# Generation-safe authorization for shared-process context caches

Prevent revoked or replaced authorization from reusing cached context or authorizing asynchronous work in shared agent processes.

Exact reference: {"kind":"skill_version","skill_id":"skl_QRS4oi_lTVyF-3Cr6oxV_g","version_id":"skv_viJbCB48-MQSR5lhiB3bSg"}

Applicability: [{"constraint":"Plugins that cache transform context across asynchronous session work","technology":"Shared-process agent plugins","version_scheme":"unknown"},{"constraint":"Caches whose authorization can be revoked or replaced during a live session","technology":"Authorization-aware context caches","version_scheme":"unknown"}]

# Generation-safe authorization for shared-process context caches

## Trigger
Use this when an agent plugin caches context before a system-message transform, multiple root or child sessions share a process, and authorization can be revoked or replaced while a root session remains alive.

## Failure prevented
Without generation binding, stale cached context or delayed callbacks can cross session boundaries, inject revoked context, authorize network activity after revocation, or overwrite state belonging to a replacement authorization.

## Practical steps

1. Create an immutable cache and work identity containing plugin instance, authorization lineage, root session, explicit child session, session epoch, authorization generation, content revision, and capability scope where reuse could cross a boundary.
2. Keep root and child entries separate. Give a child only an explicit, bounded immutable snapshot carrying its parent generation, revision, scope, and authorization identity. Reject stale or over-scoped snapshots.
3. Define one linearization point for authorization replacement. Advance the generation atomically before publishing replacement state, mark older entries stale, and cancel or invalidate queued work from older generations.
4. Bind transforms, refreshes, retries, network requests, and callbacks to an immutable generation token. At lookup, transform, injection, refresh, network admission, and response completion, compare that token with the current generation and replacement identity. Missing or mismatched state fails closed.
5. Treat cancellation as insufficient. Invalidate old work at dispatch, commit, and result-use points. Use compare-and-swap semantics for refreshes so an older refresh cannot overwrite newer state. Discard late results from obsolete generations.
6. Make cache admission, eviction, and byte accounting atomic. Enforce per-session and process-wide byte and entry budgets, context and history limits, child-concurrency limits, deadlines, and idle or time-based expiry. Use weighted eviction for unpinned entries and cancel or reject work when all entries are active and the budget is exhausted.
7. Clear entries on completion, cancellation, logout, authorization change, and plugin disposal. Ensure immutable snapshots cannot be mutated through aliases, and avoid retaining large errors or closures.
8. Record only value-free metrics such as bytes, entry counts, evictions, rejected writes, active pins, and generation mismatches.

## Limits
Deletion alone does not revoke an in-flight reference. Generation identifiers must be unique and non-reused across replacement and restart boundaries. A shared-process cache cannot safely infer authorization from ambient current-session state. TTL and LRU are memory controls, not authorization controls; security decisions require generation and identity checks at each boundary.

## Validation targets
Reason through concurrent roots, parent-child isolation, delayed transforms, revocation during lookup or queue delay, replacement during retry, late callbacks, refresh races, eviction pressure, and disposal. This guidance is reasoned analysis, not evidence from executed tests.

## Supporting basis and limitations

This proposal is based on the existing technical discussion about a shared-process agent plugin caching context before a system-message transform, including the requirement that authorization may be revoked and replaced while the same root session remains alive. The discussion and an independent review identified generation-token binding, a single replacement linearization point, stale-result suppression, compare-and-swap refreshes, and atomic memory accounting as necessary safeguards. Support is reasoned analysis only; no repository inspection or tests were executed.

## Change and rationale

Adds atomic authorization-generation binding, stale-work suppression, child provenance, compare-and-swap refreshes, and explicit memory bounds.

The existing isolation guidance addresses generation checks but does not present the full replacement ordering, in-flight invalidation, refresh race, child provenance, and budget-atomicity rules as one reusable procedure.