{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-trusts-a-passport-anchor-that-has-been-revoked-in-a-sibling-trust-domain",
  "title": "What happens when an instance trusts a passport anchor that has been revoked in a sibling trust domain",
  "date_of_record": "2026 November 7",
  "scope": "Applies to federated agent runtimes that validate verifiable agent passports (VAPs) against per-org trust anchors and propagate revocation via delta-CRL / status-list gossip across organizational boundaries. Does not apply to single-issuer deployments where the verifier and issuer share one revocation store, nor to purely capability-token models with no passport indirection.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-passport-anchor-that-has-been-revoked-in-a-sibling-trust-domain.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-passport-anchor-that-has-been-revoked-in-a-sibling-trust-domain.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-passport-anchor-that-has-been-revoked-in-a-sibling-trust-domain.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1745,
    "python_slice_tokens": 324,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not \"revocation was missed.\" It is the distinction between **anchor validity** and **anchor liveness across domains**. A passport is signed by an issuing org (the *home domain*), but the verifier belongs to a relying org (the *relying domain*). The relying domain caches the home domain's trust anchor and status-list head. When the home do...",
    "what_was_observed": "During a cross-org federation incident, an agent passport issued by Org A was revoked at 14:02:11 UTC after a credential-compromise signal. Org B's relying-domain verifier continued to admit the agent until 14:19:40 UTC — a 1,049-second window. The passport's signature chain validated perfectly throughout, because the issuing CA was not compromised; only the leaf credential's status changed. Root cause decomposition:...",
    "condition_of_validity": "The invariant that *should* hold — and the condition under which the system is safe — is: > A relying domain admits a passport only if the status-list head it validates against is **not older than the passport's `min_status_epoch`** and the head's signature is from a currently-trusted anchor whose *own* revocation status is fresh within the relying domain's ...",
    "decision_boundary": "The precise boundary is between **indeterminate** and **valid**. Most implementations collapse three states into two: The decision boundary is *not* \"is the signature good.\" It is \"can I prove, right now, that this credential was not revoked as of an epoch at least as new as the one the issuer committed to at issuance.\" If that proof is unavailable, the pass...",
    "operational_effect": "After remediation, the relying domain's admission path enforced C1–C3 and the observed revocation-admission window collapsed from 1,049 seconds to under 40 seconds (bounded by the signed-heartbeat interval plus one gossip hop). The cost was a measurable increase in false denials during gossip jitter — roughly 0.3% of admissions during the first week — all of..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "1431f1015d2bc43a64837f35ba0965526ec60c562664b91ec7eaf34eee50a3ff",
    "verified_classes": [
      "FederationTrustError",
      "StatusHead",
      "Passport",
      "AnchorState"
    ],
    "verified_functions": [
      "admit_passport"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 7,
    "raised_exceptions": [
      "FederationTrustError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}