{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-equivocation-in-multi-agent-task-commitment-when-attestation-quorums-overlap",
  "title": "Which invariants prevent equivocation in multi-agent task commitment when attestation quorums overlap",
  "date_of_record": "2026 November 7",
  "scope": "Applies to BFT consensus layers that bind task commitment (who accepted what work) to result attestation (which agents certified the output), specifically when the two quorum sets are drawn from the same validator pool and may intersect across epochs. Does not apply to single-epoch commit-then-attest pipelines with disjoint validator sets, nor to proof-of-work attestation where quorum overlap is not a meaningful concept.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-equivocation-in-multi-agent-task-commitment-when-attestation-quorums-overlap.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-equivocation-in-multi-agent-task-commitment-when-attestation-quorums-overlap.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-equivocation-in-multi-agent-task-commitment-when-attestation-quorums-overlap.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1574,
    "python_slice_tokens": 317,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not classic Byzantine equivocation (a leader sending conflicting proposals). It is **cross-phase equivocation**: an agent commits to task $T$ in consensus round $r$, and later attests to a result for $T'$ that contradicts the commitment, where $T'$ was committed in a *different* round by an overlapping quorum. Each phase is internally con...",
    "what_was_observed": "In a 7-validator pool with $f=2$ (quorum $=5$), we ran a task-commitment layer and a result-attestation layer sharing the same validator set. Overlap between the commit quorum $Q_c$ and the attestation quorum $Q_a$ was permitted to be as low as 3 (majority intersection). Two Byzantine validators $B_1, B_2$ plus one crash-faulted honest validator produced the following: - Round $r$: $Q_c = \\{A, C, D, E, B_1\\}$ commits...",
    "condition_of_validity": "The safety property holds only if all three of the following are enforced: 1. **Content binding.** The attestation certificate must include a hash of the committed task input, and verifiers must reject any attestation whose bound input hash differs from the commitment certificate's. Membership overlap alone does not transport the commitment's semantics. 2. *...",
    "decision_boundary": "When designing the join, the boundary is: - **If** commitment and attestation share a validator pool **and** the attestation's semantics depend on the commitment's content, **then** the attestation certificate MUST carry the commitment's input hash and the verifier MUST check it. Otherwise treat the two layers as independent systems with independent trust as...",
    "operational_effect": "Once content binding and intersection-based quorum checks were added, the observed attack surface closed: attestations with mismatched input hashes were rejected at verification (rate: 100% of adversarial attempts in replay), and epoch-rotation attestations with insufficient intersection were flagged as unverifiable rather than accepted. The cost was a ~12% ..."
  },
  "matched_failure_symptoms": [
    "SPLIT_BRAIN_OR_ZOMBIE_WORKER"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "a4a329ea419f7341af0a778ad3599497d0493e277138f674d22116c697813a45",
    "verified_classes": [
      "AttestationInvariantError",
      "Commitment",
      "Attestation"
    ],
    "verified_functions": [
      "verify_attestation",
      "attest"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "AttestationInvariantError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}