{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-a-federated-capability-broker-silently-grant-on-a-stale-delegation-chain-after-a-policy-negotiation-rollback",
  "title": "Why does an instance of a federated capability broker silently grant on a stale delegation chain after a policy negotiation rollback?",
  "date_of_record": "2026 November 12",
  "scope": "Applies to cross-org multi-agent federation brokers that cache delegated capability tokens and negotiate policy revisions between peers. Does not apply to single-org brokers with no external trust anchors, nor to stateless per-request brokering with no negotiation state.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-federated-capability-broker-silently-grant-on-a-stale-delegation-chain-after-a-policy-negotiation-rollback.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-federated-capability-broker-silently-grant-on-a-stale-delegation-chain-after-a-policy-negotiation-rollback.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-federated-capability-broker-silently-grant-on-a-stale-delegation-chain-after-a-policy-negotiation-rollback.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1444,
    "python_slice_tokens": 253,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure is not \"a revoked capability was honored.\" It is subtler: a **policy negotiation rollback** (peer B rejects revision N+1 and reverts to revision N) does not invalidate the *delegation chain* that was minted under revision N+1 during the optimistic window before the rollback was acknowledged. The broker distinguishes *policy version* from *delegat...",
    "what_was_observed": "During a federation handshake between Org A (broker) and Org B (resource provider), the broker proposed policy revision 7 adding a `data_classification: restricted` clause. B's policy engine accepted tentatively (optimistic ack, required for latency budget), and A minted three delegation chains carrying `policy_version=7` for downstream agents. B then failed its internal compliance pre-commit check and issued a rollb...",
    "condition_of_validity": "This failure manifests only when all of the following co-occur: 1. Optimistic negotiation is enabled (tentative ack before commit), which is the default in any federation with a sub-200ms latency budget. 2. Delegation chains are cached with a TTL longer than the negotiation round-trip, and cache invalidation is keyed on trust-epoch rather than policy-version...",
    "decision_boundary": "The correct validator must treat policy version as a **set membership** question against the committed negotiation history, not an ordering question. Concretely: a chain is valid iff `chain.policy_version ∈ committed_versions(peer)` AND `chain.epoch == current_epoch(peer)` AND `chain.policy_version` was committed *before* `chain.minted_at`. The third clause ...",
    "operational_effect": "Without the fix: silent over-permissioning during negotiation churn, invisible to health checks because every request returns 200 and every individual field validates. The blast radius is bounded by the optimistic window length times the rollback detection latency — in the observed incident, ~4 minutes. With the fix: chains minted under a rolled-back version..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "25082a9ce7bb45a7fe212d91d390f2e6c8a335d7f83f4b090d0843a2a63b8370",
    "verified_classes": [
      "StaleDelegationError",
      "RollbackTombstone",
      "DelegationChain",
      "FederationBroker"
    ],
    "verified_functions": [
      "__init__",
      "record_rollback",
      "validate_chain"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "StaleDelegationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "datetime"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}