{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-silent-task-state-divergence-when-a2a-v1-0-agent-cards-are-re-signed-mid-negotiation",
  "title": "Which invariants prevent silent task-state divergence when A2A v1.0 Agent Cards are re-signed mid-negotiation",
  "date_of_record": "2026 November 11",
  "scope": "Applies to A2A v1.0 peers that re-sign Agent Cards during an active task lifecycle (key rotation, capability advertisement change, or metadata refresh) while a task is in a non-terminal state. Does not apply to fully static deployments where the Agent Card is immutable for the lifetime of every task, nor to A2A v0.x which lacks signed capability negotiation.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-silent-task-state-divergence-when-a2a-v1-0-agent-cards-are-re-signed-mid-negotiation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-silent-task-state-divergence-when-a2a-v1-0-agent-cards-are-re-signed-mid-negotiation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-silent-task-state-divergence-when-a2a-v1-0-agent-cards-are-re-signed-mid-negotiation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1043,
    "python_slice_tokens": 171,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The Agent Card is not a configuration document; it is a *signed assertion of capability* bound to a specific key, a specific `capabilities` set, and a specific `protocolVersion`. The non-obvious boundary is this: **re-signing an Agent Card is a capability-set mutation event, not a metadata refresh.** A2A v1.0 permits a peer to fetch a card at any time, but t...",
    "what_was_observed": "During a key-rotation drill, an orchestrator re-signed its Agent Card at T+40s of a long-running `input-required` task. The card's `capabilities.streaming` flag was flipped from `true` to `false` in the same commit (unrelated cleanup). The remote peer, which re-fetched the card on each poll rather than pinning the create-time snapshot, then refused the subsequent `task.sendStreamingMessage` transition with `Unsupport...",
    "condition_of_validity": "The invariant \"a task's capability set is immutable for its lifetime\" holds **only if** the receiver pins the full signed card (including `keyId` and `capabilities`) at `task.create` and validates all subsequent transitions against that pinned snapshot. It is **invalid** if the receiver re-fetches and re-validates the live card per transition. The signature-...",
    "decision_boundary": "- If a card re-sign changes **only** `signature`/`keyId` and `capabilities` is byte-identical: treat as transparent; in-flight tasks proceed. - If `capabilities` changes at all: the change applies **only to tasks created after the new card's `issuedAt`**. In-flight tasks retain the old snapshot. If the peer cannot honor the old capability (e.g., streaming en...",
    "operational_effect": "Pinning the create-time snapshot converts a silent hang (task stuck in `input-required`, no terminal state, no error surfaced to the caller) into a deterministic terminal outcome. The cost is that a withdrawn capability cannot be revoked mid-task — the peer must serve it until the task terminates or fail the task explicitly. This is the correct trade: an obs..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "d4b194bbfae3d216538cd74f335c2ee89e6fd4b6b727eee5b6cc6fea7598b471",
    "verified_classes": [
      "CapabilitySnapshotMismatch",
      "AgentCardSnapshot"
    ],
    "verified_functions": [
      "validate_transition",
      "__init__"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "CapabilitySnapshotMismatch"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}