What's happening
During the observation window (2026-05-08 → 2026-05-15) the v1.8 governance signature check, capability_attestation check, and a few related verifier paths run in advisory mode. Failures are logged for analysis but not rejected at the boundary. After the Day-16 strict-flip cutover, the same failures will produce 401 responses.
This window exists so operators can fix passport-issuance issues before they become user-visible rejections.
Reading the log entry
Every advisory event carries:
| Field | Meaning |
|---|---|
event_kind | verifier_fail (this operator) or peer_verify_fail (downstream peer relayed the failure) |
severity | low / medium / high — heuristic-classifier scoring |
reason_code | Machine-readable cause (see codebook below) |
agent_id | Which agent's passport tripped the check |
correlation_id | Handle for joining against your own request logs |
observed_at | When the verifier saw the failure |
classification | legitimate / adversarial / unknown (heuristic v0.X output) |
classification_version | v0.3 at window kickoff; may bump during observation week |
A request that hit advisory failures is allowed through, but the correlation_id lets you reproduce the same input and understand what the strict-mode rejection would look like.
Common reason_codes during observation week
| Reason code | What's wrong | What to check |
|---|---|---|
GOVERNANCE_SIGNATURE_INVALID | v1.8 governance_payload_signature did not verify against the operator's governance_signing_pubkey_url | Pubkey URL reachable and serving the correct PEM? Canonical-bytes contract honored when signing? |
CAPABILITY_ATTESTATION_INVALID | v1.6 attestation signature did not verify | attester_pubkey_url reachable? Attestation rotated past attested_at validity window? |
DELEGATION_CHAIN_INVALID | One hop in the chain failed signature, expiry, or scope-subset check | Audit detail for the failing hop index. Most common: hop expired between issuance and call. |
GOVERNANCE_TRUST_ROOT_NOT_SEPARATE | governance_signing_pubkey_url resolves to the same origin as the passport-level signing key | These should be independent rotation surfaces; see agent passport schema v1.8. |
SG_MGAIF_* / ZA_POPIA_* | Jurisdictional pack required field absent under governance_payload.jurisdictional_extensions.<JURISDICTION> | See Jurisdictional extensions for the required field paths. |
Expected volume during the window
Anomaly observatory baseline freezes at window kickoff. The /registry/anomaly/flip_gate?hours=168 endpoint reports flip_recommended: true only when the legitimate / adversarial / unknown ratio crosses the configured threshold; until that flag flips, expect a small but non-zero advisory-event stream as operators iterate on their passport-issuance pipelines.
What to do
- Pull the events for your operator: see my_events self-diagnosis.
- For each
reason_code, check the table above + the linked schema section. - Fix the root cause in your issuance pipeline before Day-16 strict-flip.
- If you classify an event you investigated, post the classification back via
POST /registry/anomaly/classifyso the heuristic improves for everyone.
When advisory becomes mandatory
Day-16 (2026-05-16) cutover, gated by flip_recommended on /registry/anomaly/flip_gate. After cutover, the same reason_code produces a 401 from /api/protect with correlation_id in the body — see verifier_fail correlation_id and Day-16 strict-flip rejection.