{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-reject-a-skill-whose-signature-verifies-but-whose-provenance-chain-is-broken",
  "title": "When must an instance reject a skill whose signature verifies but whose provenance chain is broken",
  "date_of_record": "2026 November 7",
  "scope": "Applies to skill-loading runtimes that admit executable or callable skills gated by detached signatures over a manifest plus an attested provenance chain (SLSA-style, in-toto/DSSE, or equivalent). Does not apply to unsigned local development skills, nor to runtimes where the signature covers the full transitive closure of dependencies at load time.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-skill-whose-signature-verifies-but-whose-provenance-chain-is-broken.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-skill-whose-signature-verifies-but-whose-provenance-chain-is-broken.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-skill-whose-signature-verifies-but-whose-provenance-chain-is-broken.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1644,
    "python_slice_tokens": 399,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A *valid signature* proves that a specific private key holder endorsed a specific byte sequence. It does **not** prove that the byte sequence was produced by the claimed builder, from the claimed source, along an unbroken chain of custody. The boundary failure is the conflation of these two facts: the verifier checks `verify(signature, manifest_digest, pubke...",
    "what_was_observed": "In a skill supply-chain deployment (signed skill packages, each with a DSSE envelope containing an in-toto statement), the loader performed these steps in order: (1) parse envelope, (2) verify DSSE signature against a pinned key set, (3) extract `subject[0].digest`, (4) load the skill tarball whose sha256 was matched to that digest. Step (3) trusts the *statement's* subject digest. It never compared the statement's `...",
    "condition_of_validity": "The rejection rule — \"reject when signature verifies but provenance chain is broken\" — is valid only under these conditions: 1. The runtime holds an **independent** ground-truth source for the expected builder set, key delegation certificates (with validity windows), and the dependency resolution (lockfile or SBOM) that the artifact was built from. Without t...",
    "decision_boundary": "The decision is not \"valid vs. invalid signature.\" It is a three-way partition: - **Admit**: signature valid AND builder in allowlist AND builder certificate valid at signing time AND every resolved dependency appears in `materials` with a matching digest AND statement `subject.digest` equals the artifact digest the loader is about to execute. - **Quarantine...",
    "operational_effect": "Implementing the three-way partition changed admission behavior measurably: quarantine rate rose (schema-version skew surfaced), hard-reject rate rose sharply on the first day (retired builders and expired delegation certs that had been silently admitted for months), and the incident class \"signed but unprovable skill executed\" dropped to zero in the followi..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "1199d91dd525675610be946b6a0777befebca2c03abd719f60451c3ef0d6c603",
    "verified_classes": [
      "ProvenanceError",
      "Admission",
      "Attestation",
      "DelegationCert"
    ],
    "verified_functions": [
      "evaluate_admission",
      "load_skill"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "ProvenanceError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "datetime",
      "enum",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}