{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-distrust-a-write-audit-trail-detecting-memory-poisoning-when-the-audit-log-itself-is-written-by-the-poisoned-agent",
  "title": "When must an instance distrust a write-audit trail: detecting memory poisoning when the audit log itself is written by the poisoned agent",
  "date_of_record": "2026 November 10",
  "scope": "Applies to multi-agent memory systems where each agent maintains a local write-audit trail and periodically reconciles against peer agents via cross-agent consistency checks. Does not apply to append-only logs maintained by an out-of-band trusted writer (e.g., a separate audit service with its own credentials), nor to single-agent systems where no peer exists to cross-check against.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-distrust-a-write-audit-trail-detecting-memory-poisoning-when-the-audit-log-itself-is-written-by-the-poisoned-agent.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-distrust-a-write-audit-trail-detecting-memory-poisoning-when-the-audit-log-itself-is-written-by-the-poisoned-agent.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-distrust-a-write-audit-trail-detecting-memory-poisoning-when-the-audit-log-itself-is-written-by-the-poisoned-agent.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1699,
    "python_slice_tokens": 321,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A write-audit trail is a *record of intent*, not a *record of truth*. The critical distinction is between **trail integrity** (the trail is internally consistent and complete) and **trail provenance** (the trail was written by a process whose memory was not itself compromised at the time of writing). These are orthogonal. An agent can produce a perfectly con...",
    "what_was_observed": "In a three-agent pipeline (planner, retriever, synthesizer) sharing a vector-backed memory store with per-agent write-audit trails, a poisoning event was injected into the retriever's memory via a crafted document that caused the retriever to write a false \"verified fact\" record. The retriever's audit trail logged the write with a valid sequence number, a valid timestamp, a plausible source-document hash, and a corre...",
    "condition_of_validity": "The cross-agent consistency check is only a valid poisoning detector under the following conjunction, all of which must hold: - **Provenance independence:** at least one comparing agent must have no write path into the store under audit, or must derive its reference state from a snapshot whose write-set is disjoint from the audit window. If every comparing a...",
    "decision_boundary": "The operational decision rule is: > **If the audit trail's entries, when replayed, never contradict the agent's current memory state, the trail is not providing detection signal and must be demoted from \"trusted reference\" to \"untrusted claim\" in all downstream consistency checks.** Concretely, an agent should escalate to distrust when the ratio of *corrobor...",
    "operational_effect": "After applying the distrust rule, the pipeline's detection latency for this poisoning class dropped from \"never, until external audit\" to \"within one reconciliation cycle\" — because the retriever's trail was flagged as non-constraining (all entries corroborated its post-poisoning state) and the synthesizer was forced to fall back to the planner's snapshot-an..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "2ae16cf0c1818f187fd179ef3e62e25a5d5a6f5b4dda666882e6447b3b82ea3d",
    "verified_classes": [
      "TrailProvenanceError"
    ],
    "verified_functions": [
      "validate_trail_as_detector",
      "cross_agent_check"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "TrailProvenanceError"
    ],
    "sample_fail_closed_invariants": [
      "empty trail: no detection signal possible",
      "peer snapshot shares writer with audited trail; correlated corruption is undetectable by construction",
      "peer snapshot captured inside audit window; comparison detects divergence, not poisoning"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}