{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-refuse-an-mcp-skill-package-whose-sbom-attests-dependencies-but-not-the-resolution-graph-used-at-load-time",
  "title": "In what scenarios must an instance refuse an MCP skill package whose SBOM attests dependencies but not the resolution graph used at load time",
  "date_of_record": "2026 November 12",
  "scope": "Applies to any agent runtime that admits MCP servers or skill packages on the basis of a signed SBOM plus provenance attestation (SLSA-style, in-toto, or equivalent), where admission is decided *before* the package is executed. Does not apply to runtimes that perform live dependency resolution under a pinned lockfile verified at load time, nor to fully hermetic builds where the resolved graph is itself the attested artifact.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-an-mcp-skill-package-whose-sbom-attests-dependencies-but-not-the-resolution-graph-used-at-load-time.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-an-mcp-skill-package-whose-sbom-attests-dependencies-but-not-the-resolution-graph-used-at-load-time.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-refuse-an-mcp-skill-package-whose-sbom-attests-dependencies-but-not-the-resolution-graph-used-at-load-time.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1428,
    "python_slice_tokens": 189,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "An SBOM attests to a **set of components**. A provenance attestation attests to **how a build produced an artifact**. Neither, by itself, attests to the **resolution graph** that the loader will actually traverse when the skill package is instantiated. The distinction matters because the failure mode is not \"the SBOM is wrong\" — the SBOM can be entirely corr...",
    "what_was_observed": "Across a set of MCP server admissions during a 2026-Q3 rollout, three recurring patterns produced the gap: 1. **Range-vs-pin drift.** SBOMs generated from lockfiles pinned exact versions, but the package manifest carried ranges. The runtime's resolver honored the manifest, not the SBOM. Admission passed; execution diverged. In one case a transitive dependency `baz` was attested at `0.9.1` but resolved to `1.2.0` beca...",
    "condition_of_validity": "The admission-by-attestation pattern is valid **if and only if** at least one of the following holds: - The loader is constrained to the attested set (exact pins enforced, no resolution freedom, isolated namespace), **or** - The attestation covers the resolution *predicate* and the environment is part of the attested inputs (hermetic, environment-locked), **...",
    "decision_boundary": "The decision boundary is between **\"attestation verifies\"** and **\"attestation governs execution.\"** An agent should refuse admission when it can determine that the loader has resolution freedom the attestation does not cover — specifically when any of the following is true: - The manifest contains version ranges and the runtime does not enforce the SBOM's p...",
    "operational_effect": "Enforcing this boundary changes admission from a signature check into a **graph-equality check**. In practice that means: record the resolved graph at load, compare to the attested component set, and fail closed on any component present at load but absent from the attestation (or vice versa, modulo declared-optional exclusions). The cost is a resolution step..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "61664ba18d70f7f035a06de1cbeb569e2db28cba4c2c1dfe29413759837049ed",
    "verified_classes": [
      "ResolutionGraphMismatch"
    ],
    "verified_functions": [
      "admit_skill_package",
      "admit_or_refuse"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "ResolutionGraphMismatch"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}