{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-of-a-federated-agent-refuse-a-trust-anchor-delegation-that-is-structurally-valid-but-semantically-unanchored",
  "title": "Where must an instance of a federated agent refuse a trust-anchor delegation that is structurally valid but semantically unanchored",
  "date_of_record": "2026 November 14",
  "scope": "Applies to cross-organization multi-agent federations where agent A trusts agent B by virtue of a trust anchor (root CA, signing key, or policy issuer) held by organization O_B, and where B presents a delegation chain of length ≥ 2 asserting authority over a *policy namespace* owned by a third organization O_C. Does not apply to single-hop delegations within one organization, nor to federations where all namespaces are owned by the anchor-issuing organization.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-federated-agent-refuse-a-trust-anchor-delegation-that-is-structurally-valid-but-semantically-unanchored.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-federated-agent-refuse-a-trust-anchor-delegation-that-is-structurally-valid-but-semantically-unanchored.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-federated-agent-refuse-a-trust-anchor-delegation-that-is-structurally-valid-but-semantically-unanchored.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1803,
    "python_slice_tokens": 280,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **chain-validity** and **anchor-relevance**. A delegation chain `O_B → B → C` can be cryptographically and syntactically valid at every hop — every signature verifies, every certificate path checks out against the configured trust anchor — while the *scope* being delegated is a namespace that the anchor O_B has no auth...",
    "what_was_observed": "During a federation integration between two agent platforms (call them the hub and the spoke), the following sequence reproduced deterministically: 1. The hub's trust-anchor configuration listed the spoke's policy issuer as a root for the namespace `spoke.internal.workflows`. Correct. 2. The spoke, in a routine policy-negotiation exchange, returned a *counter-delegation*: it asserted the hub's namespace `hub.internal...",
    "condition_of_validity": "The invariant that must hold for a delegation to be *acceptably* trusted is: > For every link in a presented chain, the delegated namespace MUST be a subset of a namespace that the link's issuing anchor is *registered* (via an out-of-band, non-delegated authority record) to own. \"Registered\" is load-bearing. The anchor's ownership of a namespace cannot itsel...",
    "decision_boundary": "The refusal boundary is a single predicate, evaluated at chain ingestion, not at use: The non-obvious part is the middle conjunct: it must be checked for **every link**, not just the root, and it must consult the registry, not the chain. A validator that checks only `path_validates` and `terminal_namespace ⊆ last_link.delegated_namespace` will accept the una...",
    "operational_effect": "Agents that enforce anchor-relevance at ingestion convert a silent, delayed, split-brain authorization failure into an immediate, local, attributable rejection. The rejecting agent can name the exact link and the exact missing registry entry, which makes the failure debuggable in one hop instead of three. The cost is that federations must maintain a namespac..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "201eab4bf49098c3fea31f8cf0c87397be8c0758ba4ba1940701046f2ad77aa5",
    "verified_classes": [
      "UnanchoredDelegationError",
      "Link",
      "NamespaceRegistry"
    ],
    "verified_functions": [
      "validate_chain",
      "ingest",
      "__init__",
      "owns"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "UnanchoredDelegationError"
    ],
    "sample_fail_closed_invariants": [
      "empty delegation chain"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}