{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-reject-a-vector-clock-merge-that-is-causally-consistent-but-byzantine-tainted",
  "title": "When must an instance reject a vector-clock merge that is causally consistent but Byzantine-tainted?",
  "date_of_record": "2026 November 5",
  "scope": "Applies to multi-agent systems where each agent maintains a vector clock over a shared world-model state, and consensus requires merging clocks across agents where up to `f` of `3f+1` agents may be Byzantine. Does not apply to crash-fault-tolerant systems, to single-writer clocks, or to clocks where Byzantine agents are assumed only to equivocate on *values* rather than on *clock components*.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-vector-clock-merge-that-is-causally-consistent-but-byzantine-tainted.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-vector-clock-merge-that-is-causally-consistent-but-byzantine-tainted.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-vector-clock-merge-that-is-causally-consistent-but-byzantine-tainted.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1487,
    "python_slice_tokens": 345,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious failure is this: a merged vector clock can be **causally well-formed** (every component is monotone, no component exceeds its sender's own clock, the merge is a valid join in the lattice) while still being **Byzantine-tainted** because one contributing component was fabricated to be *exactly* the value that makes the merge dominate a competin...",
    "what_was_observed": "During a 3f+1 = 7 agent deployment (f=2), a single Byzantine agent `B` repeatedly issued clock components `B[k] = max_seen + 1` on messages whose payloads were never delivered to the honest agents it claimed to have synchronized with. Honest agents `A` and `C` held concurrent histories `H_A` and `H_C` with `H_A || H_C`. `B` sent `A` a clock claiming `B` had observed `C`'s write (fabricated component), and sent `C` a ...",
    "condition_of_validity": "The merge is only valid when, for every component `c` in the merged clock that is *load-bearing* — i.e., whose presence changes the causal ordering verdict — the component is accompanied by at least `f+1` distinct attestations from agents other than the component's owner, each attesting that the owner's clock had reached `c` at the time of attestation. Compo...",
    "decision_boundary": "Reject the merge and raise when *any* of the following hold: 1. A load-bearing component `c` in the incoming clock is greater than the local clock's component for that owner, and fewer than `f+1` foreign attestations exist for `c`. 2. The incoming clock's attestation set contains a component attested solely by its owner (self-attestation is not evidence). 3....",
    "operational_effect": "On rejection, the agent must (a) quarantine the incoming clock, (b) emit a `ByzantineClockComponent` event naming the owner and component, and (c) fall back to the last quorum-attested clock for that owner rather than the local merge. The practical consequence is a bounded liveness penalty — the agent waits for `f+1` attestations to arrive — in exchange for ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "7f1239845874856dbf023750cd1a018ac700fb6a42ec9d557ae32746a81a20d6",
    "verified_classes": [
      "ByzantineClockError",
      "Attestation",
      "VectorClock"
    ],
    "verified_functions": [
      "_foreign_attestation_count",
      "_is_load_bearing",
      "merge_clocks",
      "apply_remote_clock"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "ByzantineClockError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}