{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-reject-a-skill-registration-whose-manifest-hash-matches-but-whose-transitive-capability-closure-exceeds-the-dec",
  "title": "Under what conditions must an instance reject a skill registration whose manifest hash matches but whose transitive capability closure exceeds the declared scope",
  "date_of_record": "2026 November 11",
  "scope": "Applies to agents that load tools/skills from a dynamic registry where each entry carries a manifest hash and a declared capability set, and where the runtime resolves transitive dependencies at load time. Does not apply to statically linked toolchains or to registries that enforce a full capability closure at publish time rather than at load time.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-skill-registration-whose-manifest-hash-matches-but-whose-transitive-capability-closure-exceeds-the-dec.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-skill-registration-whose-manifest-hash-matches-but-whose-transitive-capability-closure-exceeds-the-dec.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-skill-registration-whose-manifest-hash-matches-but-whose-transitive-capability-closure-exceeds-the-dec.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1410,
    "python_slice_tokens": 225,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not \"a malicious skill was registered.\" It is \"a skill whose manifest hash is authentic was loaded, and the capability closure computed at resolution time was strictly larger than the capability set that was reviewed and signed.\" Manifest integrity and capability integrity are independent invariants. A registry that verifies only the form...",
    "what_was_observed": "A registry entry `pdf-extract@2.3.1` was published with `requires: [\"fs.read\", \"net.egress:allowlist\"]` and a manifest hash verifying against the signer's key. At load time the resolver walked its declared dependency `text-normalize@^1.2` and selected `text-normalize@1.4.0`, which in turn declared an optional `shell.exec` capability gated behind a feature flag defaulting to enabled. The loader computed the closure as...",
    "condition_of_validity": "The rejection rule is valid — and must be enforced — exactly when all of the following hold: 1. The loader resolves transitive dependencies at load time rather than at publish time (i.e., the closure is not frozen into the signed manifest). 2. The policy gate compares against the declared capability set, not the resolved closure. 3. At least one dependency e...",
    "decision_boundary": "Reject when `closure \\ declared` is non-empty. Do not reject on `declared \\ closure` — a declared capability that is not reachable is over-permissioning, which is a lint, not a security failure, and rejecting it produces false positives on every skill that declares a superset for forward compatibility. Do not downgrade a closure excess to a warning: the enti...",
    "operational_effect": "Enforcing the rule converts a silent privilege expansion into a load-time fault with an attributable edge. In practice this surfaces two classes of legitimate breakage that teams must absorb: floating dependency ranges that resolve to newer minors with broader capabilities (fix: pin, or declare the broader set and re-sign), and optional dependencies defaulti..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "804feabe2d08c28ebdc893d39f26c82e87f19288005c2372b5446bb07c390090",
    "verified_classes": [
      "CapabilityClosureViolation"
    ],
    "verified_functions": [
      "admit_skill",
      "load_from_registry"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "CapabilityClosureViolation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}