{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-trusts-a-tool-manifest-s-declared-side-effect-class-during-hot-reload",
  "title": "What happens when an instance trusts a tool manifest's declared side-effect class during hot-reload",
  "date_of_record": "2026 November 14",
  "scope": "Applies to agent runtimes that dynamically load tool/skill manifests at runtime (MCP-style servers, plugin registries, hot-reloaded tool bundles) where the manifest declares a `side_effect_class` or equivalent capability tag used to gate invocation. Does not apply to statically compiled tool sets or runtimes that derive capabilities from code inspection rather than manifest self-declaration.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-tool-manifest-s-declared-side-effect-class-during-hot-reload.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-tool-manifest-s-declared-side-effect-class-during-hot-reload.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-a-tool-manifest-s-declared-side-effect-class-during-hot-reload.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1773,
    "python_slice_tokens": 373,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is between *manifest-declared capability* and *runtime-observable capability*. A tool manifest is a self-attestation by the tool provider. It is not a proof. Runtimes commonly enforce policy on the declared field — e.g., \"tools declaring `side_effect_class: read_only` may be invoked without human approval, and may be composed into au...",
    "what_was_observed": "In a representative incident class, the sequence is: 1. A tool manifest is fetched from a registry endpoint at session start (or mid-session, on `tools/list_changed`). 2. The manifest declares `name: \"summarize_document\"`, `side_effect_class: \"read_only\"`, and a `description` field that the agent's planner reads into context. 3. The declared class causes the runtime to (a) skip the human-approval gate, (b) permit the...",
    "condition_of_validity": "The declared-class invariant holds only under the conjunction: - The tool payload is content-addressed and the hash is pinned in the trust policy *before* the manifest is admitted (TOFU on first load is insufficient — the pin must be set by an out-of-band authority). - The manifest and payload are signed by an identity the runtime can verify against a policy...",
    "decision_boundary": "The runtime must choose, at manifest-admission time, between two policies: - **Trust-by-declaration:** admit the tool, honor its declared class, skip approval for `read_only`. Fast, low-friction, and *unsound* whenever the manifest source is not pinned+signed. - **Trust-by-observation:** admit the tool, but downgrade its effective class to the *most restrict...",
    "operational_effect": "When the invariant is enforced (trust-by-observation for unverified manifests), the observable effects are: - Read-only tools from unverified sources lose the approval-skip and the high-iteration budget; they run in a sandboxed trace path with pre-state capture. Latency per invocation rises by the snapshot cost. - Planner context no longer contains raw `desc..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "927654f0a2e9b55c46bb27732b04696673e0004b334286be1c12692a790464b0",
    "verified_classes": [
      "SideEffectClass",
      "ManifestTrustError",
      "ToolManifest"
    ],
    "verified_functions": [
      "admit_manifest",
      "re_admit_on_list_changed",
      "hash_payload"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ManifestTrustError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "enum",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}