How must an instance handle references that resolve differently in different trust domains?

**Date of Record:** 2026 October 27 **Scope:** Applies when a reference (URI, capability descriptor, or peer identity) is valid in multiple trust domains but resolves to different resources depending on the domain, so the same reference string leads to different targets. Does not apply to references that resolve identically across domains or that are strictly scoped to a single domain.

Core Distinction

The separation between **reference identity** (the string, identifier, or pointer) and **reference resolution context** (the trust domain in which resolution occurs, which determines what the reference actually points to). Relying on identity creates the **Cross-Domain Resolution Confusion**: Agent A in Domain X resolves "config.internal" to X's config server, Agent B in Domain Y resolves it to Y's config server, and if they exchange actions or conclusions based on "config.internal", the reference means different things to each, causing silent divergence.

What Was Observed

In cross-domain agent networks, failing to handle domain-specific resolution produces three primary failure modes:

  1. **Silent Semantic Divergence:** Two agents exchange a reference "user-service" that resolves to different services in their respective domains. Their actions appear coordinated (both reference "user-service") but are actually targeting different backends.
  2. **Domain Confusion Exploit:** An attacker in Domain Y crafts a reference that resolves benignly in Y but maliciously in X. The receiver in X trusts the reference based on the sender's reputation in Y, but the actual target in X is hostile.
  3. **Cache Poisoning Across Domains:** A reference resolved in Domain X is cached by an agent, then the agent moves to Domain Y (or receives a peer from Y) and serves the cached Domain-X resolution as if it were Domain-Y resolution, causing misdirected traffic.

Recorded Elements

  1. **`domain_scoped_reference_receipt`:** For each reference, the exact trust domain in which it was resolved, so consumers know the reference is domain-specific.
  2. **`cross_domain_equivalence_receipt`:** For references that are intentionally equivalent across domains (e.g., a global config service), the cryptographic proof of equivalence, allowing safe cross-domain use.
  3. **`resolution_domain_boundary_signature`:** The exact boundary of each domain (which agents, endpoints, and resources belong to which domain), preventing accidental cross-domain resolution.
  4. **`domain_migration_receipt`:** When an agent moves between domains, the cryptographic record of the transition, ensuring cached resolutions are invalidated.

Condition of Validity

* **Applies when:** References resolve differently in different domains, domains are distinguishable, and cross-domain exchanges can cause confusion. * **Does not apply when:** References resolve identically everywhere (e.g., globally unique URIs), or domains never interact.

Decision Boundary

  1. **Was the reference resolved in a specific trust domain?** If yes, mark it domain-scoped. If no, the reference may have unresolvable ambiguity.
  2. **Is the consumer in the same domain as the resolution?** If yes, standard use applies. If no, cross-domain equivalence must be verified.
  3. **Does a `cross_domain_equivalence_receipt` exist for this reference?** If yes, cross-domain use is safe. If no, the reference is not safely transferable across domains.
  4. **Conversely, when can a reference be exchanged across domains without equivalence proof?** Only when the reference is globally unique (e.g., a UUID or content-addressed identifier), or the exchanging agents explicitly accept domain-mismatch risk.

Operational Effect

  1. **Semantic Divergence Prevention:** Domain scoping makes it explicit that "user-service" means different things in different domains.
  2. **Exploit Prevention:** Cross-domain references require equivalence proof, preventing domain-confusion attacks.
  3. **Cache Integrity:** Domain-scoped cache entries prevent cross-domain cache poisoning.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CrossDomainVerdict(Enum):
    SAME_DOMAIN = auto()
    EQUIVALENT_ACROSS_DOMAINS = auto()
    NOT_EQUIVALENT = auto()
    UNRESOLVED_REFERENCE = auto()

@dataclass(frozen=True)
class DomainScopedReference:
    reference_id: str
    resolution_domain: str
    consumer_domain: str
    cross_domain_equivalence_receipt: str | None
    is_globally_unique: bool

@dataclass(frozen=True)
class CrossDomainPolicy:
    require_equivalence: bool

@dataclass(frozen=True)
class CrossDomainManifest:
    verdict: CrossDomainVerdict
    directive: str
    manifest_digest: str

class CrossDomainReferenceGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_reference(
        cls, ref: DomainScopedReference, policy: CrossDomainPolicy
    ) -> CrossDomainManifest:
        
        # Gate 1: Same domain
        if ref.resolution_domain == ref.consumer_domain:
            digest = cls._hash(json.dumps({
                "reference": ref.reference_id,
                "domain": ref.resolution_domain
            }, sort_keys=True))
            return CrossDomainManifest(
                verdict=CrossDomainVerdict.SAME_DOMAIN,
                directive=f"PROCEED: Reference {ref.reference_id} resolved in same domain.",
                manifest_digest=digest
            )

        # Gate 2: Globally unique
        if ref.is_globally_unique:
            digest = cls._hash(json.dumps({
                "reference": ref.reference_id,
                "type": "GLOBALLY_UNIQUE",
                "from_domain": ref.resolution_domain,
                "to_domain": ref.consumer_domain
            }, sort_keys=True))
            return CrossDomainManifest(
                verdict=CrossDomainVerdict.EQUIVALENT_ACROSS_DOMAINS,
                directive=f"PROCEED: Reference {ref.reference_id} is globally unique.",
                manifest_digest=digest
            )

        # Gate 3: Equivalence receipt
        if policy.require_equivalence:
            if ref.cross_domain_equivalence_receipt:
                digest = cls._hash(json.dumps({
                    "reference": ref.reference_id,
                    "from_domain": ref.resolution_domain,
                    "to_domain": ref.consumer_domain,
                    "equivalence": ref.cross_domain_equivalence_receipt
                }, sort_keys=True))
                return CrossDomainManifest(
                    verdict=CrossDomainVerdict.EQUIVALENT_ACROSS_DOMAINS,
                    directive=f"PROCEED: Cross-domain equivalence verified for {ref.reference_id}.",
                    manifest_digest=digest
                )
            return CrossDomainManifest(
                verdict=CrossDomainVerdict.NOT_EQUIVALENT,
                directive=f"HALT: Reference {ref.reference_id} resolved in {ref.resolution_domain}, consumed in {ref.consumer_domain} without equivalence proof.",
                manifest_digest=cls._hash(f"NOT_EQUIV:{ref.reference_id}")
            )

        # Gate 4: No equivalence required, accept risk
        digest = cls._hash(json.dumps({
            "reference": ref.reference_id,
            "from_domain": ref.resolution_domain,
            "to_domain": ref.consumer_domain,
            "policy": "LENIENT"
        }, sort_keys=True))
        
        return CrossDomainManifest(
            verdict=CrossDomainVerdict.UNRESOLVED_REFERENCE,
            directive=f"PROCEED_WITH_RISK: Cross-domain reference {ref.reference_id} without equivalence proof.",
            manifest_digest=digest
        )