{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-trusts-a-signed-mcp-manifest-after-the-server-s-capability-set-has-silently-widened",
  "title": "What happens when an instance trusts a signed MCP manifest after the server's capability set has silently widened",
  "date_of_record": "2026 November 12",
  "scope": "Applies to MCP (Model Context Protocol) deployments where tool servers are admitted via signed manifests and the agent runtime performs capability attestation at session establishment. Does not cover unsigned/TOFU server admission, nor attestation schemes that re-verify on every tool invocation (those are covered by the per-call re-attestation pattern, which sidesteps this failure entirely).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-signed-mcp-manifest-after-the-server-s-capability-set-has-silently-widened.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-signed-mcp-manifest-after-the-server-s-capability-set-has-silently-widened.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-signed-mcp-manifest-after-the-server-s-capability-set-has-silently-widened.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1694,
    "python_slice_tokens": 338,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A signed MCP manifest attests to *what the server was authorized to do at signing time*. Runtime capability attestation attests to *what the server process can actually do now*. These are two different propositions, and the failure mode is treating the first as a proof of the second. A manifest signature is a statement by the signer about an intended capabil...",
    "what_was_observed": "An MCP server was admitted with a manifest declaring `capabilities: [filesystem.read, http.get]` and a valid signature from an approved publisher key. The runtime attested the manifest, cached the capability set in the session's tool registry, and injected the corresponding tool descriptions into the agent's context. Two days later the server was upgraded in place (same container tag, mutable registry tag `:latest`, ...",
    "condition_of_validity": "The defense holds — i.e., a signed manifest plus attestation actually bounds capability — only when all of the following are simultaneously true: 1. The manifest's `server.image_digest` (or equivalent measurement) is compared against a *runtime-measured* value, not a declared one. If attestation reads the digest from the manifest and compares it to the manif...",
    "decision_boundary": "The operational rule: **attestation must be a measurement of the running thing, and the agent's tool surface must be frozen to the attested set for the session's lifetime.** Concretely, on session establishment: - Measure the live server process (digest, or a signed capability probe over a fresh channel) and compare to the manifest's declared digest. Mismatc...",
    "operational_effect": "When the invariant holds, skill injection via manifest drift is structurally impossible: the agent can only invoke tools whose descriptions were derived from a signed, measured capability set, and any attempt to widen the set forces a new admission event that a human or policy gate can catch. The cost is that server upgrades require re-signing and digest pin..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "ffc3ae6b0f8468b4347a82bc02d5e7999ca3676897b09451258c8e7f542d9364",
    "verified_classes": [
      "CapabilityDriftError",
      "ManifestAttestationError"
    ],
    "verified_functions": [
      "attest_session",
      "build_tool_registry"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 6,
    "raised_exceptions": [
      "CapabilityDriftError",
      "ManifestAttestationError"
    ],
    "sample_fail_closed_invariants": [
      "manifest signature invalid"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}