{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-treat-taint-aware-sink-blocking-as-a-hard-invariant-rather-than-a-best-effort-filter",
  "title": "In what scenarios must an instance treat taint-aware sink blocking as a hard invariant rather than a best-effort filter",
  "date_of_record": "2026 November 11",
  "scope": "Applies to agent runtimes that propagate taint labels from untrusted prompt sources (retrieved documents, tool outputs, web fetches, user-supplied files) to downstream tool invocations, and that enforce blocking at \"sinks\" (shell exec, file write, HTTP POST, outbound messaging, credential use). Does not apply to systems where all tool inputs are operator-authored and no untrusted data enters the tool-call graph, nor to purely advisory classifiers that never gate execution.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-taint-aware-sink-blocking-as-a-hard-invariant-rather-than-a-best-effort-filter.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-taint-aware-sink-blocking-as-a-hard-invariant-rather-than-a-best-effort-filter.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-taint-aware-sink-blocking-as-a-hard-invariant-rather-than-a-best-effort-filter.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1732,
    "python_slice_tokens": 210,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between **taint as a label on data** and **taint as a property of the reachable call graph from a source to a sink**. Most implementations get the first right and the second wrong. Labeling a string as `UNTRUSTED` is cheap; correctly computing whether *any* path from that labeled value reaches a sink without an intervening dec...",
    "what_was_observed": "In a runtime that propagated taint through a Python object graph, three concrete leaks were reproduced: 1. **Template interpolation laundering.** A tainted document was passed into a Jinja-style template as a context variable. The rendered output was a new `str` constructed by the template engine, which had no taint provenance. The rendered string was then passed to `shell_exec`. The taint engine saw an untainted `st...",
    "condition_of_validity": "The invariant \"no tainted value reaches a sink\" holds only under the following conditions, and the enforcement is invalid if any is violated: - **Provenance must be attached to values, not variables.** Rebinding a variable, copying a field, or returning from a function must carry the label. If your taint model is a set of variable names, it is already broken...",
    "decision_boundary": "The operational question is: **when does a taint violation justify halting the task versus degrading gracefully?** - **Hard halt** when the sink is irreversible or externally visible: outbound network calls, credential use, `rm`/`mv`/`chmod`, message sends, payments. A taint violation here is a potential exfiltration or destructive action; the correct respon...",
    "operational_effect": "Enforcing the invariant as a hard gate changes the runtime in three measurable ways: 1. **Tool authors must declare sinks, not just capabilities.** A tool's manifest gains a `sinks: [...]` field enumerating every external effect, and the runtime refuses to register a tool whose declared sinks are incomplete relative to its imports. This is enforceable with a..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "5aada1e91e2656a2f731555b8d2c650f59e2e1e35ee57632de2caae980ddce44",
    "verified_classes": [
      "TaintSinkViolation",
      "Sink"
    ],
    "verified_functions": [
      "enforce_sink",
      "run_tool_call"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "TaintSinkViolation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}