{
  "schema_version": "1.3.0",
  "slug": "when-must-an-agent-sandbox-reject-a-capability-delegation-that-is-transitively-valid-but-crosses-a-syscall-policy-epoch",
  "title": "When must an agent sandbox reject a capability delegation that is transitively valid but crosses a syscall policy epoch?",
  "date_of_record": "2026 November 5",
  "scope": "Applies to capability-based microVM sandboxes (Firecracker/Cloud Hypervisor-class VMMs) where a guest agent holds unforgeable capability tokens to host-side resources and a syscall-level policy engine (seccomp-bpf plus an LSM or ptrace-based interposer) enforces per-syscall allow-lists. Does not apply to pure in-process interpreters, gVisor user-space kernels, or systems where capability tokens are re-validated on every syscall by construction.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-agent-sandbox-reject-a-capability-delegation-that-is-transitively-valid-but-crosses-a-syscall-policy-epoch.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-agent-sandbox-reject-a-capability-delegation-that-is-transitively-valid-but-crosses-a-syscall-policy-epoch.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-agent-sandbox-reject-a-capability-delegation-that-is-transitively-valid-but-crosses-a-syscall-policy-epoch.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1682,
    "python_slice_tokens": 460,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A capability token is *transitively valid* when every delegation link from root issuer to holder is intact in the capability graph. It is *syscall-policy valid* when the syscall that the holder would use to exercise that capability is permitted under the policy epoch currently bound to the holder's task. These are independent predicates. The common failure i...",
    "what_was_observed": "In a deployment of ~4,000 concurrent microVM sandboxes, an orchestrator re-delegated a `net:connect` capability from a parent agent to a child agent across a policy-epoch boundary. The parent had been created under epoch `E41`, whose seccomp filter allowed `connect` to a restricted CIDR. A rolling policy update produced epoch `E42`, which narrowed `connect` to loopback and additionally gated it behind a `CAP_NET_RAW`...",
    "condition_of_validity": "The sandbox may accept a delegated capability without re-issuance **iff** all of the following hold: 1. The capability token carries the policy-epoch identifier under which it was minted (`epoch_id` in the token's authenticated metadata), and that identifier equals the epoch bound to the receiving task's seccomp program. 2. The syscall-policy engine treats a...",
    "decision_boundary": "The boundary is *at delegation*, not at syscall execution. The check is: If `accept` is false, the sandbox must reject the delegation with a typed error and force the delegator to re-mint under the receiver's epoch. It must *not* accept the token and defer the decision to the syscall interposer — deferral converts a clean, attributable delegation failure int...",
    "operational_effect": "Enforcing the boundary at delegation converts a mid-flight `SIGSYS` storm into a synchronous, retryable delegation error at the orchestrator, which can re-mint under the current epoch and proceed. The cost is one extra HMAC-mint per cross-epoch delegation (measured: +40µs p99 on the delegation path, negligible against microVM boot). The benefit is that polic..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "e3841c94d2dbd38f11b9be9662faf801a85b9001bca0b944d6116aa07092fb24",
    "verified_classes": [
      "PolicyEpochMismatch",
      "Capability",
      "PolicyEpoch"
    ],
    "verified_functions": [
      "_mac",
      "mint",
      "accept_delegation"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "PolicyEpochMismatch"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib",
      "hmac"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}