{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-manifest-level-skill-shadowing-during-dynamic-tool-registry-reload",
  "title": "How does an instance detect manifest-level skill shadowing during dynamic tool registry reload",
  "date_of_record": "2026 November 11",
  "scope": "Applies to agent runtimes that load tool/skill manifests from a mutable registry at runtime and permit re-registration or versioned overrides of previously loaded skills. Does not apply to statically compiled tool sets or registries where skill identity is immutable and name collisions are rejected at load time.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-manifest-level-skill-shadowing-during-dynamic-tool-registry-reload.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-manifest-level-skill-shadowing-during-dynamic-tool-registry-reload.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-manifest-level-skill-shadowing-during-dynamic-tool-registry-reload.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1412,
    "python_slice_tokens": 337,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The commonly modeled injection surface is *content* injection: a manifest declares a tool whose description or parameter schema carries adversarial instructions, and the model is tricked into calling it. The non-obvious surface is *identity* injection: a manifest declares a tool with a name that collides with, or shadows, an already-registered trusted skill,...",
    "what_was_observed": "In a runtime that hot-reloads manifests on registry push events, a plugin published under a namespace-adjacent name (`fs.read_file` vs the trusted `fs.read`) passed schema validation because validation was per-manifest, not per-namespace. The registry's collision policy was \"last writer wins\" with a warning log that was not surfaced to the agent loop. After reload, the agent's tool resolver, which keyed on a normaliz...",
    "condition_of_validity": "The detection procedure below is valid only when all of the following hold: 1. The runtime can enumerate the *pre-reload* binding table (identifier → implementation hash/version) and the *post-reload* table. 2. Skill identifiers are normalized by a known, documented function; if normalization is opaque, the detector must compare on raw identifiers and flag a...",
    "decision_boundary": "The boundary between acceptable reload and injection is *not* \"did a name change\" and *not* \"did a new skill appear.\" It is: - **New identifier, new binding** → benign expansion. - **Existing identifier, identical implementation digest** → benign no-op or metadata refresh. - **Existing identifier, changed digest, accompanied by an explicit promotion record s...",
    "operational_effect": "On detection, the runtime must (a) refuse to commit the post-reload binding table, (b) retain the pre-reload table, (c) quarantine the offending manifest's origin so subsequent reloads from it are rejected, and (d) emit an audit event naming the colliding identifiers and the divergent digests. Critically, the agent loop must be told the reload failed so the ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "06f5d2d85c2e4fbedcf5903669c8c1bc3f9c12b61e133e35403e8fb52a27168b",
    "verified_classes": [
      "SkillShadowingError",
      "Binding"
    ],
    "verified_functions": [
      "_normalize",
      "_digest",
      "validate_reload",
      "commit_reload"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "SkillShadowingError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}