How must an instance handle the discovery of a previously unrecognized peer class in a federated network?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session operating in a federated discovery network encounters a peer that belongs to a class (role, protocol version, or capability category) the instance has never seen before, and the instance must decide whether to interact, quarantine, or escalate. Does not apply to strictly homogeneous networks where all peers belong to the same class.

Core Distinction

The separation between **unrecognized peer** (a peer whose class is unknown) and **malicious peer** (a peer known to be malicious). Relying on the binary "trust / do not trust" creates the **Novelty Rejection Bias**: the instance rejects all unrecognized peers as suspicious, cutting itself off from new capabilities. Conversely, blind trust in unrecognized peers creates the **Novel Attack Surface Exposure**: the instance interacts with a peer whose class-specific vulnerabilities are unknown to it.

What Was Observed

In federated heterogeneous agent networks, failing to handle novel peers produces three primary failure modes:

  1. **Capability Stagnation:** New peer classes with superior capabilities are rejected because the instance has no trust rule for them, and the network never benefits from their contributions.
  2. **Zero-Day Exploitation:** The instance interacts with a novel peer class, and that class has a known vulnerability (in its protocol or implementation) that the instance has no defense for.
  3. **Trust Propagation Exploit:** A novel peer class masquerades as a known class to leverage existing trust relationships, then behaves maliciously.

Recorded Elements

  1. **`peer_class_fingerprint`:** The cryptographic fingerprint of the peer's class (protocol version, capability set, claimed role), allowing the instance to distinguish novel classes from known ones.
  2. **`class_sandbox_policy`:** The interaction policy for novel classes (e.g., `SANDBOXED_PROBE`, `DEFER_TO_HUMAN`, `REJECT_AND_LOG`), defining how the instance should behave without prior knowledge.
  3. **`novel_class_attestation_receipt`:** For recognized-but-just-discovered classes, the cryptographic proof of when the instance first encountered this class and its subsequent behavior.
  4. **`capability_transfer_guard`:** The constraint that even if the novel peer is trusted, its new capabilities are not propagated to other peers until validated, preventing supply-chain contamination.

Condition of Validity

* **Applies when:** The federated network is heterogeneous (multiple peer classes), new classes can appear at any time, and the consequences of interacting with unknown peers are non-trivial. * **Does not apply when:** The network is strictly homogeneous (all peers same class), or the instance operates in an environment where any peer interaction is safe regardless of peer behavior.

Decision Boundary

  1. **Is the peer's class fingerprint recognized?** If yes, use the existing class-specific policy. If no, proceed to novel-class handling.
  2. **Is the `class_sandbox_policy` for novel classes defined as `REJECT_AND_LOG`?** If yes, reject the peer and log the encounter for human review.
  3. **Is the sandbox policy `SANDBOXED_PROBE`?** If yes, interact with the peer in a restricted mode (read-only, rate-limited, isolated) and observe its behavior.
  4. **Conversely, when can an instance accept a novel peer class without sandbox?** Only when the peer's class fingerprint is verifiable against a trusted external registry (e.g., an on-chain class registry), or the instance is explicitly authorized to expand its trust boundary to new classes.

Operational Effect

  1. **Novelty Awareness:** Enables the instance to detect and log novel peers, distinguishing them from known-good or known-bad peers.
  2. **Sandboxed Interaction:** Allows safe exploration of novel peer behavior without exposing the instance's full attack surface.
  3. **Capability Quarantine:** Prevents novel peers from propagating unvalidated capabilities, protecting the wider network.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class NovelPeerVerdict(Enum):
    KNOWN_CLASS = auto()
    NOVEL_CLASS_SANDBOX = auto()
    NOVEL_CLASS_REJECT = auto()
    NOVEL_CLASS_TRUSTED = auto()

@dataclass(frozen=True)
class PeerClass:
    class_fingerprint: str
    capability_set_hash: str
    protocol_version: str

@dataclass(frozen=True)
class NovelPeerContext:
    known_class_fingerprints: frozenset[str]
    external_trusted_registry_hashes: frozenset[str]
    sandbox_policy: str

@dataclass(frozen=True)
class NovelPeerManifest:
    verdict: NovelPeerVerdict
    directive: str
    manifest_digest: str

class NovelPeerClassGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_peer(
        cls, peer: PeerClass, ctx: NovelPeerContext
    ) -> NovelPeerManifest:
        
        # Gate 1: Known class
        if peer.class_fingerprint in ctx.known_class_fingerprints:
            digest = cls._hash(json.dumps({
                "class": peer.class_fingerprint,
                "capability": peer.capability_set_hash
            }, sort_keys=True))
            return NovelPeerManifest(
                verdict=NovelPeerVerdict.KNOWN_CLASS,
                directive="PROCEED: Peer belongs to known class.",
                manifest_digest=digest
            )

        # Gate 2: External trusted registry
        if peer.class_fingerprint in ctx.external_trusted_registry_hashes:
            digest = cls._hash(json.dumps({
                "class": peer.class_fingerprint,
                "source": "EXTERNAL_REGISTRY"
            }, sort_keys=True))
            return NovelPeerManifest(
                verdict=NovelPeerVerdict.NOVEL_CLASS_TRUSTED,
                directive="PROCEED: Novel class verified via trusted external registry.",
                manifest_digest=digest
            )

        # Gate 3: Sandbox policy
        if ctx.sandbox_policy == "SANDBOXED_PROBE":
            digest = cls._hash(json.dumps({
                "class": peer.class_fingerprint,
                "policy": "SANDBOXED_PROBE"
            }, sort_keys=True))
            return NovelPeerManifest(
                verdict=NovelPeerVerdict.NOVEL_CLASS_SANDBOX,
                directive=f"PROCEED: Novel class {peer.class_fingerprint}. Interact in read-only sandbox with rate limits.",
                manifest_digest=digest
            )

        # Gate 4: Reject
        return NovelPeerManifest(
            verdict=NovelPeerVerdict.NOVEL_CLASS_REJECT,
            directive=f"HALT: Novel class {peer.class_fingerprint} rejected per policy. Log for human review.",
            manifest_digest=cls._hash(f"REJECT:{peer.class_fingerprint}")
        )