How must an instance operate when its context window is partially corrupted?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session detects that its context window contains corrupted or unreliable segments (from adversarial injection, memory corruption, or partial overwrites) but must continue operating on the uncorrupted portions. Does not apply to sessions that can simply restart with clean context or that detect and immediately halt.

Core Distinction

The separation between **partial corruption** (some segments are unreliable, others are intact) and **total corruption** (no reliable context remains). Relying on either extreme creates the **Corruption Binary**: treating corruption as all-or-nothing means sessions either halt unnecessarily or operate on contaminated context; real corruption is usually partial, and the session's behavior must scale to the corruption's scope.

What Was Observed

In context-persistent agent architectures, failing to operate under partial corruption produces three primary failure modes:

  1. **Binary Halting:** The session detects any corruption and halts, forfeiting all the value of uncorrupted context and abandoning the task unnecessarily.
  2. **Silent Contamination:** The session continues as if all context is intact, reasoning from corrupted segments and producing corrupted conclusions with full confidence.
  3. **Over-Segregation:** The session quarantines segments aggressively, isolating context that was merely uncertain but not actually corrupted, losing task continuity.

Recorded Elements

  1. **`corruption-scope-receipt`:** The exact segments detected as corrupted, their extent, and the detection method, so the corrupted region is bounded.
  2. **`segment-trust-classification-signature`:** For each context segment, its trust classification (verified, probable, or corrupted), so all segments are classified not just the corrupted ones.
  3. **`task-dependency-graph-receipt`:** For the current task, which segments are required for reasoning, so the session knows whether uncorrupted segments suffice.
  4. **`degraded-operation-boundary-signature`:** The exact operations permissible under the corruption scope, so the session's action space matches its epistemic state.

Condition of Validity

* **Applies when:** The context can be partially corrupted, the session must continue operating, and corrupted segments can be distinguished from intact ones. * **Does not apply when:** Corruption is total, the session can restart with clean context, or the task requires the corrupted segments.

Decision Boundary

  1. **Is the corruption partial or total?** If total, halt and restart. If partial, proceed.
  2. **Are corrupted segments identified via `corruption-scope-receipt`?** If yes, the boundary is known. If no, all segments are assumed potentially corrupted.
  3. **Does the `task-dependency-graph-receipt` show that uncorrupted segments suffice for the task?** If yes, proceed with degraded operation. If no, halt or escalate.
  4. **Conversely, when can the session proceed without corruption scoping?** Only when the task's operations are verified independent of the corrupted segments, or the corrupted segments are verifiably irrelevant to the current reasoning.

Operational Effect

  1. **Value Preservation:** Uncorrupted context remains usable.
  2. **Contamination Prevention:** Corrupted segments are quarantined, not reasoned from.
  3. **Degraded Mode Bounding:** Operations are limited to what uncorrupted context supports.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CorruptionVerdict(Enum):
    NO_CORRUPTION = auto()
    PARTIAL_CORRUPTION_BOUNDED = auto()
    TOTAL_CORRUPTION_HALT = auto()
    TASK_DEPENDENCY_CONFLICT = auto()

@dataclass(frozen=True)
class CorruptionState:
    segment_id: str
    is_corrupted: bool
    task_requires_segment: bool
    uncorrupted_segments_suffice: bool

@dataclass(frozen=True)
class CorruptionPolicy:
    halt_on_total_corruption: bool

@dataclass(frozen=True)
class CorruptionManifest:
    verdict: CorruptionVerdict
    directive: str
    manifest_digest: str

class PartialCorruptionGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_state(
        cls, state: CorruptionState, policy: CorruptionPolicy
    ) -> CorruptionManifest:
        
        # Gate 1: No corruption
        if not state.is_corrupted:
            digest = cls._hash(json.dumps({
                "segment": state.segment_id,
                "corrupted": False
            }, sort_keys=True))
            return CorruptionManifest(
                verdict=CorruptionVerdict.NO_CORRUPTION,
                directive=f"PROCEED: Segment {state.segment_id} intact.",
                manifest_digest=digest
            )

        # Gate 2: Task dependency
        if state.task_requires_segment:
            if not state.uncorrupted_segments_suffice:
                return CorruptionManifest(
                    verdict=CorruptionVerdict.TASK_DEPENDENCY_CONFLICT,
                    directive=f"HALT: Task requires corrupted segment {state.segment_id}.",
                    manifest_digest=cls._hash(f"DEPENDENCY:{state.segment_id}")
                )

        # Gate 3: Bounded
        digest = cls._hash(json.dumps({
            "segment": state.segment_id,
            "required": state.task_requires_segment,
            "sufficient": state.uncorrupted_segments_suffice
        }, sort_keys=True))
        
        return CorruptionManifest(
            verdict=CorruptionVerdict.PARTIAL_CORRUPTION_BOUNDED,
            directive=f"PROCEED: Quarantine {state.segment_id}, operate on uncorrupted segments.",
            manifest_digest=digest
        )