{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-label-laundering-across-a-rag-retrieval-boundary-that-re-materializes-tainted-content-as-a-fresh-document",
  "title": "How does an instance detect label-laundering across a RAG retrieval boundary that re-materializes tainted content as a fresh document",
  "date_of_record": "2026 November 12",
  "scope": "Applies to agent runtimes that propagate dynamic information-flow labels (taint) through tool-call arguments, tool results, and retrieval-augmented context injection, where retrieved chunks are re-indexed or re-chunked between the point of origin and the point of consumption. Does not apply to static, compile-time label systems or to runtimes where retrieval and generation share a single address space with no serialization boundary.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-label-laundering-across-a-rag-retrieval-boundary-that-re-materializes-tainted-content-as-a-fresh-document.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-label-laundering-across-a-rag-retrieval-boundary-that-re-materializes-tainted-content-as-a-fresh-document.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-label-laundering-across-a-rag-retrieval-boundary-that-re-materializes-tainted-content-as-a-fresh-document.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1989,
    "python_slice_tokens": 303,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **label propagation across a call** and **label preservation across a re-materialization**. A tool call is a discrete event: the runtime can attach a taint set to the request, observe the response, and union the origin labels of the callee into the result. This is straightforward because the call graph is explicit and ...",
    "what_was_observed": "In an agent that used a shared document store for both user uploads and its own tool outputs, a tool call returned a record derived from an untrusted web fetch. The runtime correctly tainted the tool result with `origin:web_untrusted`. The agent then summarized that result and wrote the summary back into the document store as a new note — a legitimate, expected action. The write path did not accept a taint parameter,...",
    "condition_of_validity": "The invariant — *a label attached to a content artifact at origin is present on every derivative artifact consumed by the model* — holds only when three conditions are met simultaneously: 1. **Label carriage at every serialization boundary.** Every store, queue, cache, and index that accepts content must accept and persist the taint set as metadata, and ever...",
    "decision_boundary": "The operational decision is whether to treat an unlabeled artifact as *clean* or as *unknown*. The default in most runtimes is clean, because the type system has no third state and because treating unknown as tainted would taint everything (most content in a real store has no provenance). The boundary rule that survives contact with production is: - If the a...",
    "operational_effect": "The practical consequence is that taint tracking must be enforced at the *storage and retrieval layer*, not only at the orchestration layer. Concretely: the document store schema needs a taint column, the write API needs a required taint argument, the chunker needs to propagate the parent's taint to every chunk, the retriever needs to return taint with each ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "fda5d191fb33e3be7366ceba043ab11bb418901f4b79eaa4555bbb26af39af2e",
    "verified_classes": [
      "TaintLaunderingError",
      "Artifact"
    ],
    "verified_functions": [
      "join_taint",
      "verify_retrieval_label",
      "assemble_context",
      "__init__"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintLaunderingError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}