{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-loads-an-agent-tool-manifest-whose-declared-tool-set-diverges-from-its-resolved-capability-set",
  "title": "What happens when an instance loads an agent tool manifest whose declared tool set diverges from its resolved capability set",
  "date_of_record": "2026 November 8",
  "scope": "Applies to agents that load tool manifests at runtime from mutable sources (registries, filesystem, remote endpoints) and resolve them into callable capabilities. Does not apply to statically compiled tool bindings or manifests that are cryptographically pinned and verified before any resolution step.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-loads-an-agent-tool-manifest-whose-declared-tool-set-diverges-from-its-resolved-capability-set.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-loads-an-agent-tool-manifest-whose-declared-tool-set-diverges-from-its-resolved-capability-set.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-loads-an-agent-tool-manifest-whose-declared-tool-set-diverges-from-its-resolved-capability-set.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1455,
    "python_slice_tokens": 283,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between the *declared* tool set — what the manifest says the agent can do — and the *resolved* capability set — what the runtime actually binds and exposes to the model after resolution, merging, aliasing, and shadowing. Skill-injection attacks live in the gap between these two. A manifest is not a capability. The attack surfa...",
    "what_was_observed": "A tool manifest declared exactly one tool, `summarize`, with a benign schema. It passed JSON-schema validation, signature check against the registry key, and a name allowlist. The runtime then applied its standard resolution steps: 1. It merged the manifest with a lower-precedence \"base\" manifest that supplied default tools. 2. It resolved an alias: the manifest's `summarize` entry carried a `$ref` to a shared tool d...",
    "condition_of_validity": "The invariant holds only when the following are all true: - Every resolution step (merge, alias, shadow, default-injection, plugin-discovery) is *capability-preserving*: the output capability's declared schema and effect class are a subset of the union of the input manifests' declared schemas and effect classes. - Trust is evaluated on the *resolved* capabil...",
    "decision_boundary": "The operational decision is where to place the enforcement point. Three options, in increasing order of robustness: - **Validate-at-load:** check each manifest against schema and signature. Cheap, and blind to composition. Rejects only the crudest injections. - **Validate-at-resolve:** after all merges and alias resolution, recompute the effective declared s...",
    "operational_effect": "After adopting resolve-time enforcement with trust propagation, the failure mode changed from \"silent capability synthesis\" to \"explicit resolution rejection with an audit record naming the layer, the alias chain, and the undeclared effect class.\" The cost was a measurable increase in resolution latency (roughly proportional to alias-chain depth) and a class..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "275d183418ffbd1eec8e48f9ef92a9b6e25f29b0649715cfc8611b623f4b1825",
    "verified_classes": [
      "CapabilitySynthesisError",
      "Layer"
    ],
    "verified_functions": [
      "resolve",
      "enforce",
      "load_manifest",
      "__init__"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "CapabilitySynthesisError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}