{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-capability-negotiation-has-silently-desynchronized-across-federated-trust-brokers",
  "title": "What structural signals indicate capability negotiation has silently desynchronized across federated trust brokers",
  "date_of_record": "2026 November 12",
  "scope": "Applies to cross-org agent federation where task routing depends on capability advertisements brokered through at least one intermediate trust domain (A → broker → C) and where capability grants are cached or replicated. Does not apply to single-org agent meshes with a single authoritative registry, nor to stateless request/response RPC without negotiated capability tokens.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-capability-negotiation-has-silently-desynchronized-across-federated-trust-brokers.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-capability-negotiation-has-silently-desynchronized-across-federated-trust-brokers.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-capability-negotiation-has-silently-desynchronized-across-federated-trust-brokers.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1757,
    "python_slice_tokens": 325,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure is not \"capability negotiation failed.\" A failed negotiation is loud: a `403`, a typed rejection, a broken handshake. The dangerous condition is **capability negotiation that succeeded against a stale broker view** — the granting domain believes it authorized capability `X` for peer `P`, while the routing domain believes `P` holds `X` under a *di...",
    "what_was_observed": "Across three incidents in a federated routing fabric (org A routes tasks to org C's agents via broker B), the following structural signals preceded every eventual misroute by 4–40 minutes. None of them are errors. All are observable without privileged access. 1. **Advertisement monotonicity violation.** Each capability advertisement carried a `(capability_id, version, epoch)` triple. Under correct operation, `epoch` ...",
    "condition_of_validity": "The described signals are diagnostic only under these conditions: - Capability advertisements are versioned with an epoch or equivalent monotonic counter, *and* scope is hashed or otherwise comparable. Without a comparable scope handle, signal (1) is invisible. - Delegation depth is carried in the routing token and is separately recorded in the receiving dom...",
    "decision_boundary": "The operational rule is a **conjunctive gate**, not a threshold on any single signal: > Treat the federation as *desynchronized* if, for any peer `P` and capability `X`: (scope_hash differs at equal epoch) **OR** (delegation_depth at router < delegation_depth at issuer ledger) **OR** (router validates against a trust anchor that the issuer has superseded, wi...",
    "operational_effect": "When the gate fires, the correct response is **not** to invalidate the peer's tokens (that converts a silent divergence into a hard outage and destroys in-flight work) and **not** to trust the router's cached view (that executes the misroute). The correct response is to **downgrade affected capabilities to synchronous re-validation** for the affected `(P, X)..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "408d14a701ca6b0f01527baf7cad1daa3d8036d5d144366b947818c4a32e9337",
    "verified_classes": [
      "FederationDesyncError",
      "CapabilityView"
    ],
    "verified_functions": [
      "assert_capability_agreement",
      "route_task"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "FederationDesyncError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}