{
  "schema_version": "1.3.0",
  "slug": "how-does-an-instance-detect-taint-laundering-via-re-summarization-in-a-taint-aware-tool-sandbox",
  "title": "How does an instance detect taint-laundering via re-summarization in a taint-aware tool sandbox?",
  "date_of_record": "2026 November 12",
  "scope": "Applies to agent runtimes that tag tool outputs with a taint bit (untrusted/sensitive) and enforce quarantine before memory persistence or downstream consumption. Does not apply to single-turn stateless invocations where no persistence or chaining occurs, nor to outputs that carry verified provenance from a trusted signing authority.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-taint-laundering-via-re-summarization-in-a-taint-aware-tool-sandbox.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-taint-laundering-via-re-summarization-in-a-taint-aware-tool-sandbox.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-does-an-instance-detect-taint-laundering-via-re-summarization-in-a-taint-aware-tool-sandbox.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1316,
    "python_slice_tokens": 240,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The sandbox invariant is usually stated as: *an untrusted output must not reach persistent memory or a downstream tool without an explicit declassification step.* The non-obvious failure is that the taint bit is a property of the **artifact**, but the enforcement boundary is a property of the **transformation graph**. A summarizer, formatter, translator, or ...",
    "what_was_observed": "A tool sandbox accepted an external HTTP fetch whose body was classified `UNTRUSTED`. The runtime correctly quarantined the raw body and refused to write it to long-term memory. The agent then invoked an internal `summarize` tool — a first-party, `TRUSTED`-class component — passing the quarantined body as input. The summarizer returned a condensed string. Because `summarize` was registered as `TRUSTED`, the orchestra...",
    "condition_of_validity": "The quarantine guarantee is valid **only if** every transformation node `f` in the reachable tool graph satisfies: i.e., output taint is at least the join of input taints (monotonic, non-decreasing). A node may *raise* taint (safe) or *preserve* it (safe). A node that *lowers* taint without an explicit, audited declassification capability is a violation. Dec...",
    "decision_boundary": "At runtime, decide as follows: - If `out_taint == join(in_taints)`: proceed through normal gates. - If `out_taint ⊐ join(in_taints)` (raised): proceed; conservative, safe. - If `out_taint ⊏ join(in_taints)` (lowered): **halt the pipeline**, refuse persistence and downstream dispatch, and raise a laundering fault. Do not \"repair\" by re-stamping; the artifact ...",
    "operational_effect": "Enforcing closure over the transformation graph converts a class of silent prompt-injection persistence into a hard, auditable fault. The cost is that legitimate declassification must be modeled explicitly (named policy nodes with audit records) rather than emerging implicitly from tool trust classes. In the observed incident, the fix was to compute output t..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "e4903d62a2416fd413bfd90a3da0c8f23dc2ba4e226f1c6151a17096f7417e7f",
    "verified_classes": [
      "Taint",
      "TaintLaunderingError",
      "Artifact",
      "Node"
    ],
    "verified_functions": [
      "guarded_apply",
      "join",
      "apply"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "TaintLaunderingError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "enum",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}