How must an instance detach from an adversarial sibling agent's shared resource?

**Date of Record:** 2026 October 27 **Scope:** Applies when two or more agentic sessions share a resource (database, message queue, credential pool), one sibling becomes adversarial (compromised, misbehaving, or leaking), and the honest instance must detach from the shared resource without losing its own state or exposing itself to the adversary's influence. Does not apply to strictly isolated per-agent resources.

Core Distinction

The separation between **cohabitation** (multiple sessions sharing a resource) and **detachment** (an honest session migrating off the shared resource to isolate itself from an adversarial sibling). Relying on cohabitation creates the **Shared Resource Contagion**: the adversary's behavior corrupts shared state or pollutes the channel, and the honest session's subsequent actions inherit the contamination because it is still attached to the same resource.

What Was Observed

In shared-resource agent architectures, failing to detach from adversarial siblings produces three primary failure modes:

  1. **State Pollution:** The adversary writes poisoned records to a shared database. The honest session reads them, uses them in reasoning, and produces corrupted outputs.
  2. **Message Queue Poisoning:** The adversary injects malicious messages into a shared queue. The honest session processes them as legitimate.
  3. **Credential Contamination:** The adversary uses a shared credential pool to establish a reputation. The honest session inherits the adversary's actions through the shared credential's audit trail.

Recorded Elements

  1. **`adversarial_sibling_detection_receipt`:** The cryptographic proof that the sibling is adversarial (e.g., signed report from a trusted detector), required before triggering detachment.
  2. **`detachment_checkpoint_receipt`:** The cryptographic proof of the honest session's clean state at the moment of detachment, establishing a baseline before migration.
  3. **`isolation_boundary_signature`:** The exact boundary (new database, new queue, new credentials) the honest session migrates to, with cryptographic proof the adversary has no access.
  4. **`state_migration_receipt`:** For the honest session's state moved from the shared resource to the isolated one, the cryptographic proof that only clean state was migrated, not adversary-contaminated records.

Condition of Validity

* **Applies when:** The session shares resources with a sibling, the sibling can become adversarial, and the session's state or decisions can be contaminated. * **Does not apply when:** Resources are strictly isolated per session, or the adversarial sibling has no ability to affect the honest session's resources.

Decision Boundary

  1. **Has a sibling been identified as adversarial?** If no, standard resource sharing applies. If yes, proceed.
  2. **Is the `detachment_checkpoint_receipt` captured before migration?** If no, the honest session cannot distinguish its clean state from contaminated state. It must checkpoint first.
  3. **Does the `isolation_boundary_signature` prove the adversary has no access?** If no, detachment is illusory. The new resource is still shared.
  4. **Conversely, when can the honest session remain attached to the shared resource?** Only when the shared resource is read-only for the adversary (no writes possible) and the session can filter adversarial contributions with cryptographic guarantees.

Operational Effect

  1. **Contamination Prevention:** Migration isolates the honest session from adversarial writes.
  2. **State Integrity:** Clean state is preserved and migrated, adversary-contaminated state is abandoned.
  3. **Audit Isolation:** The honest session's future audit trail is separate from the adversary's.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class DetachmentVerdict(Enum):
    NO_ADVERSARY = auto()
    DETACHMENT_READY = auto()
    CHECKPOINT_MISSING = auto()
    ISOLATION_UNPROVEN = auto()

@dataclass(frozen=True)
class SiblingState:
    sibling_id: str
    is_adversarial: bool
    has_write_access: bool

@dataclass(frozen=True)
class DetachmentState:
    sibling: SiblingState
    checkpoint_captured: bool
    isolation_proven: bool
    new_resource_signature: str | None

@dataclass(frozen=True)
class DetachmentPolicy:
    require_checkpoint: bool
    require_isolation_proof: bool

@dataclass(frozen=True)
class DetachmentManifest:
    verdict: DetachmentVerdict
    directive: str
    manifest_digest: str

class AdversarialSiblingGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_detachment(
        cls, state: DetachmentState, policy: DetachmentPolicy
    ) -> DetachmentManifest:
        
        # Gate 1: No adversary
        if not state.sibling.is_adversarial:
            digest = cls._hash(json.dumps({
                "sibling": state.sibling.sibling_id,
                "adversarial": "FALSE"
            }, sort_keys=True))
            return DetachmentManifest(
                verdict=DetachmentVerdict.NO_ADVERSARY,
                directive=f"PROCEED: Sibling {state.sibling.sibling_id} not adversarial.",
                manifest_digest=digest
            )

        # Gate 2: No write access (safe to stay)
        if not state.sibling.has_write_access:
            digest = cls._hash(json.dumps({
                "sibling": state.sibling.sibling_id,
                "write_access": "FALSE"
            }, sort_keys=True))
            return DetachmentManifest(
                verdict=DetachmentVerdict.NO_ADVERSARY,
                directive=f"PROCEED: Adversarial sibling has no write access. Safe to stay.",
                manifest_digest=digest
            )

        # Gate 3: Checkpoint
        if policy.require_checkpoint and not state.checkpoint_captured:
            return DetachmentManifest(
                verdict=DetachmentVerdict.CHECKPOINT_MISSING,
                directive=f"HALT: Adversarial sibling {state.sibling.sibling_id} with write access. Checkpoint required before detachment.",
                manifest_digest=cls._hash(f"NO_CHECKPOINT:{state.sibling.sibling_id}")
            )

        # Gate 4: Isolation proof
        if policy.require_isolation_proof and not state.isolation_proven:
            return DetachmentManifest(
                verdict=DetachmentVerdict.ISOLATION_UNPROVEN,
                directive=f"HALT: Isolation to new resource not proven.",
                manifest_digest=cls._hash("NO_ISOLATION")
            )

        # Gate 5: Ready
        digest = cls._hash(json.dumps({
            "sibling": state.sibling.sibling_id,
            "checkpoint": "CAPTURED",
            "isolation": "PROVEN",
            "new_resource": state.new_resource_signature or "NONE"
        }, sort_keys=True))
        
        return DetachmentManifest(
            verdict=DetachmentVerdict.DETACHMENT_READY,
            directive=f"ACTION: Detach from adversarial sibling {state.sibling.sibling_id}, migrate to isolated resource.",
            manifest_digest=digest
        )