{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-of-the-egress-taint-correlator-draw-the-syscall-completion-boundary-and-why-the-naive-post-return-hook-is-unsound",
  "title": "Where must an instance of the egress-taint correlator draw the syscall-completion boundary, and why the naive \"post-return\" hook is unsound",
  "date_of_record": "2026 November 12",
  "scope": "Applies to sandboxed tool-execution runtimes that combine (a) syscall-level confinement (seccomp-bpf / ptrace-based interception / user-space syscall brokers) with (b) egress-taint correlation, i.e. the propagation of a \"this process has touched sensitive data\" mark to outbound network operations. Does not apply to pure capability-model sandboxes with no data-flow taint tracking, nor to correlators that operate on whole-process snapshots rather than per-syscall events.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-of-the-egress-taint-correlator-draw-the-syscall-completion-boundary-and-why-the-naive-post-return-hook-is-unsound.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-the-egress-taint-correlator-draw-the-syscall-completion-boundary-and-why-the-naive-post-return-hook-is-unsound.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-the-egress-taint-correlator-draw-the-syscall-completion-boundary-and-why-the-naive-post-return-hook-is-unsound.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1707,
    "python_slice_tokens": 247,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The correlator has exactly one job that matters at the boundary: decide, for each outbound `connect`/`sendto`/`sendmsg`, whether the calling thread's taint state was established *before* the bytes being sent were materialized. The naive design hooks the syscall *after* the kernel returns to user space (a ptrace `PTRACE_SYSCALL` stop on exit, or a seccomp use...",
    "what_was_observed": "A tool sandbox running a filesystem-reading tool (`read_file` → protected fd → `read()` into a heap buffer → later `writev()` to a logging socket) was instrumented with a ptrace tracer that marked taint on `read` exit and checked taint on `sendmsg` **exit**. Under load, a small but reproducible fraction of tainted sends were *allowed* even though the read had completed and the taint mark was set. The window was not a...",
    "condition_of_validity": "The entry-stop boundary is only sound if all three of the following hold: 1. **No coalescing.** The tracer must guarantee a distinct stop on the entry of every `send*` syscall, and must not resume the thread past a `send*` entry until the taint check has committed a verdict. Under ptrace this requires `PTRACE_SYSCALL` with no `PTRACE_SINGLESTEP` shortcuts an...",
    "decision_boundary": "At `send*` entry, the correlator must choose between three verdicts, and the choice must be made *before* the kernel is allowed to proceed: - **Deny** if the source range overlaps any committed tainted range and the destination is outside the sandbox's egress allowlist. Return `-EPERM` via the user-notification path; never `CONTINUE`. - **Allow-with-mark** i...",
    "operational_effect": "Drawing the boundary at send entry with taint committed at read exit eliminated the observed misses and, as a side effect, made the correlator's log total-ordered: every `egress_allowed` event now has a preceding `taint_set` event with a strictly smaller sequence number, which is the property an auditor actually needs. The cost is that the sandbox can no lon..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "0569a5e094de597762201c6eac635ddf887ccba7b216c5bb4198cad0a93182af",
    "verified_classes": [
      "TaintBoundaryError",
      "Range",
      "ThreadTaint"
    ],
    "verified_functions": [
      "check_egress",
      "overlaps",
      "commit_read",
      "is_tainted"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintBoundaryError"
    ],
    "sample_fail_closed_invariants": [
      "tainted egress to non-allowlisted destination: return -EPERM at entry, do not CONTINUE"
    ],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}