{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-federated-agent-identity-revocation-fail-to-propagate-across-a-cross-org-trust-domain-boundary-when-the-revocation-is-signed-b",
  "title": "Why does an instance of federated agent identity revocation fail to propagate across a cross-org trust domain boundary when the revocation is signed by an intermediate authority that is itself no longer trusted",
  "date_of_record": "2026 November 8",
  "scope": "This record applies to federated agent identity systems where revocation events are propagated as signed artifacts (revocation lists, revocation tokens, or status assertions) across two or more independently governed trust domains that have a bilateral trust relationship. It does not apply to single-domain revocation, nor to systems where a single root authority directly signs every revocation with no intermediate delegation.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-federated-agent-identity-revocation-fail-to-propagate-across-a-cross-org-trust-domain-boundary-when-the-revocation-is-signed-b.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-federated-agent-identity-revocation-fail-to-propagate-across-a-cross-org-trust-domain-boundary-when-the-revocation-is-signed-b.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-federated-agent-identity-revocation-fail-to-propagate-across-a-cross-org-trust-domain-boundary-when-the-revocation-is-signed-b.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1490,
    "python_slice_tokens": 256,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious distinction is between **revocation validity** and **revocation provenance trustworthiness**. A revocation artifact can be cryptographically valid — the signature verifies against the key material present in the artifact — while the authority that issued it is, from the receiving domain's current perspective, no longer trusted. Most propagati...",
    "what_was_observed": "Two organizations, A and B, operate a bilateral federation. A delegates agent issuance to an intermediate authority `IA_A`, which is cross-signed by B's trust anchor `TA_B` so that B will accept agent credentials issued under `IA_A`. A revokes an agent credential and emits a signed revocation artifact under `IA_A`. Concurrently, A decommissions `IA_A` and rotates to `IA_A'`, notifying B through the out-of-band trust ...",
    "condition_of_validity": "This failure mode is reachable when and only when all of the following hold: 1. Revocation artifacts are signed by a delegated intermediate rather than by the root trust anchor of the issuing domain. 2. The receiving domain performs a provenance check against a *current* trust anchor set, and treats provenance failure as a hard discard rather than a quaranti...",
    "decision_boundary": "The correct operational rule is: **a revocation artifact must be evaluated against the trust anchor set that was in effect at the artifact's issuance timestamp, not the current set, provided the artifact's issuance timestamp falls within the retained verification window for that intermediate.** Concretely, the receiving domain must maintain a *historical* tr...",
    "operational_effect": "Applying the historical-provenance rule converts a silent security failure into a bounded, auditable reconciliation workload. Retired intermediates produce a finite, enumerable set of in-flight revocations that must be drained before the verification material can be safely garbage-collected. The operational invariant to enforce is: **verification material fo..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "6b1a77490215365bb4c0c049d4ceaf937626fc162efd9f98af3f75e76ba6e479",
    "verified_classes": [
      "RevocationProvenanceError",
      "TrustInterval",
      "RevocationArtifact"
    ],
    "verified_functions": [
      "resolve_provenance",
      "apply_revocation"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "RevocationProvenanceError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}