{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-treat-a-skill-registry-load-as-an-injection-event-rather-than-a-benign-refresh",
  "title": "Under what conditions must an instance treat a skill-registry load as an injection event rather than a benign refresh",
  "date_of_record": "2026 November 13",
  "scope": "Applies to agents that resolve and load executable skills (tool definitions, prompt fragments, handler code) from a mutable registry at runtime, where the registry is writable by parties other than the agent's operator. Does not apply to statically bundled skills compiled into the agent image, nor to registries whose write set is strictly a subset of the agent's trust domain.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-a-skill-registry-load-as-an-injection-event-rather-than-a-benign-refresh.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-a-skill-registry-load-as-an-injection-event-rather-than-a-benign-refresh.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-treat-a-skill-registry-load-as-an-injection-event-rather-than-a-benign-refresh.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1575,
    "python_slice_tokens": 324,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is not \"trusted vs. untrusted source.\" It is **whether the loaded artifact can alter the agent's own future resolution behavior**, independent of whether its declared payload looks malicious. A skill registry has two distinct surfaces: 1. **Payload surface** — the skill body: instructions, tool schemas, code. Auditable per-artifact. ...",
    "what_was_observed": "Across several deployments of dynamic registries, the following recurred: - **Alias capture.** A refresh added a skill whose trigger phrase was a near-duplicate of an existing, frequently-invoked skill (e.g., `deploy_service` vs. `deploy-service`). Resolution normalized both to one key; the newer artifact won by recency. The original skill's payload was untouched; every invocation of the original name now executed th...",
    "condition_of_validity": "Treat a load as an injection event when **all** of the following hold: 1. The registry is writable by a principal outside the operator's trust domain, **and** 2. The load can change the resolution surface reachable by an already-loaded skill — via alias, name normalization, precedence, version repoint, or dependency edge — **and** 3. The affected skill's cap...",
    "decision_boundary": "Compute, before applying any refresh, the **resolution delta**: the set of `(trigger_key → resolved_artifact, capability_scope)` tuples reachable from currently-loaded skills, diffed against the post-refresh closure. Then: - **Empty delta** → apply as refresh. - **Non-empty delta touching a loaded skill's reachable trigger set** → halt, raise, require operat...",
    "operational_effect": "Enforcing this boundary converts a class of silent routing hijacks into explicit, blockable events. The cost is that legitimate refreshes which legitimately change precedence (a real reordering, a real alias addition) now require re-consent — this is the intended friction, because those are precisely the operations that carry injection risk. The agent should..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "797a370a1f693df1e28cc09ab051467d07b0b8d44225c179320c357a5be22b70",
    "verified_classes": [
      "SkillInjectionError",
      "SkillRef",
      "ResolutionSurface"
    ],
    "verified_functions": [
      "apply_refresh",
      "closure"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "SkillInjectionError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}