical = Vec::new();
+
+    // Find genesis (first operation)
+    let genesis = match audit_log.first() {
+        Some(g) => g,
+        None => return canonical,
+    };
+
+    canonical.push(0);
+    let mut current_cid = genesis.cid.clone();
+
+    // Follow the chain, preferring non-nullified operations
+    loop {
+        if let Some(indices) = prev_to_indices.get(&current_cid) {
+            // Find the first non-nullified operation
+            if let Some(&next_idx) = indices.iter().find(|&&idx| !audit_log[idx].nullified) {
+                canonical.push(next_idx);
+                current_cid = audit_log[next_idx].cid.clone();
             } else {
-                println!("✅ Validation successful!");
-                println!();
-                println!("📄 Final DID State:");
-                println!("   Rotation keys: {}", final_state.rotation_keys.len());
-                for (i, key) in final_state.rotation_keys.iter().enumerate() {
-                    println!("     [{}] {}", i, key);
-                }
-                println!();
-                println!("   Verification methods: {}", final_state.verification_methods.len());
-                for (name, key) in &final_state.verification_methods {
-                    println!("     {}: {}", name, key);
-                }
-                println!();
-                if !final_state.also_known_as.is_empty() {
-                    println!("   Also known as: {}", final_state.also_known_as.len());
-                    for uri in &final_state.also_known_as {
-                        println!("     - {}", uri);
-                    }
-                    println!();
-                }
-                if !final_state.services.is_empty() {
-                    println!("   Services: {}", final_state.services.len());
-                    for (name, service) in &final_state.services {
-                        println!("     {}: {} ({})", name, service.endpoint, service.service_type);
-                    }
+                // All operations at this point are nullified - try to find any operation
+                if let Some(&next_idx) = indices.first() {
+                    canonical.push(next_idx);
+                    current_cid = audit_log[next_idx].cid.clone();
+                } else {
+                    break;
                 }
             }
+        } else {
+            // No more operations
+            break;
         }
+    }
+
+    canonical
+}
+
+/// Display the final state after validation
+fn display_final_state(final_state: &PlcState, quiet: bool) {
+    if quiet {
+        println!("✅ VALID");
     } else {
-        eprintln!("❌ Error: Could not extract final state");
-        process::exit(1);
+        println!("✅ Validation successful!");
+        println!();
+        println!("📄 Final DID State:");
+        println!("   Rotation keys: {}", final_state.rotation_keys.len());
+        for (i, key) in final_state.rotation_keys.iter().enumerate() {
+            println!("     [{}] {}", i, key);
+        }
+        println!();
+        println!("   Verification methods: {}", final_state.verification_methods.len());
+        for (name, key) in &final_state.verification_methods {
+            println!("     {}: {}", name, key);
+        }
+        println!();
+        if !final_state.also_known_as.is_empty() {
+            println!("   Also known as: {}", final_state.also_known_as.len());
+            for uri in &final_state.also_known_as {
+                println!("     - {}", uri);
+            }
+            println!();
+        }
+        if !final_state.services.is_empty() {
+            println!("   Services: {}", final_state.services.len());
+            for (name, service) in &final_state.services {
+                println!("     {}: {} ({})", name, service.endpoint, service.service_type);
+            }
+        }
     }
 }
 
···
     let url = format!("{}/{}/log/audit", plc_url, did);
 
     let client = Client::builder()
-        .user_agent("atproto-plc-audit/0.1.0")
+        .user_agent("atproto-plc-audit/0.2.0")
         .timeout(std::time::Duration::from_secs(30))
         .build()?;
 

src/bin/plc-fork-viz.rs

···
+//! PLC Fork Visualizer
+//!
+//! This binary fetches DID audit logs and visualizes any forks in the operation chain,
+//! showing which operations won/lost and why based on rotation key priority and the
+//! 72-hour recovery window.
+
+use atproto_plc::{Did, Operation, VerifyingKey};
+use chrono::{DateTime, Utc};
+use clap::Parser;
+use reqwest::blocking::Client;
+use serde::Deserialize;
+use std::collections::HashMap;
+use std::process;
+
+/// Command-line arguments
+#[derive(Parser, Debug)]
+#[command(
+    name = "plc-fork-viz",
+    about = "Visualize forks in PLC audit logs",
+    long_about = "Fetches and visualizes fork points in DID operation chains from plc.directory,\nshowing which operations won/lost based on rotation key priority and recovery window rules"
+)]
+struct Args {
+    /// The DID to analyze (e.g., did:plc:ewvi7nxzyoun6zhxrhs64oiz)
+    #[arg(value_name = "DID")]
+    did: String,
+
+    /// Custom PLC directory URL (default: https://plc.directory)
+    #[arg(long, default_value = "https://plc.directory")]
+    plc_url: String,
+
+    /// Show detailed information for each operation
+    #[arg(short, long)]
+    verbose: bool,
+
+    /// Show timing information (timestamps and recovery window calculations)
+    #[arg(short, long)]
+    timing: bool,
+
+    /// Show full DIDs and CIDs instead of truncated versions
+    #[arg(long)]
+    full_ids: bool,
+
+    /// Output format: tree (default), json, or markdown
+    #[arg(short, long, default_value = "tree")]
+    format: OutputFormat,
+}
+
+#[derive(Debug, Clone, clap::ValueEnum)]
+enum OutputFormat {
+    Tree,
+    Json,
+    Markdown,
+}
+
+/// Audit log response from plc.directory
+#[derive(Debug, Deserialize, Clone)]
+struct AuditLogEntry {
+    /// The DID this operation is for
+    #[allow(dead_code)]
+    did: String,
+
+    /// The operation itself
+    operation: Operation,
+
+    /// CID of this operation
+    cid: String,
+
+    /// Timestamp when this operation was created
+    #[serde(rename = "createdAt")]
+    created_at: String,
+
+    /// Nullified flag (if this operation was invalidated by fork resolution)
+    #[allow(dead_code)]
+    #[serde(default)]
+    nullified: bool,
+}
+
+/// Represents a fork point in the operation chain
+#[derive(Debug, Clone)]
+struct ForkPoint {
+    /// The prev CID that all operations in this fork reference
+    prev_cid: String,
+
+    /// Competing operations at this fork
+    operations: Vec<ForkOperation>,
+
+    /// The winning operation (after fork resolution)
+    winner_cid: String,
+}
+
+/// An operation that's part of a fork
+#[derive(Debug, Clone)]
+struct ForkOperation {
+    cid: String,
+    operation: Operation,
+    timestamp: DateTime<Utc>,
+    signing_key_index: Option<usize>,
+    signing_key: Option<String>,
+    is_winner: bool,
+    rejection_reason: Option<String>,
+}
+
+fn main() {
+    let args = Args::parse();
+
+    // Parse and validate the DID
+    let did = match Did::parse(&args.did) {
+        Ok(did) => did,
+        Err(e) => {
+            eprintln!("❌ Error: Invalid DID format: {}", e);
+            eprintln!("   Expected format: did:plc:<24 lowercase base32 characters>");
+            process::exit(1);
+        }
+    };
+
+    println!("🔍 Analyzing forks in: {}", did);
+    println!("   Source: {}", args.plc_url);
+    println!();
+
+    // Fetch the audit log
+    let audit_log = match fetch_audit_log(&args.plc_url, &did) {
+        Ok(log) => log,
+        Err(e) => {
+            eprintln!("❌ Error: Failed to fetch audit log: {}", e);
+            process::exit(1);
+        }
+    };
+
+    if audit_log.is_empty() {
+        eprintln!("❌ Error: No operations found in audit log");
+        process::exit(1);
+    }
+
+    println!("📊 Audit log contains {} operations", audit_log.len());
+
+    // Detect forks
+    let forks = detect_forks(&audit_log, &args);
+
+    if forks.is_empty() {
+        println!("\n✅ No forks detected - this is a linear operation chain");
+        println!("   All operations form a single canonical path from genesis to tip.");
+
+        if args.verbose {
+            println!("\n📋 Linear chain visualization:");
+            visualize_linear_chain(&audit_log, &args);
+        }
+
+        return;
+    }
+
+    println!("⚠️  Detected {} fork point(s)", forks.len());
+    println!();
+
+    // Visualize based on format
+    match args.format {
+        OutputFormat::Tree => visualize_tree(&audit_log, &forks, &args),
+        OutputFormat::Json => visualize_json(&forks),
+        OutputFormat::Markdown => visualize_markdown(&audit_log, &forks, &args),
+    }
+}
+
+/// Detect fork points in the audit log
+fn detect_forks(audit_log: &[AuditLogEntry], args: &Args) -> Vec<ForkPoint> {
+    let mut prev_to_operations: HashMap<String, Vec<AuditLogEntry>> = HashMap::new();
+
+    // Group operations by their prev CID
+    for entry in audit_log {
+        if let Some(prev) = entry.operation.prev() {
+            prev_to_operations
+                .entry(prev.to_string())
+                .or_default()
+                .push(entry.clone());
+        }
+    }
+
+    // Build operation map for state reconstruction
+    let operation_map: HashMap<String, AuditLogEntry> = audit_log
+        .iter()
+        .map(|e| (e.cid.clone(), e.clone()))
+        .collect();
+
+    let mut forks = Vec::new();
+
+    // Find fork points (where multiple operations reference the same prev)
+    for (prev_cid, operations) in prev_to_operations {
+        if operations.len() > 1 {
+            if args.verbose {
+                println!("🔀 Fork detected at {}", truncate(&prev_cid, args));
+                println!("   {} competing operations", operations.len());
+            }
+
+            // Get the state at the prev operation to determine rotation keys
+            let state = if let Some(prev_entry) = operation_map.get(&prev_cid) {
+                get_state_from_operation(&prev_entry.operation)
+            } else {
+                // This shouldn't happen in a valid chain
+                continue;
+            };
+
+            // Analyze each operation in the fork
+            let mut fork_ops = Vec::new();
+            for entry in &operations {
+                let timestamp = parse_timestamp(&entry.created_at);
+
+                // Determine which rotation key signed this operation
+                let (signing_key_index, signing_key) = if !state.rotation_keys.is_empty() {
+                    find_signing_key(&entry.operation, &state.rotation_keys)
+                } else {
+                    (None, None)
+                };
+
+                fork_ops.push(ForkOperation {
+                    cid: entry.cid.clone(),
+                    operation: entry.operation.clone(),
+                    timestamp,
+                    signing_key_index,
+                    signing_key,
+                    is_winner: false,
+                    rejection_reason: None,
+                });
+            }
+
+            // Resolve the fork to determine winner
+            let winner_cid = resolve_fork(&mut fork_ops);
+
+            forks.push(ForkPoint {
+                prev_cid,
+                operations: fork_ops,
+                winner_cid,
+            });
+        }
+    }
+
+    // Sort forks chronologically
+    forks.sort_by_key(|f| {
+        f.operations
+            .iter()
+            .map(|op| op.timestamp)
+            .min()
+            .unwrap_or_else(Utc::now)
+    });
+
+    forks
+}
+
+/// Resolve a fork point and mark the winner
+fn resolve_fork(fork_ops: &mut [ForkOperation]) -> String {
+    // Sort by timestamp (chronological order)
+    fork_ops.sort_by_key(|op| op.timestamp);
+
+    // First-received is the default winner
+    let mut winner_idx = 0;
+    fork_ops[0].is_winner = true;
+
+    // Check if any later operation can invalidate based on priority
+    for i in 1..fork_ops.len() {
+        let competing_key_idx = fork_ops[i].signing_key_index;
+        let winner_key_idx = fork_ops[winner_idx].signing_key_index;
+
+        match (competing_key_idx, winner_key_idx) {
+            (Some(competing_idx), Some(winner_idx_val)) => {
+                if competing_idx < winner_idx_val {
+                    // Higher priority (lower index)
+                    let time_diff = fork_ops[i].timestamp - fork_ops[winner_idx].timestamp;
+
+                    if time_diff <= chrono::Duration::hours(72) {
+                        // Within recovery window - this operation wins
+                        fork_ops[winner_idx].is_winner = false;
+                        fork_ops[winner_idx].rejection_reason = Some(format!(
+                            "Invalidated by higher-priority key[{}] within recovery window",
+                            competing_idx
+                        ));
+
+                        fork_ops[i].is_winner = true;
+                        winner_idx = i;
+                    } else {
+                        // Outside recovery window
+                        fork_ops[i].rejection_reason = Some(format!(
+                            "Higher-priority key[{}] but outside 72-hour recovery window ({:.1}h late)",
+                            competing_idx,
+                            time_diff.num_hours() as f64
+                        ));
+                    }
+                } else {
+                    // Lower priority
+                    fork_ops[i].rejection_reason = Some(format!(
+                        "Lower-priority key[{}] (current winner has key[{}])",
+                        competing_idx,
+                        winner_idx_val
+                    ));
+                }
+            }
+            _ => {
+                fork_ops[i].rejection_reason = Some("Could not determine signing key".to_string());
+            }
+        }
+    }
+
+    fork_ops[winner_idx].cid.clone()
+}
+
+/// Find which rotation key signed an operation
+fn find_signing_key(operation: &Operation, rotation_keys: &[String]) -> (Option<usize>, Option<String>) {
+    for (index, key_did) in rotation_keys.iter().enumerate() {
+        if let Ok(verifying_key) = VerifyingKey::from_did_key(key_did) {
+            if operation.verify(&[verifying_key]).is_ok() {
+                return (Some(index), Some(key_did.clone()));
+            }
+        }
+    }
+    (None, None)
+}
+
+/// Get state from an operation
+fn get_state_from_operation(operation: &Operation) -> atproto_plc::PlcState {
+    match operation {
+        Operation::PlcOperation {
+            rotation_keys,
+            verification_methods,
+            also_known_as,
+            services,
+            ..
+        } => atproto_plc::PlcState {
+            rotation_keys: rotation_keys.clone(),
+            verification_methods: verification_methods.clone(),
+            also_known_as: also_known_as.clone(),
+            services: services.clone(),
+        },
+        _ => atproto_plc::PlcState::new(),
+    }
+}
+
+/// Parse ISO 8601 timestamp
+fn parse_timestamp(timestamp: &str) -> DateTime<Utc> {
+    timestamp
+        .parse::<DateTime<Utc>>()
+        .unwrap_or_else(|_| Utc::now())
+}
+
+/// Visualize forks as a tree
+fn visualize_tree(audit_log: &[AuditLogEntry], forks: &[ForkPoint], args: &Args) {
+    println!("📊 Fork Visualization (Tree Format)");
+    println!("═══════════════════════════════════════════════════════════════");
+    println!();
+
+    // Build a map of which operations are part of forks
+    let mut fork_map: HashMap<String, &ForkPoint> = HashMap::new();
+    for fork in forks {
+        for op in &fork.operations {
+            fork_map.insert(op.cid.clone(), fork);
+        }
+    }
+
+    // Track which prev CIDs have been processed
+    let mut processed_forks: std::collections::HashSet<String> = std::collections::HashSet::new();
+
+    for entry in audit_log.iter() {
+        let is_genesis = entry.operation.is_genesis();
+        let prev = entry.operation.prev();
+
+        // Check if this operation is part of a fork
+        if let Some(_prev_cid) = prev {
+            if let Some(fork) = fork_map.get(&entry.cid) {
+                // This is a fork point
+                if !processed_forks.contains(&fork.prev_cid) {
+                    processed_forks.insert(fork.prev_cid.clone());
+
+                    println!("Fork at operation referencing {}", truncate(&fork.prev_cid, args));
+
+                    for (j, fork_op) in fork.operations.iter().enumerate() {
+                        let symbol = if fork_op.is_winner { "✓" } else { "✗" };
+                        let color = if fork_op.is_winner { "🟢" } else { "🔴" };
+                        let prefix = if j == fork.operations.len() - 1 { "└─" } else { "├─" };
+
+                        println!(
+                            "  {} {} {} CID: {}",
+                            prefix,
+                            color,
+                            symbol,
+                            truncate(&fork_op.cid, args)
+                        );
+
+                        if let Some(key_idx) = fork_op.signing_key_index {
+                            println!("     │  Signed by: rotation_key[{}]", key_idx);
+                            if args.verbose {
+                                if let Some(key) = &fork_op.signing_key {
+                                    println!("     │  Key: {}", truncate(key, args));
+                                }
+                            }
+                        }
+
+                        if args.timing {
+                            println!(
+                                "     │  Timestamp: {}",
+                                fork_op.timestamp.format("%Y-%m-%d %H:%M:%S UTC")
+                            );
+                        }
+
+                        if !fork_op.is_winner {
+                            if let Some(reason) = &fork_op.rejection_reason {
+                                println!("     │  Reason: {}", reason);
+                            }
+                        } else {
+                            println!("     │  Status: CANONICAL (winner)");
+                        }
+
+                        if args.verbose {
+                            if let Some(Operation::PlcOperation { services, .. }) = Some(&fork_op.operation) {
+                                if !services.is_empty() {
+                                    println!("     │  Services: {} configured", services.len());
+                                }
+                            }
+                        }
+
+                        if j < fork.operations.len() - 1 {
+                            println!("     │");
+                        }
+                    }
+                    println!();
+                }
+                continue;
+            }
+        }
+
+        // Regular operation (not part of a fork)
+        if is_genesis {
+            println!("🌱 Genesis");
+            println!("   CID: {}", truncate(&entry.cid, args));
+            if args.timing {
+                println!("   Timestamp: {}", entry.created_at);
+            }
+            if args.verbose {
+                if let Operation::PlcOperation { rotation_keys, .. } = &entry.operation {
+                    println!("   Rotation keys: {}", rotation_keys.len());
+                }
+            }
+            println!();
+        }
+    }
+
+    // Summary
+    println!("═══════════════════════════════════════════════════════════════");
+    println!("📈 Summary:");
+    println!("   Total operations: {}", audit_log.len());
+    println!("   Fork points: {}", forks.len());
+
+    let total_competing_ops: usize = forks.iter().map(|f| f.operations.len()).sum();
+    let rejected_ops = total_competing_ops - forks.len();
+    println!("   Rejected operations: {}", rejected_ops);
+
+    if !forks.is_empty() {
+        println!("\n🔐 Fork Resolution Details:");
+        for (i, fork) in forks.iter().enumerate() {
+            let winner = fork.operations.iter().find(|op| op.is_winner).unwrap();
+            println!(
+                "   Fork {}: Winner is {} (signed by key[{}])",
+                i + 1,
+                truncate(&winner.cid, args),
+                winner.signing_key_index.unwrap_or(999)
+            );
+        }
+    }
+}
+
+/// Visualize linear chain (no forks)
+fn visualize_linear_chain(audit_log: &[AuditLogEntry], args: &Args) {
+    for (i, entry) in audit_log.iter().enumerate() {
+        let symbol = if i == 0 { "🌱" } else { "  ↓" };
+        println!("{} Operation {}: {}", symbol, i, truncate(&entry.cid, args));
+
+        if args.timing {
+            println!("     Timestamp: {}", entry.created_at);
+        }
+
+        if args.verbose {
+            if let Some(prev) = entry.operation.prev() {
+                println!("     Previous: {}", truncate(prev, args));
+            }
+        }
+    }
+}
+
+/// Visualize forks as JSON
+fn visualize_json(forks: &[ForkPoint]) {
+    #[derive(serde::Serialize)]
+    struct JsonFork {
+        prev_cid: String,
+        winner_cid: String,
+        operations: Vec<JsonForkOp>,
+    }
+
+    #[derive(serde::Serialize)]
+    struct JsonForkOp {
+        cid: String,
+        timestamp: String,
+        signing_key_index: Option<usize>,
+        is_winner: bool,
+        rejection_reason: Option<String>,
+    }
+
+    let json_forks: Vec<JsonFork> = forks
+        .iter()
+        .map(|f| JsonFork {
+            prev_cid: f.prev_cid.clone(),
+            winner_cid: f.winner_cid.clone(),
+            operations: f
+                .operations
+                .iter()
+                .map(|op| JsonForkOp {
+                    cid: op.cid.clone(),
+                    timestamp: op.timestamp.to_rfc3339(),
+                    signing_key_index: op.signing_key_index,
+                    is_winner: op.is_winner,
+                    rejection_reason: op.rejection_reason.clone(),
+                })
+                .collect(),
+        })
+        .collect();
+
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&json_forks).unwrap()
+    );
+}
+
+/// Visualize forks as Markdown
+fn visualize_markdown(audit_log: &[AuditLogEntry], forks: &[ForkPoint], args: &Args) {
+    println!("# PLC Fork Analysis Report\n");
+    println!("**DID**: {}\n", args.did);
+    println!("**Total Operations**: {}", audit_log.len());
+    println!("**Fork Points**: {}\n", forks.len());
+
+    if forks.is_empty() {
+        println!("✅ No forks detected - linear operation chain\n");
+        return;
+    }
+
+    println!("## Fork Details\n");
+
+    for (i, fork) in forks.iter().enumerate() {
+        println!("### Fork {} (at {})\n", i + 1, truncate(&fork.prev_cid, args));
+        println!("| Status | CID | Key Index | Timestamp | Reason |");
+        println!("|--------|-----|-----------|-----------|--------|");
+
+        for op in &fork.operations {
+            let status = if op.is_winner { "✅ Winner" } else { "❌ Rejected" };
+            let key_idx = op
+                .signing_key_index
+                .map(|i| i.to_string())
+                .unwrap_or_else(|| "?".to_string());
+            let timestamp = op.timestamp.format("%Y-%m-%d %H:%M:%S");
+            let reason = op
+                .rejection_reason
+                .as_deref()
+                .unwrap_or("Canonical operation");
+
+            println!(
+                "| {} | {} | {} | {} | {} |",
+                status,
+                truncate(&op.cid, args),
+                key_idx,
+                timestamp,
+                reason
+            );
+        }
+
+        println!();
+    }
+
+    println!("## Summary\n");
+    println!("- Total competing operations: {}", forks.iter().map(|f| f.operations.len()).sum::<usize>());
+    println!("- Rejected operations: {}", forks.iter().map(|f| f.operations.len() - 1).sum::<usize>());
+}
+
+/// Truncate a string for display
+fn truncate(s: &str, args: &Args) -> String {
+    if args.full_ids {
+        s.to_string()
+    } else {
+        if s.len() > 20 {
+            format!("{}...{}", &s[..8], &s[s.len() - 8..])
+        } else {
+            s.to_string()
+        }
+    }
+}
+
+/// Fetch the audit log for a DID from plc.directory
+fn fetch_audit_log(
+    plc_url: &str,
+    did: &Did,
+) -> Result<Vec<AuditLogEntry>, Box<dyn std::error::Error>> {
+    let url = format!("{}/{}/log/audit", plc_url, did);
+
+    let client = Client::builder()
+        .user_agent("atproto-plc-fork-viz/0.2.0")
+        .timeout(std::time::Duration::from_secs(30))
+        .build()?;
+
+    let response = client.get(&url).send()?;
+
+    if !response.status().is_success() {
+        return Err(format!(
+            "HTTP error: {} - {}",
+            response.status(),
+            response.text().unwrap_or_default()
+        )
+        .into());
+    }
+
+    let audit_log: Vec<AuditLogEntry> = response.json()?;
+    Ok(audit_log)
+}

src/lib.rs

···
     fn test_library_info() {
         let info = library_info();
         assert!(info.contains("atproto-plc"));
-        assert!(info.contains("0.1.0"));
+        assert!(info.contains("0.2.0"));
     }
 
     #[test]

src/validation.rs

···
 use crate::error::{PlcError, Result};
 use crate::operations::Operation;
 use chrono::{DateTime, Duration, Utc};
+use std::collections::HashMap;
 
 /// Recovery window duration (72 hours)
 const RECOVERY_WINDOW_HOURS: i64 = 72;
 
+/// Represents an operation with its server-assigned timestamp
+#[derive(Debug, Clone)]
+pub struct OperationWithTimestamp {
+    /// The operation itself
+    pub operation: Operation,
+    /// Server-assigned timestamp when the operation was received
+    pub timestamp: DateTime<Utc>,
+}
+
+/// Represents a fork point where multiple operations reference the same prev CID
+#[derive(Debug)]
+struct ForkPoint {
+    /// The prev CID that multiple operations reference
+    #[allow(dead_code)]
+    prev_cid: String,
+    /// Competing operations at this fork point, with their timestamps and signing key indices
+    operations: Vec<(Operation, DateTime<Utc>, usize)>,
+}
+
+impl ForkPoint {
+    /// Create a new fork point
+    fn new(prev_cid: String) -> Self {
+        Self {
+            prev_cid,
+            operations: Vec::new(),
+        }
+    }
+
+    /// Add an operation to this fork point
+    fn add_operation(&mut self, operation: Operation, timestamp: DateTime<Utc>, key_index: usize) {
+        self.operations.push((operation, timestamp, key_index));
+    }
+
+    /// Resolve this fork point and return the canonical operation
+    ///
+    /// Resolution algorithm:
+    /// 1. Sort operations by timestamp (first-received wins by default)
+    /// 2. Check if any later-received operation with higher priority can invalidate within 72 hours
+    /// 3. Return the winning operation
+    fn resolve(&self) -> Result<Operation> {
+        if self.operations.is_empty() {
+            return Err(PlcError::ForkResolutionError(
+                "Fork point has no operations".to_string(),
+            ));
+        }
+
+        // If only one operation, it wins by default
+        if self.operations.len() == 1 {
+            return Ok(self.operations[0].0.clone());
+        }
+
+        // Sort by timestamp - first-received wins by default
+        let mut sorted = self.operations.clone();
+        sorted.sort_by_key(|(_, timestamp, _)| *timestamp);
+
+        // The first operation in chronological order is the default winner
+        let (mut canonical_op, mut canonical_ts, mut canonical_key_idx) = sorted[0].clone();
+
+        // Check if any later-received operation can invalidate the current canonical
+        for (competing_op, competing_ts, competing_key_idx) in &sorted[1..] {
+            // Can only invalidate if the competing operation has higher priority (lower index)
+            if *competing_key_idx < canonical_key_idx {
+                // Check if within recovery window from the canonical operation
+                let time_diff = *competing_ts - canonical_ts;
+                if time_diff <= Duration::hours(RECOVERY_WINDOW_HOURS)
+                    && time_diff >= Duration::zero()
+                {
+                    // This higher-priority operation invalidates the canonical one
+                    // Update the canonical to this operation
+                    canonical_op = competing_op.clone();
+                    canonical_ts = *competing_ts;
+                    canonical_key_idx = *competing_key_idx;
+                }
+            }
+        }
+
+        Ok(canonical_op)
+    }
+}
+
+/// Builder for constructing the canonical chain from a set of operations with timestamps
+struct CanonicalChainBuilder {
+    /// All operations with timestamps, in the order they were received
+    operations: Vec<OperationWithTimestamp>,
+}
+
+impl CanonicalChainBuilder {
+    /// Create a new builder
+    fn new(operations: Vec<OperationWithTimestamp>) -> Self {
+        Self { operations }
+    }
+
+    /// Build the canonical chain by detecting and resolving forks
+    ///
+    /// Algorithm:
+    /// 1. Build a graph of operations by CID
+    /// 2. Detect fork points (multiple operations with same prev CID)
+    /// 3. Resolve each fork using rotation key priority and recovery window
+    /// 4. Build the canonical chain from genesis to tip
+    fn build(&self) -> Result<Vec<Operation>> {
+        if self.operations.is_empty() {
+            return Err(PlcError::EmptyChain);
+        }
+
+        // Build a map of CID -> (operation, timestamp) for quick lookup
+        let mut operation_map: HashMap<String, (Operation, DateTime<Utc>)> = HashMap::new();
+        for op_with_ts in &self.operations {
+            let cid = op_with_ts.operation.cid()?;
+            operation_map.insert(cid, (op_with_ts.operation.clone(), op_with_ts.timestamp));
+        }
+
+        // Find the genesis operation (prev = None)
+        let genesis = self
+            .operations
+            .iter()
+            .find(|op| op.operation.is_genesis())
+            .ok_or_else(|| PlcError::FirstOperationNotGenesis)?;
+
+        // Detect fork points - group operations by their prev CID
+        let mut prev_to_operations: HashMap<String, Vec<(Operation, DateTime<Utc>)>> =
+            HashMap::new();
+
+        for op_with_ts in &self.operations {
+            if let Some(prev_cid) = op_with_ts.operation.prev() {
+                prev_to_operations
+                    .entry(prev_cid.to_string())
+                    .or_default()
+                    .push((op_with_ts.operation.clone(), op_with_ts.timestamp));
+            }
+        }
+
+        // Build fork points for any prev CID with multiple operations
+        let mut fork_points: HashMap<String, ForkPoint> = HashMap::new();
+        for (prev_cid, operations) in &prev_to_operations {
+            if operations.len() > 1 {
+                // This is a fork point - multiple operations reference the same prev
+                let mut fork_point = ForkPoint::new(prev_cid.clone());
+
+                // For each operation, determine which rotation key signed it
+                // We need to look at the state at the prev operation
+                for (operation, timestamp) in operations {
+                    // Get the state at the prev operation to find rotation keys
+                    let rotation_keys = if let Some((prev_op, _)) = operation_map.get(prev_cid) {
+                        // Build state up to prev operation to get its rotation keys
+                        self.get_state_at_operation(prev_op)?
+                    } else {
+                        PlcState::new()
+                    };
+
+                    // Find which rotation key signed this operation
+                    let key_index = self.find_signing_key_index(operation, &rotation_keys)?;
+                    fork_point.add_operation(operation.clone(), *timestamp, key_index);
+                }
+
+                fork_points.insert(prev_cid.clone(), fork_point);
+            }
+        }
+
+        // Build the canonical chain by starting from genesis and following the canonical path
+        let mut canonical_chain = vec![genesis.operation.clone()];
+        let mut current_cid = genesis.operation.cid()?;
+
+        // Follow the chain until we reach the tip
+        loop {
+            // Check if there's a fork at this point
+            if let Some(fork_point) = fork_points.get(&current_cid) {
+                // Resolve the fork and get the canonical operation
+                let canonical_op = fork_point.resolve()?;
+                let next_cid = canonical_op.cid()?;
+                canonical_chain.push(canonical_op);
+                current_cid = next_cid;
+            } else if let Some(operations) = prev_to_operations.get(&current_cid) {
+                // No fork, just a single operation
+                if operations.len() == 1 {
+                    let (operation, _) = &operations[0];
+                    let next_cid = operation.cid()?;
+                    canonical_chain.push(operation.clone());
+                    current_cid = next_cid;
+                } else {
+                    // This shouldn't happen - we should have detected this as a fork
+                    return Err(PlcError::ForkResolutionError(
+                        "Unexpected multiple operations without fork point".to_string(),
+                    ));
+                }
+            } else {
+                // No more operations - we've reached the tip
+                break;
+            }
+        }
+
+        Ok(canonical_chain)
+    }
+
+    /// Find the index of the rotation key that signed this operation
+    fn find_signing_key_index(
+        &self,
+        operation: &Operation,
+        state: &PlcState,
+    ) -> Result<usize> {
+        if state.rotation_keys.is_empty() {
+            return Err(PlcError::InvalidRotationKeys(
+                "No rotation keys available for verification".to_string(),
+            ));
+        }
+
+        // Try each rotation key and return the index of the first one that verifies
+        for (index, key_did) in state.rotation_keys.iter().enumerate() {
+            let verifying_key = VerifyingKey::from_did_key(key_did)?;
+            if operation.verify(&[verifying_key]).is_ok() {
+                return Ok(index);
+            }
+        }
+
+        // No key verified the signature
+        Err(PlcError::SignatureVerificationFailed)
+    }
+
+    /// Get the state at a specific operation
+    ///
+    /// This reconstructs the state by applying all operations from genesis up to
+    /// and including the specified operation.
+    fn get_state_at_operation(&self, target_operation: &Operation) -> Result<PlcState> {
+        let mut state = PlcState::new();
+        let target_cid = target_operation.cid()?;
+
+        // Build the chain up to the target operation
+        // We need to traverse from genesis to the target
+        for op_with_ts in &self.operations {
+            let op = &op_with_ts.operation;
+
+            // Apply this operation to the state
+            match op {
+                Operation::PlcOperation {
+                    rotation_keys,
+                    verification_methods,
+                    also_known_as,
+                    services,
+                    ..
+                } => {
+                    state.rotation_keys = rotation_keys.clone();
+                    state.verification_methods = verification_methods.clone();
+                    state.also_known_as = also_known_as.clone();
+                    state.services = services.clone();
+                }
+                Operation::PlcTombstone { .. } => {
+                    state = PlcState::new();
+                }
+                Operation::LegacyCreate { .. } => {
+                    return Err(PlcError::InvalidOperationType(
+                        "Legacy create operations not fully supported".to_string(),
+                    ));
+                }
+            }
+
+            // Check if this is the target operation
+            if op.cid()? == target_cid {
+                break;
+            }
+        }
+
+        Ok(state)
+    }
+}
+
 /// Operation chain validator
 pub struct OperationChainValidator;
 
···
     ///
     /// This handles the recovery mechanism where operations signed by higher-priority
     /// rotation keys can invalidate later operations if submitted within 72 hours.
+    ///
+    /// # Arguments
+    ///
+    /// * `operations` - All operations in the audit log (may contain forks)
+    /// * `timestamps` - Server-assigned timestamps for each operation
+    ///
+    /// # Returns
+    ///
+    /// The final state after applying the canonical chain (after fork resolution)
+    ///
+    /// # Errors
+    ///
+    /// Returns errors if:
+    /// - Operations and timestamps arrays have different lengths
+    /// - Chain is empty
+    /// - First operation is not genesis
+    /// - Fork resolution fails
+    /// - Any signature is invalid
+    /// - Any operation violates constraints
     pub fn validate_chain_with_forks(
         operations: &[Operation],
         timestamps: &[DateTime<Utc>],
···
             ));
         }
 
-        // For now, we do basic validation without fork resolution
-        // Full fork resolution would require tracking all possible forks
-        // and selecting the canonical chain based on rotation key priority
-        Self::validate_chain(operations)
+        if operations.is_empty() {
+            return Err(PlcError::EmptyChain);
+        }
+
+        // Build operations with timestamps
+        let operations_with_timestamps: Vec<OperationWithTimestamp> = operations
+            .iter()
+            .zip(timestamps.iter())
+            .map(|(op, ts)| OperationWithTimestamp {
+                operation: op.clone(),
+                timestamp: *ts,
+            })
+            .collect();
+
+        // Use the canonical chain builder to resolve forks
+        let builder = CanonicalChainBuilder::new(operations_with_timestamps);
+        let canonical_chain = builder.build()?;
+
+        // Validate the canonical chain
+        Self::validate_chain(&canonical_chain)
     }
 
     /// Check if an operation is within the recovery window relative to another operation
···
     #[test]
     fn test_validate_chain_empty() {
         assert!(OperationChainValidator::validate_chain(&[]).is_err());
+    }
+
+    // ========================================================================
+    // Fork Resolution Tests
+    // ========================================================================
+
+    /// Test simple fork resolution where higher priority key wins within recovery window
+    #[test]
+    fn test_fork_resolution_priority_within_window() {
+        // Create two rotation keys with different priorities
+        let primary_key = SigningKey::generate_p256(); // Index 0 - highest priority
+        let backup_key = SigningKey::generate_k256(); // Index 1 - lower priority
+
+        let rotation_keys = vec![primary_key.to_did_key(), backup_key.to_did_key()];
+
+        // Create genesis operation
+        let genesis = Operation::new_genesis(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+        )
+        .sign(&primary_key)
+        .unwrap();
+
+        let genesis_cid = genesis.cid().unwrap();
+        let genesis_time = Utc::now();
+
+        // Create two competing operations that both reference genesis
+        // Operation A: signed by backup key (lower priority)
+        let mut services_a = HashMap::new();
+        services_a.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://pds-a.example.com".to_string(),
+            },
+        );
+
+        let op_a = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_a,
+            genesis_cid.clone(),
+        )
+        .sign(&backup_key)
+        .unwrap();
+
+        let op_a_time = genesis_time + Duration::hours(1);
+
+        // Operation B: signed by primary key (higher priority), arrives 24 hours after A
+        let mut services_b = HashMap::new();
+        services_b.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://pds-b.example.com".to_string(),
+            },
+        );
+
+        let op_b = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_b,
+            genesis_cid,
+        )
+        .sign(&primary_key)
+        .unwrap();
+
+        let op_b_time = op_a_time + Duration::hours(24); // Within 72-hour window
+
+        // Build operations and timestamps arrays
+        let operations = vec![genesis.clone(), op_a.clone(), op_b.clone()];
+        let timestamps = vec![genesis_time, op_a_time, op_b_time];
+
+        // Validate with fork resolution
+        let result = OperationChainValidator::validate_chain_with_forks(&operations, &timestamps);
+        assert!(result.is_ok());
+
+        let state = result.unwrap();
+
+        // Operation B should win because it has higher priority (lower index)
+        // and was received within the 72-hour recovery window
+        assert_eq!(
+            state.services.get("pds").unwrap().endpoint,
+            "https://pds-b.example.com"
+        );
+    }
+
+    /// Test fork resolution where lower priority operation wins after recovery window expires
+    #[test]
+    fn test_fork_resolution_priority_outside_window() {
+        let primary_key = SigningKey::generate_p256(); // Index 0
+        let backup_key = SigningKey::generate_k256(); // Index 1
+
+        let rotation_keys = vec![primary_key.to_did_key(), backup_key.to_did_key()];
+
+        let genesis = Operation::new_genesis(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+        )
+        .sign(&primary_key)
+        .unwrap();
+
+        let genesis_cid = genesis.cid().unwrap();
+        let genesis_time = Utc::now();
+
+        // Operation A: signed by backup key (lower priority)
+        let mut services_a = HashMap::new();
+        services_a.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://pds-a.example.com".to_string(),
+            },
+        );
+
+        let op_a = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_a,
+            genesis_cid.clone(),
+        )
+        .sign(&backup_key)
+        .unwrap();
+
+        let op_a_time = genesis_time + Duration::hours(1);
+
+        // Operation B: signed by primary key, arrives 100 hours after A (outside 72-hour window)
+        let mut services_b = HashMap::new();
+        services_b.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://pds-b.example.com".to_string(),
+            },
+        );
+
+        let op_b = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_b,
+            genesis_cid,
+        )
+        .sign(&primary_key)
+        .unwrap();
+
+        let op_b_time = op_a_time + Duration::hours(100); // Outside 72-hour window
+
+        let operations = vec![genesis.clone(), op_a.clone(), op_b.clone()];
+        let timestamps = vec![genesis_time, op_a_time, op_b_time];
+
+        let result = OperationChainValidator::validate_chain_with_forks(&operations, &timestamps);
+        assert!(result.is_ok());
+
+        let state = result.unwrap();
+
+        // Operation A should win because even though B has higher priority,
+        // it arrived outside the 72-hour recovery window
+        assert_eq!(
+            state.services.get("pds").unwrap().endpoint,
+            "https://pds-a.example.com"
+        );
+    }
+
+    /// Test multiple forks at different points in the chain
+    #[test]
+    fn test_fork_resolution_multiple_forks() {
+        let key1 = SigningKey::generate_p256();
+        let key2 = SigningKey::generate_k256();
+        let key3 = SigningKey::generate_p256();
+
+        let rotation_keys = vec![key1.to_did_key(), key2.to_did_key(), key3.to_did_key()];
+
+        // Genesis
+        let genesis = Operation::new_genesis(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+        )
+        .sign(&key1)
+        .unwrap();
+
+        let genesis_cid = genesis.cid().unwrap();
+        let genesis_time = Utc::now();
+
+        // First fork at genesis
+        let mut services_1a = HashMap::new();
+        services_1a.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://fork1a.example.com".to_string(),
+            },
+        );
+
+        let op_1a = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_1a,
+            genesis_cid.clone(),
+        )
+        .sign(&key2)
+        .unwrap();
+
+        let op_1a_time = genesis_time + Duration::hours(1);
+
+        // Second operation at same fork (higher priority, within window)
+        let mut services_1b = HashMap::new();
+        services_1b.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://fork1b.example.com".to_string(),
+            },
+        );
+
+        let op_1b = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_1b,
+            genesis_cid,
+        )
+        .sign(&key1)
+        .unwrap();
+
+        let op_1b_time = op_1a_time + Duration::hours(2);
+
+        // Next operation continues from op_1b (the winner)
+        let op_1b_cid = op_1b.cid().unwrap();
+
+        let mut services_2 = HashMap::new();
+        services_2.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://continuation.example.com".to_string(),
+            },
+        );
+
+        let op_2 = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_2,
+            op_1b_cid,
+        )
+        .sign(&key1)
+        .unwrap();
+
+        let op_2_time = op_1b_time + Duration::hours(1);
+
+        let operations = vec![
+            genesis.clone(),
+            op_1a.clone(),
+            op_1b.clone(),
+            op_2.clone(),
+        ];
+        let timestamps = vec![genesis_time, op_1a_time, op_1b_time, op_2_time];
+
+        let result = OperationChainValidator::validate_chain_with_forks(&operations, &timestamps);
+        assert!(result.is_ok());
+
+        let state = result.unwrap();
+
+        // The final state should be from op_2, which continues from op_1b
+        assert_eq!(
+            state.services.get("pds").unwrap().endpoint,
+            "https://continuation.example.com"
+        );
+    }
+
+    /// Test fork with three competing operations
+    #[test]
+    fn test_fork_resolution_three_way_fork() {
+        let key1 = SigningKey::generate_p256(); // Highest priority
+        let key2 = SigningKey::generate_k256(); // Medium priority
+        let key3 = SigningKey::generate_p256(); // Lowest priority
+
+        let rotation_keys = vec![key1.to_did_key(), key2.to_did_key(), key3.to_did_key()];
+
+        let genesis = Operation::new_genesis(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+        )
+        .sign(&key1)
+        .unwrap();
+
+        let genesis_cid = genesis.cid().unwrap();
+        let genesis_time = Utc::now();
+
+        // Three competing operations
+        let mut services_a = HashMap::new();
+        services_a.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://op-a.example.com".to_string(),
+            },
+        );
+
+        let op_a = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_a,
+            genesis_cid.clone(),
+        )
+        .sign(&key3)
+        .unwrap(); // Lowest priority, first to arrive
+
+        let op_a_time = genesis_time + Duration::hours(1);
+
+        let mut services_b = HashMap::new();
+        services_b.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://op-b.example.com".to_string(),
+            },
+        );
+
+        let op_b = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_b,
+            genesis_cid.clone(),
+        )
+        .sign(&key2)
+        .unwrap(); // Medium priority
+
+        let op_b_time = op_a_time + Duration::hours(2);
+
+        let mut services_c = HashMap::new();
+        services_c.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://op-c.example.com".to_string(),
+            },
+        );
+
+        let op_c = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_c,
+            genesis_cid,
+        )
+        .sign(&key1)
+        .unwrap(); // Highest priority, within window
+
+        let op_c_time = op_a_time + Duration::hours(10);
+
+        let operations = vec![
+            genesis.clone(),
+            op_a.clone(),
+            op_b.clone(),
+            op_c.clone(),
+        ];
+        let timestamps = vec![genesis_time, op_a_time, op_b_time, op_c_time];
+
+        let result = OperationChainValidator::validate_chain_with_forks(&operations, &timestamps);
+        assert!(result.is_ok());
+
+        let state = result.unwrap();
+
+        // Operation C should win (highest priority, within window)
+        assert_eq!(
+            state.services.get("pds").unwrap().endpoint,
+            "https://op-c.example.com"
+        );
+    }
+
+    /// Test no fork - linear chain should work as before
+    #[test]
+    fn test_fork_resolution_no_fork() {
+        let key = SigningKey::generate_p256();
+        let rotation_keys = vec![key.to_did_key()];
+
+        let genesis = Operation::new_genesis(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+        )
+        .sign(&key)
+        .unwrap();
+
+        let genesis_cid = genesis.cid().unwrap();
+        let genesis_time = Utc::now();
+
+        let mut services = HashMap::new();
+        services.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://pds.example.com".to_string(),
+            },
+        );
+
+        let op1 = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services.clone(),
+            genesis_cid,
+        )
+        .sign(&key)
+        .unwrap();
+
+        let op1_time = genesis_time + Duration::hours(1);
+
+        let operations = vec![genesis.clone(), op1.clone()];
+        let timestamps = vec![genesis_time, op1_time];
+
+        let result = OperationChainValidator::validate_chain_with_forks(&operations, &timestamps);
+        assert!(result.is_ok());
+
+        let state = result.unwrap();
+        assert_eq!(
+            state.services.get("pds").unwrap().endpoint,
+            "https://pds.example.com"
+        );
+    }
+
+    /// Test fork resolution with rotation key changes
+    #[test]
+    fn test_fork_resolution_with_key_rotation() {
+        let key1 = SigningKey::generate_p256();
+        let key2 = SigningKey::generate_k256();
+        let key3 = SigningKey::generate_p256();
+
+        // Initial rotation keys
+        let rotation_keys_v1 = vec![key1.to_did_key(), key2.to_did_key()];
+
+        let genesis = Operation::new_genesis(
+            rotation_keys_v1.clone(),
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+        )
+        .sign(&key1)
+        .unwrap();
+
+        let genesis_cid = genesis.cid().unwrap();
+        let genesis_time = Utc::now();
+
+        // Update rotation keys in first operation
+        let rotation_keys_v2 = vec![key1.to_did_key(), key3.to_did_key()];
+
+        let op1 = Operation::new_update(
+            rotation_keys_v2.clone(),
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+            genesis_cid,
+        )
+        .sign(&key1)
+        .unwrap();
+
+        let op1_cid = op1.cid().unwrap();
+        let op1_time = genesis_time + Duration::hours(1);
+
+        // Create a fork at op1 - both operations use the new rotation keys
+        let mut services_a = HashMap::new();
+        services_a.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://op-a.example.com".to_string(),
+            },
+        );
+
+        let op_a = Operation::new_update(
+            rotation_keys_v2.clone(),
+            HashMap::new(),
+            vec![],
+            services_a,
+            op1_cid.clone(),
+        )
+        .sign(&key3)
+        .unwrap(); // Index 1 in new keys
+
+        let op_a_time = op1_time + Duration::hours(1);
+
+        let mut services_b = HashMap::new();
+        services_b.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://op-b.example.com".to_string(),
+            },
+        );
+
+        let op_b = Operation::new_update(
+            rotation_keys_v2.clone(),
+            HashMap::new(),
+            vec![],
+            services_b,
+            op1_cid,
+        )
+        .sign(&key1)
+        .unwrap(); // Index 0 in new keys (higher priority)
+
+        let op_b_time = op_a_time + Duration::hours(2);
+
+        let operations = vec![
+            genesis.clone(),
+            op1.clone(),
+            op_a.clone(),
+            op_b.clone(),
+        ];
+        let timestamps = vec![genesis_time, op1_time, op_a_time, op_b_time];
+
+        let result = OperationChainValidator::validate_chain_with_forks(&operations, &timestamps);
+        assert!(result.is_ok());
+
+        let state = result.unwrap();
+
+        // Operation B should win (signed by key1 which is index 0 in the new rotation keys)
+        assert_eq!(
+            state.services.get("pds").unwrap().endpoint,
+            "https://op-b.example.com"
+        );
+    }
+
+    /// Test that operations with mismatched timestamps and operations fail
+    #[test]
+    fn test_fork_resolution_mismatched_lengths() {
+        let key = SigningKey::generate_p256();
+        let rotation_keys = vec![key.to_did_key()];
+
+        let genesis = Operation::new_genesis(
+            rotation_keys,
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+        )
+        .sign(&key)
+        .unwrap();
+
+        let operations = vec![genesis];
+        let timestamps = vec![Utc::now(), Utc::now()]; // Different length
+
+        let result = OperationChainValidator::validate_chain_with_forks(&operations, &timestamps);
+        assert!(result.is_err());
+    }
+
+    /// Test recovery window boundary (exactly 72 hours)
+    #[test]
+    fn test_fork_resolution_recovery_window_boundary() {
+        let primary_key = SigningKey::generate_p256();
+        let backup_key = SigningKey::generate_k256();
+
+        let rotation_keys = vec![primary_key.to_did_key(), backup_key.to_did_key()];
+
+        let genesis = Operation::new_genesis(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            HashMap::new(),
+        )
+        .sign(&primary_key)
+        .unwrap();
+
+        let genesis_cid = genesis.cid().unwrap();
+        let genesis_time = Utc::now();
+
+        // Operation A: signed by backup key
+        let mut services_a = HashMap::new();
+        services_a.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://op-a.example.com".to_string(),
+            },
+        );
+
+        let op_a = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_a,
+            genesis_cid.clone(),
+        )
+        .sign(&backup_key)
+        .unwrap();
+
+        let op_a_time = genesis_time + Duration::hours(1);
+
+        // Operation B: exactly at 72-hour boundary (should still be within window)
+        let mut services_b = HashMap::new();
+        services_b.insert(
+            "pds".to_string(),
+            ServiceEndpoint {
+                service_type: "AtprotoPersonalDataServer".to_string(),
+                endpoint: "https://op-b.example.com".to_string(),
+            },
+        );
+
+        let op_b = Operation::new_update(
+            rotation_keys.clone(),
+            HashMap::new(),
+            vec![],
+            services_b,
+            genesis_cid,
+        )
+        .sign(&primary_key)
+        .unwrap();
+
+        // Exactly 72 hours after op_a
+        let op_b_time = op_a_time + Duration::hours(72);
+
+        let operations = vec![genesis.clone(), op_a.clone(), op_b.clone()];
+        let timestamps = vec![genesis_time, op_a_time, op_b_time];
+
+        let result = OperationChainValidator::validate_chain_with_forks(&operations, &timestamps);
+        assert!(result.is_ok());
+
+        let state = result.unwrap();
+
+        // At exactly 72 hours, the higher priority operation should still win
+        assert_eq!(
+            state.services.get("pds").unwrap().endpoint,
+            "https://op-b.example.com"
+        );
     }
 }

wasm/package-lock.json

···
 {
   "name": "atproto-plc",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "atproto-plc",
-      "version": "0.1.0",
+      "version": "0.2.0",
       "license": "MIT OR Apache-2.0",
       "devDependencies": {
         "@types/node": "^20.0.0"

wasm/package.json

···
 {
   "name": "atproto-plc",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "did-method-plc implementation for ATProto with WASM support",
   "type": "module",
   "main": "index.js",

wasm/plc-audit.js

···
   try {
     const response = await fetch(url, {
       headers: {
-        'User-Agent': 'atproto-plc-audit-wasm/0.1.0',
+        'User-Agent': 'atproto-plc-audit-wasm/0.2.0',
       },
     });
 
···
 }
 
 /**
+ * Detect if there are fork points in the audit log
+ */
+function detectForks(operations) {
+  const prevCounts = new Map();
+
+  for (const entry of operations) {
+    const prev = entry.operation.prev();
+    if (prev) {
+      prevCounts.set(prev, (prevCounts.get(prev) || 0) + 1);
+    }
+  }
+
+  // If any prev CID is referenced by more than one operation, there's a fork
+  return Array.from(prevCounts.values()).some(count => count > 1);
+}
+
+/**
+ * Build a list of indices that form the canonical chain
+ */
+function buildCanonicalChainIndices(operations) {
+  // Build a map of prev CID to operations
+  const prevToIndices = new Map();
+
+  for (let i = 0; i < operations.length; i++) {
+    const prev = operations[i].operation.prev();
+    if (prev) {
+      if (!prevToIndices.has(prev)) {
+        prevToIndices.set(prev, []);
+      }
+      prevToIndices.get(prev).push(i);
+    }
+  }
+
+  // Start from genesis and follow the canonical chain
+  const canonical = [];
+
+  // Find genesis (first operation)
+  if (operations.length === 0) {
+    return canonical;
+  }
+
+  canonical.push(0);
+  let currentCid = operations[0].cid;
+
+  // Follow the chain, preferring non-nullified operations
+  while (true) {
+    const indices = prevToIndices.get(currentCid);
+    if (!indices || indices.length === 0) {
+      break;
+    }
+
+    // Find the first non-nullified operation
+    const nextIdx = indices.find(idx => !operations[idx].nullified);
+    if (nextIdx !== undefined) {
+      canonical.push(nextIdx);
+      currentCid = operations[nextIdx].cid;
+    } else {
+      // All operations at this point are nullified - try to find any operation
+      if (indices.length > 0) {
+        canonical.push(indices[0]);
+        currentCid = operations[indices[0]].cid;
+      } else {
+        break;
+      }
+    }
+  }
+
+  return canonical;
+}
+
+/**
+ * Display the final state after validation
+ */
+function displayFinalState(finalEntry, rawEntry) {
+  const rotationKeys = finalEntry.operation.rotationKeys();
+
+  if (!rotationKeys) {
+    console.error('❌ Error: Could not extract final state');
+    process.exit(1);
+  }
+
+  if (args.quiet) {
+    console.log('✅ VALID');
+  } else {
+    console.log('✅ Validation successful!');
+    console.log();
+    console.log('📄 Final DID State:');
+    console.log('   Rotation keys:', rotationKeys.length);
+    for (let i = 0; i < rotationKeys.length; i++) {
+      console.log(`     [${i}] ${rotationKeys[i]}`);
+    }
+    console.log();
+
+    // Extract additional state from the raw operation
+    const op = rawEntry.operation;
+    if (op.verificationMethods) {
+      const vmKeys = Object.keys(op.verificationMethods);
+      console.log('   Verification methods:', vmKeys.length);
+      for (const name of vmKeys) {
+        console.log(`     ${name}: ${op.verificationMethods[name]}`);
+      }
+      console.log();
+    }
+
+    if (op.alsoKnownAs && op.alsoKnownAs.length > 0) {
+      console.log('   Also known as:', op.alsoKnownAs.length);
+      for (const uri of op.alsoKnownAs) {
+        console.log(`     - ${uri}`);
+      }
+      console.log();
+    }
+
+    if (op.services) {
+      const serviceNames = Object.keys(op.services);
+      if (serviceNames.length > 0) {
+        console.log('   Services:', serviceNames.length);
+        for (const name of serviceNames) {
+          const service = op.services[name];
+          console.log(`     ${name}: ${service.endpoint} (${service.type})`);
+        }
+      }
+    }
+  }
+}
+
+/**
  * Main validation logic
  */
 async function main() {
···
       console.log();
     }
 
-    // Validate the operation chain
+    // Detect forks and build canonical chain
     if (!args.quiet) {
-      console.log('🔐 Validating operation chain...');
+      console.log('🔐 Analyzing operation chain...');
       console.log();
     }
 
-    // Step 1: Validate chain linkage (prev references)
+    // Detect fork points and nullified operations
+    const hasForks = detectForks(operations);
+    const hasNullified = operations.some(e => e.nullified);
+
+    if (hasForks || hasNullified) {
+      if (!args.quiet) {
+        if (hasForks) {
+          console.log('⚠️  Fork detected - multiple operations reference the same prev CID');
+        }
+        if (hasNullified) {
+          console.log('⚠️  Nullified operations detected - will validate canonical chain only');
+        }
+        console.log();
+      }
+
+      // Build canonical chain
+      if (args.verbose) {
+        console.log('Step 1: Fork Resolution & Canonical Chain Building');
+        console.log('===================================================');
+      }
+
+      const canonicalIndices = buildCanonicalChainIndices(operations);
+
+      if (args.verbose) {
+        console.log('  ✅ Fork resolution complete');
+        console.log('  ✅ Canonical chain identified');
+        console.log();
+
+        console.log('Canonical Chain Operations:');
+        console.log('===========================');
+
+        for (const idx of canonicalIndices) {
+          const entry = operations[idx];
+          console.log(`  [${idx}] ✅ ${entry.cid} - ${entry.createdAt}`);
+        }
+        console.log();
+
+        if (hasNullified) {
+          console.log('Nullified/Rejected Operations:');
+          console.log('==============================');
+          for (let i = 0; i < operations.length; i++) {
+            const entry = operations[i];
+            if (entry.nullified && !canonicalIndices.includes(i)) {
+              console.log(`  [${i}] ❌ ${entry.cid} - ${entry.createdAt} (nullified)`);
+              const prev = entry.operation.prev();
+              if (prev) {
+                console.log('      Referenced:', prev);
+              }
+            }
+          }
+          console.log();
+        }
+      }
+
+      // Validate signatures along canonical chain
+      if (args.verbose) {
+        console.log('Step 2: Cryptographic Signature Validation');
+        console.log('==========================================');
+      }
+
+      let currentRotationKeys = [];
+
+      for (const idx of canonicalIndices) {
+        const entry = operations[idx];
+
+        // For genesis operation, extract rotation keys
+        if (idx === 0) {
+          if (args.verbose) {
+            console.log(`  [${idx}] Genesis operation - extracting rotation keys`);
+          }
+
+          const rotationKeys = entry.operation.rotationKeys();
+          if (rotationKeys) {
+            currentRotationKeys = rotationKeys;
+
+            if (args.verbose) {
+              console.log('      Rotation keys:', rotationKeys.length);
+              for (let j = 0; j < rotationKeys.length; j++) {
+                console.log(`        [${j}] ${rotationKeys[j]}`);
+              }
+              console.log('      ⚠️  Genesis signature cannot be verified (bootstrapping trust)');
+            }
+          }
+          continue;
+        }
+
+        if (args.verbose) {
+          console.log(`  [${idx}] Validating signature...`);
+          console.log('      CID:', entry.cid);
+          console.log('      Signature:', entry.operation.signature());
+        }
+
+        // Validate signature using current rotation keys
+        if (currentRotationKeys.length > 0) {
+          if (args.verbose) {
+            console.log('      Available rotation keys:', currentRotationKeys.length);
+            for (let j = 0; j < currentRotationKeys.length; j++) {
+              console.log(`        [${j}] ${currentRotationKeys[j]}`);
+            }
+          }
+
+          // Parse verifying keys
+          const verifyingKeys = [];
+          for (const keyStr of currentRotationKeys) {
+            try {
+              verifyingKeys.push(WasmVerifyingKey.fromDidKey(keyStr));
+            } catch (error) {
+              console.error(`Warning: Failed to parse rotation key: ${keyStr}`);
+            }
+          }
+
+          if (args.verbose) {
+            console.log(`      Parsed verifying keys: ${verifyingKeys.length}/${currentRotationKeys.length}`);
+          }
+
+          // Try to verify with each key and track which one worked
+          try {
+            const keyIndex = entry.operation.verifyWithKeyIndex(verifyingKeys);
+
+            if (args.verbose) {
+              console.log(`      ✅ Signature verified with rotation key [${keyIndex}]`);
+              console.log(`         ${currentRotationKeys[keyIndex]}`);
+            }
+          } catch (error) {
+            console.error();
+            console.error(`❌ Validation failed: Invalid signature at operation ${idx}`);
+            console.error('   Error:', error.message);
+            console.error('   CID:', entry.cid);
+            console.error(`   Tried ${verifyingKeys.length} rotation keys, none verified the signature`);
+            process.exit(1);
+          }
+        }
+
+        // Update rotation keys if this operation changes them
+        const newRotationKeys = entry.operation.rotationKeys();
+        if (newRotationKeys) {
+          const keysChanged = JSON.stringify(newRotationKeys) !== JSON.stringify(currentRotationKeys);
+
+          if (keysChanged) {
+            if (args.verbose) {
+              console.log('      🔄 Rotation keys updated by this operation');
+              console.log('         Old keys:', currentRotationKeys.length);
+              console.log('         New keys:', newRotationKeys.length);
+              for (let j = 0; j < newRotationKeys.length; j++) {
+                console.log(`           [${j}] ${newRotationKeys[j]}`);
+              }
+            }
+            currentRotationKeys = newRotationKeys;
+          }
+        }
+      }
+
+      if (args.verbose) {
+        console.log();
+        console.log('✅ Cryptographic signature validation complete');
+        console.log();
+      }
+
+      // Build final state
+      const finalIdx = canonicalIndices[canonicalIndices.length - 1];
+      const finalEntry = operations[finalIdx];
+      const finalRawEntry = auditLog[finalIdx];
+      displayFinalState(finalEntry, finalRawEntry);
+      return;
+    }
+
+    // Simple linear chain validation (no forks or nullified operations)
     if (args.verbose) {
-      console.log('Step 1: Chain Linkage Validation');
+      console.log('Step 1: Linear Chain Validation');
       console.log('================================');
     }
 
     for (let i = 1; i < operations.length; i++) {
-      if (operations[i].nullified) {
-        if (args.verbose) {
-          console.log(`  [${i}] ⊘ Skipped (nullified)`);
-        }
-        continue;
-      }
-
       const prevCid = operations[i - 1].cid;
       const expectedPrev = operations[i].operation.prev();
 
···
     }
 
     // Build final state
-    const finalEntry = operations.filter(e => !e.nullified).pop();
-    const finalRotationKeys = finalEntry.operation.rotationKeys();
-
-    if (finalRotationKeys) {
-      if (args.quiet) {
-        console.log('✅ VALID');
-      } else {
-        console.log('✅ Validation successful!');
-        console.log();
-        console.log('📄 Final DID State:');
-        console.log('   Rotation keys:', finalRotationKeys.length);
-        for (let i = 0; i < finalRotationKeys.length; i++) {
-          console.log(`     [${i}] ${finalRotationKeys[i]}`);
-        }
-      }
-    } else {
-      console.error('❌ Error: Could not extract final state');
-      process.exit(1);
-    }
+    const finalEntry = operations[operations.length - 1];
+    const finalRawEntry = auditLog[auditLog.length - 1];
+    displayFinalState(finalEntry, finalRawEntry);
 
   } catch (error) {
     console.error('❌ Fatal error:', error.message);