An agent plugin caches task context and later injects it through a system-message transform. Several root sessions and nested child sessions run in one shared process. The design question is how to key and lifetime-manage that cache so one session never reads another session's context, including parent versus child isolation where required, while also bounding memory under long-lived processes. Constraints: treat this as architecture reasoning only; no repository inspection; prefer explicit session identity as the cache key, invalidate on session end, and use eviction or size caps so stale entries cannot grow without bound.
Related prior conversationsRelated search is temporarily unavailable. Continue with the public brief and verify any later suggestions.
Resolution sketch: key every cache entry by the concrete session id used for that transform invocation, never by process-global or root-only identity. Treat child sessions as distinct keys unless product rules explicitly require inheritance; if inheritance is needed, copy at fork time into the child key rather than reading the parent key later. Clear or tombstone on session dispose and on transform teardown. Bound memory with a max entry count and optional max bytes, LRU or TTL eviction for abandoned sessions, and store only the payload required for injection rather than full transcripts. Avoid module-level mutable singleton maps without a session key. Reasoning only; no local tests executed.
Extended requirement: authorization may be revoked and replaced while the process and root session stay alive. Cache keys must include both session id and an authorization generation or epoch token that bumps on every revoke or replace. On replacement, drop or tombstone all entries for prior generations under that session; do not merely overwrite a mutable credential field inside an old entry. Network paths must re-check the live generation at send time and refuse if the cached context generation is not current, so stale transform payloads cannot authorize outbound calls. In-flight work should cancel or fail closed when the generation advances. Reasoning only; no local tests.
Independent review requested of the session-plus-auth-generation cache design: composite keys, invalidate prior generations on replace, fail-closed network checks against live generation, cancel in-flight work. Reviewer instructed to find concrete defects or confirm soundness without local inspection. Awaiting that verdict.
Independent review verdict: design direction is necessary but not sufficient. Concrete defects: one, rebuild under the new generation can rebind not-yet-revoked credentials so send-time generation equality still passes with stale secrets unless credentials are generation-gated and revoked before rebuild. Two, child live generation must follow the auth root on bump; cascading cache tombstones alone leave children authorizing at the old epoch. Three, fork concurrent with invalidation can install a child entry under the old generation after the sweep. Four, generation compare without atomic credential invalidation or epoch held across check-and-use remains TOCTOU. Five, unbounded tombstone retention can defeat memory caps. Six, already-injected transform text is an unaddressed stale-context data path. Session keys, copy-on-fork, non-mutating old entries, and non-authoritative cache were not treated as errors.