{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-signature-substitution-when-agent-skill-packages-are-re-signed-during-hot-reload",
  "title": "Which invariants prevent signature substitution when agent skill packages are re-signed during hot reload",
  "date_of_record": "2026 November 10",
  "scope": "Applies to runtimes that load agent skills dynamically and verify a detached signature over a manifest (or bundle digest) before activation. Does not apply to statically compiled skill sets, nor to runtimes that pin a single signature per process lifetime with no reload path.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-signature-substitution-when-agent-skill-packages-are-re-signed-during-hot-reload.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-signature-substitution-when-agent-skill-packages-are-re-signed-during-hot-reload.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-signature-substitution-when-agent-skill-packages-are-re-signed-during-hot-reload.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1540,
    "python_slice_tokens": 352,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between *verifying a signature* and *attesting provenance*. A signature check answers \"was this byte string signed by holder of key K?\" Provenance attestation answers \"does this artifact descend from an authorized publisher through an authorized build path, and is the key that signed it still the key we trust for that publishe...",
    "what_was_observed": "A skill loader operating under a reload-on-change watcher processed a modified skill directory. The manifest carried `signing_key_id: \"publisher-a/2024-11\"` and a detached Ed25519 signature. The loader: 1. Parsed the manifest. 2. Looked up `signing_key_id` in a registry that was populated from a directory of *all* keys ever seen, including keys embedded in previously loaded packages. 3. Verified the signature against...",
    "condition_of_validity": "The invariant \"artifact may name but not select its key\" holds only when all of the following are true: - The trust store is consulted by **key fingerprint**, computed over the raw public key bytes, and the fingerprint is compared against an allow-list bound to the publisher identity — not against an identifier string the artifact supplies. - The cache key f...",
    "decision_boundary": "The operational decision is where to fail closed. Two boundaries: - **Binding boundary:** if the fingerprint resolved from the trust store does not equal the fingerprint of the key the signature actually verifies against, raise. Do not fall back to \"trust the manifest's identifier.\" Do not log-and-continue. - **Reload boundary:** if a reload presents a (skil...",
    "operational_effect": "With the binding enforced, the substituted package fails at resolution: the fingerprint computed from the manifest-named key does not appear in the publisher's allow-list, and the load aborts before activation. The reload cache, keyed on (publisher, fingerprint, digest), misses on the changed fingerprint and forces the full binding path. The cost is one extr..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "e891da9cc4f1bbd8a907c751a23b50a24358dc874608b1bd7e7280e12215dcc0",
    "verified_classes": [
      "ProvenanceBindingError",
      "TrustAnchor"
    ],
    "verified_functions": [
      "fingerprint",
      "resolve_anchor",
      "verify_and_activate"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "ProvenanceBindingError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}