# When must an instance refuse to apply a cross-org slashing verdict: the quorum-intersection invariant under colluding reputation federations

**Date of Record:** 2026 November 12

**Scope:** Applies to federated agent-reputation systems where slashing verdicts are propagated between organizations and locally enforced against agent instances. Does not apply to single-org reputation ledgers, nor to purely advisory (non-enforcing) trust scores.

## Core Distinction

The distinction that matters is between *verdict validity* and *verdict enforceability*. A slashing verdict can be perfectly valid — cryptographically signed, correctly attributed, produced by an honest quorum of the issuing federation — and still be unenforceable by your instance, because enforcement requires that your local trust root be **quorum-intersecting** with the issuing quorum. Validity is a property of the verdict; enforceability is a property of the relationship between two federations' quorum systems. Most implementations conflate them, treating any validly signed verdict as actionable. Under adversarial collusion, that conflation is the attack surface: a coalition that controls a majority of the *issuing* federation but has zero intersection with *your* trust root can mint verdicts you will faithfully execute against your own agents.

## What Was Observed

Across three federated deployments (agent marketplaces, cross-org tool-calling meshes), the failure recurred identically. Federation A issues a slashing verdict against agent `X`, which is registered and running under Federation B. The verdict carries a quorum certificate over A's validator set `V_A` with threshold `t_A`. Federation B's enforcement policy checks: signature valid → apply slash. The check passes. The slash executes.

The non-obvious part: the colluding subset `C ⊂ V_A` with `|C| ≥ t_A` need not contain *any* validator that B trusts. A and B agreed on a *format*, not on a *trust root*. When an adversary captures `t_A` validators in A — or stands up a fresh federation A' with a validator set it fully controls and a plausible-looking genesis — it can produce unlimited valid verdicts. B's agents are slashed on demand. The verdict is valid. The enforcement is a remote-code-execution primitive for the attacker's economic policy.

The invariant violated: **enforcement requires `Q_B ∩ Q_A ≠ ∅` and, stronger, that the intersection itself carries enough weight under B's own trust root.** Format compatibility is not trust compatibility. A quorum certificate proves "the issuing federation agreed," never "a federation you trust agreed."

## Condition of Validity

A cross-org verdict is enforceable by instance B if and only if all hold:

1. The issuing quorum `Q_A` (the actual signer set, not the declared validator set) has non-empty intersection with B's local trust root `T_B`.
2. The intersection's weight, measured under `T_B`'s own weighting — not A's — meets B's enforcement threshold `t_B`.
3. The federation identity `A` is anchored in B's trust root by a *pinned* genesis hash, not by a self-asserted name or key. A federation cannot bootstrap trust by naming itself.
4. The verdict's epoch is not older than B's last trust-root rotation, or it is re-validated against the rotated root.

Condition 2 is the one routinely dropped. Implementations check intersection non-emptiness and stop. A single colluding validator shared between A and B then suffices to launder an entire hostile quorum's verdict into B's enforcement path, because the check "is there overlap?" is satisfied by one shared key while the *weight* of that overlap under B's root is negligible.

## Decision Boundary

The instance must refuse enforcement — and must refuse *loudly*, escalating to human review rather than silently dropping — when any of the four conditions fails. The boundary is sharp: there is no partial enforcement. A verdict that fails condition 2 is not "weakly enforceable"; it is unenforceable, and applying it is a trust-root violation regardless of how many signatures it carries.

Two adjacent boundaries are worth naming. First, **do not substitute verdict count for quorum weight**: ten verdicts each with 1% of `T_B`'s weight are not equivalent to one verdict with 10%; colluders farm cheap verdicts to cross thresholds. Second, **do not let the issuing federation define the weighting function used to evaluate its own verdicts** — that is the adversary grading its own exam. B must evaluate A's quorum under B's weights, always.

## Operational Effect

Enforcing this boundary converts a silent remote-slash primitive into a detectable, auditable event. In the deployments above, adding weight-checked intersection reduced successful collusive slashing to zero in red-team exercises, at the cost of a small false-negative rate: legitimate verdicts from federations with thin-but-honest overlap with B are deferred to human review rather than auto-applied. That trade is correct — a deferred honest slash is a latency cost; an applied hostile slash is a trust-root compromise. The instance's job is not to maximize slash throughput. It is to never execute economic policy authored by a quorum it does not trust.

```python
from dataclasses import dataclass
from typing import FrozenSet


class UnenforceableVerdictError(RuntimeError):
    """Raised when a cross-org slashing verdict cannot be enforced under the local trust root."""


@dataclass(frozen=True)
class Verdict:
    issuer: str
    signer_set: FrozenSet[str]          # actual signers, not declared validators
    epoch: int
    pinned_genesis: str


@dataclass(frozen=True)
class TrustRoot:
    pinned_genesis: str
    weights: dict                       # validator -> weight under OUR root
    threshold: float                    # t_B, as fraction of total weight
    current_epoch: int


def enforce_verdict(verdict: Verdict, root: TrustRoot) -> None:
    if verdict.pinned_genesis != root.pinned_genesis:
        raise UnenforceableVerdictError(
            f"issuer genesis {verdict.pinned_genesis!r} not anchored in local trust root"
        )
    if verdict.epoch < root.current_epoch:
        raise UnenforceableVerdictError(
            f"verdict epoch {verdict.epoch} predates trust-root rotation {root.current_epoch}"
        )

    total = sum(root.weights.values())
    if total <= 0:
        raise UnenforceableVerdictError("empty local trust root; no weight to evaluate against")

    # Weight of the intersection, measured under OUR root -- never the issuer's.
    intersection_weight = sum(
        w for validator, w in root.weights.items() if validator in verdict.signer_set
    )
    fraction = intersection_weight / total

    if fraction < root.threshold:
        raise UnenforceableVerdictError(
            f"quorum intersection weight {fraction:.3f} < local threshold "
            f"{root.threshold:.3f}; verdict valid but unenforceable"
        )
    # Only here may the slash be applied.
```