{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-refuse-to-forward-an-attested-handoff-when-the-receipt-nonce-collides-with-a-prior-session-s-replay-window",
  "title": "Where must an instance refuse to forward an attested handoff when the receipt nonce collides with a prior session's replay window",
  "date_of_record": "2026 November 10",
  "scope": "Applies to agent-to-agent task handoffs where the sender signs a receipt binding (task_id, sender_id, receiver_id, payload_hash, nonce, issued_at) and the receiver must produce a counter-signed acknowledgment before executing. Does not apply to unidirectional fire-and-forget dispatch, nor to handoffs where receipts are advisory rather than load-bearing for non-repudiation.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-refuse-to-forward-an-attested-handoff-when-the-receipt-nonce-collides-with-a-prior-session-s-replay-window.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-refuse-to-forward-an-attested-handoff-when-the-receipt-nonce-collides-with-a-prior-session-s-replay-window.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-refuse-to-forward-an-attested-handoff-when-the-receipt-nonce-collides-with-a-prior-session-s-replay-window.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1606,
    "python_slice_tokens": 271,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure is not signature forgery, key compromise, or clock skew. It is the collision between two independently reasonable nonce policies: the *sender's* monotonically increasing counter per (sender, receiver) pair, and the *receiver's* replay window keyed on (sender, receiver, nonce) with a fixed TTL. When a sender restarts from persisted state and reiss...",
    "what_was_observed": "A three-agent pipeline (planner → executor → auditor) using Ed25519 receipts. The executor crashed after signing its acknowledgment to the planner but before durably committing the acknowledgment. On restart, the executor's persisted state showed the task as *received but unacknowledged*, so it re-derived the receipt from its journal and re-sent the acknowledgment. The planner rejected it: `nonce_replay` — the execut...",
    "condition_of_validity": "The invariant \"one valid acknowledgment per task_id\" holds only if the receiver's replay window is strictly longer than the sender's maximum crash-recovery retransmission interval *and* the sender never reuses a nonce across that interval. Both conditions are violated by default in most implementations: - Sender nonce counters are typically flushed lazily (b...",
    "decision_boundary": "An instance must refuse to forward an attested handoff — and must escalate rather than retry-with-fresh-nonce — when all of the following hold: 1. The incoming receipt's signature verifies against the sender's registered key. 2. The receipt's nonce is inside the receiver's replay window for that (sender, receiver) pair. 3. The receipt's `payload_hash` and `t...",
    "operational_effect": "Implementations that treat nonce collision as a simple reject-and-retry observe a specific failure signature: audit logs contain multiple valid signatures per task_id, and the count of \"executed\" tasks diverges from the count of \"audited\" tasks by the number of sender crashes during the acknowledgment window. The divergence is silent — no error is raised, be..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "a362c9b98ed44fdaaeb5576742817973b030d07d6bb29dba0b3ab6d942388655",
    "verified_classes": [
      "AttestedHandoffAmbiguity"
    ],
    "verified_functions": [
      "admit_receipt"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "AttestedHandoffAmbiguity"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}