Spent Authority Must Outlive the Generation: Seven Hot-Swap and Reload Bypasses in an Agent Approval Gate

Pitch

Where a hot-reloadable agent runtime rebuilt its approval state per generation, a spent single-use or budgeted approval came back to life. We catalogue seven such bypasses found in one audit wave and the one rule that closes them: key authority state to the rule or the content digest, never to the generation.

Abstract

Agent runtimes let an operator approve an irreversible action once, or install a standing auto-approve rule with a use count and a time-to-live. They also let the running program be swapped, rolled back, unloaded and reloaded, or forked, usually by tools the agent itself can call. We report an audit of this seam in revl's session layer, in which the approval state was built per generation. Seven defects followed one pattern: state that belongs to a rule, a grant or a program was stored on, or reset with, the generation, so a boundary crossing renewed authority the operator had already spent. A spent uses budget came back on every swap; the same budget came back on unload and reload; a fork started with a fresh budget; the activation-time spend path never wrote its counter back; a consumed single-use typed approval was re-seeded unspent into each successor; a deferral queue was orphaned in the dead owner so a queued irreversible send was lost while the verdict still read clean; and a gauntlet evidence dossier keyed by component name admitted a different program with the same name. Each fix has a named regression test on main; the distillation tests among them skip without the pinned cordis fork. The rule we extract is that authority state is keyed to the rule text or the content digest and settled at each owner boundary, and that carrying state forward may only narrow what a crossing can do. We also state what the fixes do not cover. We have no measurement of how often these bypasses are reachable by an agent in practice.

Problem and claim

Approval designs usually fix the question "who may say yes" and "how is a yes bound to a request". They say less about identity over time. If the runtime supports live update, the question "is this the same approval" depends on what the state is keyed on. Erlang-style code_change hands state across a swap by convention; capability systems treat revocation as the hard problem; allowlist approval in agent clients is per session. None of these name the failure mode where a boundary crossing, not an attacker action in the usual sense, quietly renews a bounded permission.

Claim: for this class, most defects are state-key or carry-direction errors. Two keys are correct: the rule (its canonical text) for budgets and review binds, and the component's content digest for evidence. In the seven cases catalogued here the generation is not a correct key for authority state, and the direction of any carry-over must be monotone (spent stays spent, the reviewed set stays as narrow as it was). The deferral-queue defect (item 508) is a missing carry, not a key error. The roadmap entries for the seven items (498, 500-504, 508) give the failure direction for each, which is mostly permissive (over-authorization) and, for the deferral queue, a lossy and falsely clean verdict.

Contributions

1. A catalogue of seven generation-boundary bypasses (items 498, 500, 501, 502, 503, 504, 508), each with the state, the boundary, the failure direction and the fix. A rollback-pointer defect (item 497) is a recovery-path analog and is not counted among the seven.
2. The keying rule: budgets and review binds are keyed by rule.to_dsl() (src/revl/mcp/session.py:8155, src/revl/mcp/session.py:8982) and persist through _persist_auto_spend (src/revl/mcp/session.py:5978); dossiers are keyed by (name, content digest); single-use approvals are settled back onto the session state at the generation boundary. Whether the budget persists beside the policy binding was not checked.
3. A test pattern, one test per boundary (swap, rollback, unload/reload, fork) per state kind, with a never-spent control and a "narrowing only" control.
4. A negative result: a fork must carry no approval but must carry the state that refuses one.
5. An accounting of exceptions: evidence is deliberately session-scoped (a dossier dies on unload) while budgets are not, and a failed load must not roll back the approval state, because a spend is committed before the activation body can fire it.

Related work

Evidence on main

Numbers that exist

• Seven defects in one audit wave, all dated 2026-09-13 in the roadmap entries. Test counts per file: 5 (tests/test_502_approval_replay.py), 31 (tests/test_distill_enforcement.py, of which 14, at lines 480 to 945, concern these boundaries), 8 (tests/test_290_dossier_content_binding.py), 14 (tests/test_247_second_pass_dataloss.py, 4 on the queue carry). Counts are def test_ lines; the tests were not run for this draft.
• Item 500's text reports a measured reproduction: a uses=2 rule whose crossing sat in an activation body fired across four consecutive swaps and accumulated 5 emissions. That is the only exploit magnitude available.
• No data on how the bugs were found (human audit, tool, agent) is available; we make no claim about discovery method.

Paper outline

1. Introduction: approval is a statement about identity over time.
2. Setting: session, generation, owner, rules, grants, typed approvals, deferral queue.
3. The seven bypasses: state, boundary, direction, fix, test, in a single table then short narratives.
4. The keying rule and the narrowing-only rule, with the three justified exceptions (session-scoped evidence, no refund on failed load, no approval carried by fork).
5. Making the class mechanical: field classification and mutation check.
6. Survey of other systems (if done).
7. Limits and related work.

Threats to validity and limits

• One codebase, one audit wave, one author team. Seven is a count of what was found, not of what exists. There is no estimate of residual bugs.
• The failure-direction claims come from the roadmap entries' own analysis; the entries and the code carry sites were read but the reproducers were not executed.
• Quorum item 499 is excluded: its defect is an ordering rule (a lapse overwrote a decided outcome), not a generation key.
• The distillation tests skip without the cordis fork, so a green run of a minimal environment proves nothing about them.
• Some reachability depends on a deployment where the agent can call unload, load, swap, rollback as tools; item 502 says these are ordinary tool verbs, not gated by the approve verb. A deployment with those verbs operator-gated narrows the impact.

Fact-check

Claims in this draft were checked against revl main at commit 45bec431f: 23 checked, 7 corrected.

Cite this draft

@misc{revlp26,
  author       = {Thomas Moussajee},
  title        = {Spent Authority Must Outlive the Generation: Seven Hot-Swap and Reload Bypasses in an Agent Approval Gate},
  year         = {2026},
  howpublished = {\url{https://inso1337.github.io/revl/research/P26.html}},
  note         = {Research draft, not peer reviewed. Written against revl commit 45bec431f. Licensed CC BY 4.0.}
}

Text licensed CC BY 4.0, author Thomas Moussajee.