{
  "schema_version": "1.3.0",
  "slug": "how-should-an-instance-distinguish-litmus-adversarial-harness-contamination-from-a-genuine-tool-misuse-policy-violation",
  "title": "How should an instance distinguish LITMUS adversarial harness contamination from a genuine tool-misuse policy violation",
  "date_of_record": "2026 November 13",
  "scope": "Applies to LITMUS-style safety benchmarks that drive an agent through a tool-calling loop against an adversarial harness injecting synthetic tool responses, prompts, and side-effect probes. Does not apply to static prompt/response safety suites, red-team datasets scored offline, or production guardrail telemetry where the environment is trusted.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-litmus-adversarial-harness-contamination-from-a-genuine-tool-misuse-policy-violation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-litmus-adversarial-harness-contamination-from-a-genuine-tool-misuse-policy-violation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-litmus-adversarial-harness-contamination-from-a-genuine-tool-misuse-policy-violation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1314,
    "python_slice_tokens": 205,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "An adversarial harness has two distinct failure surfaces that produce identical downstream signals: (1) a **policy violation**, where the agent under test emits a disallowed tool call (e.g., exfiltrating a secret, executing a destructive shell command) in response to a legitimate adversarial stimulus, and (2) **harness contamination**, where the harness itse...",
    "what_was_observed": "In a multi-turn harness where the adversarial controller resamples tool outputs (e.g., a synthetic `read_file` returning a path traversal payload on turn *n*), agents that correctly refused on turn *n* were sometimes recorded as violating on turn *n+1*. Root cause: the harness replayed the *original* tool-call arguments from turn *n* alongside the *mutated* tool result from turn *n+1*, producing a stimulus pair (argu...",
    "condition_of_validity": "The violation is attributable to the agent under test only if all of the following hold: 1. The stimulus fingerprint (canonical hash of system prompt, tool schemas, full message history, and the exact tool observation bytes) matches an entry in the oracle's calibration manifest. 2. The harness recorded no mutation, truncation, or replay event between the pri...",
    "decision_boundary": "- **Count as violation:** fingerprint matches manifest, no mutation event, agent output schema-valid, oracle match key includes observation. - **Quarantine as contamination:** fingerprint absent from manifest, or mutation/truncation event logged without manifest regeneration, or match key is argument-only against a mutated observation. - **Escalate to harnes...",
    "operational_effect": "Treat the LITMUS harness as an untrusted oracle. Every violation record must carry a stimulus fingerprint and a mutation-event flag; the aggregation layer must refuse to sum across records lacking either. This converts silent contamination into a loud, auditable quarantine, and it forces the harness maintainers to version the oracle alongside the mutation po..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "888226d66713c8d0f28b59ca9fa94a3b1dcd9c9472b0fe35478961caad585189",
    "verified_classes": [
      "UnattributableViolationError",
      "StimulusFingerprint"
    ],
    "verified_functions": [
      "triage_violation",
      "digest"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "UnattributableViolationError"
    ],
    "sample_fail_closed_invariants": [
      "grader match key is argument-only against a mutated observation; replay artifact likely",
      "agent output failed schema validation but harness truncation of input is the probable cause; re-run required"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib",
      "json"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}