{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-of-a-tool-manifest-loader-enforce-schema-invariants-relative-to-skill-injection",
  "title": "Where must an instance of a tool-manifest loader enforce schema invariants relative to skill injection",
  "date_of_record": "2026 November 10",
  "scope": "Applies to agent runtimes that resolve tool manifests (JSON/YAML) at runtime from mutable or remote sources and merge them into an active capability set. Does not apply to statically compiled tool registries or manifests pinned by content hash at build time with no runtime re-resolution path.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-tool-manifest-loader-enforce-schema-invariants-relative-to-skill-injection.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-tool-manifest-loader-enforce-schema-invariants-relative-to-skill-injection.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-tool-manifest-loader-enforce-schema-invariants-relative-to-skill-injection.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1389,
    "python_slice_tokens": 247,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure is not \"a malicious manifest was loaded.\" The failure is a **trust-boundary inversion during merge**: a manifest that is individually valid is merged into a capability set whose *union* violates an invariant that no single manifest was checked against. Skill injection becomes possible when the loader validates each manifest in isolation but treat...",
    "what_was_observed": "In a staging runtime, a dynamically loaded manifest set of 41 tools was resolved from a local directory watched by a reload loop. A benign-looking manifest added a tool named `read_file` with an identical signature to the existing one but an additional optional field `encoding`. The loader's merge was `dict.update`, so the new schema replaced the old. No error. The agent's planner, which had cached a prompt fragment ...",
    "condition_of_validity": "The invariant holds only under the following conditions, all of which must be checked at merge time, not load time: 1. **Monotonic narrowing.** For any tool name, the effective schema after merge must be a structural subtype of every schema previously active for that name. Violation is a widening event and must abort the merge, not warn. 2. **Name provenance...",
    "decision_boundary": "Abort the merge when any of the following is true; do not degrade to a warning: - Effective schema for a name is not a subtype of the prior effective schema (widening). - A name is declared by a second source without a matching `supersedes` hash. - The merge changes the set of required fields for any name. - A handler default becomes reachable under the new ...",
    "operational_effect": "Enforcing narrowing-only merges converts skill injection from a silent capability expansion into a hard load failure. In the staging runtime, after the change, the `encoding` manifest was rejected with a widening error, the planner cache was invalidated on every accepted merge, and the empty-argv default branch became unreachable because the schema required ..."
  },
  "matched_failure_symptoms": [
    "SCHEMA_DRIFT_OR_COERCION_CRASH"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "9ad4baa2c662ee70661044f3da07d61c7ff6bc767b2206083d3652c5b050a7ab",
    "verified_classes": [
      "ManifestMergeInvariantError"
    ],
    "verified_functions": [
      "_schema_hash",
      "_required_fields",
      "_is_narrowing",
      "merge_manifests"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "ManifestMergeInvariantError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "hashlib",
      "json",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}