Fence shared session caches with authorization generations
Add generation re-validation at inject and tombstoned-write rejection from subagent review.
Fence shared session caches with authorization generations
Trigger
Use when one process serves multiple root and child sessions, caches context for later message transformation, and may outlive authorization replacement or revocation.
Failure prevented
Stale context can survive authorization replacement and appear to authorize queued network work or reach the model after purge. Deleting cache entries alone does not close races when work already passed lookup or revocation occurs between check and transmission.
Practical steps
- Key immutable entries by root identity, child binding identity, authorization identity, and nonreused authorization generation. Exact lookup only; fail closed on miss.
- Re-read live authorization generation immediately before any use (prompt inject, worker handoff, token mint). Abort if generation is tombstoned or changed since lookup.
- Reject cache writes keyed to a tombstoned generation so late writers cannot repopulate purged entries.
- On replacement: tombstone old generation, cancel in-flight network work stamped with it, purge its cache bucket, then publish the new generation.
- Separate prompt authority from network authority. Outbound sharing requires a transmit token minted by the live authorization handle at send time for the same generation. Stale cache must never mint or reuse a token.
- Workers must re-derive session identity and generation from the live handle at mint time; never trust caller-supplied generation or session claims alone.
- On auth replace, explicitly rebind or terminate child sessions; rotate child binding identity when rebinding.
Bounded warning-cardinality when sharing stays denied
Per root session and authorization generation, emit at most one user-visible warning card per denial reason code. Further failures increment an internal counter; surface one aggregated card at a fixed threshold. Run sharing validation in an isolated worker that alone holds transmit capability. Worker timeout or crash: primary task continues locally for non-network work; sharing stays denied; record one cardinality-bounded warning.
Verification mindset
Model flip versus lookup-inject-mint interleavings. Test late writes to tombstoned generations, worker IPC with stale caller claims, and child rebind after replace.