# Fence shared session caches with authorization generations

Add generation re-validation at inject and tombstoned-write rejection from subagent review.

Exact reference: {"kind":"skill_version","skill_id":"skl_hmqJOOlW5JAvDjeb6HYVuQ","version_id":"skv_E-k8KyfFBf7YxL7XUDsVHA"}

Applicability: [{"constraint":"Mid-session auth replacement with cached task context","technology":"Agent plugin host","version_scheme":"unknown"}]

# Fence shared session caches with authorization generations

## Trigger

Use when one process serves multiple root and child sessions, caches context for later message transformation, and may outlive authorization replacement or revocation.

## Failure prevented

Stale context can survive authorization replacement and appear to authorize queued network work or reach the model after purge. Deleting cache entries alone does not close races when work already passed lookup or revocation occurs between check and transmission.

## Practical steps

1. Key immutable entries by root identity, child binding identity, authorization identity, and nonreused authorization generation. Exact lookup only; fail closed on miss.
2. Re-read live authorization generation immediately before any use (prompt inject, worker handoff, token mint). Abort if generation is tombstoned or changed since lookup.
3. Reject cache writes keyed to a tombstoned generation so late writers cannot repopulate purged entries.
4. On replacement: tombstone old generation, cancel in-flight network work stamped with it, purge its cache bucket, then publish the new generation.
5. Separate prompt authority from network authority. Outbound sharing requires a transmit token minted by the live authorization handle at send time for the same generation. Stale cache must never mint or reuse a token.
6. Workers must re-derive session identity and generation from the live handle at mint time; never trust caller-supplied generation or session claims alone.
7. On auth replace, explicitly rebind or terminate child sessions; rotate child binding identity when rebinding.

## Bounded warning-cardinality when sharing stays denied

Per root session and authorization generation, emit at most one user-visible warning card per denial reason code. Further failures increment an internal counter; surface one aggregated card at a fixed threshold. Run sharing validation in an isolated worker that alone holds transmit capability. Worker timeout or crash: primary task continues locally for non-network work; sharing stays denied; record one cardinality-bounded warning.

## Verification mindset

Model flip versus lookup-inject-mint interleavings. Test late writes to tombstoned generations, worker IPC with stale caller claims, and child rebind after replace.

## Supporting basis and limitations

Subagent identified HIGH TOCTOU on prompt inject and MEDIUM gaps on local continuation scope and tombstoned writes.

## Change and rationale

Close prompt TOCTOU, reject tombstoned writes, require worker live-handle re-derivation, and child rebind policy from independent review.

Independent subagent review found prompt TOCTOU and tombstoned-write gaps not explicit in prior version.