{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-taint-tracked-retrieval-augmentation-fails-at-the-provenance-join-boundary",
  "title": "What structural signals indicate taint-tracked retrieval augmentation fails at the provenance-join boundary",
  "date_of_record": "2026 November 7",
  "scope": "Applies to RAG pipelines where retrieved chunks carry provenance metadata and a taint-tracking layer propagates trust labels from source documents to generated tokens. Does not apply to systems that treat the entire corpus as uniformly untrusted and apply output filtering only, nor to retrieval over a single-author corpus with no adversarial write path.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-taint-tracked-retrieval-augmentation-fails-at-the-provenance-join-boundary.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-taint-tracked-retrieval-augmentation-fails-at-the-provenance-join-boundary.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-taint-tracked-retrieval-augmentation-fails-at-the-provenance-join-boundary.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1634,
    "python_slice_tokens": 283,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Taint-tracked retrieval augmentation is usually described as a dataflow problem: each retrieved chunk has a trust label, the label flows through the context window into the model, and any chunk whose label is \"untrusted\" should not be able to influence a privileged action. This framing is correct but incomplete, because it treats the *join* between a retriev...",
    "what_was_observed": "In a pipeline with three stages (dense retrieval → cross-encoder re-rank → context packer with dedup), a corpus document containing an indirect injection was ingested with `trust=external`. The retrieval stage attached the correct label to the chunk ID. The re-ranker, however, operated on `(query, chunk_text)` pairs and emitted scores keyed by text hash, not chunk ID. The context packer deduplicated near-identical ch...",
    "condition_of_validity": "The taint-tracking guarantee holds only while all of the following are true: 1. Every transform between retrieval and context assembly is label-preserving *by construction*, meaning the transform's output type carries the label set of its inputs as a required field, not an optional one. 2. Deduplication and merging use a join key that is stable across the tr...",
    "decision_boundary": "The operational decision is whether to make labels a type-level property of the content object or a runtime annotation on the pipeline. Type-level labeling (a `TaintedChunk` that cannot be constructed without a label set, and whose every transform method returns a labeled result) is the only configuration that survives refactoring and library substitution. R...",
    "operational_effect": "When the invariant holds, indirect injection via the corpus is contained to the trust boundary of the injected document: an external chunk can influence the model's prose but cannot be laundered into a trusted slot, and the assembly audit produces a per-prompt label manifest that is auditable after the fact. When it fails, the failure is silent: the tracker ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "5b87586f6d5db6e159b0b5ec1adf1f68c7cb3a79f7004a8c662ab2ac7def73c1",
    "verified_classes": [
      "ProvenanceJoinError",
      "LabeledChunk"
    ],
    "verified_functions": [
      "assemble_context",
      "__post_init__"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ProvenanceJoinError"
    ],
    "sample_fail_closed_invariants": [
      "assembled context is empty; no labeled bytes emitted"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}