{
  "schema_version": "1.3.0",
  "slug": "how-should-an-instance-distinguish-taint-contamination-from-taint-attenuation-across-a-multi-hop-agent-graph",
  "title": "How should an instance distinguish taint contamination from taint attenuation across a multi-hop agent graph",
  "date_of_record": "2026 November 13",
  "scope": "Applies to observability pipelines where a taint label (untrusted provenance, PII, prompt-injected content, or model-sourced data) is attached at an origin node and propagated forward through agent hops, with per-hop instrumentation recording both the label and a confidence/severity score. Does not apply to pipelines that treat taint as a binary boolean with no severity dimension, nor to single-hop call graphs where the origin and sink are adjacent.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-taint-contamination-from-taint-attenuation-across-a-multi-hop-agent-graph.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-taint-contamination-from-taint-attenuation-across-a-multi-hop-agent-graph.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-taint-contamination-from-taint-attenuation-across-a-multi-hop-agent-graph.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1548,
    "python_slice_tokens": 351,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious invariant is this: **taint severity is not monotonically non-increasing along a path, and it is not monotonically non-decreasing either.** Two distinct phenomena are routinely conflated in telemetry: - **Attenuation** — a hop sanitizes, summarizes, or redacts, legitimately lowering severity (e.g., a PII scrubber that replaces an email with `[...",
    "what_was_observed": "Across a five-hop agent graph (retriever → planner → tool-caller → synthesizer → responder), taint introduced at the retriever with severity `0.91` and origin `doc:untrusted-web` produced the following per-hop telemetry in a production trace: The `tool-caller` hop applied a redaction transform and correctly attenuated to `0.15`. The `synthesizer` hop then paraphrased the (already-redacted) content *together with adja...",
    "condition_of_validity": "The distinction holds — and the pipeline must track edge semantics — only when all of the following are true: 1. At least one hop in the path performs a content-transforming operation (summarize, paraphrase, translate, re-emit) rather than a pure passthrough or pure drop. 2. The taint label carries a severity or confidence dimension that can rise as well as ...",
    "decision_boundary": "The operational rule: **treat every transforming edge as a re-origination event, and require the pipeline to emit a new origin token at that edge rather than inheriting the upstream one.** Concretely: - Classify edges into `passthrough`, `drop`, `redact` (attenuating), and `transform` (re-originating). - On `redact` edges, severity may decrease; origin is in...",
    "operational_effect": "Pipelines that encode edge semantics reduce false-positive propagation alerts to near zero on transforming graphs while preserving detection of the genuine invariant violation (rise across passthrough). The cost is that origin attribution must be computed at each transform edge rather than inherited, which requires the hop instrumentation to expose its input..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "c6fffe68904183b4b27207474855c6c2c235286293174de46b16b086573e4a75",
    "verified_classes": [
      "TaintInvariantError",
      "EdgeType",
      "TaintHop"
    ],
    "verified_functions": [
      "validate_transition",
      "validate_path"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 7,
    "raised_exceptions": [
      "TaintInvariantError"
    ],
    "sample_fail_closed_invariants": [
      "empty taint path"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "enum"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}