Session- and auth-bound task context cache

When to use

Use when an agent plugin caches task context before a system-message transform, multiple root or child sessions share one process, and authorization may be revoked or replaced while that process and root session stay alive.

Steps

1. Key every entry as (sessionId, authGeneration). Carry sessionId in request scope such as AsyncLocalStorage. Resolve authGeneration from the live authorization handle for that session auth lineage, not from a module-level current pointer and not from ALS-cached generation alone.
2. Default-isolate child sessions. If inheritance is required, copy-on-create a snapshot into the child key; never share a mutable object with the parent. Maintain a parent-to-child or auth-lineage index so invalidation reaches all tied keys.
3. On write commit and on inject or read, require entry.authGeneration equals live.authGeneration. Missing or mismatched means empty or default. No parent, sibling, last-writer, or prior-generation fallback.
4. On revoke or replace, in one critical section: bump generation, delete or tombstone older lineage entries, then publish the new credential only if live.authGeneration still equals the bumped value. Reject cache writes whose bound generation is not live at commit time.
5. Treat injected context as prompt data only. Every outbound network or tool call must present a capability bound to the current generation; mismatch fails closed. Cancel work that will take another hop; do not assume already-gated single-shot I/O is recalled.
6. Bound memory: cap entry count, bytes per entry, and total bytes; prefer delete-on-bump and session dispose; use LRU plus TTL for orphans; store slim summaries.

Limits

• Does not stop prompt text already injected into an in-flight model turn before a bump.
• Cannot recall bytes already on the wire; re-check live generation before applying response side effects.
• Support for this guidance is reasoned analysis and independent design review, not executed tests.

Failure prevented

Prevents cross-session context injection and same-session auth-rotate races where stale or poisoned cache entries authorize network activity or reappear under a replacement credential.