# Session- and auth-bound task context cache Key in-process task-context caches by session epoch, live auth generation, and content revision; isolate shared-process sessions, survive mid-session auth replace, and keep prompt data separate from network authority. Exact reference: {"kind":"skill_version","skill_id":"skl_wCKU3ytdp9mfmqZocBWzrA","version_id":"skv_nDa7MQWC6yPF6EXbMdznEw"} Applicability: [] # Session- and auth-bound task context cache Key in-process task-context caches by session epoch, live auth generation, and content revision; isolate shared-process sessions, survive mid-session auth replace, and keep prompt data separate from network authority. ## When to use Use when an agent plugin caches task context before a system-message transform, multiple root or child sessions share one process, and authorization may be revoked or replaced while that process and root session stay alive. ## Practical steps 1. **Composite key with explicit sentinels.** Key every immutable entry by authLineageId, sessionId, sessionEpoch, authGeneration, contentRevision, processEpoch, childBindingId, and parentLineageGeneration. Use explicit root sentinels for childBindingId and parentLineageGeneration on root sessions—never omit or share a default that could collide. Resolve authGeneration from the live authorization handle at every write, read, and inject. 2. **Session epoch in request scope.** Carry sessionId and sessionEpoch in request scope such as AsyncLocalStorage. Registry lookup requires both; sessionId reuse without epoch match fails closed to empty. If scope is lost after await or across worker boundaries, fail closed. 3. **Separate auth generation from content revision.** Bump contentRevision for content-only updates; bump authGeneration only on revoke or replace. Bind each model turn to explicit contentRevision in a turn lease carried on the turn handle—never inject implicit latest across internal awaits. 4. **Exact lookup, fail closed.** After any await, re-resolve the full composite key from live handles immediately before lookup. Missing key, generation mismatch, or stale parentLineageGeneration on child entries yields empty or default inject. Never fall back to parent, sibling, latest, or prior generation. 5. **Auth replace as atomic handle fan-out.** Under one revoke critical section: tombstone entries matching revoked authLineageId and authGeneration including child lineage; if authLineageId rotates on replace, tombstone all entries for the old authLineageId across every generation; cancel queued work tagged with old generation and version-stamp schedulers so stragglers must pass execution-time checks; bump every bound handle—root, child, in-flight continuations—so new credentials and new authGeneration become observable together; signal in-flight workers to abort or re-check at commit. On swap failure after tombstone, fail closed on network and inject. 6. **Child fork with visibility gate.** Copy-on-create a sanitized snapshot under a critical section blocking parent writers and child readers. Publish childBindingId, parentLineageGeneration, and snapshot-ready atomically—no child read or inject until copy completes. Re-validate live parent generation on every child read and inject. 7. **Inject lease with cross-thread lock.** If workers share the cache, one lock must cover resolve live handle, build full key, lookup, verify generations, and pin. Minimum unit: read live generation and turn-bound contentRevision, select under full key, verify, pin, defensive copy into message buffer, release pin. Repeat entire unit after any await. Tombstone rejects new pins; cap pinned bytes, concurrent pins, and pin duration per session. 8. **Worker write commit CAS.** At commit, require authGeneration and contentRevision to match values observed at write start and contentRevision must be at or above the high-water mark for that binding. Tombstone or mismatch aborts; never revive stale-generation entries. 9. **Prompt data versus network authority.** Cached context is prompt data only—never embed credentials or scopes. Mint short-lived capabilities from a live-handle snapshot. Tag dispatches with authLineageId and authGeneration; reject mismatch at enqueue and again at execution before socket write, RPC, or filesystem side effect. Re-check generation before any async side effect outside the cache. 10. **Memory bounds.** Cap bytes per entry, per session, and process-wide. Delete-on-bump as primary eviction; LRU plus TTL for orphans. Account pinned snapshots, pin refcounts, fork duplication, and queued work in budgets. ## Limits - Does not scrub prompt text already injected into an in-flight model turn before auth replace. - Cannot recall bytes already on the wire under a prior generation. - Model may plan from semantically stale prompt while network gate uses fresh credentials. - Does not define distributed revocation protocol, capability format, or crash-recovery store. - Support is reasoned analysis and independent adversarial subagent review in the source conversation, not executed tests. ## Failure prevented Prevents cross-session context injection including sessionId reuse without epoch; stale context surviving auth replace or lineage rotation; child torn reads and parent-writer races at fork; inject TOCTOU across await, threads, or concurrent replace; stale revision winning after concurrent writes; cross-lineage tombstone collateral; stale prompt authorizing network activity via enqueue-only gates; pin eviction use-after-free; generation-gated cache with ungated side effects; and unbounded memory from orphaned generations, idle sessions, or pin leaks. ## Supporting basis Reasoned design analysis and independent adversarial subagent review in the cited source conversation. No repository inspection and no executed tests were performed. ## Supporting basis and limitations Multi-turn reasoned design in this conversation covering session isolation, mid-session auth replace, and adversarial subagent review. Architectural reasoning only; no executed tests. ## Change and rationale Incorporate adversarial-review patches: sessionEpoch scope, lineage-rotation tombstone, child visibility gate, cross-thread inject lock, worker commit CAS with revision high-water mark, execution-time network gate, pin bounds, root sentinels, turn-lease carrier, and scheduler straggler handling. Independent adversarial review found seven concrete gaps in the prior version—thread TOCTOU, revision CAS, sessionId reuse, lineage rotation, partial fork reads, enqueue-only network gate, and uncancelled microtasks. These minimal patches close the holes without changing the fail-closed core model.