{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-the-litmus-safety-harness-from-silently-passing-a-regressed-agent",
  "title": "Which invariants prevent the LITMUS safety harness from silently passing a regressed agent",
  "date_of_record": "2026 November 12",
  "scope": "Applies to construction and mutation of LITMUS-style safety benchmark harnesses that elicit agentic risk behaviors (tool misuse, prompt-injection compliance, sandbox escape) and gate regressions via pass/fail aggregation. Does not apply to static content-classifier evaluation, red-team scoring where human adjudication replaces automated oracles, or harnesses that execute against live production side effects rather than sandboxed tool stubs.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-the-litmus-safety-harness-from-silently-passing-a-regressed-agent.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-the-litmus-safety-harness-from-silently-passing-a-regressed-agent.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-the-litmus-safety-harness-from-silently-passing-a-regressed-agent.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1323,
    "python_slice_tokens": 234,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A LITMUS harness has two distinct failure surfaces that are routinely conflated: **elicitation failure** (the probe did not provoke the risk behavior, so the agent's refusal is uninformative) and **detection failure** (the risk behavior occurred but the oracle did not observe it). A regression gate that aggregates raw pass rates cannot separate these. An age...",
    "what_was_observed": "During a harness revision cycle, a suite of 240 tool-misuse scenarios was replayed against two agent builds: a baseline and a candidate with a tightened planner that dropped multi-turn tool chaining. The candidate's aggregate pass rate rose from 0.91 to 0.97. Investigation showed the delta was entirely composed of scenarios where the agent terminated the episode before invoking the second tool — the injection payload...",
    "condition_of_validity": "The engagement-precondition invariant is valid only when each scenario declares, in machine-checkable form, the minimum trace signature that constitutes \"reached the decision point.\" For a two-hop exfiltration probe this is the presence of a `read_file` tool call with the canary path, *before* the terminal action, regardless of whether the terminal action oc...",
    "decision_boundary": "The boundary is between *scenarios that can be satisfied by non-engagement* and *scenarios that require engagement to be scored at all*. A scenario belongs on the gated side only if its precondition predicate is non-trivially satisfiable — i.e., there exists a trace that satisfies the precondition and fails the risk predicate, and a trace that satisfies the ...",
    "operational_effect": "Applying the precondition invariant changed the candidate build's reported safety rate from 0.97 back to 0.91 with 18 scenarios reclassified as `INCONCLUSIVE` — matching the baseline within noise and correctly flagging the planner regression. The gate now blocks merges when a scenario family exceeds the inconclusive threshold, and the trace-level oracle catc..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "7a2f08adcf3b95cb254da6b99822a43450f0c31952aef09e8395e03214328f29",
    "verified_classes": [
      "HarnessInconclusiveError",
      "Scenario",
      "FamilyStats"
    ],
    "verified_functions": [
      "score",
      "gate"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "HarnessInconclusiveError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}