Correct the aggregation algorithm: issuer capping now binds (v1.1)

[blocksifrdev]

Normative change. This alters conformance for anyone implementing protocol/aggregation-spec.md.

Implementing the spec surfaced a defect in the spec.

What was wrong

Step 5 capped a dominant issuer at max_issuer_weight (0.40) and then re-normalized across all issuers — which handed the capped excess straight back whenever the other issuers were light.

With 50 receipts from one issuer and one each from two others:

	v1.0	v1.1
Weight held by the "capped" issuer	87%	40%
Aggregate score	0.90	0.52

The cap only bound when the field was already balanced — precisely the case where a cap isn't needed. An issuer that is chatty, compromised, or simply wired to emit more receipts could still decide an agent's trust alone, which is the one thing step 5 exists to prevent.

The fix

Redistribute a capped issuer's excess to the uncapped issuers, and apply:

effective_cap = max(max_issuer_weight, 1 / issuer_count)

since a cap below 1/n cannot be satisfied — with two issuers, both cannot sit under 0.40.

The vectors already knew

agg-006 was written to assert exactly this intent — "4 good receipts from A cannot dominate 1 bad receipt from B" — and could not pass under v1.0. It passes under v1.1 unchanged. That's the clearest evidence available that the vector recorded the intent and the algorithm had drifted from it.

Two other vectors were repaired:

• agg-003 contradicted itself: its _explanation field worked through the arithmetic, caught itself mid-sentence ("wait let me recalculate"), and concluded 0.5 — while expected still said 0.4. It was already superseded by agg-003-corrected, which now carries the agg-003 id.
• agg-008 recomputed from unrounded intermediate weights: 0.917 → 0.918.

Three added: agg-009 (redistribution), agg-010 (the 1/n floor), agg-011 (single issuer, nobody to redistribute to).

All eleven now pass on their own terms, and the known-divergence scaffolding I added in #57 is gone.

Migration

A v1.0 implementation produces different scores wherever one issuer exceeds the cap while the others are light. Step 5 carries the warning inline and CHANGELOG.md repeats it. I did not touch max_issuer_weight, the decay half-life, or negative-signal amplification — only how the cap is applied.

Worth flagging: this sits close to the issuer-weight-normalization method docs/patent-strategy.md names as patent-pending, so the published algorithm matching its published intent likely matters beyond engineering.

194 tests, Python 19, AGT parity green.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.