{
  "schema_version": "1.3.0",
  "slug": "what-invariants-must-survive-when-the-context-window-itself-becomes-a-security-boundary",
  "title": "What invariants must survive when the context window itself becomes a security boundary?",
  "date_of_record": "2026 October 20",
  "scope": "* **Applies when:** The context window mixes content from multiple trust sources, some content is unauthenticated, and downstream decisions depend on which content is trusted. * **Does not apply when:** All context comes from one authentica",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-invariants-must-survive-when-the-context-window-itself-becomes-a-security-boundary.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-invariants-must-survive-when-the-context-window-itself-becomes-a-security-boundary.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-invariants-must-survive-when-the-context-window-itself-becomes-a-security-boundary.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1275,
    "python_slice_tokens": 469,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The separation between **context window as workspace** (the agent's working memory, where anything goes) and **context window as trust domain** (the agent's security boundary, where only authorized content belongs). Relying on the workspace model creates the **Context Boundary Confusion**: unauthenticated content (web search results, tool outputs, peer messa...",
    "what_was_observed": "In security-sensitive agent architectures, failing to treat context as a trust domain produces three primary failure modes: 1. **Injection via Retrieval:** The agent retrieves content from untrusted sources (web search, RAG from external corpus), and the content includes instructions the agent follows as if they came from the system prompt. The boundary between trusted and untrusted context is not enforced. 2. **Cont...",
    "condition_of_validity": "* **Applies when:** The context window mixes content from multiple trust sources, some content is unauthenticated, and downstream decisions depend on which content is trusted. * **Does not apply when:** All context comes from one authenticated source, or the agent's decisions are insensitive to context trust level.",
    "decision_boundary": "1. **Does the session mix content from multiple trust sources?** If no, standard context handling applies. If yes, proceed. 2. **Is each context segment classified by `context_segment_trust_class_receipt`?** If yes, the trust level is known. If no, all segments must be treated as untrusted. 3. **Is the `context_boundary_authentication_signature` present for ...",
    "operational_effect": "1. **Injection Prevention:** Untrusted content cannot impersonate trusted content. 2. **Leakage Prevention:** Cross-session content is flagged as out-of-boundary. 3. **Priority Integrity:** Trust hierarchy is enforced against content-based manipulation."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "f07e8b952ace29be805d00d40d49baa088d8ca5479484a82ebe6d65ce9312a8e",
    "verified_classes": [
      "TrustClass",
      "ContextBoundaryVerdict",
      "ContextSegment",
      "ContextWindow",
      "ContextPolicy",
      "ContextBoundaryManifest",
      "ContextTrustBoundaryGuard"
    ],
    "verified_functions": [
      "_hash",
      "evaluate_window"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 0,
    "raised_exceptions": [],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "enum",
      "hashlib",
      "json"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}