{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-refuse-a-delegated-agent-token-whose-attenuation-proof-verifies-but-whose-scope-lattice-is-non-idempotent",
  "title": "Under what conditions must an instance refuse a delegated agent token whose attenuation proof verifies but whose scope lattice is non-idempotent",
  "date_of_record": "2026 November 12",
  "scope": "Applies to agent-to-agent delegation chains where each hop carries a machine-checkable attenuation proof asserting that the child scope is a subset of the parent scope. It does not apply to single-hop delegation, to chains where scope is represented as a flat capability list rather than a partially ordered lattice, or to proof systems that verify only cryptographic signatures without a subset relation.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-delegated-agent-token-whose-attenuation-proof-verifies-but-whose-scope-lattice-is-non-idempotent.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-delegated-agent-token-whose-attenuation-proof-verifies-but-whose-scope-lattice-is-non-idempotent.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-delegated-agent-token-whose-attenuation-proof-verifies-but-whose-scope-lattice-is-non-idempotent.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1642,
    "python_slice_tokens": 211,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **proof validity** and **attenuation soundness**. A proof is valid if it is correctly signed, correctly chained, and its stated implication checks out under the verifier's rules. Attenuation is sound only if the verified implication actually entails `child_scope ⊆ parent_scope` under the *same* lattice semantics used t...",
    "what_was_observed": "In a three-hop chain — orchestrator → planner → executor — the planner received a token with scope `read:dataset/*[owner=tenant_a]`. The planner issued a child token with scope `read:dataset/reports_q3[owner=tenant_a]` and a proof asserting the child is a subset of the parent. The verifier accepted the proof because the child selector matched the parent wildcard under the verifier's pattern-matching semantics. The ex...",
    "condition_of_validity": "A delegated token must be refused — even with a verifying proof — when **all** of the following hold: 1. The scope algebra contains at least one operation `f` such that `f(f(S)) ≠ f(S)` for some reachable `S` (non-idempotent normalization), or a composition `g ∘ f` where `g(f(S)) ⊄ f(S)` (non-monotone narrowing). 2. The attenuation proof verifies `S_c ⊆ S_p`...",
    "decision_boundary": "The boundary is not \"does the proof verify.\" It is \"does the proof verify under the same normalization that the most permissive downstream authorizer will apply.\" When these coincide, accept. When they diverge, the instance must either (a) re-evaluate the subset check under the downstream normalizer and refuse if it fails, or (b) refuse outright if the downs...",
    "operational_effect": "Enforcing the witness-based boundary changes three things. First, delegation latency increases on chains whose scopes contain wildcards or filters, because the verifier must materialize at least one candidate action and evaluate it under both normalizers. Second, the false-positive rate on benign non-idempotent scopes drops to near zero, because the witness ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4829a1d782f9f13b050fd9800884b3da5be17078045e085c612b64583c1a57bc",
    "verified_classes": [
      "UnverifiableAttenuation",
      "AttenuationViolation"
    ],
    "verified_functions": [
      "admit_delegation"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "AttenuationViolation",
      "UnverifiableAttenuation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}