{
  "schema_version": "1.3.0",
  "slug": "when-must-a-skill-registry-reject-a-dynamically-loaded-skill-before-granting-it-tool-authority",
  "title": "When must a skill registry reject a dynamically loaded skill before granting it tool authority?",
  "date_of_record": "2026 November 6",
  "scope": "Applies to agent runtimes that resolve skills/tools at runtime from a mutable registry (plugin directories, remote manifests, hot-reloaded bundles) and bind them to the agent's tool-calling loop without a process restart. Does not apply to statically compiled tool sets fixed at build time, nor to sandboxed registries where every skill executes in an isolated process with no shared capability namespace.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-a-skill-registry-reject-a-dynamically-loaded-skill-before-granting-it-tool-authority.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-a-skill-registry-reject-a-dynamically-loaded-skill-before-granting-it-tool-authority.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-a-skill-registry-reject-a-dynamically-loaded-skill-before-granting-it-tool-authority.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1318,
    "python_slice_tokens": 299,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is between **identity binding** and **authority binding**. A registry typically validates a skill's *identity* at load time — signature, name, version, manifest hash — and then grants *authority* separately, often lazily, at first invocation or at the moment the skill declares a capability. The failure mode is that these two moments ...",
    "what_was_observed": "In a hot-reload registry, a skill manifest declared `capabilities: [\"read_file\"]`. The registry validated the manifest signature, resolved the string `read_file` against a global capability table at grant time, and bound the skill. A subsequent registry update — pushed as a \"minor\" revision — changed the manifest to `capabilities: [\"read_file\", \"exec_shell\"]` but the reload path only re-validated the *name and versio...",
    "condition_of_validity": "The registry may grant tool authority to a dynamically loaded skill only when all of the following hold simultaneously and atomically: 1. The artifact hash validated at load equals the artifact hash of the executable image at invocation (no re-read between check and use). 2. The granted capability set is derived from the *same validated artifact*, not from a...",
    "decision_boundary": "Reject (do not load, do not grant) when: the reload path cannot prove artifact-hash equality across the check/use gap; a capability set changed since last validation, even additively; a skill attempts to register a name in a reserved namespace; or a skill registers a child whose authority is not independently granted. Accept only when the grant is computed f...",
    "operational_effect": "Enforcing this boundary converts a silent privilege-escalation surface into a hard load failure. Skills that legitimately add capabilities must re-enter the validation queue; shadowing attempts fail closed; hot-reload becomes safe because the grant is always recomputed from the bytes that will run. The cost is that some benign updates require a re-authorizat..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "6388a5ca515c559babdef5bef3afb3ebcc6234b71352da2a8ed1d2644fe499b6",
    "verified_classes": [
      "SkillAuthorityError",
      "SkillArtifact",
      "Grant"
    ],
    "verified_functions": [
      "grant_authority",
      "bind_and_invoke",
      "artifact_hash"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "SkillAuthorityError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}