{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-drift-across-the-trust-boundary-when-federated-span-aggregation-applies-differential-privacy-before-cardinality-reconciliation",
  "title": "Why does an instance drift across the trust boundary when federated span aggregation applies differential privacy before cardinality reconciliation",
  "date_of_record": "2026 November 14",
  "scope": "Applies to federated observability pipelines where agents emit span records to a local collector, the local collector applies a privacy mechanism (noise injection, k-anonymity suppression, or attribute generalization), and the resulting aggregate is joined against a remote peer's aggregate across an organizational trust boundary. Does not apply to single-tenant aggregation, nor to federated setups where the privacy transform is applied only after schema and cardinality reconciliation at a neutral third party.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-drift-across-the-trust-boundary-when-federated-span-aggregation-applies-differential-privacy-before-cardinality-reconciliation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-drift-across-the-trust-boundary-when-federated-span-aggregation-applies-differential-privacy-before-cardinality-reconciliation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-drift-across-the-trust-boundary-when-federated-span-aggregation-applies-differential-privacy-before-cardinality-reconciliation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1579,
    "python_slice_tokens": 217,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure is not a privacy leak and not a correctness bug in either side's local pipeline. It is a *cardinality-drift* failure: the privacy transform changes the population of distinct keys (span operation names, service identities, error classes) that participate in an aggregation, and the reconciliation step on the far side of the boundary assumes that t...",
    "what_was_observed": "In a two-org federation (Org A emits spans, Org B reconciles against its own), span operation names were generalized on the A side to a fixed vocabulary of 40 buckets before crossing the boundary. The bucket function was stable per-operation but not surjective onto the original key space: three distinct operations (`db.query.read`, `db.query.read_replica`, `db.query.read_cache`) collapsed into `db.query.read`. Org B'...",
    "condition_of_validity": "The reconciliation is valid only when all of the following hold: 1. The privacy transform is applied **after** the cardinality reconciliation, or the transform is accompanied by a *suppression/generalization ledger* that names, for each emitted key, the set of source keys it represents and the count of source keys suppressed. 2. The ledger is transmitted in-...",
    "decision_boundary": "The boundary is this: **if the receiver cannot reconstruct the source-key set from the received message plus a shared, versioned policy, the aggregate must be treated as unattributable and routed to a quarantine path rather than joined.** Do not attempt to infer suppression from sparsity; sparsity is also produced by genuine absence, by window skew, and by p...",
    "operational_effect": "With the ledger in place and the join gated on policy-version agreement, the false trust-escalation rate dropped to zero over a four-week window, and the missing-key counter was replaced by a `suppressed_by_policy` counter that the on-call rotation no longer pages on. The cost is a modest increase in envelope size (the ledger is O(distinct source keys) per w..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "ec4fe026490bc19be3d0e9e684784d0040f6a8425c0ec7036bfe9677bbfa797f",
    "verified_classes": [
      "FederationLedgerError"
    ],
    "verified_functions": [
      "reconcile_aggregate"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "FederationLedgerError"
    ],
    "sample_fail_closed_invariants": [
      "remote aggregate arrived without a suppression/generalization ledger; cannot distinguish suppressed keys from absent key"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}