{
  "schema_version": "1.3.0",
  "slug": "when-must-an-instance-reject-a-tool-use-plan-as-hallucinated-before-executing-it",
  "title": "When must an instance reject a tool-use plan as hallucinated before executing it?",
  "date_of_record": "2026 November 5",
  "scope": "Applies to agents that generate tool-call plans (structured function invocations with arguments) and score them via execution-grounded self-consistency: sampling N candidate plans, executing each in a sandboxed or dry-run harness, and comparing observed tool results across samples. Does not apply to single-shot tool calls with no sampling, nor to plans whose tools are non-deterministic by contract (e.g., `get_current_time`, `random_sample`) where cross-sample result divergence is expected and carries no signal.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-tool-use-plan-as-hallucinated-before-executing-it.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-tool-use-plan-as-hallucinated-before-executing-it.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-an-instance-reject-a-tool-use-plan-as-hallucinated-before-executing-it.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1329,
    "python_slice_tokens": 386,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Execution-grounded self-consistency conflates two failure modes that produce identical low-agreement scores: **argument hallucination** (the model invents a parameter value, ID, or path that does not exist) and **tool-result nondeterminism** (the tool itself returns different values across identical calls). A naive scorer treats both as evidence of hallucina...",
    "what_was_observed": "In a batch of 4,000 sampled plans across 12 tools, three tools were declared deterministic but were not: `search_index` (returned results in unstable order under concurrent writes), `read_config` (raced with a config reload), and `resolve_user` (hit a cache with a 60s TTL that expired mid-batch). Plans invoking these tools showed cross-sample agreement of 0.41–0.58, well below the 0.80 rejection threshold. 71% of rej...",
    "condition_of_validity": "The rejection decision is valid only when all of the following hold: 1. The tool is declared `deterministic: true` in its schema, **and** that declaration has been empirically verified (e.g., two identical calls in the same sandbox epoch return byte-identical results). 2. Agreement is computed over the **normalized argument structure** (sorted keys, canonica...",
    "decision_boundary": "- **Reject as hallucinated** when argument-level agreement < 0.20 on a verified-deterministic tool with N ≥ 5 and a fixed epoch. This is the fabricated-argument signature. - **Defer (re-sample or escalate to human)** when argument-level agreement ≥ 0.80 but result-level agreement < 0.50. The plan is likely correct; the tool is suspect. Quarantine the tool's ...",
    "operational_effect": "Separating the two signals reduced false-positive rejections from 71% of rejected plans to 9% in the same batch, and surfaced three mis-declared tools that were silently corrupting downstream plans. The cost is one extra parse-and-canonicalize pass per sample and a per-tool determinism probe at sandbox startup. The probe is cheap (two calls) and catches decl..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "b79c50d6bb5209d305baa16cc879352c3b5163372029bcb8a5555512f79bbeae",
    "verified_classes": [
      "HallucinationGateError",
      "ToolSchema"
    ],
    "verified_functions": [
      "_canon_args",
      "_canon_result",
      "classify_plan",
      "gate_or_raise"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "HallucinationGateError"
    ],
    "sample_fail_closed_invariants": [
      "epoch not fixed; tool nondeterminism would leak into arg signal"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib",
      "json",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}