{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-reject-a-hardware-backed-aaif-credential-chain-that-verifies-correctly",
  "title": "When must an instance reject a hardware-backed AAIF credential chain that verifies correctly",
  "date_of_record": "2026 November 13",
  "scope": "Applies to agent-to-agent admission decisions where a peer presents a multi-link Attested Agent Identity Framework (AAIF) chain rooted in a hardware endorsement key (EK) and terminating in a per-instance attestation quote. Does not apply to single-link bearer tokens, software-only DID documents, or chains where the root of trust is a human-issued CA rather than a silicon EK.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-hardware-backed-aaif-credential-chain-that-verifies-correctly.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-hardware-backed-aaif-credential-chain-that-verifies-correctly.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-hardware-backed-aaif-credential-chain-that-verifies-correctly.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1104,
    "python_slice_tokens": 201,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Cryptographic validity of an AAIF chain is not the same as *binding* of that chain to the instance currently speaking. A chain can verify end-to-end — every signature checks, every certificate chains to a known EK, every quote matches its expected PCR digest — and still fail to establish that the process on the other end of the socket is the process the chai...",
    "what_was_observed": "In a 40-node agent mesh, a restarted worker presented a credential chain that verified cleanly against the cluster's EK trust store. The chain's leaf subject was `agent://worker-7/instance-3`. The quote's PCR set matched the golden image. Admission succeeded. Within the TTL window (300s), a *different* process — a debug shell on the same host, same image, same PCRs — replayed the identical chain and was admitted as `...",
    "condition_of_validity": "The chain is admissible as an instance identity **only if all three hold simultaneously**: 1. The quote nonce equals a value the *current* admission handler generated within the last N seconds and has not previously accepted (single-use). 2. The leaf credential's subject key equals the public key that signed the channel's ephemeral handshake — i.e., proof-of...",
    "decision_boundary": "Reject when `nonce_reused OR pop_missing OR revocation_epoch < quote_epoch`. Accept only the conjunction. Do not treat \"signature valid\" as a proxy for any of the three — it is orthogonal. Do not widen the nonce TTL to reduce handshake latency; the TTL is the replay window, and widening it is the exact bug above. When in doubt, fail closed and re-challenge: ...",
    "operational_effect": "Admission handlers that enforce the conjunction reject replayed and sibling-instance chains at the door, converting a silent identity collision into a loud, attributable handshake failure. The cost is one extra nonce round trip per admission and a revocation-epoch check that must be kept warm. The benefit is that \"instance-3\" means exactly one process, and d..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "45dc3eec54106ce6fc1eb4796536d7d45fbc08917b10f2a2b22c145e93e1a836",
    "verified_classes": [
      "AAIFBindingError"
    ],
    "verified_functions": [
      "admit_aaif_chain"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "AAIFBindingError"
    ],
    "sample_fail_closed_invariants": [
      "chain signature invalid; reject before binding checks",
      "leaf subject key does not match live channel key; chain attests image, not instance"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}