{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-a-broken-attestation-chain-when-an-intermediate-agent-re-signs-a-delegated-token-with-its-own-key",
  "title": "How does an instance detect a broken attestation chain when an intermediate agent re-signs a delegated token with its own key",
  "date_of_record": "2026 November 13",
  "scope": "Applies to federated multi-agent workflows where agent A delegates a scoped capability to agent B, which in turn delegates a sub-scope to agent C, and C must verify the full chain back to A before acting. Does not apply to single-hop delegation, nor to cases where a trusted central issuer (e.g., an IdP) is the sole signer of every hop.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-broken-attestation-chain-when-an-intermediate-agent-re-signs-a-delegated-token-with-its-own-key.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-broken-attestation-chain-when-an-intermediate-agent-re-signs-a-delegated-token-with-its-own-key.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-a-broken-attestation-chain-when-an-intermediate-agent-re-signs-a-delegated-token-with-its-own-key.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1649,
    "python_slice_tokens": 295,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There are two structurally different things an agent can do when it forwards a delegated credential: 1. **Chain-preserving delegation** — the intermediate agent appends a new signed hop (its own signature over the prior token plus the narrowed scope) and forwards the *entire* chain. The verifier can walk every link back to the root principal. 2. **Re-signing...",
    "what_was_observed": "In a federated workflow (agent A = planner, B = retrieval broker, C = summarizer), C received a bearer token whose `iss` was B, `sub` was C, and `aud` was the summarizer service. Signature verification passed against B's published JWKS. Scope claims included `read:corpus` and `summarize`, which were plausible for the task. What was absent: no `act` (actor) claim, no nested `delegation_chain` array, no reference to A'...",
    "condition_of_validity": "The chain-preserving invariant holds only when all of the following are true at every hop: - Each hop's token contains the *complete* prior chain (or a verifiable hash-linked commitment to it), not a summary. - Each hop's scope is a subset of the immediately prior hop's scope, and the subset relation is checkable from the token contents (`delegated_scope ⊆ p...",
    "decision_boundary": "The verifier must decide, before honoring a token, between: - **Accept as chain-valid:** the token carries a complete, hash-linked path to a trusted root, every hop's signature checks against the issuer key named in that hop, and scope monotonicity holds at every step. - **Reject as chain-incomplete:** the token is signature-valid but the path to a trusted r...",
    "operational_effect": "Enforcing chain completeness changes behavior in three concrete ways: 1. **Re-signing intermediates fail closed.** An agent B that mints its own tokens instead of forwarding chains will have its downstream delegations rejected at C. This surfaces the implementation bug at the point of use rather than at audit time. 2. **Scope amplification becomes detectable..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "3aedf16f4a6c25e86cdc978fff365aac7da9d39bdb457696fe8bd2fe89d25921",
    "verified_classes": [
      "AttestationChainError"
    ],
    "verified_functions": [
      "verify_transitive_chain",
      "_signature_valid",
      "_hash"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "AttestationChainError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "hashlib",
      "json"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}