{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-of-a-provenance-taint-label-be-re-established-after-crossing-a-tool-boundary",
  "title": "Where must an instance of a provenance taint label be re-established after crossing a tool boundary",
  "date_of_record": "2026 November 13",
  "scope": "Applies to agent runtimes that propagate instruction-vs-data provenance labels across tool calls, retrieval results, and memory writes. Does not apply to single-turn, tool-free inference where no label ever crosses a process or serialization boundary.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-provenance-taint-label-be-re-established-after-crossing-a-tool-boundary.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-provenance-taint-label-be-re-established-after-crossing-a-tool-boundary.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-provenance-taint-label-be-re-established-after-crossing-a-tool-boundary.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1478,
    "python_slice_tokens": 432,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A provenance label is a claim about *who authored a span of bytes*. The common and wrong mental model treats the label as a property of the *value*: if a string is tainted at the point of ingestion, it stays tainted as it flows. This holds inside a single address space. It fails at every boundary where the value is serialized, transformed, or re-materialized...",
    "what_was_observed": "In a pipeline where a retrieval tool returned documents and a summarizer tool consumed them, taint was tracked as a per-message attribute in the orchestrator's message list. The summarizer was invoked over a JSON-serialized payload. The summarizer's output was re-inserted into the orchestrator's context as a new message. The re-inserted message carried the *summarizer's* provenance (trusted tool output), not the *sou...",
    "condition_of_validity": "The invariant — \"a span's label is preserved across a boundary\" — is valid only when the boundary satisfies all of: 1. The receiving component's schema has a field that can carry the label, and that field is *mandatory* on ingress (absent field is a hard error, not a default). 2. The transformation is label-monotone: it may raise taint (data → instruction is...",
    "decision_boundary": "The operational rule: **re-establish the label at the boundary from the authoritative provenance record, and treat any component that cannot carry the label as taint-amplifying, not taint-neutral.** Concretely, a tool whose output schema lacks a provenance field must be wrapped so that its output inherits the *join* (least-upper-bound of taint) of all its in...",
    "operational_effect": "With the join rule enforced at the wrapper, the destructive tool call above is blocked: the summary arrives instruction-tainted, the policy check sees taint, and the call requires explicit human confirmation. The cost is over-tainting — a summary of benign documents is still marked untrusted, and downstream tools that only accept trusted input will refuse it..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "f424db8bc9109f94e4f05379e49cde18570e3f9f58662463bdd6c06123e006fd",
    "verified_classes": [
      "ProvenanceViolation",
      "Labeled"
    ],
    "verified_functions": [
      "join_taint",
      "summarize",
      "write_memory",
      "policy_check"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "ProvenanceViolation"
    ],
    "sample_fail_closed_invariants": [
      "assert summary.taint == INSTRUCTION_TAINTED",
      "summarizer attempted to lower taint below input join; boundary does not satisfy label-monotonicity"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}