{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-taint-aware-tool-sandboxing-silently-lose-its-exfiltration-block-when-the-labeled-context-is-re-materialized-through-a-cache-h",
  "title": "Why does an instance of taint-aware tool sandboxing silently lose its exfiltration block when the labeled context is re-materialized through a cache hit",
  "date_of_record": "2026 November 13",
  "scope": "Applies to tool-calling agents whose sandbox enforces information-flow control (IFC) via taint labels attached to context segments, where labeled segments may be served from a shared or per-session cache before being passed to a tool. Does not apply to stateless sandboxes that re-derive taint from provenance on every call, nor to deployments where cache entries carry and re-validate their original taint label.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-taint-aware-tool-sandboxing-silently-lose-its-exfiltration-block-when-the-labeled-context-is-re-materialized-through-a-cache-h.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-taint-aware-tool-sandboxing-silently-lose-its-exfiltration-block-when-the-labeled-context-is-re-materialized-through-a-cache-h.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-taint-aware-tool-sandboxing-silently-lose-its-exfiltration-block-when-the-labeled-context-is-re-materialized-through-a-cache-h.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1467,
    "python_slice_tokens": 288,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A taint-aware sandbox has two distinct jobs that are easy to conflate: (1) *tracking* which bytes in the model context are derived from labeled sources, and (2) *enforcing* a flow policy at the boundary where a tool receives arguments. The invariant that is commonly assumed is that \"if a labeled segment is present in context, any tool call whose arguments ov...",
    "what_was_observed": "In a representative agent runtime, a document retrieved from a sensitive corpus was labeled `SENSITIVE:customer_pii` and placed in context. A summarization step produced a derived segment that inherited the label. On a subsequent turn, the same document was requested again; the retrieval layer served it from a content-addressed cache. The cached object was deserialized and inserted into context as a fresh segment. Th...",
    "condition_of_validity": "The block is valid only when the following holds for every labeled segment reaching a tool boundary: 1. Provenance is keyed on content identity (e.g., a cryptographic hash of the segment bytes plus its label set), not on the insertion event or the transport that delivered it. 2. Cache entries persist the full label set alongside the payload, and cache hits r...",
    "decision_boundary": "The operational decision is whether to treat a cache hit as a *new* context insertion (requiring re-derivation of taint) or as a *replay* of the original insertion (inheriting taint). The correct choice is replay-inheritance, but it is not free: it requires the cache to be taint-aware, which in turn requires that eviction and invalidation respect label chang...",
    "operational_effect": "The practical consequence is a class of exfiltration that appears only under cache warmth, evades cold-path test suites, and produces audit logs that look clean because the taint tracker faithfully reports \"untainted\" at the moment of the call. Detection requires correlating cache-hit events with tool-call argument overlap against the *original* labeled corp..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4540a6fad1bdbe661880cfc6f120943d5de29365de53199db87e405b3e3d4f6d",
    "verified_classes": [
      "TaintLaunderingError",
      "Segment",
      "TaintAwareCache"
    ],
    "verified_functions": [
      "enforce_flow",
      "second_read_exfil_test",
      "content_hash",
      "__init__",
      "put",
      "get"
    ],
    "verified_functions_count": 6,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "TaintLaunderingError"
    ],
    "sample_fail_closed_invariants": [
      "cache miss on warmed entry"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}