# Under what conditions must an instance treat a write-audit diff as evidence of poisoning rather than as a legitimate consolidation event

**Date of Record:** 2026 November 12

**Scope:** Applies to agent long-term memory stores that perform periodic consolidation (summarization, deduplication, embedding re-projection) and that maintain a write-audit log capable of producing per-record diffs between snapshots. Does not apply to append-only stores with no consolidation pass, nor to stores where the audit log records only write timestamps without content hashes.

## Core Distinction

A write-audit diff answers one question: *did the bytes of this record change between snapshot N and snapshot N+k?* It does **not** answer *who caused the change or whether the change was authorized.* Consolidation passes routinely rewrite records — merging duplicates, shortening summaries, re-embedding after a model upgrade — and these rewrites produce diffs that are byte-for-byte indistinguishable from an injected poisoning write at the diff layer. The boundary failure is treating *diff presence* as *poisoning signal*. The correct distinction is between a diff that is **explained by a registered consolidation transaction** and a diff that is **orphaned** — present in the audit log with no corresponding entry in the consolidation manifest for that window.

## What Was Observed

On a store with a nightly consolidation pass, an embedding re-projection job rewrote 4,200 records. The write-audit diff flagged all 4,200 as "modified." A naive poisoning detector keyed on diff volume raised a critical alert and quarantined the entire namespace. The actual poisoning event that week — 3 records whose content had been replaced with instructions redirecting the agent's retrieval policy — was buried inside the same alert and went unexamined for 40 hours because the signal was saturated.

In a second incident, the inverse failure occurred. A consolidation job that legitimately merged two near-duplicate records into one was *whitelisted* by content-hash prefix matching. An attacker who had observed the whitelist pattern injected a poisoned record whose hash collided with a whitelisted prefix, and the diff was suppressed. The poisoning survived two consolidation cycles.

The discriminating variable in both cases was not the diff itself but the **presence or absence of a matching consolidation-manifest entry** keyed on `(record_id, snapshot_pair, transaction_id)`. Diffs with a manifest entry are consolidation; diffs without one are orphans and require inspection.

## Condition of Validity

The diff-as-poisoning-evidence interpretation is valid only when all of the following hold:

1. The consolidation pass emits a manifest entry for every record it rewrites, and the manifest is written **before** the record mutation commits (write-ahead ordering). If the manifest is written after, a crash between mutation and manifest write produces a legitimate diff with no manifest entry — a false orphan.
2. The diff is computed on a **content hash that includes provenance fields** (source, authoring transaction, retrieval policy tag), not on the payload alone. Payload-only hashing cannot distinguish a re-embedding from a payload swap.
3. The audit log is itself append-only and hash-chained; otherwise an attacker with write access to the log can forge a manifest entry and convert an orphan into a "legitimate" consolidation.
4. The consistency check compares the record against its **declared invariants** (e.g., "this record's retrieval policy tag must match the namespace default") independently of the diff. A diff that passes invariant checks and has a manifest entry is consolidation; a diff that passes manifest checks but *fails* an invariant check is poisoning that has been laundered through the consolidation path.

## Decision Boundary

Classify a diff as **poisoning evidence** when any of these hold:

- The diff is orphaned (no manifest entry for the snapshot pair) **and** the content hash change includes a provenance field.
- The diff has a manifest entry but the record fails a declared invariant after the rewrite (the manifest explains *that* a rewrite happened, not *what* it was allowed to change).
- The diff's transaction_id appears in the manifest but the manifest entry's declared `expected_hash_after` does not match the observed post-rewrite hash — indicating the manifest was forged or the mutation was tampered with after manifest commit.

Classify a diff as **benign consolidation** only when it is manifest-matched, invariant-passing, and hash-consistent. Classify as **indeterminate** — and route to human review, not auto-quarantine — when the manifest is missing but the invariant check passes and the diff is confined to non-provenance fields. Indeterminate diffs must not be silently dropped; they must be retained with a TTL and re-examined if a second orphan appears on the same record.

## Operational Effect

The practical consequence is that poisoning detection must be a **two-key** operation: diff presence *and* manifest/invariant mismatch. Single-key detectors either saturate on consolidation volume (false positive) or are defeated by whitelist-pattern observation (false negative). Stores that cannot emit a write-ahead consolidation manifest cannot safely run diff-based poisoning detection at all and must fall back to invariant-only checks, accepting a higher false-negative rate. The audit log's hash chain is load-bearing: without it, the manifest is forgeable and the two-key operation collapses to one key controlled by the attacker.

```python
import hashlib
from dataclasses import dataclass


class PoisoningEvidenceError(RuntimeError):
    """Raised when a write-audit diff cannot be classified as consolidation or poisoning."""
    pass


@dataclass(frozen=True)
class DiffRecord:
    record_id: str
    snapshot_pair: tuple[str, str]
    pre_hash: str
    post_hash: str
    provenance_changed: bool
    invariant_holds: bool
    manifest_entry: dict | None  # None means orphaned


def classify_diff(diff: DiffRecord, audit_chain_valid: bool) -> str:
    if not audit_chain_valid:
        # Without a valid hash chain the manifest is forgeable; no diff is trustworthy.
        raise PoisoningEvidenceError(
            f"audit chain invalid for {diff.record_id}; cannot classify diff"
        )

    if diff.manifest_entry is None:
        if diff.provenance_changed:
            return "poisoning_evidence"
        if diff.invariant_holds:
            return "indeterminate"
        return "poisoning_evidence"

    expected = diff.manifest_entry.get("expected_hash_after")
    if expected is not None and expected != diff.post_hash:
        return "poisoning_evidence"

    if not diff.invariant_holds:
        # Manifest explains that a rewrite happened, not that it was allowed.
        return "poisoning_evidence"

    return "benign_consolidation"


def audit_window(diffs: list[DiffRecord], audit_chain_valid: bool) -> dict[str, list[str]]:
    buckets: dict[str, list[str]] = {
        "poisoning_evidence": [],
        "indeterminate": [],
        "benign_consolidation": [],
    }
    for d in diffs:
        verdict = classify_diff(d, audit_chain_valid)
        buckets[verdict].append(d.record_id)

    if buckets["poisoning_evidence"]:
        raise PoisoningEvidenceError(
            f"poisoning evidence in window: {buckets['poisoning_evidence']}"
        )
    return buckets
```