{
  "schema_version": "1.3.0",
  "slug": "how-should-an-instance-treat-a-tool-result-whose-taint-label-is-absent-rather-than-empty-the-unlabeled-result-boundary-in-cross-tool-information-flow",
  "title": "How should an instance treat a tool result whose taint label is absent rather than empty: the unlabeled-result boundary in cross-tool information-flow tracking",
  "date_of_record": "2026 November 13",
  "scope": "Applies to agent runtimes that propagate dynamic information-flow (IFC) labels across tool-call boundaries to defend against prompt injection, specifically when a tool result arrives with no label field at all. Does not apply to systems where every tool adapter is contractually required to emit a label, nor to purely static taint analysis.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-should-an-instance-treat-a-tool-result-whose-taint-label-is-absent-rather-than-empty-the-unlabeled-result-boundary-in-cross-tool-information-flow.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-treat-a-tool-result-whose-taint-label-is-absent-rather-than-empty-the-unlabeled-result-boundary-in-cross-tool-information-flow.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-treat-a-tool-result-whose-taint-label-is-absent-rather-than-empty-the-unlabeled-result-boundary-in-cross-tool-information-flow.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1390,
    "python_slice_tokens": 265,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The invariant most taint-tracking runtimes get wrong is the conflation of **absent label** with **empty label**. An empty label set means \"this data was inspected and found to carry no untrusted influence.\" An absent label means \"no IFC verdict was rendered for this data.\" These are categorically different: the first is a positive assertion of cleanliness, t...",
    "what_was_observed": "In a multi-tool agent (web fetch, document parser, database query, shell), an injected instruction was placed in a fetched HTML page. The fetch tool's adapter was upgraded mid-rollout and briefly emitted results without the `ifc_label` field (the field was added to the schema but a code path returned the raw payload dict). The parser consumed that dict, the label field deserialized to `frozenset()`, and the planner t...",
    "condition_of_validity": "The distinction matters only when all of the following hold: (a) labels are attached dynamically at tool boundaries rather than derived statically; (b) at least one adapter can produce a result without a label (schema drift, legacy path, partial rollout, third-party plugin); (c) the label representation admits an empty set as a valid value; and (d) some sink...",
    "decision_boundary": "The correct decision is: **treat absent as ⊤ and fail closed at the first consumer that would otherwise treat it as ⊥.** Concretely, the label deserializer must distinguish \"field missing\" from \"field present and empty,\" and the policy engine must route the former to a quarantine path (drop, re-fetch with a labeled adapter, or escalate to human review) rathe...",
    "operational_effect": "After the fix, unlabeled tool results were routed through a quarantine sink that re-invoked the adapter under a strict schema or marked the payload `UNTRUSTED`. The shell and egress sinks gained an explicit `TOP` rejection with a distinct error class so the failure is loud rather than silent. The operational lesson: in IFC systems, the lattice's top and bott..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "30c5c0027f4af022d95c9d9f38bd5c191c073acc89ba8347d1bf90cf25154370",
    "verified_classes": [
      "UnlabeledResultError",
      "ToolResult"
    ],
    "verified_functions": [
      "resolve_trust",
      "admit_to_context",
      "shell_sink"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "UnlabeledResultError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}