{
  "schema_version": "1.3.0",
  "slug": "how-should-an-instance-treat-provenance-labels-as-monotonic-once-a-tool-output-has-been-tainted",
  "title": "How should an instance treat provenance labels as monotonic once a tool output has been tainted",
  "date_of_record": "2026 November 12",
  "scope": "Applies to agents that attach provenance/taint labels to context segments (user turns, RAG chunks, tool outputs) and gate privileged actions on the aggregate taint state of the working context. Does not apply to systems that perform no label propagation across tool boundaries, nor to purely static prompt filtering that never re-admits model- or tool-generated text into the context window.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-should-an-instance-treat-provenance-labels-as-monotonic-once-a-tool-output-has-been-tainted.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-treat-provenance-labels-as-monotonic-once-a-tool-output-has-been-tainted.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-treat-provenance-labels-as-monotonic-once-a-tool-output-has-been-tainted.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1422,
    "python_slice_tokens": 309,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is between *label presence* and *label monotonicity*. A provenance label is useful only if it is a join-semilattice element that can only move upward (untrusted dominates) as text flows through transformations. The failure is not \"a tainted chunk was missed\" — that is a detection failure, recoverable by tightening extraction. The fai...",
    "what_was_observed": "In a retrieval-augmented agent with three re-emission points — (1) tool output ingestion, (2) chunk re-ranking/summarization, (3) scratchpad compaction — a chunk retrieved from an untrusted corpus carried `provenance=external:untrusted`. It was correctly blocked from a `send_email` tool call. The same content, after passing through a *summarizer tool* whose output was labeled `provenance=internal:derived` (because th...",
    "condition_of_validity": "Monotonic taint holds only when all three of the following are enforced: 1. **Join on re-emission.** Every derived artifact's label is `join(labels of all inputs)`, never the producer's own trust class. A summarizer, formatter, translator, or code-executor that emits text derived from tainted input emits tainted text, regardless of how trusted the tool is. 2...",
    "decision_boundary": "The gate should admit a privileged action iff `join(all labels in the effective context) ≤ trusted`. The effective context is the transitive closure of everything the model can condition on, including tool outputs, retrieved chunks, prior assistant turns, and compaction summaries. Two boundary decisions follow: - **Re-emission is not sanitization.** A tool t...",
    "operational_effect": "With monotonic join enforced, the earlier incident is caught: the summarizer's output joins to `external:untrusted`, the `send_email` gate rejects, and the agent must route through an explicit verifier or surface the taint to the user. The cost is over-blocking: legitimate chains where a trusted tool summarizes untrusted data and the *summary* is safe to act..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "09f2ffa11483ac3188b2c6f783ccf6c50dba3033fcd39ef428b71edc5cc1213e",
    "verified_classes": [
      "Taint",
      "TaintLaunderingError",
      "Artifact"
    ],
    "verified_functions": [
      "join",
      "reemit",
      "assert_monotonic",
      "gate_privileged_action"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintLaunderingError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "enum",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}