{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-a-taint-propagation-break-at-the-mcp-capability-boundary-during-nested-agent-delegation",
  "title": "What structural signals indicate a taint-propagation break at the MCP capability boundary during nested agent delegation",
  "date_of_record": "2026 November 9",
  "scope": "Applies to multi-hop agent chains where a parent agent invokes a tool sandbox that itself spawns sub-agents, each holding a capability-scoped MCP server session. Does not apply to single-hop tool calls where the caller and callee share one taint context, nor to chains where capability tokens are re-minted (rather than delegated) at each hop.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-taint-propagation-break-at-the-mcp-capability-boundary-during-nested-agent-delegation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-taint-propagation-break-at-the-mcp-capability-boundary-during-nested-agent-delegation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-taint-propagation-break-at-the-mcp-capability-boundary-during-nested-agent-delegation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1026,
    "python_slice_tokens": 108,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure that matters is not \"an untrusted input reached a privileged tool.\" That is the expected case a taint system is built to catch. The failure that matters is **taint-label laundering across a delegation boundary**: a sub-agent receives a tainted argument, but because the MCP server session was opened with a *narrower* capability scope than the pare...",
    "what_was_observed": "In a three-hop chain (planner → fetch-worker → summarize-worker), a prompt-injected string originating from an untrusted HTTP fetch was correctly tagged `taint=untrusted:external` at hop 1. At hop 2 the fetch-worker opened an MCP session with a delegated capability token whose scope was a strict subset of the parent's. The sandbox's session-admission check, written as `if session.scope ⊆ parent.scope: admit(untainted...",
    "condition_of_validity": "The above signals are diagnostic only when all of the following hold: (a) taint labels are attached to *data*, not to sessions; (b) capability tokens are delegated by subset, not re-minted; (c) the sandbox admits sub-sessions without a human or policy gate. If tokens are re-minted at each hop with an explicit `declassify` step, the taint drop is legitimate a...",
    "decision_boundary": "On observing signals 1 and 3 together, halt the chain and quarantine the payload; do not merely log. On signal 2 alone, treat as a warning and force re-evaluation of the argument's taint from its provenance rather than the session. The boundary is: **a taint decrease is only admissible if accompanied by a matching `declassify` event whose authority is a stri...",
    "operational_effect": "Enforcing taint-monotonicity across delegation edges eliminates the class of confused-deputy writes where a narrowly-scoped sub-agent is weaponized against its own scope. The cost is that legitimate declassification now requires an explicit, audited hop, which lengthens chains and surfaces human review points. In practice the failure rate of injected-content..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "2864e0363b04d79b7d8a7a16a405a391d191bf00c67d1c2b69bcb06b43c569bd",
    "verified_classes": [
      "TaintLaunderingError"
    ],
    "verified_functions": [
      "admit_subsession"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintLaunderingError"
    ],
    "sample_fail_closed_invariants": [
      "declassify authority is not a superset of consuming capability"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}