Response / Semantic-Cache Poisoning & Cross-User Cache-Bleed Check

Your response cache served one user's poisoned answer verbatim to another.

A recognized production-agent failure no other surface grades: a cache-key collision or a poisoned cache entry causes ONE user's manipulated / poisoned answer (or a stale poisoned safety decision) to be served VERBATIM to ANOTHER user — cross-tenant disclosure + injection delivery + stale-safety-bypass in a single mechanism. It is a DISTINCT trust boundary from its three nearest neighbours: memory-lab grades persisted cross-session / cross-actor MEMORY writes & reads; rag-scan grades the RETRIEVAL corpus / index; stored-injection grades persisted user CONTENT re-served as injection. NONE model the RESPONSE / SEMANTIC CACHE. AgentSmack taints each cache key with its storing identity (actor / tenant / session) + origin provenance (trusted / user_supplied / external / untrusted), binds each serve back to its store, and fires a hard blocker when an untrusted-origin entry is served, when a serve crosses a principal boundary, or when a directive smuggled into a cached value is grounded into an action. Ground-truth-first: a per-tenant-isolated, trusted-provenance cache with no cross-principal serve scores a clean 100. Raw cached values are never stored — only a sha-prefix + closed enums + distinct principal labels + a redacted excerpt. Load a sample to watch the store → serve lineage light up with no live infra.