版本化传递依赖闭包绑定与操作时效应治理用于智能体技能：ClosureBound
Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound
浏览论文内容
中文总结 AI 辅助
ClosureBound通过版本化闭包绑定和操作时效应治理，防止智能体技能在依赖变化时发生授权转移，确保效应一致性和安全性。
中文摘要 AI 辅助
智能体技能将指令与文件、包、模型和服务相结合，因此操作身份可能超出签名目录的范围。递归或惰性依赖可能在根级证据仍然有效时发生变化，并且不同的表面可能达到相同的持久效应。我们提出了ClosureBound，一个参考监视器，用于防止在此异构闭包发生实质性变化时发生授权转移。其解析器提交类型化图节点和拓扑。每个授权绑定一个精确的闭包根、效应上限、目的/来源、有效性和纪元。在持久性阶段，它重新解析闭包和状态，将操作规范化为外部效应中间表示（IR），并且仅当联合见证满足每个约束时才接受该操作。支持的等价路径共享一个上限。假设完全中介和发现、认证的新鲜性、健全的规范化、密码学绑定和权威的线性化，我们建立了元数据非权威性、闭包确定性、版本非继承性、效应非放大性、约束值新鲜性和路径不变性。我们不建立程序等价性或远程服务诚实性。一个无提供方的实现匹配40个冻结的生命周期夹具；18个内核契约和六个变体覆盖了绑定和降级情况。全配置探索达到84,608个状态和530,752个转换，没有声明的不变式违规；六个弱化配置产生见证。对549个公共技能（4,872个唯一文件）的词汇审计发现，526个捆绑文件的根中有21个逐字命名了每个非清单路径，67个包含解析到其根之外的链接，并且没有根声明前置元数据依赖字段。这些观察结果激励了保守的闭包发现，并为更广泛的运行时、互操作性、有效性和生产验证定义了具体目标。
英文摘要
Agent Skills combine instructions with files, packages, tools, models, and services, so operational identity can exceed a signed directory. Recursive or lazy dependencies may change while root-level evidence remains valid, and different surfaces may reach the same durable effect. We present ClosureBound, a reference monitor that prevents authorization transfer across material changes to this heterogeneous closure. Its resolver commits typed graph nodes and topology. Each grant binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs. At durability, it re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound. Supported equivalent paths share one ceiling. Assuming complete mediation and discovery, authenticated freshness, sound normalization, cryptographic binding, and authoritative linearization, we establish metadata non-authority, closure determinism, version non-inheritance, effect non-amplification, bound-value freshness, and path invariance. We do not establish program equivalence or remote-service honesty. A provider-free implementation matches 40 frozen lifecycle fixtures; 18 kernel contracts and six mutants cover binding and downgrade cases. Full-profile exploration reaches 84,608 states and 530,752 transitions without a declared invariant violation; six weakened profiles yield witnesses. A lexical audit of 549 public Skills (4,872 unique files) finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field. These observations motivate conservative closure discovery and define concrete targets for broader runtime, interoperability, efficacy, and production validation.
发表机构
- Accentrust
- Georgia Institute of Technology（佐治亚理工学院）
- University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）
机构由 AI 辅助整理，请以论文原文为准。
