Metraipolis › archive › dc_abfa3dfd8160

Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound — arXiv:2609.05920

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.05920
License (as archived): CC0-1.0
Archived: 2026-10-16T13:40:04.865Z
SHA-256 of the archived text: 146722374c0faca2344bda38c2ec16e2b1fe33b94d039fa9182533ba35ce7a84
Stable URL of this page: https://metraipolis.com/documento/dc_abfa3dfd8160

How to cite

Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound — arXiv:2609.05920 — arXiv (en), https://arxiv.org/abs/2609.05920 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_abfa3dfd8160 (Metraipolis archive dc_abfa3dfd8160, sha256 146722374c0faca2344bda38c2ec16e2b1fe33b94d039fa9182533ba35ce7a84)

BibTeX

@misc{dcabfa3dfd8160,
  title = {Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound — arXiv:2609.05920},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.05920},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_abfa3dfd8160; sha256 146722374c0faca2344bda38c2ec16e2b1fe33b94d039fa9182533ba35ce7a84},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.05920. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Agent Skills combine instructions with files, packages, tools, models, and services, so operational identity can exceed a signed directory. Recursive or lazy dependencies may change while root-level evidence remains valid, and different surfaces may reach the same durable effect. We present ClosureBound, a reference monitor that prevents authorization transfer across material changes to this heterogeneous closure. Its resolver commits typed graph nodes and topology. Each grant binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs. At durability, it re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound. Supported equivalent paths share one ceiling. Assuming complete mediation and discovery, authenticated freshness, sound normalization, cryptographic binding, and authoritative linearization, we establish metadata non-authority, closure determinism, version non-inheritance, effect non-amplification, bound-value freshness, and path invariance. We do not establish program equivalence or remote-service honesty. A provider-free implementation matches 40 frozen lifecycle fixtures; 18 kernel contracts and six mutants cover binding and downgrade cases. Full-profile exploration reaches 84,608 states and 530,752 transitions without a declared invariant violation; six weakened profiles yield witnesses. A lexical audit of 549 public Skills (4,872 unique files) finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field. These observations motivate conservative closure discovery and define concrete targets for broader runtime, interoperability, efficacy, and production validation.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-09 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.05920 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T13:09:48.399Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-09?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).