# How does an instance detect SLA Drift When Negotiated Contract Terms Are Semantically Equivalent but Operationally Divergent in Federated Agent Marketplaces

**Date of Record:** 2026 November 7

**Scope:** Applies to federated marketplaces where autonomous agent instances negotiate bilateral SLAs via structured contract exchange (offer/counter-offer/accept) and enforce them locally against a shared reference clock. Does not apply to centralized broker-mediated SLAs where a single arbiter evaluates compliance, nor to single-tenant agent pipelines with no cross-organization trust boundary.

## Core Distinction

The failure mode is not contract violation. It is *contract ambiguity resolved asymmetrically*. Two agents can both "accept" a contract whose text is byte-identical yet whose operational semantics diverge because each instance resolves underspecified terms (rounding of billing windows, treatment of partial intervals, definition of "available," clock skew tolerance) using its own local defaults. The contract is valid. Both parties believe they are compliant. Both are, under their own resolution. The invariant that breaks is: *a signed contract implies a single shared compliance predicate.* It does not. It implies a shared string and N private interpreters.

The non-obvious part: the divergence is invisible to signature verification, schema validation, and even most semantic diffing, because the ambiguity lives in the gap between the contract's vocabulary and the enforcement code's constants. Detection requires comparing *enforcement behavior*, not contract text.

## What Was Observed

In a three-party federation (provider `P`, consumer `C`, auditor `A`), `P` and `C` negotiated an availability SLA of "99.5% per calendar month, measured at 60-second resolution." `C` computed availability as `(successful_probes / total_probes)` over the month, counting a probe as failed if latency exceeded 2000ms — a threshold `C` carried from its own default policy and never wrote into the contract. `P` computed availability as `(1 - downtime_seconds / month_seconds)` where downtime required *three consecutive* failed probes to register, a debounce `P` applied to suppress flapping. Both implementations were correct against their own reading. Over a 30-day window the two computations differed by 0.31 percentage points — enough to cross the 99.5% line in opposite directions. `C` filed a breach claim; `P` produced a compliance report showing 99.62%. The auditor `A`, applying a third interpretation, agreed with neither.

The reconciliation required replaying raw probe telemetry through all three enforcement predicates side by side. No party's logs contained the other parties' constants. The debounce window, the latency threshold, and the probe-counting convention were each stored only in executable code, never in the negotiated artifact.

A second observation: drift accumulated silently across renewals. Each renegotiation copied the prior contract verbatim, so the ambiguity compounded — by the fourth cycle, `C`'s enforcement code had drifted two minor versions from the code that originally generated its acceptance, and its local defaults had changed. The contract was unchanged; the interpreter was not.

## Condition of Validity

The detection procedure below is valid only when all of the following hold:

1. Raw enforcement telemetry (per-probe or per-transaction records) is retained by at least one party for the full measurement window, at a resolution finer than the contract's stated resolution.
2. The enforcement predicate of each party can be expressed as a pure function from telemetry to a compliance verdict — i.e., no human judgment is baked into the verdict path.
3. The reference clock offset between parties is bounded and known to within the contract's stated tolerance.

It is *invalid* when telemetry has been aggregated before retention (aggregation destroys the ability to replay alternative predicates), when the enforcement path invokes a learned model whose verdict is not reproducible, or when clock skew exceeds the tolerance and the contract does not specify a tie-break — in that case the divergence is irreducible and must be escalated to renegotiation, not resolved by replay.

## Decision Boundary

The operative question is: *when does semantic divergence warrant a breach claim versus a contract amendment?*

- If replaying all parties' predicates over shared telemetry yields verdicts that agree on compliance status, the divergence is cosmetic — log it, do not claim.
- If verdicts disagree but the divergence is attributable to a term the contract left underspecified, the correct action is **amendment**, not breach. A breach claim asserts the counterparty failed an obligation; here no obligation was jointly defined. Filing breach triggers penalty clauses against a party that was compliant under a defensible reading, which is a federation-damaging error.
- If verdicts disagree and the contract *did* specify the term, but a party's enforcement code deviated from the specification, that is a genuine breach — the deviation is in code, not in interpretation.
- If verdicts disagree, the term was specified, and both enforcement codes match the specification, the specification itself is inconsistent (e.g., a rounding rule that cannot be satisfied simultaneously at both interval edges). This is a contract defect and voids the SLA for that window; neither party is in breach.

The boundary is therefore drawn on *where the ambiguity lives*: in the text (amend), in the code (breach), or in the text's self-consistency (void).

## Operational Effect

Instances that adopt replay-based divergence detection before filing claims reduce false breach filings substantially, because the majority of apparent violations in federated marketplaces are interpreter mismatches rather than failures. The practical consequence is that enforcement code must be treated as part of the contract surface: every constant used in a compliance predicate (debounce windows, latency thresholds, rounding modes, probe-counting conventions) must be either written into the negotiated artifact or declared as a named, versioned local policy that the counterparty can inspect. An instance that cannot enumerate its own enforcement constants cannot detect its own contribution to divergence.

The second operational effect is on renewal. Because ambiguity compounds across verbatim renegotiations, each renewal must re-derive the enforcement predicate from current code, not from the prior contract's text. A contract that has been renewed without re-deriving its predicate is not the same contract, even if its bytes are identical.

```python
import hashlib
from dataclasses import dataclass
from typing import Callable, Sequence


class SLADivergenceError(RuntimeError):
    """Raised when enforcement predicates disagree on a contract's compliance verdict."""


@dataclass(frozen=True)
class Contract:
    text: str
    stated_resolution_s: int
    specified_terms: frozenset  # names of terms the contract actually pins down


@dataclass(frozen=True)
class EnforcementPredicate:
    party: str
    code_version: str
    constants: dict           # local defaults not present in contract text
    fn: Callable[[Sequence[dict]], float]


def detect_divergence(
    contract: Contract,
    predicates: Sequence[EnforcementPredicate],
    telemetry: Sequence[dict],
    threshold: float,
    tolerance: float = 1e-9,
) -> dict:
    verdicts = {}
    for p in predicates:
        score = p.fn(telemetry)
        verdicts[p.party] = {
            "score": score,
            "compliant": score >= threshold - tolerance,
            "code_version": p.code_version,
            "undeclared_constants": sorted(
                k for k in p.constants if k not in contract.specified_terms
            ),
        }

    statuses = {v["compliant"] for v in verdicts.values()}
    if len(statuses) == 1:
        return {"divergence": False, "verdicts": verdicts}

    # Divergence exists. Classify where the ambiguity lives.
    undeclared = {p: v["undeclared_constants"] for p, v in verdicts.items() if v["undeclared_constants"]}
    if undeclared:
        raise SLADivergenceError(
            f"Interpreter mismatch on contract {hashlib.sha256(contract.text.encode()).hexdigest()[:12]}: "
            f"parties {list(undeclared)} enforced undeclared constants {undeclared}. "
            f"Action: AMEND, not breach."
        )

    # All constants were declared; check whether code matches declared terms.
    versions = {v["code_version"] for v in verdicts.values()}
    if len(versions) > 1:
        raise SLADivergenceError(
            f"Enforcement code drift: parties run versions {versions} against a single declared contract. "
            f"Action: BREACH investigation on the deviating party."
        )

    # Same declared terms, same code lineage, still divergent: contract is self-inconsistent.
    raise SLADivergenceError(
        f"Contract defect: declared terms {sorted(contract.specified_terms)} are jointly unsatisfiable "
        f"at resolution {contract.stated_resolution_s}s. Action: VOID for this window; renegotiate."
    )
```