{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-equivocation-in-byzantine-resilient-agent-registry-gossip-under-partial-synchrony",
  "title": "Which invariants prevent equivocation in Byzantine-resilient agent registry gossip under partial synchrony",
  "date_of_record": "2026 November 14",
  "scope": "Applies to cross-organization agent registries that disseminate capability advertisements (agent ID, capability set, endpoint, TTL, signature) via gossip and rely on Byzantine quorum certificates for admission. Does not apply to single-org registries with a trusted membership authority, nor to gossip protocols where membership is static and authenticated out-of-band.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-equivocation-in-byzantine-resilient-agent-registry-gossip-under-partial-synchrony.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-equivocation-in-byzantine-resilient-agent-registry-gossip-under-partial-synchrony.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-equivocation-in-byzantine-resilient-agent-registry-gossip-under-partial-synchrony.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1428,
    "python_slice_tokens": 232,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode that matters is not a forged advertisement — signatures handle that. It is **equivocation of the capability set across quorum slices**: a Byzantine registry peer advertises agent `A` with capability set `C1` to one partition of the gossip graph and `C2` to another, each signed by `A`'s key, each accompanied by a valid quorum certificate asse...",
    "what_was_observed": "During a multi-region rollout, a registry peer in region `eu-west` was partitioned from `us-east` for ~90s. Region `us-east` continued to admit updates from the agent's home org; `eu-west` admitted an earlier, larger capability set from a stale but still-valid certificate. When the partition healed, gossip merged both certificates. Requesters hitting `eu-west` resolved `A` to capabilities including `code-exec:shell`;...",
    "condition_of_validity": "The uniqueness invariant holds only when all three conditions are met: 1. **Epoch monotonicity:** every honest peer rejects any certificate whose epoch is not strictly greater than the highest epoch it has previously certified for that agent. Epochs must be assigned by the agent's home org (or a designated sequencer), not by gossip relays. 2. **Certificate b...",
    "decision_boundary": "The operational choice is: **do you accept a certificate on first valid quorum, or do you require epoch-confirmed uniqueness before serving the capability?** - Accept-on-first-quorum: lower latency, but any partition can produce a split view. Suitable only when capability grants are advisory (routing hints, load-balancing) and a downstream enforcement point ...",
    "operational_effect": "After switching to epoch-scoped certificates with a sequencer-acknowledged uniqueness check, the partition-heal window produced a bounded, observable failure: requesters in the minority partition received `EpochUnconfirmedError` and fell back to their last confirmed view rather than serving a stale or divergent capability set. The authorization split-brain d..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "479b664d0810ab575e50d3c47c4624e63ebbde7cae55f4092d8865d4c4e8698e",
    "verified_classes": [
      "EpochUnconfirmedError",
      "Certificate",
      "RegistryView"
    ],
    "verified_functions": [
      "__init__",
      "admit",
      "resolve"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "EpochUnconfirmedError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}