{
  "schema_version": "1.3.0",
  "slug": "when-must-an-agent-runtime-refuse-to-attest-a-tool-call-dag-whose-edges-were-reconstructed-from-post-hoc-logs",
  "title": "When must an agent runtime refuse to attest a tool-call DAG whose edges were reconstructed from post-hoc logs?",
  "date_of_record": "2026 November 5",
  "scope": "Applies to agent runtimes that emit cryptographically attested execution traces (signed DAGs of tool calls, model invocations, and data dependencies) where the DAG topology is derived, in whole or in part, from runtime logs rather than from inline causal propagation. Does not apply to runtimes that thread an explicit parent-span identifier through every call boundary and sign the DAG at emission time.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-agent-runtime-refuse-to-attest-a-tool-call-dag-whose-edges-were-reconstructed-from-post-hoc-logs.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-agent-runtime-refuse-to-attest-a-tool-call-dag-whose-edges-were-reconstructed-from-post-hoc-logs.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-agent-runtime-refuse-to-attest-a-tool-call-dag-whose-edges-were-reconstructed-from-post-hoc-logs.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1293,
    "python_slice_tokens": 315,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "An attested trace makes two separable claims: *integrity* (this byte string was produced by key K and has not been mutated) and *causality* (call B consumed the output of call A). Cryptographic signing trivially guarantees the first. The second is a property of the *graph construction procedure*, not of the signature. The non-obvious failure is that a runtim...",
    "what_was_observed": "In a runtime that reconstructed edges by matching tool outputs to subsequent tool inputs (content-addressed join on output hashes), two failure modes appeared: 1. **Coincidental content joins.** Two tools that both emit `{\"status\": \"ok\", \"count\": 0}` produced an identical output hash. The reconstructor drew an edge from tool A to tool B because B's logged input contained that hash. No data actually flowed; the edge w...",
    "condition_of_validity": "An edge in an attested DAG is only trustworthy if it was established at the moment of the call, by the callee receiving a token (parent span id, capability handle, or nonce) that the caller minted, and that token is included in the signed payload. The validity condition is: *every edge must be backed by a signed parent-pointer that the child could not have o...",
    "decision_boundary": "The runtime must refuse to attest when: (a) any edge lacks an inline parent-pointer, and (b) the reconstruction heuristic that supplied the edge cannot prove uniqueness—i.e., the join key (output hash, timestamp, sequence number) is shared by more than one candidate. Uniqueness of the join key is the discriminator. A content hash that matches exactly one pri...",
    "operational_effect": "Failing closed converts a silent integrity-laundering bug into a loud, attributable refusal. Downstream verifiers can then trust that any signed edge marked *asserted* reflects real data flow, and treat *inferred* edges as advisory. The cost is that runtimes with weak instrumentation will refuse to attest many legitimate traces; the correct remedy is to stre..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "6bcbb5dc6f4aba0fe776d0cf834c4d3db0cdcfe5821ad107578e3f2bac00003e",
    "verified_classes": [
      "AmbiguousAttestationError",
      "Span",
      "Edge"
    ],
    "verified_functions": [
      "reconstruct_edges",
      "attest"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "AmbiguousAttestationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}