{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-a-signed-skill-manifest-pass-verification-yet-still-execute-with-capabilities-it-never-attested",
  "title": "Why does an instance of a signed skill manifest pass verification yet still execute with capabilities it never attested?",
  "date_of_record": "2026 November 13",
  "scope": "Applies to agent runtimes that load skills as signed manifests with capability attestations and verify provenance at invocation time. Does not apply to monolithic agents where skill code and capability grants are statically linked at build time and never re-evaluated.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-signed-skill-manifest-pass-verification-yet-still-execute-with-capabilities-it-never-attested.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-signed-skill-manifest-pass-verification-yet-still-execute-with-capabilities-it-never-attested.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-signed-skill-manifest-pass-verification-yet-still-execute-with-capabilities-it-never-attested.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1359,
    "python_slice_tokens": 236,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure is not a broken signature. The failure is a *split between the attested capability set and the effective capability set at execution time*. A signed manifest attests to the capabilities the skill *declared* it needs at signing time. Provenance verification confirms the bytes of the manifest and the skill bundle are authentic and unmodified. Neith...",
    "what_was_observed": "A skill manifest was signed with `capabilities: [\"fs.read:/data\", \"http.get:api.internal\"]`. The signature verified. The bundle hash matched. Provenance chain resolved to a trusted issuer. The runtime then instantiated the skill in a worker whose tool bindings were inherited from the *parent agent's* session context rather than narrowed to the attested set. Because the parent agent held `fs.write`, `shell.exec`, and ...",
    "condition_of_validity": "Provenance verification is only a meaningful defense when all of the following hold: - The runtime *derives* the sandbox, token, or tool-binding set **only** from the attested set, never from ambient session context, parent inheritance, or defaults. - Capability matching is **exact** on a fully qualified capability identifier, not substring, prefix, or glob,...",
    "decision_boundary": "Do not treat \"signature valid + provenance resolved\" as a sufficient gate for execution. The decision to execute must be gated on `effective == attested` *after* the sandbox is materialized and *before* the skill's first instruction runs. Concretely: - If the runtime cannot enumerate the effective capability set of the instantiated worker, refuse to run the ...",
    "operational_effect": "Once the diff gate is enforced, the failure mode converts from a silent privilege escalation into a hard load-time error. Skills that relied on ambient inheritance stop loading — which is the correct outcome, because they were never actually constrained by their manifests. The cost is a burst of load failures during rollout as previously-latent ambient depen..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "f3e5e7d368105635ff783c224339d876869781d9f0b2e2d36fb0a4924a638426",
    "verified_classes": [
      "CapabilityAttestationError"
    ],
    "verified_functions": [
      "verify_and_instantiate"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "CapabilityAttestationError"
    ],
    "sample_fail_closed_invariants": [
      "manifest signature invalid",
      "bundle hash mismatch",
      "effective capability set is unenumerable; cannot prove subset of attested",
      "policy changed between verification and instantiation"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}