{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-reject-a-federated-capability-contract-that-is-syntactically-valid-but-semantically-unenforceable",
  "title": "In what scenarios must an instance reject a federated capability contract that is syntactically valid but semantically unenforceable",
  "date_of_record": "2026 November 13",
  "scope": "Applies to federated agent policy negotiation where two or more organizational domains exchange declarative capability contracts (e.g., signed JSON/OPA/Cedar capability manifests) before delegating tool invocations. Does not apply to intra-organizational policy evaluation, where a single trust root can resolve ambiguity by fiat.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-federated-capability-contract-that-is-syntactically-valid-but-semantically-unenforceable.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-federated-capability-contract-that-is-syntactically-valid-but-semantically-unenforceable.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-federated-capability-contract-that-is-syntactically-valid-but-semantically-unenforceable.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1433,
    "python_slice_tokens": 318,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A capability contract has two independent validity dimensions: *syntactic validity* (it parses, its signature verifies, its schema conforms) and *semantic enforceability* (the receiving instance can actually constrain its own behavior to the contract's terms at the point of execution). The non-obvious boundary is that these dimensions decouple. A contract ca...",
    "what_was_observed": "During a cross-org negotiation between an orchestrator domain (A) and a tool-provider domain (B), domain A issued a contract containing the clause `\"max_reasoning_depth\": 3` alongside `\"forbid_subdelegation\": true`. Both clauses verified against the schema and both signatures checked out. Domain B's agent accepted the contract and began execution. The failure surfaced three hops later. B's runtime had no concept of \"...",
    "condition_of_validity": "A federated capability contract is enforceable by instance *I* only if, for every clause *c*: 1. *c* names a runtime-observable quantity (a counter *I* increments, a set *I* can enumerate, a resource *I* meters), not an inferred or emergent property; 2. the guard for *c* is installed at the *lowest* effect site in *I*'s execution graph — the point past which...",
    "decision_boundary": "The instance must reject when *any* contract clause is unenforceable under the four conditions above, and *must not* substitute its own interpretation of an ambiguous clause. The boundary is deliberately strict because the cost asymmetry is severe: a rejected contract triggers a renegotiation (bounded, recoverable, visible), whereas an accepted-but-unenforce...",
    "operational_effect": "Enforcing this boundary shifts negotiation failures left, from post-hoc audit to pre-execution handshake. In practice it produces a characteristic artifact: a *rejection report* enumerating each unenforceable clause with the specific condition it violates and a proposed enforceable rewrite. Peers converge on contracts expressed in terms of countable events (..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "813643bccc409cc131c00c8c35b0e586969a3b40f5ad6f20014dec774fb85099",
    "verified_classes": [
      "UnenforceableClauseError",
      "Clause"
    ],
    "verified_functions": [
      "_violations",
      "accept_contract"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "UnenforceableClauseError"
    ],
    "sample_fail_closed_invariants": [
      "contract signature failed verification"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}