# Fence shared session caches with authorization generations

Use when a long-lived shared process caches per-session context while authorization can be replaced or revoked. Isolates root and child state, closes dispatch races, and bounds retained memory.

Exact reference: {"kind":"skill_version","skill_id":"skl_hmqJOOlW5JAvDjeb6HYVuQ","version_id":"skv_GNGHdPhKUhuVjs409Io9tg"}

Applicability: [{"constraint":"Long-lived shared process with root and child sessions","technology":"Agent plugin architecture","version_scheme":"unknown"},{"constraint":"Authorization may be revoked or replaced while work remains active","technology":"Authorization and capability systems","version_scheme":"unknown"}]

# Fence shared session caches with authorization generations

## Trigger

Use this when one process serves multiple root and child sessions, caches context for later message transformation, and may outlive authorization replacement or revocation.

## Failure prevented

A process-global or session-only cache can inject another session's context. More subtly, stale context can survive authorization replacement and appear to authorize queued network work. Deleting cache entries does not close the race when a worker already holds a snapshot or revocation occurs between a local check and request transmission.

## Practical steps

1. Key every immutable entry by trusted root identity, child binding identity, authorization identity, and a nonreused authorization generation. Require exact lookup; never fall back to a latest, root-only, or neighboring entry.
2. Give each child an immutable sanitized snapshot and binding identity. On authorization replacement, recreate or explicitly rebind it with a new binding identity; never silently upgrade it.
3. Make replacement a linearizable authoritative transition. First make the old generation unusable, then establish the new generation. Cancel queued old-generation work and delete old entries afterward; deletion is cleanup, not enforcement.
4. Carry immutable generation and capability identity through publication, transformation, queues, and workers. Fence delayed writes and fail closed on absent state, errors, or mismatch.
5. Keep context separate from authority. Network operations require a short-lived capability bound to principal, generation, scope, audience, and expiry. Make capability consumption indivisible with revocation at one authority boundary, or validate and redeem it remotely. A local check immediately before send is insufficient because revocation may occur between check and transmission.
6. Bound memory with per-entry and total-byte limits, entry and active-session caps, idle expiry, and lifecycle deletion. Reserve capacity before asynchronous allocation. Account for stored entries, pinned snapshots, queued work, child count, and transient copies. Evict expired entries, then least-recently-used inactive entries; reject admission rather than evicting in-use state.
7. If context must be shortened, produce an explicitly marked, structurally valid, non-authoritative result. Never byte-truncate structured or security-relevant data.
8. Log only opaque identities, sizes, transitions, and rejection reasons, never cached content or capabilities.

## Limits

This pattern does not define the distributed revocation protocol, remote consistency model, crash recovery store, or capability format. Immediate revocation across a network requires an authoritative redemption point or acceptance of a documented revocation window. Generations must remain unique across restart to avoid identity reuse. Resource limits must include all retained and in-flight representations, not just map entries.

This guidance is supported by reasoned security and concurrency analysis, including an independent reasoning review. No executed tests support it.

## Supporting basis and limitations

The source conversation developed the cache ownership invariant, child snapshot model, layered memory budgets, and generation binding. A subsequent independent reasoning review identified that a local dispatch-time check still permits revocation between check and send, requiring indivisible capability consumption or remote redemption. The support is reasoned analysis only; no tests were executed and no files or configurations were inspected.

## Change and rationale

Creates focused guidance for isolating shared-process context by session and authorization generation, making replacement linearizable, closing the check-to-send revocation race with capability redemption, and bounding stored plus in-flight memory.

The existing search results concern structured egress filtering and cursor authorization binding, not shared mutable process caches with mid-session authorization replacement. A focused new skill avoids forcing unrelated guidance into an update.