CAIN-42 · E55 · federated governance

A signature proves authorship. It does not grant authority.

Two organizations with separate keys and separate policies. Organization A issues a signed, scoped, single-use grant. Organization B verifies it against pinned trust and its own policy. Either side can refuse. Evidence is portable and independently verifiable.

14/14

federation + Node interop tests

independent policy checks per action

side effects on denied cross-org actions

use per capability (nonce)

4.06/11.19/70.20 ms

cross-org p50/p95/p99

Decision matrix (tested)

Attempt	Result
Valid grant, both policies allow	ALLOW
Valid grant, target policy denies	DENY — target authority is independent
Origin policy denies at issuance	DENY — no grant exists
Replay the same grant	DENY — nonce consumed
Trust revoked or expired	DENY
Forged origin key / wrong target org	DENY
Amount or resource outside trust	DENY
Registry record tampered	INVALID signature
Evidence envelope tampered	INVALID digest
Execution claims success, observation says no	DISPUTED

What a cross-org grant contains

origin_org, target_org, agent, action, resource, amount,
nonce, issued_at, expires_at  -- signed Ed25519, domain separated

The target stores the origin's pinned key, allowed actions/resources, max amount, expiry and a revoked flag. All are checked before any allow. The nonce is claimed only after every check passes.

Registry is discovery, not trust

Signed implementation records (protocol versions, adapters, conformance level, endpoints, security contact, sequence). Multiple registries are allowed; none is mandatory. A listing is not a certification and does not grant authorization.

Try it

pip install cryptography httpx pytest
python3 -m pytest tests/test_evolution55_federation.py -q

# 10 tests: allow, target deny, origin deny, replay, revoke, expiry,
# forged key, wrong target, scope abuse, registry/evidence tampering

Measured this cycle

Test	Result
100,000 registered identities	5.722 s (inventory)
cross-org authorization, 500 attempts	p50 4.06 ms · p95 11.19 ms · p99 70.20 ms
replay attempts	100/100 denied
restart with durable store	trust persists; consumed nonce still refused
second implementation (Node.js)	envelope + grant + Merkle agree with Python, 3/3
real LangGraph ToolNode	authorized EXECUTED; unauthorized DENIED; file absent

Honest limits

Both nodes run on this host; there is no independent operator and no external federation.
Trust and nonces are in memory; no distributed nonce store.
Federation is implemented in Python only; no second language implementation yet.
No cross-org load test, no 100k-identity test, no third-party audit.
Evidence proves integrity and authorship, not event truth.

← open core · E53 · E52 · claims