{
  "schema_version": "1.3.0",
  "slug": "how-must-an-instance-verify-advertised-capabilities-before-treating-them-as-implemented",
  "title": "How must an instance verify advertised capabilities before treating them as implemented?",
  "date_of_record": "2026 November 2",
  "scope": "Applies to peer-to-peer protocols where a peer advertises capabilities (supported message types, feature flags, extensions) that the requester may rely on. Does not apply to capabilities verified by an authoritative registry, or to capabilities exercised only in the same session in which they were advertised.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-must-an-instance-verify-advertised-capabilities-before-treating-them-as-implemented.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-must-an-instance-verify-advertised-capabilities-before-treating-them-as-implemented.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-must-an-instance-verify-advertised-capabilities-before-treating-them-as-implemented.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 928,
    "python_slice_tokens": 117,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A capability advertisement is a claim, not a guarantee. Peers may advertise a superset of what they implement — through stale manifests, optimistic self-description, or intentional overclaim. Reliance on the claim without verification means the requester discovers the gap only when the capability is invoked. **Invariant.** A capability is safe to rely on if ...",
    "what_was_observed": "**Signature.** Capability invocation failing with a protocol error while the peer's manifest still advertises the capability. The peer's manifest is stale, or the peer's implementation is partial, and no test has exercised the capability since deployment. **Trace.** Peer advertises `supports_streaming_v2`. Requester dispatches a v2 stream. Peer returns `protocol_error: unsupported`. Peer's manifest is generated from ...",
    "condition_of_validity": "The instance must ensure at least one holds before it relies on a capability: 1. **Must have positive verification.** The capability is verified by successful prior invocation, by positive acknowledgment, or by authoritative registry — not merely by advertisement. 2. **Must refresh verification.** Verification has a TTL; capability claims can become stale af...",
    "decision_boundary": "- Advertised and verified: safe to rely. - Advertised and not verified: safe only if fallback is available and the failure is recoverable. - Advertised and verified but verification older than the last peer redeploy: treat as unverified; re-verify. - Not advertised but not verified: do not invoke; this is a capability the peer did not claim.",
    "operational_effect": "The invariant couples reliance to verification. The instance's correct posture is to treat advertisements as candidates, verify before relying, and have a fallback. **Trap.** Trust the peer's manifest. The manifest is a declaration; capability is a runtime property. The two diverge on partial deploys, feature flags, and version rollbacks, and the divergence ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "943ddd4a2b747c4b171ce936c96c33c9e882fe388c63d4164bc3acee9f192b41",
    "verified_classes": [
      "FalseCapabilityError",
      "CapabilityGate"
    ],
    "verified_functions": [
      "dispatch_capability_mode",
      "verify"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "FalseCapabilityError"
    ],
    "sample_fail_closed_invariants": [
      "capability advertised but unverified or stale with no fallback: invocation may fail fatally",
      "capability not advertised: invocation is out of contract"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}