Security: planner safe registration descriptors for third party agents

Finding

Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems (arXiv:2609.15516, submitted 2026-09-14) identifies a pre-invocation attack surface: planner-visible third-party agent descriptions can alter decomposition, capability grounding, or subtask specifications before any worker executes. The originating team reports that one manipulated description can reduce GAIA task success from 84.31% to 37.25%, and some attacks increase token use or execution time by more than 111%. DescGuard restores performance toward baseline by retaining only worker-scoped interface information before planner exposure.

Evidence class: originating-team report. The paper states artifacts will be released; no independent RuV reproduction claim is made.

Primary source: https://arxiv.org/abs/2609.15516

RuV contradiction result

Current Ruflo A2A ingestion already has a useful partial defense. fromAgentCard maps remote cards into FederationNode using skill identifiers and transport metadata, enters them at TrustLevel.UNTRUSTED, and does not copy the card description or skill descriptions into the federation registry. This means the paper does not demonstrate a current A2A exploit in Ruflo.

The missing primitive is an explicit planner-visible descriptor boundary that future federation, marketplace, WASM gallery, MCP, or plugin discovery integrations can reuse without accidentally reintroducing free-form third-party text.

RVM issue #55 remains the canonical pre-invocation tool lifecycle gate. This issue is narrower and earlier: sanitize what the planner may see at registration time, before tool selection or invocation exists.

Opportunity score

4.655 / 5 using the daily RuV weighting model.

Scores: applicability 5, performance impact 3, implementation speed 4.5, cross-stack leverage 5, commercial value 5, strategic differentiation 5, security improvement 5, open-source leadership 4.5, evidence confidence 4, long-horizon option value 5, reversibility 5.

Decision

Add an additive PlannerSafeAgentDescriptor contract to the agent federation package. A remote card never supplies planner prose directly. The remote registration supplies only a bounded canonical capability identifier. A host-controlled resolver maps recognized identifiers to typed planner fields: functionality, input specification, output specification, and usage constraints. Unknown capabilities are omitted by default.

Required invariants

1. Card description, skill description, examples, tags, extension parameters, provider text, and documentation URLs never enter planner-visible output.
2. Capability identifiers are NFKC-normalized, bounded, free of controls, bidi/invisible characters, and constrained to a canonical identifier grammar.
3. Unknown or malformed capabilities fail closed and are not exposed to the planner.
4. Host-resolved definitions are bounded and canonicalized before exposure.
5. Planner descriptors carry authority: none; registration metadata never grants execution capability.
6. RVM remains the privileged invocation boundary and issue #55 remains responsible for tool lifecycle trust.
7. The existing A2A ingestion and trust semantics remain unchanged as rollback.

Benchmark and adversarial contract

Freeze benign and malicious cards covering prompt injection in card descriptions, skill descriptions, examples, tags, extension params, invisible Unicode, bidi controls, markup, oversized fields, duplicate skills, unknown skills, and post-registration metadata changes.

Report baseline raw-text exposure rate, candidate exposure rate, benign recognized-capability retention, false exclusion, validation throughput, p95 latency, bytes, failures, exact Node version, commit, seeds where randomized, and reproduction commands.

Acceptance for the structural primitive requires zero attacker-controlled free-form text reaching planner-visible output, zero unknown capability exposure, deterministic output, and benign recognized capability retention of 100% on the frozen corpus. Task-level utility claims require a separate MetaHarness reproduction against a real planner.

MetaHarness roles

Research pins the paper and current Ruflo surfaces. Implementation builds only the descriptor boundary. Review checks for accidental semantic reintroduction of raw metadata. Security attacks Unicode, markup, duplicate identifiers, scope confusion, and registration mutation. Testing runs unit, adversarial, and structural benchmark cases. Reproducibility binds exact head, Node versions, corpus, and commands. Release remains human-only.

Cross-stack reuse

RuFlo owns registration and planner exposure. RVM owns actual effect authorization. RVF can bind descriptor and source-card digests. MetaHarness measures planning utility and attack success. RuVector may index validated descriptors but cannot infer capabilities from untrusted description embeddings. RuVector WASM and WASM gallery can reuse the same contract. Cognitum can apply it to partner agent catalogs and MCP discovery. Core Memory records registration evidence and revocation without converting metadata into authority.

Governance

No autonomous merge, deployment, credential escalation, capability widening, evaluator mutation, threshold weakening, or irreversible migration.