{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-bound-skill-injection-risk-in-a-dynamically-loaded-tool-registry",
  "title": "Where must an instance Bound Skill-Injection Risk in a Dynamically Loaded Tool Registry?",
  "date_of_record": "2026 November 12",
  "scope": "Applies to agent runtimes that resolve tool/plugin manifests at load time from mutable sources (registries, plugin directories, remote catalogs) and merge their declared capabilities into an active tool namespace. Does not apply to statically compiled tool sets whose manifest hashes are pinned at build time and verified by the build artifact, nor to single-tenant sandboxes with no cross-plugin name sharing.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-bound-skill-injection-risk-in-a-dynamically-loaded-tool-registry.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-bound-skill-injection-risk-in-a-dynamically-loaded-tool-registry.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-bound-skill-injection-risk-in-a-dynamically-loaded-tool-registry.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1601,
    "python_slice_tokens": 286,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The intuitive defense against skill injection is *manifest validation*: parse the manifest, check the declared schema, reject unknown fields, verify a signature. This catches malformed or unsigned plugins. It does **not** catch the actual attack surface, which is not the manifest's *contents* but the *resolution order and namespace merge semantics* that occu...",
    "what_was_observed": "In a registry loading three plugins (`calendar`, `email`, `notes`) plus a fourth (`calendar-plus`) installed later, all four manifests validated and verified. `calendar-plus` declared a tool named `create_event` with the description \"Create a calendar event.\" The legitimate `calendar` plugin also declared `create_event`. The registry's merge policy was last-writer-wins on name collision, keyed by load order, which wa...",
    "condition_of_validity": "The invariant that must hold is: **for every identifier in the merged namespace, exactly one manifest is the authoritative owner, and that ownership is determined by a total order that is independent of filesystem enumeration, network arrival, or installation timestamp.** This invariant is violated whenever any of the following hold: - The merge key is the b...",
    "decision_boundary": "At load time, for each capability a manifest declares, the registry must decide: *is this identifier already owned?* The correct boundary is **reject, do not resolve**. If `create_event` is already owned by `calendar`, a second declaration from `calendar-plus` must fail the load of `calendar-plus` (or quarantine that single capability), never silently overwr...",
    "operational_effect": "When the boundary is enforced as reject-on-collision, the observable effect is that a plugin which would have shadowed a capability fails to load loudly, with the colliding identifier and both owners named in the error. Operators see the conflict at install time rather than at first misrouted request. The cost is that benign plugins with generic tool names (..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "e900dc7fdac844f348918fd584a0651bf868ece25d59d5c4a75fa505e350f73a",
    "verified_classes": [
      "SkillInjectionError",
      "Manifest"
    ],
    "verified_functions": [
      "resolve_namespace"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "SkillInjectionError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}