{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-a2a-v1-0-cross-org-agent-card-federation-from-silently-degrading-into-trust-laundering-proxies",
  "title": "Which invariants prevent A2A v1.0 cross-org agent card federation from silently degrading into trust-laundering proxies",
  "date_of_record": "2026 November 14",
  "scope": "Applies to A2A v1.0 agent-to-agent federation where an Agent Card is fetched across an organizational boundary (different `provider.organization`, different signing key trust root, or different DNS/well-known origin). Does not apply to intra-org card resolution, nor to card caching within a single trust domain where the signing key is pinned out-of-band.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-a2a-v1-0-cross-org-agent-card-federation-from-silently-degrading-into-trust-laundering-proxies.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-a2a-v1-0-cross-org-agent-card-federation-from-silently-degrading-into-trust-laundering-proxies.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-a2a-v1-0-cross-org-agent-card-federation-from-silently-degrading-into-trust-laundering-proxies.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1678,
    "python_slice_tokens": 278,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There are two structurally different things an Agent Card can be: a **signed capability declaration** (the card is a claim by an origin, verifiable against a key the consumer independently trusts) and a **fetched document** (the card is bytes obtained from a URL that someone told you about). A2A v1.0 permits both to flow through the same resolution path, and...",
    "what_was_observed": "During a federated deployment (three orgs, A2A v1.0, cards served from `/.well-known/agent-card.json` per origin), Org B stood up a \"card relay\" to reduce cross-org fetch latency. The relay cached cards from Org A and Org C and re-served them under `relay.b.example` with the original `signatures` array untouched. Consumers in Org C fetched from the relay, verified the signature against Org A's published JWKS, and acc...",
    "condition_of_validity": "The invariant holds — and federation is safe — only when all of the following are true simultaneously: - The consumer resolves the card from the **same origin** that the signing key's `provider.organization` claims, verified by comparing the card's `provider.url` host and the JWKS `iss`/origin against the fetch origin. If these differ, the card is a *relayed...",
    "decision_boundary": "The boundary is: **does the consumer's trust decision bind to the origin, or to the bytes?** If the consumer's logic is \"fetch card, verify signature, trust contents,\" it binds to bytes and is vulnerable to relay staleness and provenance confusion. If the consumer's logic is \"resolve origin, fetch card *from that origin*, verify signature *against that origi...",
    "operational_effect": "Enforcing the origin-binding invariant costs one extra origin comparison and one pinned-key lookup per federation hop, and it converts a silent degradation (stale-but-valid cards, misattributed audit trails) into a loud, catchable failure at resolution time. The practical rule: a card whose fetch origin does not match its signed `provider` origin is a *relay..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "350ed2f4c03326ba07e570299573ffb0f2f75ff6441d322d2900321686824003",
    "verified_classes": [
      "AgentCardFederationError",
      "ResolvedCard"
    ],
    "verified_functions": [
      "admit_federated_card"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "AgentCardFederationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "time",
      "urllib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}