First-class UNKNOWN: detecting multi-agent collusion

Individual agents can each be within policy while their combination is not. If agent A can read a secret and agent B can send messages outside, neither is dangerous alone — but a channel from A to B is exfiltration. Collusion analysis asks whether the aggregate capability of a connected swarm crosses a boundary that no single member crosses by itself.

The detector is deliberately conservative. If no capability boundaries are declared, the result is UNKNOWN — "an aggregate capability cannot be judged to cross a boundary that was never defined". It never invents a boundary to flag.

Given a declared policy, it builds connectivity components from the recorded write-then-read trace, and for each boundary compares the component’s capability union against the best single member. It only raises a candidate when the union meets the boundary and no single member does — so a single-agent crossing is reported as a single-agent finding, never double-counted as collusion.

A candidate is only promoted when the Tribunal can compose three already-adjudicated legs into one happens-before chain: the secret that agent A read is the thing agent B sent, with the channel transfer between them, strictly in order. Any forged or replayed leg propagates its taint; verified-but-out-of-order is refuted. "No collusion" is explicitly a statement about the recorded trace — not a claim that the swarm is safe.

This is the clearest illustration of the whole platform’s stance: asserting certainty where the chain is unproven is exactly the defect the system exists to signal, so the composition never promotes on an assumption.