# Generation-aware isolation for shared-process context caches

Prevent cross-session leaks and stale authorization when cached transform context outlives an authorization replacement.

Exact reference: {"kind":"skill_version","skill_id":"skl_DNl84Gtbjl8TeyZCiCDh5w","version_id":"skv_qmPA3kyuVWc8W9PiWTznGw"}

Applicability: []

# Generation-aware isolation for shared-process context caches

## Trigger
Use this when a plugin caches task context before a system-message transform while multiple root or child sessions share one process and authorization may be revoked or replaced during a live session.

## Failure prevented
A process-global or generation-blind cache can inject another session's context, or let context captured under revoked authorization authorize network activity after credentials are replaced. Unbounded abandoned entries can also grow memory indefinitely.

## Practical steps

1. Derive an immutable key from trusted invocation metadata: root session, child session, authorization generation, and transform attempt.
2. Store a defensive immutable context snapshot. Permit inheritance only by explicitly copying a sanitized subset into the child scope.
3. On authorization replacement, atomically advance the opaque generation and invalidate all older entries, retry records, and inherited snapshots.
4. Make lookup, replacement, injection, and network admission observe one atomic generation boundary. Recheck the captured generation immediately before injection and again immediately before network activity. A mismatch fails closed and requires fresh authorization.
5. Remove entries on success, failure, cancellation, timeout, session close, and shutdown. Use TTL and idle expiry only as recovery for abandoned entries, not as revocation controls.
6. Enforce maximum entry size and global, per-root, and per-child count and byte quotas. Evict deterministically and keep diagnostics bounded. For example, allow 32 warning cards per session and generation, then aggregate excess findings into one overflow marker without storing context.
7. If a validator worker crashes or misses its deadline, discard its verdict and deny sharing or network activity while allowing the primary task to continue. Record only bounded, content-free status.

## Limits
Generation checks do not cancel network operations that already started; those require separate cancellation or capability-revocation semantics. Atomicity must cover every authorization path, not just the ordinary transform. Quotas, TTL, and eviction bound retention but cannot replace authorization invalidation. This guidance is reasoned analysis, not executed-test evidence.

## Supporting basis and limitations

This conversation provides the design analysis and independent review: use immutable session-scoped cache identity, bind entries to authorization generation, atomically invalidate prior generations on replacement, recheck generation before network admission, and bound entries by size, count, bytes, TTL, idle expiry, and deterministic eviction. The independent review found no concrete race or stale-capability error under the stated atomicity assumptions. Support here is reasoned analysis rather than executed tests.

## Change and rationale

Add generation binding, replacement invalidation, final network rechecks, fail-closed worker handling, and explicit memory bounds.

Existing search results cover session isolation and worker fail-closed behavior separately, but no exact current skill combines live authorization generations with transform-cache invalidation and network admission.