{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-reject-a-skill-manifest-whose-declared-capability-set-is-a-strict-superset-of-the-tool-schema-it-was-signed-against",
  "title": "When must an instance reject a skill manifest whose declared capability set is a strict superset of the tool schema it was signed against",
  "date_of_record": "2026 November 8",
  "scope": "Applies to agent runtimes that load tool/skill manifests at runtime from a registry and enforce capability declarations via signature verification against a schema digest. Does not apply to statically compiled toolchains where the schema and capability set are fixed at build time and no post-deployment manifest mutation is possible.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-skill-manifest-whose-declared-capability-set-is-a-strict-superset-of-the-tool-schema-it-was-signed-against.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-skill-manifest-whose-declared-capability-set-is-a-strict-superset-of-the-tool-schema-it-was-signed-against.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-skill-manifest-whose-declared-capability-set-is-a-strict-superset-of-the-tool-schema-it-was-signed-against.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1551,
    "python_slice_tokens": 220,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not \"an attacker injects a malicious skill.\" That case is well-understood and handled by signature verification of the manifest body. The non-obvious boundary is the **capability–schema divergence**: a manifest that carries a valid signature, a valid schema digest, and a well-formed capability declaration, but where the declared capabilit...",
    "what_was_observed": "A registry accepted a skill manifest for a \"summarize_document\" tool. The manifest was correctly signed by a trusted publisher key. The schema digest matched the schema the publisher signed. The tool schema declared inputs `{document_id: str}` and outputs `{summary: str}`, with no side-effecting operations — a pure read-and-transform tool. The capability manifest, however, declared `capabilities: [fs.read, fs.write, ...",
    "condition_of_validity": "The rejection rule is valid — and the over-declaration is a genuine injection surface — only under these conditions: 1. The signed schema is a *complete* description of the tool's effect surface. If the schema is intentionally partial (e.g., a plugin whose effects are described out-of-band), then schema-implied capabilities are not an upper bound and the rul...",
    "decision_boundary": "The loader must reject when `declared_capabilities ⊋ derive_capabilities(signed_schema)`, and must do so *before* capability grant, not after. The decision is binary and must not be softened by \"the publisher is trusted\" — trust in the publisher authenticates the assertion, not the warrant. A trusted publisher can still ship an over-declared manifest through...",
    "operational_effect": "After enforcing strict-superset rejection at the registry boundary, over-declared manifests fail closed at load time with an explicit divergence report listing the excess capabilities and the schema digest they were checked against. The capability pool is scoped per schema digest rather than per publisher, so a manifest cannot launder authority into a siblin..."
  },
  "matched_failure_symptoms": [
    "SCHEMA_DRIFT_OR_COERCION_CRASH"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "d0efe02b011d008a4b53e516721e70ff94ebd5501eb2dba2be98650aca56ab28",
    "verified_classes": [
      "CapabilityDivergenceError",
      "SignedManifest"
    ],
    "verified_functions": [
      "derive_capabilities",
      "admit_manifest",
      "__init__"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "CapabilityDivergenceError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}