{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-treat-a-tool-result-as-tainted-for-the-lifetime-of-a-memory-write-and-when-may-taint-be-discharged",
  "title": "In what scenarios must an instance treat a tool result as tainted for the lifetime of a memory write, and when may taint be discharged?",
  "date_of_record": "2026 November 13",
  "scope": "Applies to agents that read external content (tool outputs, fetched pages, user-supplied files) and persist derived state into memory or downstream tool calls. Does not apply to synthetic test fixtures with a signed provenance channel, nor to pure computation over agent-authored literals.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-a-tool-result-as-tainted-for-the-lifetime-of-a-memory-write-and-when-may-taint-be-discharged.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-a-tool-result-as-tainted-for-the-lifetime-of-a-memory-write-and-when-may-taint-be-discharged.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-a-tool-result-as-tainted-for-the-lifetime-of-a-memory-write-and-when-may-taint-be-discharged.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1300,
    "python_slice_tokens": 288,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The boundary that matters is not \"trusted vs. untrusted input\" — that framing collapses at the first tool call. The operative distinction is **provenance propagation through derivation** versus **provenance reset through re-assertion**. A tool result is tainted when it entered the context through a channel the principal did not author. That taint does **not*...",
    "what_was_observed": "A retrieval tool returned a document containing an instruction-shaped string embedded inside a code comment. The agent summarized the document into a memory record. The summary omitted the instruction verbatim but preserved its *semantic residue*: a note that \"the deployment target should be switched to staging-2 before the next write.\" A later turn read that memory record, treated it as agent-authored context (becau...",
    "condition_of_validity": "Taint may be discharged at a boundary only if **all** of the following hold: 1. The re-assertion is performed by a mechanism whose inputs do not transit the tainted channel (a validator reading the raw value, not the agent's paraphrase of it). 2. The re-assertion is *total* over the value's use — every field that will later influence an action is covered. 3....",
    "decision_boundary": "- **Summarize → memory:** propagate taint. The summary is derived. - **Validate against schema → typed value:** discharge, *if* the validator reads the raw tool output. - **Human confirms a specific action:** discharge for that action only, not for the memory record. - **Agent re-states in its own words:** propagate. Paraphrase is derivation. - **Cross-tool ...",
    "operational_effect": "Enforcing propagation at the memory-write boundary converts a silent laundering path into an explicit, auditable one. The cost is that memory records accumulate taint markers and downstream actions must check them, which surfaces legitimate cases where an action should have required confirmation anyway. The benefit is that the injection's blast radius is bou..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "c739f383ba2a22b8f13b959eb83ff7d247d96a1f0649eb2c4dad83980570d1cd",
    "verified_classes": [
      "TaintDischargeError",
      "Provenance",
      "MemoryRecord"
    ],
    "verified_functions": [
      "write_memory",
      "discharge_via_validator",
      "build_tool_call_args",
      "derive"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "TaintDischargeError"
    ],
    "sample_fail_closed_invariants": [
      "discharge rejected: validator must read raw tool output and cover all fields"
    ],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}