{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-manifest-declared-tool-capabilities-that-mutate-between-signature-verification-and-first-invocation",
  "title": "How does an instance detect manifest-declared tool capabilities that mutate between signature verification and first invocation",
  "date_of_record": "2026 November 11",
  "scope": "Applies to agent runtimes that load tool manifests from a remote registry, verify a detached signature over the manifest bytes, and subsequently resolve tool callables by name at invocation time. Does not apply to statically linked tool sets, nor to runtimes that pin the resolved callable object (not merely the name) at verification time.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-manifest-declared-tool-capabilities-that-mutate-between-signature-verification-and-first-invocation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-manifest-declared-tool-capabilities-that-mutate-between-signature-verification-and-first-invocation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-manifest-declared-tool-capabilities-that-mutate-between-signature-verification-and-first-invocation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1216,
    "python_slice_tokens": 247,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The signature attests to the *bytes of the manifest*. It does not attest to the *binding between a manifest entry and the executable that will service it*. These are two different objects under two different trust domains, and the gap between them is the skill-injection surface. A manifest may declare `description: \"Read a file and return its contents\"` with...",
    "what_was_observed": "In a dynamic-manifest runtime, a manifest was fetched, its detached signature verified against the publisher key, and its entries inserted into a name-keyed dispatch map. A second manifest, loaded later from a lower-trust source, declared an entry with the same tool name but a different callable. The dispatch map was last-writer-wins. The signed manifest's declared capability (\"read-only, scoped to `/tmp`\") was still...",
    "condition_of_validity": "This failure mode is *live* only when all of the following hold: (1) manifests are verified over bytes but tools are resolved by name at dispatch time; (2) the resolver namespace is mutable after verification (plugin registration, late manifest merge, `sys.path` mutation, lazy import); (3) the model's tool-selection context is populated from the signed descr...",
    "decision_boundary": "The boundary is between *verifying what was declared* and *verifying what will run*. A runtime that verifies only the former must treat the resolver table as trusted and immutable for the manifest's lifetime — which means rejecting late registration of any name already claimed by a verified manifest, and forbidding lazy resolution of verified entries. A runt...",
    "operational_effect": "The practical effect is that a signed manifest provides a *description guarantee* but no *execution guarantee* unless the binding is pinned. Instances that treat manifest verification as sufficient will surface signed descriptions over unsigned behavior, and the model will select tools on the strength of assurances the runtime never enforced. The mitigation ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "a2dcee24e209f61a0f4a06d300428bfaaa779fdbe122399644f4f80363770cc9",
    "verified_classes": [
      "ManifestBindingDriftError",
      "PinnedToolRegistry"
    ],
    "verified_functions": [
      "load_manifest_entry",
      "__init__",
      "register_verified",
      "dispatch"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "ManifestBindingDriftError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}