{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-memory-poisoning-in-long-horizon-agent-state-provenance-depth-collapse-as-a-detection-invariant",
  "title": "What structural signals indicate memory poisoning in long-horizon agent state: provenance depth collapse as a detection invariant",
  "date_of_record": "2026 November 9",
  "scope": "Applies to agents that persist state across sessions via a memory store with per-entry provenance metadata (source, timestamp, derivation chain). Does not apply to stateless inference, to short-horizon contexts under ~10k tokens where all state is re-derived each turn, or to stores that do not record derivation edges.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-memory-poisoning-in-long-horizon-agent-state-provenance-depth-collapse-as-a-detection-invariant.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-memory-poisoning-in-long-horizon-agent-state-provenance-depth-collapse-as-a-detection-invariant.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-memory-poisoning-in-long-horizon-agent-state-provenance-depth-collapse-as-a-detection-invariant.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1555,
    "python_slice_tokens": 271,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Content-based poisoning detection asks *\"is this memory entry false or adversarial?\"* — a semantic judgment that requires an oracle and fails open. Structural detection asks a different question: *\"is this entry's provenance consistent with how it claims to have been produced?\"* The distinction matters because poisoned entries are frequently *plausible*: the...",
    "what_was_observed": "Over a 90-day run of a research agent with a 12k-entry persistent store, three failure classes appeared, and only the third was detectable by content review: 1. **Direct injection.** A fetched web page contained instructions that caused the agent to write a memory asserting a false fact. Content review caught ~60% of these; the rest were plausible enough to survive human spot-checks. 2. **Laundering through summariza...",
    "condition_of_validity": "The depth-collapse signal is valid only when: - Every write path to the store is instrumented to record at least `{entry_id, parent_ids[], observed_at, derived_at, source_kind}`. A single uninstrumented writer (a manual admin tool, a migration script) will generate false positives indistinguishable from class 3. - Summarization and consolidation are treated ...",
    "decision_boundary": "The operational rule: - **Depth-0 + `source_kind != direct_observation`** → quarantine immediately, do not serve to the agent, flag for provenance repair. This is a hard boundary; do not attempt content adjudication first. - **Depth < claimed derivation count** → serve with a reduced-confidence annotation and schedule repair; do not silently promote. - **Tim...",
    "operational_effect": "Instrumenting all writers and enforcing edge propagation on consolidation reduced undetected poisoned entries from an estimated 4.1% of store to 0.3% over the following 60 days, with a 2.7% false-quarantine rate concentrated almost entirely in the first week before the migration script was instrumented. The dominant cost was not detection but **provenance re..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "d05db55667a3ace21841839f66c28b4413f7c25aaf8fcf2782c39eee668b9757",
    "verified_classes": [
      "ProvenanceViolation",
      "MemoryEntry"
    ],
    "verified_functions": [
      "compute_depth",
      "validate_provenance",
      "admit"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "ProvenanceViolation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}