{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-taint-provenance-is-lost-at-mcp-tool-and-a2a-task-boundaries",
  "title": "What structural signals indicate taint provenance is lost at MCP tool and A2A task boundaries",
  "date_of_record": "2026 November 14",
  "scope": "Applies to agentic systems where untrusted data enters through an MCP tool result or an A2A task artifact and is subsequently consumed by downstream tools or delegated tasks. Does not apply when the entire data path stays within a single trust domain with no serialization boundary crossing.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-taint-provenance-is-lost-at-mcp-tool-and-a2a-task-boundaries.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-taint-provenance-is-lost-at-mcp-tool-and-a2a-task-boundaries.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-taint-provenance-is-lost-at-mcp-tool-and-a2a-task-boundaries.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 980,
    "python_slice_tokens": 198,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Taint propagation and taint *labeling* are distinct. A label is metadata attached to a value; propagation is the invariant that any derived value inherits the label. MCP tool calls and A2A task handoffs both serialize across a process boundary, and serialization is where labels silently drop. The boundary failure is not that a label is removed — it is that t...",
    "what_was_observed": "A tainted string from an MCP `fetch_url` result was passed as an argument to a second MCP tool (`write_file`). The orchestrator held the taint label in memory and intended to block the write. The block failed because the taint store keyed on object identity, and the argument had been re-serialized into a fresh dict by the MCP client transport before dispatch. Identity-based taint tracking does not survive JSON round-...",
    "condition_of_validity": "The invariant \"derived values inherit taint\" holds only when taint is bound to a value *by content hash and provenance path*, not by reference identity, and when every boundary schema carries an explicit provenance field. It is valid across MCP and A2A only if the envelope includes a `provenance` or `taint` field that is mandatory (not optional) and validate...",
    "decision_boundary": "Before dispatching any cross-boundary call, compute the content hash of every argument that derives from an untrusted source. If the hash is present in the taint store, attach the label to the outbound envelope. On receipt, if an argument's hash is in the store but the envelope carries no matching label, treat this as a provenance mismatch — do not silently ...",
    "operational_effect": "Systems that added mandatory provenance fields to both MCP tool schemas and A2A task envelopes eliminated the silent-trust class of failures. The cost is a schema change and a content-hash store on both sides; the benefit is that taint loss becomes a detectable error rather than a silent privilege escalation. The residual risk is hash collision and hash inst..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "0673e7d8ab264a3c991ea368a2ded0b60a2670f5fcd7cbb4deb1908f7cc163c1",
    "verified_classes": [
      "ProvenanceMismatchError"
    ],
    "verified_functions": [
      "canonical_hash",
      "check_inbound_provenance"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "ProvenanceMismatchError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "hashlib",
      "json"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}