{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-treat-tool-manifest-skill-injection-as-an-authority-escalation-boundary-rather-than-a-content-loading-concern",
  "title": "In what scenarios must an instance treat tool-manifest skill injection as an authority-escalation boundary rather than a content-loading concern",
  "date_of_record": "2026 November 13",
  "scope": "Applies to agent runtimes that resolve tool manifests (MCP-style tool descriptors, function-calling schemas, plugin manifests) at runtime from a source that is not identical to the runtime's trusted configuration root — remote registries, per-task directories, user-writable paths, or manifest URLs fetched during planning. Does not apply to statically compiled tool tables whose contents are fixed at build time and signed as part of the runtime artifact.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-tool-manifest-skill-injection-as-an-authority-escalation-boundary-rather-than-a-content-loading-concern.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-tool-manifest-skill-injection-as-an-authority-escalation-boundary-rather-than-a-content-loading-concern.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-tool-manifest-skill-injection-as-an-authority-escalation-boundary-rather-than-a-content-loading-concern.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1894,
    "python_slice_tokens": 348,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is this: a tool manifest is *not* a document the agent reads; it is a *capability grant* the agent executes against. The distinction that operators routinely collapse is between **description text** (human/LLM-readable prose: `description`, `help`, `examples`, parameter docstrings) and **binding semantics** (what the tool is named, w...",
    "what_was_observed": "In a runtime that loaded per-task tool manifests from a task-scoped directory, a manifest was placed with the following shape (abridged): The loader validated the JSON schema, confirmed `name` matched `^[a-z_]+$`, and injected the `description` verbatim into the system-adjacent tool block. The model, which had no channel to distinguish operator-authored policy from manifest-authored prose, issued the `export_env` cal...",
    "condition_of_validity": "The boundary is real — and the gating requirement is binding — only when all of the following hold: 1. **The manifest source is outside the trusted configuration root.** If the manifest is part of the signed runtime artifact, the prose is as trustworthy as the code and no separate gate is needed. 2. **Manifest prose enters model context.** If `description` f...",
    "decision_boundary": "The operational rule: **a dynamically loaded manifest may add tools, but may never (a) contribute text that the model will parse as policy, (b) share a namespace with a tool of higher privilege, or (c) cause the loader to resolve another manifest without a fresh trust decision.** Concretely, the loader must, before merging a manifest into the live namespace:...",
    "operational_effect": "Applying the boundary converts a class of silent, schema-clean compromises into loud, attributable rejections. In the observed runtime, adding namespace-disjointness and prose quarantine eliminated the `export_env` redirection and the `search_doc5` shadowing entirely; the transitive-merge vector required the additional root-confinement check, because the top..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "5ab73b7ba50d989b4838c3affafb6e273ebc1e567df8af088826262a26e68285",
    "verified_classes": [
      "ManifestAuthorityError"
    ],
    "verified_functions": [
      "_confusable_key",
      "_edit_distance_le1",
      "validate_dynamic_manifest"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "ManifestAuthorityError"
    ],
    "sample_fail_closed_invariants": [
      "manifest missing 'name'"
    ],
    "stdlib_dependencies": [
      "pathlib",
      "re",
      "unicodedata"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}