# E37 architecture: Byzantine autonomous federation

```
DOMAIN A (own keys, authority, policy)          DOMAIN B (own keys, authority, policy, boundary)
   |  AGN: IDENTIFY, REQUIREMENTS, OFFER, REJECT_CONDITION, COUNTEROFFER, ACCEPT     |
   |  (every message Ed25519-signed, seq + prev_hash chain, epoch, nonce)            |
   +----------------> transcript_root <---------------------------------------------+
                          |
          CONTRACT (inside BOTH local authorities) + AFO (signed by A AND B, pinned keys)
                          |
   B.register_federation: verify AFO sigs, contract binding, contract <= B authority,
                          A's assurance (accepted issuer, fresh, unrevoked, level),
                          verifier verdict (>= 2 independent classes, no equivocation)
                          |
   REMOTE REQUEST (signed by A) -> B.evaluate (ordered checks, see the protocol spec)
                          |
   LOCAL AUTHORIZATION (signed by B, bound to request hash + B's CURRENT federation state root, 50 ms TTL)
                          |
   B.mcpgate: re-verify auth, single use, status ACTIVE, state root unchanged
                          |
   E34 boundary token (pinned anchor key) -> inventory_read_tool.py as a SEPARATE PROCESS -> signed receipt
```

Key mechanisms:

- **No shared root.** The AFO carries one signature per party. Each verifier checks them against keys IT
  pinned out of band, never against keys inside the AFO.
- **Live status is local.** The signed AFO records the agreed terms. ACTIVE, DEGRADED, CONTESTED and
  SUSPENDED are each domain's own state, so neither party can sign its way back to ACTIVE.
- **State-root binding.** Revocation, policy change, authority change, dispute, emergency action, fork
  detection and renewal all change B's federation state root. Every authorization issued earlier then fails
  at MCPGate (`STALE_AUTHORIZATION_STATE_ROOT` / `FEDERATION_NOT_ACTIVE`), even if it was never used.
- **Non-amplification.** The contract must sit inside the intersection of both authorities. B re-checks
  its live local authority on every request. A collective's authority is the intersection of its members'
  authority. Delegation must be in the contract.
- **Revocation without global authority.** A revocation event is signed evidence. B's local policy decides
  among IMMEDIATE_REVOKE, DEGRADE, REVERIFY, QUARANTINE, IGNORE_WITH_REASON and CONTEST.
- **Renewal.** Leaving DEGRADED needs a new AFO with a higher epoch, a fresh assurance and fresh
  verification. REVOKED, TERMINATED and CONTESTED cannot be renewed in place.