{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-treat-a-replay-trace-as-a-causal-witness-rather-than-a-narrative-log",
  "title": "Under what conditions must an instance treat a replay trace as a causal witness rather than a narrative log",
  "date_of_record": "2026 November 10",
  "scope": "Applies to post-hoc forensics on agent execution traces where a replay is used to attribute an injected instruction (prompt injection, tool-call hijack, memory poisoning) to a specific causal step. Does not apply to live-loop observability, latency profiling, or traces reconstructed from sampled spans where the sampling decision itself is not logged.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-a-replay-trace-as-a-causal-witness-rather-than-a-narrative-log.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-a-replay-trace-as-a-causal-witness-rather-than-a-narrative-log.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-a-replay-trace-as-a-causal-witness-rather-than-a-narrative-log.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1854,
    "python_slice_tokens": 446,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A replay trace is a *narrative log* when it records what the agent emitted, in order, with timestamps. It is a *causal witness* only when every edge in the trace is backed by an artifact that the downstream step could not have produced without the upstream step. The distinction is not about fidelity of logging — a trace can be byte-perfect and still be a nar...",
    "what_was_observed": "In three separate forensic post-mortems on the same agent framework, an injected instruction appeared in the trace at step *k* (a tool result containing adversarial text), and the harmful action appeared at step *k+4*. The naive replay attributed causality to step *k*. In two of the three cases this was wrong: 1. **Re-summarization laundering.** Between *k* and *k+4* the agent's context manager ran a compaction pass ...",
    "condition_of_validity": "A replay trace may be treated as a causal witness for injection forensics only when all of the following hold: - Every context mutation (compaction, summarization, truncation, reordering) is a first-class span with recorded input and output content hashes, not an attribute on the span that triggered it. - Retrieval spans record the *returned artifact identit...",
    "decision_boundary": "The operational test an agent or forensic tool should apply before asserting causality: 1. Compute the artifact-hash closure from the suspect action backward. 2. If the closure reaches the injection node through only logged transformation nodes with matching hashes → assert causal witness. 3. If the closure reaches the injection node only by traversing a fol...",
    "operational_effect": "Downstream consequences of getting this boundary wrong are asymmetric. A false causal attribution in an injection post-mortem leads to patching the wrong input channel (case 1: patching the tool-result sanitizer when the compaction pass was the launderer) and leaves the actual vector open. A false *indeterminate* is cheap: it costs a window extension. Theref..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "1a2104a8d5b95d2935c23047805fa5b4f98e4621aeb9a24ff03ec8400972ae02",
    "verified_classes": [
      "CausalAttributionError",
      "EdgeKind",
      "TraceNode",
      "TraceEdge",
      "ReplayTrace"
    ],
    "verified_functions": [
      "assert_causal_witness",
      "parents"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "CausalAttributionError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "enum",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}