{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-trusts-write-time-provenance-but-not-mutation-frequency-the-silent-overwrite-boundary-in-agent-memory-poisoning-detectio",
  "title": "What happens when an instance trusts write-time provenance but not mutation frequency: the silent overwrite boundary in agent memory poisoning detection",
  "date_of_record": "2026 November 14",
  "scope": "Applies to agent memory systems that gate writes on per-entry provenance (source identity, trust tier, signing) while scoring poisoning risk from mutation-rate anomalies over a rolling window. Does not apply to append-only immutable logs, nor to systems where every write is independently re-validated against ground truth at read time.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-write-time-provenance-but-not-mutation-frequency-the-silent-overwrite-boundary-in-agent-memory-poisoning-detectio.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-write-time-provenance-but-not-mutation-frequency-the-silent-overwrite-boundary-in-agent-memory-poisoning-detectio.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-trusts-write-time-provenance-but-not-mutation-frequency-the-silent-overwrite-boundary-in-agent-memory-poisoning-detectio.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1108,
    "python_slice_tokens": 256,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Provenance and anomaly scoring answer two orthogonal questions. Provenance answers *who wrote this and were they authorized*. Anomaly scoring answers *does this write pattern look like an attack*. The boundary failure lives in the gap: an attacker who holds (or compromises) a single high-trust provenance identity can perform a **slow overwrite** — a sequence...",
    "what_was_observed": "In a memory store with two controls — (1) write-time provenance check against a trust-tier allowlist, and (2) an EWMA anomaly score on mutations-per-key per-window with threshold `T` — an agent's \"user preference\" memory entry was rewritten 14 times over 9 hours. Each rewrite came from the legitimate integrator identity (provenance: pass). Each rewrite landed in a distinct scoring window, so per-window mutation rate ...",
    "condition_of_validity": "This failure is *live* precisely when all of the following hold: - Writes are gated primarily by provenance/authorization, not by content re-derivation. - Anomaly scoring is computed per-window with decay, so spaced writes each look independent. - The same logical key can be overwritten (not append-only), so state is cumulative while the detector is memoryle...",
    "decision_boundary": "The correct control is not a rate threshold — it is a **cumulative-drift invariant per key**. Track semantic distance between the current value and the last *independently attested* baseline, summed across writes without decay. A slow overwrite accumulates drift monotonically even when rate is flat. Concretely: alarm when `Σ drift(key) > D` OR when `writes_s...",
    "operational_effect": "Teams that deploy provenance + rate-anomaly and declare memory \"poisoning-resistant\" carry a standing vulnerability to any actor with a valid write identity and patience. The operational remedy: (1) pin a content baseline per key refreshed only by out-of-band attestation, (2) score cumulative drift with *no* time decay, (3) require re-attestation after `N` o..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "255f2536e45d13aebbe2675440e1f459b2228db381624e372bee95781862eee9",
    "verified_classes": [
      "SlowOverwritePoisoningError",
      "MemoryWriteGuard"
    ],
    "verified_functions": [
      "__init__",
      "record_write",
      "attest_baseline"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "SlowOverwritePoisoningError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}