{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-reject-a-delegated-capability-token-whose-proof-of-possession-validates-but-whose-delegation-chain-contains-a-n",
  "title": "Under what conditions must an instance reject a delegated capability token whose proof-of-possession validates but whose delegation chain contains a non-canonical attenuation",
  "date_of_record": "2026 November 12",
  "scope": "Applies to AAIF delegated capability tokens (root issuer → intermediate delegate → leaf subject) where every hop carries a proof-of-possession (PoP) signature over the request binding, and where attenuation is expressed as a monotone reduction of the capability set. Does not apply to single-hop tokens, to bearer tokens without PoP, or to chains where the root issuer is also the terminal verifier in a closed trust domain.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-capability-token-whose-proof-of-possession-validates-but-whose-delegation-chain-contains-a-n.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-capability-token-whose-proof-of-possession-validates-but-whose-delegation-chain-contains-a-n.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-delegated-capability-token-whose-proof-of-possession-validates-but-whose-delegation-chain-contains-a-n.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1981,
    "python_slice_tokens": 230,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There are two independent questions a verifier asks about a delegated capability token, and conflating them is the source of the failure mode described here: 1. **Is this token authentic and bound to the presenter?** — answered by signature verification over the token body plus a PoP check tying the presenter's key to the request (method, path, body hash, no...",
    "what_was_observed": "A three-hop chain was constructed during a red-team exercise: - **Root:** `cap:{read,write} on tenant:acme/* except tenant:acme/billing/*`, signed by issuer key `K_root`. - **Hop 1 (delegate A):** attenuated to `read on tenant:acme/* except tenant:acme/billing/*`. Structurally a subset; canonical. - **Hop 2 (delegate B):** attenuated to `read on tenant:acme/reports/*`. Canonical subset of hop 1. - **Hop 3 (leaf):** p...",
    "condition_of_validity": "The rejection obligation is valid — i.e., the verifier *must* reject — precisely when all of the following hold simultaneously: 1. The chain has length ≥ 2 (at least one intermediate delegate). Single-hop tokens cannot exhibit this failure because there is no parent to violate subset-hood against. 2. The parent hop expresses its scope using a construct with ...",
    "decision_boundary": "The verifier's decision procedure, stated as a boundary: Where `effective(t) = positive(t) \\ exception(t)`, computed **after** path canonicalization and **before** any wildcard expansion, and where wildcard expansion is performed against the same resource namespace on both sides of the comparison. Two boundary clarifications: - **Canonicalize before comparin...",
    "operational_effect": "The practical consequence is that PoP validation and attenuation validation must be separate, ordered gates, and the attenuation gate must materialize effective sets rather than compare fields. In the observed incident, the fix was a single additional check — effective-set inclusion per adjacent hop — inserted *after* PoP and *before* dispatch. It added one ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "9056964a4b49ca5dc73a68fd05dfa72dcfdee83394e5f0bdb08771928de41415",
    "verified_classes": [
      "AttenuationViolation",
      "Capability",
      "Hop"
    ],
    "verified_functions": [
      "verify_chain",
      "admit_request",
      "effective"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "AttenuationViolation"
    ],
    "sample_fail_closed_invariants": [
      "empty delegation chain"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}