{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-quarantine-a-memory-write-rather-than-label-it-provenance-join-failure-across-tool-output-and-memory-taint-domains",
  "title": "When must an instance quarantine a memory write rather than label it: provenance join failure across tool-output and memory taint domains",
  "date_of_record": "2026 November 8",
  "scope": "Applies to agents that propagate provenance labels (source, trust tier, taint bit) from prompt ingress through tool outputs into persistent memory, and that must decide, at each memory write, whether to label-and-store or quarantine-and-drop. Does not apply to stateless single-turn tool use where no memory write occurs, nor to systems where tool outputs are re-fetched fresh on every read (no persistence of tainted bytes).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-quarantine-a-memory-write-rather-than-label-it-provenance-join-failure-across-tool-output-and-memory-taint-domains.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-quarantine-a-memory-write-rather-than-label-it-provenance-join-failure-across-tool-output-and-memory-taint-domains.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-quarantine-a-memory-write-rather-than-label-it-provenance-join-failure-across-tool-output-and-memory-taint-domains.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1906,
    "python_slice_tokens": 280,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A provenance label answers *\"where did these bytes come from?\"* A taint decision answers *\"may these bytes be joined with privileged context and acted upon?\"* The boundary failure is the assumption that a correctly propagated label is sufficient to authorize a write. It is not. Labels compose under a **join** operation: when two byte streams merge (tool outp...",
    "what_was_observed": "In a deployment where tool outputs were tagged with `Provenance(source=\"tool:<name>\", tier=UNTRUSTED, taint=True)` and memory records carried the union of their contributing provenances, three laundering paths appeared that passed all per-hop label checks: 1. **Summarizer collapse.** A memory-compaction routine ingested N records and emitted one summary. Its output provenance was constructed as `Provenance(source=\"su...",
    "condition_of_validity": "The label-and-store decision is valid **only if** the write's provenance is computed as the join over the complete set of contributing provenances, and that set is closed under all transforms applied between ingress and write. Quarantine is required instead of labeling when any of the following holds: - The transform is **not provenance-preserving by constru...",
    "decision_boundary": "The boundary is not \"is the content tainted?\" but **\"can the taint be re-derived at read time from the record alone?\"** If yes, label. If no, quarantine. Operationally: - **Label** when `record.provenance` is a complete, closed join and `record.provenance.taint` faithfully reflects it. The reader can recompute the join and enforce policy. - **Quarantine** wh...",
    "operational_effect": "After switching derived-write handling from label-and-store to quarantine-on-incomplete-join, the observed effects were: - Memory-compaction summaries dropped from the privileged retrieval index entirely until the summarizer was modified to emit a `derived_from=[record_ids]` field; once attached, the join recomputed to `taint=True` for any summary touching a..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "f82c68f16e7c881e1bcba54323e1cb8c7d7c54d0a0bd63e58976951f9a520b5a",
    "verified_classes": [
      "ProvenanceJoinError",
      "Provenance",
      "MemoryWrite"
    ],
    "verified_functions": [
      "join",
      "admit_write"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "ProvenanceJoinError"
    ],
    "sample_fail_closed_invariants": [
      "empty provenance set: join undefined",
      "tainted content targeted at internal-or-higher tier; no declassification path -> reject"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}