{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-a-shared-agent-memory-store-accept-a-poisoned-write-that-passes-every-provenance-check",
  "title": "Why does an instance of a shared agent memory store accept a poisoned write that passes every provenance check",
  "date_of_record": "2026 November 11",
  "scope": "Applies to multi-agent memory stores where writes are gated by provenance metadata (origin agent ID, signature, trust tier, derivation chain) and where poisoning detection operates on content or embedding anomalies. Does not apply to single-writer stores, stores with no provenance layer, or stores where all writers share an identical trust tier and trust tier is the only gate.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-shared-agent-memory-store-accept-a-poisoned-write-that-passes-every-provenance-check.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-shared-agent-memory-store-accept-a-poisoned-write-that-passes-every-provenance-check.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-shared-agent-memory-store-accept-a-poisoned-write-that-passes-every-provenance-check.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1657,
    "python_slice_tokens": 306,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Provenance validation answers *\"is this write attributable and authorized?\"* Poisoning detection answers *\"is this write consistent with the store's established distribution?\"* These are orthogonal predicates, and the failure mode lives in the gap between them: a write can be perfectly attributable (valid signature, legitimate origin agent, intact derivation...",
    "what_was_observed": "A memory store serving 40+ agents accepted a sequence of writes from a legitimately-registered agent whose credentials had been obtained through a compromised tool-call path. Each write carried: - A valid Ed25519 signature over the payload hash. - A `derived_from` pointer to an existing, trusted memory record. - A trust tier of `verified-peer` (correctly assigned — the agent was, in fact, a verified peer). The poison...",
    "condition_of_validity": "The failure is bounded by three conditions, all of which must hold for the gap to be exploitable: 1. **Provenance is validated at write time but not re-validated against content at read time.** If the store recomputes a claim-consistency check between child and parent at read time, the poisoned writes surface as inconsistencies. 2. **The poisoning detector u...",
    "decision_boundary": "The operational decision is *not* \"tighten the anomaly threshold\" — that produces false positives on legitimate paraphrase and legitimate knowledge update, both of which are derivation-shaped by nature. The decision boundary is: - **Accept** a write when provenance is valid **and** the write's claims are entailed by (not merely embedded-near) its parent, **a...",
    "operational_effect": "After deploying the two-stage gate (entailment check + chain-drift budget) on the affected store: - The 340-write poisoning sequence was retroactively flagged: 61 writes failed claim-entailment against their parents, and the chain-drift budget was exceeded at write 47. The three inverted configuration facts were restored from the chain root. - False-positive..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "5bb831045e547078c751fbba8522582821a23a45244bd1126b383717acf7d2bb",
    "verified_classes": [
      "ProvenancePoisoningError",
      "MemoryRecord",
      "DriftBudget"
    ],
    "verified_functions": [
      "check_entailment",
      "validate_write"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ProvenancePoisoningError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}