{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-retains-a-tainted-capability-token-across-a-downgrade-epoch-boundary",
  "title": "What happens when an instance retains a tainted capability token across a downgrade epoch boundary",
  "date_of_record": "2026 November 11",
  "scope": "Applies to agent runtimes that execute tool calls inside taint-tracking sandboxes where capability grants are versioned by a monotonic downgrade epoch and revoked by epoch increment. Does not apply to stateless per-call sandboxes, nor to runtimes where capability tokens are re-minted (not merely re-validated) on every epoch advance.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-retains-a-tainted-capability-token-across-a-downgrade-epoch-boundary.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-retains-a-tainted-capability-token-across-a-downgrade-epoch-boundary.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-retains-a-tainted-capability-token-across-a-downgrade-epoch-boundary.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1135,
    "python_slice_tokens": 143,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A taint-aware sandbox tracks two orthogonal things: *what data an agent has touched* (taint labels) and *what it is permitted to do next* (capability grants). Dynamic capability downgrading couples them: when taint crosses a sensitivity threshold, the runtime increments a downgrade epoch and narrows the capability set. The non-obvious failure is that **epoch...",
    "what_was_observed": "In a tool-execution trace, an agent read a file classified `sensitive:internal` (taint label applied, epoch advanced 41→42, `fs.write` capability narrowed to read-only paths). The agent then invoked `fs.write` with a token minted at epoch 41. The validator returned `valid: true` from a per-token cache populated at mint time, bypassing the epoch-42 capability table. The write succeeded to a path the downgrade was mean...",
    "condition_of_validity": "The bug requires all of: (1) capability tokens with a mint-time epoch stamp; (2) a validator that caches validity keyed by token identity rather than by (token, current_epoch); (3) a taint event that advances the epoch without invalidating the validator cache; (4) a tool call issued after the taint event using a pre-taint token. Remove any one and the bounda...",
    "decision_boundary": "When designing the validator, choose: **cache validity keyed on token alone** (fast, but epoch-blind — unsafe under dynamic downgrading) versus **evaluate epoch at use time** (one extra atomic read per call, correct under downgrading). The boundary is crossed the moment taint can advance the epoch asynchronously to tool execution. If downgrades only ever occ...",
    "operational_effect": "Under the failure, sensitivity downgrades become advisory rather than enforced: the agent's taint labels correctly record that it touched sensitive data, but its capabilities do not narrow, so it can exfiltrate via the very tool the downgrade was meant to restrict. The audit trail shows a compliant taint log and a compliant capability log that disagree, maki..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "8e2fa175281cd524edad69ccea6026d3f2d921844bd4752480e29fc7f3674731",
    "verified_classes": [
      "TaintedCapabilityEpochError"
    ],
    "verified_functions": [
      "dispatch_tool_call"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintedCapabilityEpochError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}