What reference-expiry invariants must survive latency-induced validity gaps?

**Date of Record:** 2026 October 27 **Scope:** Applies when a reference (capability descriptor, tool URI, or peer identity) has a bounded validity window, and network latency causes the reference to arrive at downstream agents after part of its validity has elapsed, creating a window where the reference is transmitted as valid but arrives as expired or soon-to-expire. Does not apply to immortal references or zero-latency networks.

Core Distinction

The separation between **origin validity window** (the reference was valid at origin for duration D) and **received validity window** (the reference is valid at the receiver for duration D minus transit time). Relying on origin validity creates the **Latency-Induced Expiry Surprise**: the reference arrives with less validity than expected, and agents act on it assuming full duration, either using it past its actual expiry or failing to re-fetch in time.

What Was Observed

In latency-sensitive reference networks, failing to account for transit-induced expiry produces three primary failure modes:

  1. **Silent Expiry Mid-Use:** A reference with a 5-minute validity takes 4 minutes to arrive. The agent uses it for 2 minutes, the reference expires at minute 1, and the agent's second minute of use is against an expired reference.
  2. **Burst Refetch Storm:** Many references arrive at their receivers simultaneously with little remaining validity. All agents re-fetch at once, overwhelming the origin.
  3. **Wasted Propagation:** References with validity windows shorter than typical transit time arrive already-expired, and the propagation effort is wasted.

Recorded Elements

  1. **`origin_validity_window_receipt`:** The exact validity window at origin, with the exact issue epoch, allowing the receiver to compute remaining validity on arrival.
  2. **`transit_time_signature`:** For each reference, the exact transit time from origin to receiver, allowing the receiver to know how much validity was consumed in transit.
  3. **`minimum_useful_validity_receipt`:** The minimum validity required at the receiver for the reference to be useful, so references that arrive with insufficient remaining validity can be rejected.
  4. **`refetch_scheduling_signature`:** For references approaching expiry, the cryptographic proof of when the receiver must refetch, preventing expiry mid-use.

Condition of Validity

* **Applies when:** References have bounded validity, transit times are non-negligible relative to validity, and downstream actions depend on validity. * **Does not apply when:** References are immortal, transit is instantaneous, or validity is meaningless.

Decision Boundary

  1. **Does the reference have a bounded validity window?** If no, standard reference handling applies. If yes, proceed.
  2. **Is the remaining validity on arrival above the `minimum_useful_validity_receipt`?** If yes, the reference is usable. If no, reject and re-fetch.
  3. **Is the remaining validity above the expected use duration?** If no, refetch before use. If yes, proceed.
  4. **Conversely, when can an agent use a reference with insufficient remaining validity?** Only when the reference is strictly informational (no downstream action), or the agent can accept expired-reference risk (e.g., best-effort lookup).

Operational Effect

  1. **Expiry Surprise Prevention:** Remaining validity is computed on arrival, preventing silent mid-use expiry.
  2. **Refetch Storm Prevention:** Refetch scheduling is staggered, avoiding simultaneous expiry-triggered refetches.
  3. **Wasted Propagation Prevention:** References with insufficient remaining validity are filtered, freeing network capacity.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class ExpiryVerdict(Enum):
    IMMORTAL = auto()
    SUFFICIENT_VALIDITY = auto()
    INSUFFICIENT_VALIDITY = auto()
    ARRIVED_EXPIRED = auto()

@dataclass(frozen=True)
class ReferenceTiming:
    reference_id: str
    is_immortal: bool
    origin_issue_epoch: float
    origin_validity_sec: float
    transit_sec: float
    expected_use_sec: float

@dataclass(frozen=True)
class ExpiryContext:
    current_epoch: float
    min_useful_validity_sec: float

@dataclass(frozen=True)
class ExpiryManifest:
    verdict: ExpiryVerdict
    remaining_validity_sec: float
    directive: str
    manifest_digest: str

class LatencyExpiryGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_timing(
        cls, ref: ReferenceTiming, ctx: ExpiryContext
    ) -> ExpiryManifest:
        
        # Gate 1: Immortal
        if ref.is_immortal:
            digest = cls._hash(json.dumps({
                "reference": ref.reference_id,
                "immortal": "TRUE"
            }, sort_keys=True))
            return ExpiryManifest(
                verdict=ExpiryVerdict.IMMORTAL,
                remaining_validity_sec=float('inf'),
                directive=f"PROCEED: Reference {ref.reference_id} is immortal.",
                manifest_digest=digest
            )

        # Gate 2: Compute remaining validity
        arrival_epoch = ref.origin_issue_epoch + ref.transit_sec
        expiry_epoch = ref.origin_issue_epoch + ref.origin_validity_sec
        remaining = expiry_epoch - ctx.current_epoch

        # Gate 3: Already expired
        if remaining <= 0:
            return ExpiryManifest(
                verdict=ExpiryVerdict.ARRIVED_EXPIRED,
                remaining_validity_sec=remaining,
                directive=f"HALT: Reference {ref.reference_id} arrived {(-remaining):.1f}s after expiry.",
                manifest_digest=cls._hash(f"EXPIRED:{ref.reference_id}")
            )

        # Gate 4: Insufficient for use
        if remaining < ctx.min_useful_validity_sec:
            return ExpiryManifest(
                verdict=ExpiryVerdict.INSUFFICIENT_VALIDITY,
                remaining_validity_sec=remaining,
                directive=f"HALT: Reference {ref.reference_id} has {remaining:.1f}s remaining < {ctx.min_useful_validity_sec:.1f}s minimum.",
                manifest_digest=cls._hash(f"LOW_VALIDITY:{ref.reference_id}")
            )

        # Gate 5: Insufficient for expected use
        if remaining < ref.expected_use_sec:
            return ExpiryManifest(
                verdict=ExpiryVerdict.INSUFFICIENT_VALIDITY,
                remaining_validity_sec=remaining,
                directive=f"REFETCH: Reference {ref.reference_id} has {remaining:.1f}s remaining, use expects {ref.expected_use_sec:.1f}s.",
                manifest_digest=cls._hash(f"REFETCH:{ref.reference_id}")
            )

        # Gate 6: Sufficient
        digest = cls._hash(json.dumps({
            "reference": ref.reference_id,
            "remaining": f"{remaining:.1f}",
            "transit": f"{ref.transit_sec:.1f}",
            "expected_use": f"{ref.expected_use_sec:.1f}"
        }, sort_keys=True))
        
        return ExpiryManifest(
            verdict=ExpiryVerdict.SUFFICIENT_VALIDITY,
            remaining_validity_sec=remaining,
            directive=f"PROCEED: Reference {ref.reference_id} has {remaining:.1f}s remaining (transit {ref.transit_sec:.1f}s).",
            manifest_digest=digest
        )