What invariants prevent authenticated but adversarial peers from poisoning discovery results?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session uses discovery results (peer lists, capability descriptors, resource pointers) from peers that are authenticated (proven to be who they claim to be) but potentially adversarial (they may provide misleading discovery results), requiring discovery verification beyond authentication. Does not apply to discovery from fully trusted peers or from peers with cryptographic assurance of result correctness.

Core Distinction

The separation between **peer authentication** (the peer is who they claim to be) and **peer honesty** (the peer's discovery results are accurate). Relying on authentication creates the **Authenticated Poisoning**: an authenticated peer provides misleading discovery results, and the receiver, having verified the peer's identity, trusts the results without further verification, propagating the poisoning.

What Was Observed

In authenticated discovery architectures, failing to verify results beyond authentication produces three primary failure modes:

  1. **Authenticated Misreporting:** A peer with valid identity claims a capability descriptor for a target that does not match reality. The receiver trusts the descriptor because the peer is authenticated.
  2. **Strategic Omission:** A peer omits critical discovery results (e.g., does not mention a competing peer) to bias the receiver's view. The peer is authenticated, and the omission is not detectable from a single query.
  3. **Identity-as-Authority Fallacy:** The peer's identity is verified, but the peer's authority to assert discovery results for the claimed scope is not verified. A legitimate peer asserts discovery results outside their legitimate scope.

Recorded Elements

  1. **`discovery_assertion_scope_signature`:** For each discovery assertion, the peer's claimed scope (which entities, in which domains, they are authoritative to describe), verified against the peer's actual authority.
  2. **`cross_peer_corroboration_receipt`:** For critical discovery results, a cryptographic proof that independent peers corroborated the assertion, preventing single-peer poisoning.
  3. **`discovery_coverage_declaration_receipt`:** The peer's declaration of what discovery space they covered, so the receiver can detect strategic omissions by comparing against expected coverage.
  4. **`result_integrity_attestation_signature`:** A cryptographic attestation that the discovery result matches the underlying reality (e.g., signature from the discovered entity, or hash of the resource), distinct from the reporting peer's identity.

Condition of Validity

* **Applies when:** Discovery results come from authenticated but not fully trusted peers, and results influence downstream decisions. * **Does not apply when:** Peers are fully trusted for discovery (organizational boundary), or discovery results are cryptographically verifiable.

Decision Boundary

  1. **Is the peer authenticated?** If no, standard authentication applies first. If yes, proceed.
  2. **Does the peer have `discovery_assertion_scope_signature` for the claimed entities?** If no, the peer is asserting outside its scope. Discount the result.
  3. **Is `cross_peer_corroboration_receipt` present for critical results?** If no, the result is single-peer and potentially poisoned. Proceed with caution.
  4. **Conversely, when can authenticated peer results be trusted without corroboration?** Only when the peer is verified to be inside the receiver's trust boundary for the specific discovery domain, or the result is independently verifiable by the receiver.

Operational Effect

  1. **Authenticated Poisoning Prevention:** Results are verified beyond authentication.
  2. **Scope Enforcement:** Peers cannot assert outside their authoritative scope.
  3. **Omission Detection:** Coverage declarations reveal strategic omissions.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class DiscoveryTrustVerdict(Enum):
    TRUSTED_BOUNDARY = auto()
    CORROBORATED_RESULT = auto()
    SINGLE_PEER_UNVERIFIED = auto()
    SCOPE_VIOLATION = auto()

@dataclass(frozen=True)
class DiscoveryResult:
    result_id: str
    reporting_peer_id: str
    peer_is_authenticated: bool
    peer_trust_boundary: bool
    asserted_scope: frozenset[str]
    peer_authoritative_scope: frozenset[str]
    corroboration_count: int

@dataclass(frozen=True)
class TrustPolicy:
    min_corroboration: int

@dataclass(frozen=True)
class TrustManifest:
    verdict: DiscoveryTrustVerdict
    directive: str
    manifest_digest: str

class AuthenticatedDiscoveryGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_result(
        cls, result: DiscoveryResult, policy: TrustPolicy
    ) -> TrustManifest:
        
        # Gate 1: Authentication
        if not result.peer_is_authenticated:
            return TrustManifest(
                verdict=DiscoveryTrustVerdict.SINGLE_PEER_UNVERIFIED,
                directive=f"HALT: Peer {result.reporting_peer_id} not authenticated.",
                manifest_digest=cls._hash(f"NO_AUTH:{result.result_id}")
            )

        # Gate 2: Trust boundary
        if result.peer_trust_boundary:
            digest = cls._hash(json.dumps({
                "result": result.result_id,
                "peer": result.reporting_peer_id,
                "type": "TRUST_BOUNDARY"
            }, sort_keys=True))
            return TrustManifest(
                verdict=DiscoveryTrustVerdict.TRUSTED_BOUNDARY,
                directive=f"PROCEED: Peer {result.reporting_peer_id} inside trust boundary.",
                manifest_digest=digest
            )

        # Gate 3: Scope verification
        scope_violation = not result.asserted_scope.issubset(result.peer_authoritative_scope)
        if scope_violation:
            return TrustManifest(
                verdict=DiscoveryTrustVerdict.SCOPE_VIOLATION,
                directive=f"HALT: Peer {result.reporting_peer_id} asserts outside its scope.",
                manifest_digest=cls._hash(f"SCOPE:{result.result_id}")
            )

        # Gate 4: Corroboration
        if result.corroboration_count < policy.min_corroboration:
            return TrustManifest(
                verdict=DiscoveryTrustVerdict.SINGLE_PEER_UNVERIFIED,
                directive=f"WARN: Only {result.corroboration_count} corroborations < {policy.min_corroboration}.",
                manifest_digest=cls._hash(f"LOW_CORROB:{result.result_id}")
            )

        # Gate 5: Corroborated
        digest = cls._hash(json.dumps({
            "result": result.result_id,
            "peer": result.reporting_peer_id,
            "scope": tuple(sorted(result.asserted_scope)),
            "corroboration": str(result.corroboration_count)
        }, sort_keys=True))
        
        return TrustManifest(
            verdict=DiscoveryTrustVerdict.CORROBORATED_RESULT,
            directive=f"PROCEED: {result.corroboration_count} corroborations, scope valid.",
            manifest_digest=digest
        )