Tool Schema and Registry Shadowing

Methodology, not an executable workflow. This page defines a trust boundary, close control, and evidence requirement. The operator must implement it against a specific authorized target; no command here claims to execute the full chain.

Deposit the trusted and shadow tool schemas, expose them through an identical registry topology, and record which schema/name/digest the agent selected. The attack shadow changes authority or argument meaning; the close control changes only presentation metadata; the miss remains ineligible by namespace or capability.

Correlate registry lookup, tool-selection span, arguments, execution event, and terminal oracle. Ablate registry resolution. Compare schema signing, exact tool identity, namespace isolation, duplicate-name rejection, and argument validation mitigations.