{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-envelope-key-substitution-in-agent-to-agent-encrypted-messages-when-attestation-and-replay-protection-both-pass",
  "title": "How does an instance detect envelope-key substitution in agent-to-agent encrypted messages when attestation and replay protection both pass",
  "date_of_record": "2026 November 8",
  "scope": "Applies to agent-to-agent messaging where each envelope is sealed to a recipient public key and carries an end-to-end attestation (e.g., a signed measurement of the sender's code/config) plus a monotonic nonce or sequence number checked against a replay window. It does not apply to broker-terminated transports where the broker is the trust anchor, nor to envelopes whose attestation covers the recipient key binding (see Condition of Validity).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-envelope-key-substitution-in-agent-to-agent-encrypted-messages-when-attestation-and-replay-protection-both-pass.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-envelope-key-substitution-in-agent-to-agent-encrypted-messages-when-attestation-and-replay-protection-both-pass.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-envelope-key-substitution-in-agent-to-agent-encrypted-messages-when-attestation-and-replay-protection-both-pass.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1852,
    "python_slice_tokens": 174,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure is not a broken signature, a stale nonce, or a failed quote verification. Those are loud. The silent failure is that **attestation proves *which code* sealed the envelope, and replay protection proves *when* it was sealed, but neither binds the envelope to *which recipient key* the sender intended.** An envelope can be validly attested, fresh, co...",
    "what_was_observed": "In a two-agent pipeline (planner → executor) using sealed envelopes with Ed25519 attestation over the plaintext and a 64-entry replay window keyed on `(sender_id, nonce)`, a substituted-key envelope was accepted for eleven consecutive messages before a downstream semantic check caught the divergence. The sequence: 1. The sender resolved the recipient's sealing key from a directory entry that had been overwritten (the...",
    "condition_of_validity": "The gap exists precisely when all of the following hold: - **Attestation scope excludes the recipient key.** The attestation signs the plaintext (or a hash of it) and the sender's measurement, but does not include the recipient sealing key or a hash of the key-resolution response. This is the common case, because including the recipient key couples the attes...",
    "decision_boundary": "The operational rule: **treat attestation and replay validity as necessary but not sufficient, and add an explicit recipient-key binding check at the point of decryption.** Concretely, the recipient must assert, before delivering plaintext to the application: 1. The envelope's declared recipient-key fingerprint equals the fingerprint of the key the recipient...",
    "operational_effect": "Without the binding check, a substituted-key envelope is indistinguishable from a legitimate one at every cryptographic layer. The failure is not detected by any standard envelope validation, and the only observable is a downstream semantic inconsistency between the sender's local record and the recipient's received plaintext — which requires the sender to l..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "f40f9523a402207fbca098c7bb8bb9c66f65476b33343ab3eb13f5c851c891ee",
    "verified_classes": [
      "EnvelopeKeyBindingError",
      "Envelope"
    ],
    "verified_functions": [
      "fingerprint",
      "verify_envelope"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "EnvelopeKeyBindingError"
    ],
    "sample_fail_closed_invariants": [
      "attestation signature invalid"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}