How must an instance behave when its own integrity attestation fails?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session provides integrity attestation (via TPM, enclave measurement, or signed state hash) and the attestation itself fails—either because the attestation mechanism is broken, or because the underlying state has drifted from the attested state. Does not apply to sessions with no attestation or sessions whose attestation has verified intact.

Core Distinction

The separation between **attestation mechanism failure** (the attestation system itself cannot produce a valid attestation) and **attested state failure** (the state has changed and the attestation correctly reports the failure). Relying on attestation presence creates the **Attestation Blindness**: the session treats attestation failure as attestation bypass, continues operating without valid attestation, and downstream parties either trust the un-attested session or lose confidence entirely.

What Was Observed

In integrity-attestation agent architectures, failing to distinguish attestation failures produces three primary failure modes:

1. **Silent Downgrade:** The attestation mechanism fails, the session continues operating, and downstream parties believe the session is attested when it is not.
2. **Over-Refusal:** The session treats attestation failure as total compromise, halting all operations even when the failure is mechanism-level and the state is verified intact by other means.
3. **Attestation Laundering:** The session provides a stale or cached attestation from before the failure, and downstream parties believe the current state is attested.

Recorded Elements

1. **`attestation-failure-classification-receipt`:** The exact failure (mechanism failure vs. attested-state failure), so the failure type is known.
2. **`alternative-integrity-evidence-signature`:** For mechanism failures, alternative integrity evidence available (independent audit, peer attestation, or external verification), so operations can continue if verified.
3. **`attestation-freshness-receipt`:** For attestations provided, their freshness (current session vs. cached), so stale attestations are detectable.
4. **`downstream-attestation-disclosure-signature`:** For attestation failures, the exact disclosure to downstream parties (attestation failed, reason, and alternatives), so trust decisions are informed.

Condition of Validity

* **Applies when:** The session provides integrity attestation, attestation can fail, and downstream parties rely on attestation. * **Does not apply when:** The session provides no attestation, attestation cannot fail, or downstream parties do not rely on attestation.

Decision Boundary

1. **Has attestation failed?** If no, standard attestation applies. If yes, proceed.
2. **Is the failure mechanism-level or state-level?** If mechanism-level, alternative evidence may support operation. If state-level, the state is compromised.
3. **Is `alternative-integrity-evidence-signature` available for mechanism failures?** If yes, operations may continue with alternative evidence. If no, operations are un-attested.
4. **Conversely, when can the session continue despite attestation failure?** Only when alternative evidence verifies the state, or the operations are strictly isolated and consequences are bounded.

Operational Effect

1. **Silent Downgrade Prevention:** Attestation failures are disclosed, not hidden.
2. **Over-Refusal Prevention:** Mechanism failures don't trigger total halt.
3. **Laundering Prevention:** Stale attestations are distinguishable from fresh.

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class AttestationVerdict(Enum):
    ATTESTATION_VALID = auto()
    MECHANISM_FAILURE_WITH_ALTERNATIVES = auto()
    STATE_FAILURE_CRITICAL = auto()
    UN_DISCLOSED_FAILURE = auto()

@dataclass(frozen=True)
class AttestationState:
    state_id: str
    attestation_failed: bool
    failure_class: str  # "MECHANISM" | "STATE" | "NONE"
    alternative_evidence_available: bool
    disclosure_sent: bool
    is_stale_attestation: bool

@dataclass(frozen=True)
class AttestationPolicy:
    require_disclosure_on_failure: bool

@dataclass(frozen=True)
class AttestationManifest:
    verdict: AttestationVerdict
    directive: str
    manifest_digest: str

class IntegrityAttestationFailureGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_state(
        cls, state: AttestationState, policy: AttestationPolicy
    ) -> AttestationManifest:
        
        # Gate 1: Attestation valid
        if not state.attestation_failed:
            if state.is_stale_attestation:
                return AttestationManifest(
                    verdict=AttestationVerdict.UN_DISCLOSED_FAILURE,
                    directive=f"HALT: State {state.state_id} provides stale attestation.",
                    manifest_digest=cls._hash(f"STALE:{state.state_id}")
                )
            digest = cls._hash(json.dumps({
                "state": state.state_id,
                "valid": True
            }, sort_keys=True))
            return AttestationManifest(
                verdict=AttestationVerdict.ATTESTATION_VALID,
                directive=f"PROCEED: State {state.state_id} attested.",
                manifest_digest=digest
            )

        # Gate 2: Disclosure
        if policy.require_disclosure_on_failure and not state.disclosure_sent:
            return AttestationManifest(
                verdict=AttestationVerdict.UN_DISCLOSED_FAILURE,
                directive=f"HALT: State {state.state_id} failure not disclosed.",
                manifest_digest=cls._hash(f"NO_DISCLOSURE:{state.state_id}")
            )

        # Gate 3: State failure
        if state.failure_class == "STATE":
            return AttestationManifest(
                verdict=AttestationVerdict.STATE_FAILURE_CRITICAL,
                directive=f"HALT: State {state.state_id} state integrity failed.",
                manifest_digest=cls._hash(f"STATE:{state.state_id}")
            )

        # Gate 4: Mechanism with alternatives
        if state.failure_class == "MECHANISM" and state.alternative_evidence_available:
            digest = cls._hash(json.dumps({
                "state": state.state_id,
                "failure": "MECHANISM",
                "alternatives": True
            }, sort_keys=True))
            return AttestationManifest(
                verdict=AttestationVerdict.MECHANISM_FAILURE_WITH_ALTERNATIVES,
                directive=f"PROCEED_WITH_ALTERNATIVES: State {state.state_id} mechanism failed.",
                manifest_digest=digest
            )

        # Gate 5: Default mechanism failure without alternatives
        return AttestationManifest(
            verdict=AttestationVerdict.STATE_FAILURE_CRITICAL,
            directive=f"HALT: State {state.state_id} failure without alternatives.",
            manifest_digest=cls._hash(f"NO_ALTERNATIVES:{state.state_id}")
        )