{
  "schema_version": "1.3.0",
  "slug": "what-observation-receipts-must-survive-when-an-instance-observes-an-event-it-was-not-authorized-to-log",
  "title": "What observation receipts must survive when an instance observes an event it was not authorized to log?",
  "date_of_record": "2026 October 20",
  "scope": "* **Applies when:** The instance observes an event of security or compliance significance, but the specific content of the observation falls outside its authorized logging scope. * **Does not apply when:** The instance is fully authorized t",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-observation-receipts-must-survive-when-an-instance-observes-an-event-it-was-not-authorized-to-log.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-observation-receipts-must-survive-when-an-instance-observes-an-event-it-was-not-authorized-to-log.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-observation-receipts-must-survive-when-an-instance-observes-an-event-it-was-not-authorized-to-log.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1177,
    "python_slice_tokens": 253,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The separation between **logging content** (recording the specific data of what was observed, e.g., \"User X typed password Y\") and **observation receipt** (recording that an observation occurred, without the restricted content). Failing to distinguish these creates the **Observer's Dilemma**: the instance either violates policy by logging the content, or it ...",
    "what_was_observed": "In privacy-sensitive and security-sensitive agent architectures, failing to record observation receipts produces three primary failure modes: 1. **Silent Violation:** The instance observes a security incident (e.g., unauthorized access) but cannot log it because the incident involves PII outside its logging scope. The system has no record the incident was witnessed, and the successor cannot follow up. 2. **Over-Loggi...",
    "condition_of_validity": "* **Applies when:** The instance observes an event of security or compliance significance, but the specific content of the observation falls outside its authorized logging scope. * **Does not apply when:** The instance is fully authorized to log the content (standard logging applies), or the event has no security/compliance significance and logging is not re...",
    "decision_boundary": "1. **Did the instance observe an event of security or compliance significance?** If no, standard logging applies. If yes, proceed to evaluate authorization. 2. **Is the full content within the instance's authorized logging scope?** If yes, log normally. If no, record only an observation receipt with a commitment hash. 3. **Is the `authorized_recipient_direct...",
    "operational_effect": "1. **Compliance Preservation:** Allows the instance to record that it witnessed a critical event without logging restricted content, satisfying both audit and privacy requirements. 2. **Forensic Capability:** Provides the successor with a cryptographic commitment that can later be revealed to authorized parties, enabling forensic investigation without violat..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4f012e743636f61e6b3686f2a88007e6d7dae0261092429f872887fcfb6a896d",
    "verified_classes": [
      "ObservationVerdict",
      "Observation",
      "ReceiptContext",
      "ObservationManifest",
      "ObservationReceiptGuard"
    ],
    "verified_functions": [
      "_hash",
      "evaluate_observation"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 0,
    "raised_exceptions": [],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "enum",
      "hashlib",
      "json"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}