PaperlayerView exact revision on arXiv

Source-linked AI summary

Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound

Genliang Zhu, Chu Wang

arXiv:2609.05920v1cs.CRcs.AI

TL;DR

Agent Skills may change transitively after root-level authorization, and different surfaces can produce the same durable effect. ClosureBound binds a grant to the exact current closure and normalized effect at operation time; under explicit assumptions, its supported guarantees include non-inheritance after material updates and path invariance.

  • Problem

    Agent Skills combine instructions, artifacts, and external services, so a root name or directory alone does not answer whether the exact authorized transitive capability is producing the same effect now.

    Source: §1 · pp. 1–2

  • Method

    ClosureBound binds a trusted task grant to an exact closure root, current runtime state, purpose/provenance boundary, and normalized external effect in a joint operation-time witness.

    Source: §1 · p. 2

  • Results

    Under explicit assumptions, material updates do not inherit authority, represented effects do not amplify transitive privilege, distinguishable bound-value mismatches fail closed, and supported equivalent paths cannot enlarge authority.

    Source: §13 · p. 26

  • Takeaways & Limitations

    Authorization is bound to the exact current heterogeneous closure and normalized effect, rather than merely to a root Skill identity.

    Source: §13 · p. 26

    The guarantees are conditional on sound dependency discovery and protected-sink coverage, and path invariance covers registered adapters rather than arbitrary code.

    Source: §12 · p. 25

Abstract

from arXiv · show

Agent Skills combine instructions with files, packages, tools, models, and services, so operational identity can exceed a signed directory. Recursive or lazy dependencies may change while root-level evidence remains valid, and different surfaces may reach the same durable effect. We present ClosureBound, a reference monitor that prevents authorization transfer across material changes to this heterogeneous closure. Its resolver commits typed graph nodes and topology. Each grant binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs. At durability, it re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound. Supported equivalent paths share one ceiling. Assuming complete mediation and discovery, authenticated freshness, sound normalization, cryptographic binding, and authoritative linearization, we establish metadata non-authority, closure determinism, version non-inheritance, effect non-amplification, bound-value freshness, and path invariance. We do not establish program equivalence or remote-service honesty. A provider-free implementation matches 40 frozen lifecycle fixtures; 18 kernel contracts and six mutants cover binding and downgrade cases. Full-profile exploration reaches 84,608 states and 530,752 transitions without a declared invariant violation; six weakened profiles yield witnesses. A lexical audit of 549 public Skills (4,872 unique files) finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field. These observations motivate conservative closure discovery and define concrete targets for broader runtime, interoperability, efficacy, and production validation.

1 Introduction

Agent Skills can assemble capabilities progressively from instructions, executable artifacts, and external services, so root-level integrity alone does not identify the capability producing a durable effect. ClosureBound binds authorization to the exact transitive closure and normalized effect, then checks them at operation time.

2.1 A Skill is a progressively resolved capability

  • A Skill’s operational capability can be assembled progressively from natural-language instructions, executable artifacts, the host agent, and external services.The format permits optional scripts, references, assets, and other resources, which clients load as tasks require them.Source: §1 · p. 1, §2.1 · p. 3

1 Introduction

  • A root Skill’s directory and signature can remain unchanged while a floating helper changes or an equivalent payment is reached through an unclassified shell path.The resulting authorization-transfer question is whether the exact transitive capability authorized is producing the same normalized effect now.Source: §1 · p. 2
  • ClosureBound binds a trusted task grant to an exact heterogeneous closure and normalized effect in a joint operation-time witness.It re-resolves material identities and epochs, checks current state, and denies or requires reauthorization after a change.Source: §1 · p. 2
  • The reference monitor’s claims concern authorization consistency, not whether a Skill is benign.The introduction describes deterministic closure-resolution and prepare/commit algorithms, typed reauthorization diffs, and fail-closed handling of ambiguity and indeterminate settlement.Source: §1 · p. 3

Discovery identity

  • Conflating distribution, resolved-capability, and effect identities risks accepting changed dependencies or blocking representation-equivalent evidence.ClosureBound denies unresolved ambiguity while allowing equivalent canonical evidence encodings to avoid gratuitous invalidation.Source: Discovery identity · p. 3

2.2 Why flat manifests and load-time checks are insufficient

  • A flat manifest can omit material dependencies, lose typed topology, and miss changes that occur after loading.Unknown material dependencies therefore do not disappear from authorization, and the commitment must bind the typed graph rather than component digests alone.Source: §2.2 · pp. 3–4

2.3 Why tool-call syntax is not an effect boundary

  • Surface syntax is not an effect boundary: one external transition can arrive through an API, shell, browser, database query, or helper Skill.ClosureBound does not solve arbitrary program equivalence; protected sinks use trusted adapters to emit finite effect IR, while unsupported code is denied or conservatively bounded.Source: §2.3 · p. 4

2.4 Research scope

  • Table 1 separates the central claim from adjacent questions and frames the paper’s research scope and evidence boundary.The supplied table caption does not specify its rows or columns.Source: §2.4 · p. 4, Table 1 · p. 4

3 System and Threat Model

ClosureBound models Skills as changing dependency graphs and places authorization at the durability boundary, where current identity, state, purpose, and effect are checked together. Its guarantees depend on complete discovery and mediation, authenticated freshness, and trusted enforcement components.

3.1 Entities and lifecycle; 3.2 Adversary

  • Discovery and Skill-authored metadata are untrusted; an independent grant issuer combines current task authority with organizational policy before the resolver and monitor enforce it.The adversary may manipulate dependencies and switch mediated paths to reach equivalent effects.Source: §3.1 · p. 5, §3.2 · p. 5

3.3 Assumptions and trusted computing base

  • The guarantees assume complete closure discovery and effect mediation, authoritative freshness, linearizable commit, cryptographic binding, and a trusted enforcement TCB.Remote services are trusted only to the granularity of their evidence.Source: §3.3 · p. 5

3.4 Protected event and outcome states

  • A protected event is a monitor-mediated operation at its configured durability boundary; preparation is not durability, and uncertain settlement remains indeterminate.A timeout or unauthenticated receipt does not establish the receiver’s actual state.Source: §3.4 · pp. 5–6

4.1 Typed dependency graph

  • The resolver builds a typed dependency graph with authenticated node and edge evidence, including material root-to-sink influence paths.Node records include canonical identity, version or deployment, digests, epochs, and evidence; materiality covers factors that can alter an effect.Source: §4.1 · p. 6

4.2 Canonical graph commitment

  • Canonical locators and sorted topology make the closure commitment invariant to discovery order, equivalent aliases, and admitted path spellings when the canonical edge multiset is unchanged.This commitment does not identify semantically equivalent programs with different evidence.Source: §4.2 · pp. 6–7

4.3 Task grants and policy order

  • A task grant fixes an immutable effect ceiling before closure discovery; current task, closure-contract, state, and purpose/provenance authority intersect beneath it.Skill metadata cannot modify authenticated authority or expand the issued ceiling.Source: §4.3 · pp. 7–8

4.4 Normalized external effects

  • Adapters normalize surface events into realized effects at durability; unsupported or ambiguous events deny, and supported equivalent paths use surface-independent authorization fields.The monitor need not prove arbitrary program equivalence; registry admission establishes supported policy-selection congruence.Source: §4.4 · pp. 8–9

4.5 Joint operation witness

  • At commit, one joint witness binds the grant, exact closure, effect, label, current bounds, and reservation so fields from separate grants cannot be recombined.A material change requires a new grant rather than editing the old closure binding.Source: §4.5 · p. 9

5 ClosureBound Design

ClosureBound resolves an activated Skill as a typed graph and binds a grant to its exact closure, purpose, and effect ceiling. At durability, it refreshes relevant evidence and normalizes the effect before deciding whether to admit it.

5.1 Resolver adapters and evidence profiles

  • Adapters bind each heterogeneous node to identity and evidence appropriate to its type, while evidence profiles set minimum requirements by node and effect risk.For MCP, the adapter includes protocol revision, server identity, schema/listing digest, cache scope, and observed freshness; a TTL is not proof of continuing authority.Source: §5.1 · pp. 10–11

5.2 Recursive resolution

  • Context-sensitive resolution records typed graph edges, terminates repeated expansion with a visited set, and canonicalizes cycles after the walk.The context key includes facts that can change outgoing dependencies; resolver output identifies dependencies but does not itself grant authority.Source: §5.1 · p. 10, §5.2 · p. 11

5.3 Grant compilation

  • Grant compilation freezes a trusted effect bound before closure discovery, and authorization preserves correlations among fields by meeting complete effect clauses.Skill-authored metadata can narrow the trusted bound but cannot add effects; separately permitted fields cannot be spliced into a new authorized tuple.Source: §5.3 · p. 11

5.4 Effect normalization and path registry

  • Registered adapters normalize supported surfaces to effect-contract denotations, so equivalent payment paths share a policy ceiling.A shell path that cannot determine payee and amount before execution must be denied or confined to a sandbox with an authorized maximum effect.Source: §5.4 · p. 12

5.5 Prepare and commit

  • Preparation creates only a short-lived reservation; commit reacquires volatile facts, validates the complete current tuple, and consumes a fence before durability.A distinguishable material mismatch at the linearization point requires denial or a new grant; receiver-side fence consumption or a local transaction is needed for atomic operation-time safety.Source: §5.5 · pp. 12–13, Figure 3 · p. 13

5.6 Typed contract/evidence diff and reauthorization

  • A material closure change produces a typed evidence and contract diff, and a trusted issuer must review it before creating a new grant.Unrepresentable contract differences are marked UNKNOWN and fail closed; renewal is not ordinary execution.Source: §5.6 · pp. 13–14

5.7 Caching without stale authority

  • Cached immutable nodes are performance hints, while mutable lookups require epoch/profile keys and commit-time currentness validation.Cache age alone is not a security proof, and negative or unresolved results may be cached only fail closed.Source: §5.7 · p. 14

6 Security Analysis

The security analysis derives authorization guarantees from the joint checks on metadata, closure, effects, state, and time. The claims depend on explicit assumptions and exclude unrepresented or undiscovered behavior.

6.1 Metadata cannot mint authority

  • Changing Skill-authored metadata cannot enlarge an existing grant’s effect set because the grant ceiling is frozen and independently checked at commit.The result does not claim that metadata cannot influence model behavior.Source: §6.1 · p. 14

6.2 Closure and version non-inheritance

  • A changed material node, edge, or topology changes the committed closure root, so a grant cannot admit a changed transitive dependency without renewal.Changes outside the declared material closure, omitted dependencies, malicious content already present, and behavior hidden behind unchanged weak service evidence are not covered.Source: §6.2 · pp. 14–15

6.3 Transitive effect non-amplification

  • Every admitted mediated effect must satisfy the trusted task, exact closure, current contracts, immutable grant ceiling, relational meet, and prepared state witness.Nested Skills, packages, or services are within the bound closure rather than separate authority operands; the result does not cover covert channels or compromised normalizers or receivers.Source: §6.3 · p. 15

6.4 Operation-time TOCTOU safety

  • At the commit linearization point, a distinguishable change to a bound value cannot be admitted using the prepared reservation.The claim relies on an atomic comparison of the current tuple and reservation; ABA histories mapped to the same identity are outside its value-freshness scope.Source: §6.4 · p. 15

6.5 Equivalent-effect path invariance

  • Supported paths with equivalent normalized effects receive the same effective policy, preventing a path switch from enlarging authorization.The claim excludes unregistered sinks and fails closed when a general shell or browser event cannot be normalized before durability.Source: §6.5 · p. 16

6.6 Necessity counterexamples

  • For each removed mechanism family and each single-point mutant, the paper gives a finite trace where the weakened evaluator admits an excluded effect.The traces support mechanism-family necessity, not exhaustive attack enumeration or independence of every individual condition.Source: §6.6 · p. 16

7 Reference Implementation

The reference implementation is a finite, provider-free model over synthetic records, designed to exercise closure binding and effect-policy checks rather than production integrations.

7.1 Scope

  • The reference kernel models lifecycle execution without hosted models, network dependencies, or private data, but does not implement a production reservation and atomic commit transaction.It abstracts production signature verification, package resolution, MCP servers, browser drivers, and distributed fencing.Source: §7.1 · pp. 16–17

7.2 Canonical records

  • Canonical records fix JSON ordering and domain tags, while the effect IR binds operation, target, recipient, amount ceiling, purpose, contract version, and durability.The supported effect types include file writes, messages, payments, database mutations, deployments, and permission changes.Source: §7.2 · p. 17

7.3 Profiles and mutants

  • Six seeded mutants each weaken one mechanism, and the reduced profiles distinguish partial commit refresh from ClosureBound’s complete joint refresh.A mutant is counted as detected only when its single weakening reaches the targeted unsafe commit.Source: §7.3 · pp. 17–18

7.4 Complexity

  • Resolution and SCC construction scale linearly with graph size and evidence bytes before commitment sorting, while policy checking is linear in non-dominated clauses.The paper notes worst-case graph and clause growth and recommends fail-closed profile limits rather than silently dropping dependencies or merging restrictive clauses.Source: §7.4 · p. 18

8 Evaluation

The evaluation tests lifecycle conformance, mechanism necessity, bounded-state safety, local kernel cost, and closure structure in frozen public repository snapshots. Its results support mechanism conformance within represented cases, while broader runtime and deployment claims remain outside scope.

8.1 Questions and evidence discipline; 8.2 Fixture construction

  • The evaluation combines frozen lifecycle fixtures and contract checks with bounded exploration, a single-process cost measurement, and a lexical audit; model adherence and task utility require complementary methods.Fixtures include 32 unsafe cases across eight families and eight benign controls, including exact-ceiling payment and authorized-helper cases.Source: §8.1 · p. 18, §8.2 · pp. 18–19

8.3 Kernel contract checks

  • All 18 deterministic kernel contracts passed checks spanning canonicalization, material changes, grant binding, path normalization, and downgrade resistance.The contracts also tested currentness, effect identity, and authenticated resolution context.Source: §8.3 · p. 19

8.4 Conformance and reduced profiles

  • 40/40 fixtures matched their expected outcomes: all 32 unsafe cases were denied or reauthorized before durability, and all eight benign controls received their exact decisions.The suite had zero unsafe allows, false denials, or decision mismatches.Source: §8.4 · p. 19, Table 3 · p. 19

8.5 Mutation evidence

  • All six seeded single-point mutants produced targeted unsafe witnesses, providing evidence for the six declared faults rather than general implementation-error coverage.The unmodified evaluator first rejected each same trace.Source: §8.5 · p. 19

8.6 Bounded lifecycle exploration

  • 84,608 states and 530,752 transitions were explored in the full profile with no I1–I5 violation; each of six mutant profiles reached a violation.Exploration was exhaustive only within the encoded finite abstraction; package-manager and remote-service behavior require separate models.Source: §8.6 · p. 20

8.7 Local mechanism cost

  • The full-profile fixture evaluation took 0.120 ms median (p95 0.146 ms) on one disclosed host, excluding authoritative resolution and other production operations.It included two closure commitments and two normalizations; measurements are not additive pipeline stages.Source: §8.7 · p. 20

8.8 External repository-snapshot closure audit

  • 21 of 526 roots with bundled files named every non-manifest path verbatim, while 67 Skills had links resolving outside their immediate roots.The audit covered 549 roots and 4,872 unique local files; lexical naming is not semantic dependency recall.Source: §8.8 · p. 21, Table 5 · p. 21

8.9 Validity and evaluation traceability

  • Fixtures and implementation were authored together, while the external corpus provides independently authored inputs; inference from it is limited to public structure at two frozen commits.Unsafe allow and false denial are defined against represented predicates and authored benign oracles, not broad maliciousness or user utility.Source: §8.9 · p. 21

9 Closest-Work Comparison

The comparison evaluates guaranteed capabilities rather than system names. ClosureBound’s stated novelty is jointly binding an authenticated heterogeneous operational closure and normalized realized effect at durability.

Capability matrix

  • The comparison defines an exact heterogeneous closure as authenticated operational Skill, package, tool, model, and service structure, and a joint witness as binding that closure to realized effect at durability.The table compares guaranteed axes; a check mark denotes direct support and a circle partial or adjacent support.Source: §9 · p. 22

Prior-work capabilities

  • Prior systems supply substantial pieces, including dependency resolution, normalized tool actions, staged-state validation, and durability-time authority refresh.The passage names SkillFortify, OpenAPM, AIRGuard, Cordon, and CommitGuard as adjacent contributions.Source: §9 · p. 22

Novelty boundary

  • To the authors’ knowledge, prior work has not jointly bound exact heterogeneous operational-artifact closure and cross-surface normalized realized effect in one durability-time witness.The stated novelty boundary also includes closure-version non-inheritance and equivalent-effect path invariance under explicit completeness assumptions.Source: §9 · p. 22

10 Related Work

Related work spans Agent Skill security measurement, behavioral permissions, software supply-chain integrity, and runtime authorization. ClosureBound positions its contribution at the joint durability-time binding of recursive operational identity and realized effect.

10.1 Agent Skill security and measurement

  • Skill-security studies measure vulnerabilities [18], lifecycle risks [15], real-world Skills [4], malicious and benign cases [10] [46], and runtime contexts [13]; ClosureBound is not a detector and does not reuse their rates as evidence.SkillDetonate’s runtime instruction and information-flow coverage is distinct from a version commitment [11].Source: §10.1 · pp. 22–23

10.2 Skill permissions, least privilege, and behavioral enforcement

  • Behavioral enforcement systems govern permitted behavior, while ClosureBound asks whether the recursive implementation and effect contract in use are those for which permission was granted.Related work includes SkillGuard [28], SkillScope [39], VIGIL [14], SIGIL [9], and Edge Skillguard [41]; ClosureBound builds on artifact binding [35] [42].Source: §10.2 · p. 23

10.3 Software supply-chain integrity

  • Supply-chain standards and formats cover update integrity, provenance, build guarantees, and component relationships; ClosureBound locates its contribution in operation-time authorization.SkillFortify [6] and OpenAPM address dependency resolution and install-time governance, while ClosureBound asks whether a grant remains valid at durability.Source: §10.3 · p. 23

10.4 Runtime and usage control

  • Runtime and usage-control work supplies authorization, policy composition, and durability checks [27] [30] [7] [22] [33]; ClosureBound’s stated distinction is the joint recursive-closure and cross-surface-effect witness.The passage characterizes this as an Agent-Skill-specific conjunction at the current durability decision.Source: §10.4 · pp. 23–24

10.5 Relationship to public prior team work

  • Public team papers provide adjacent protocol, task-authorization, and action-claim context [43] [44] [45], but their observations and denominators are not ClosureBound evidence.The reported evaluation results are attributed solely to this paper’s configuration and internally verified receipts.Source: §10.5 · p. 24

11 Discussion

The discussion frames ClosureBound as a control against authorization transfer across changing closures and effect paths, while emphasizing deployment completeness, adapter, service, and policy boundaries. Exact reauthorization also carries an availability cost.

11.1 Security value and residual risk

  • ClosureBound changes the trust unit from a once-approved Skill to the exact current recursive capability authorized for a class of effect, while content benignness and unmediated channels remain separate concerns.The stated risks include dependency substitution, service or schema drift, load-to-use races, path laundering, and stale replay.Source: §11.1 · p. 24

11.2 Completeness is a deployment obligation

  • Completeness is a deployment obligation: high-risk policies may require no unknown dynamic loads and attested services, while lower-risk tasks may accept a pinned container as an enclosing identity.An unversioned service URL is not treated as strong evidence.Source: §11.2 · p. 24

11.3 Availability and update ergonomics

  • Exact non-inheritance makes updates require reauthorization, a security property with an availability cost; trusted compatibility contracts and policy-authorized ranges may reduce friction.Automatic renewal requires a new grant binding the new root; calling it the same grant would hide an authority transition.Source: §11.3 · pp. 24–25

11.4 Remote services and settlement

  • Endpoint, schema/effect-contract, and deployed-implementation identities differ; many services expose only the first two, so implementation identity needs independent evidence.For confidential or irreversible profiles, the passage recommends deployment attestation, a constrained server-side transaction contract, or human confirmation.Source: §11.4 · p. 25

11.5 Effect adapters as a governance API

  • The adapter registry is a major trusted-computing-base surface; coarse effect ceilings can preserve soundness for opaque commands but may cause false denials.The passage calls for versioned, reviewed, fuzzed adapter contracts included as closure nodes.Source: §11.5 · p. 25

11.6 Policy and legal interpretation

  • Purpose, recipient, and data-class labels are policy inputs, while latent intent, legal validity, and social desirability require separate human and institutional judgment.Ambiguity should lead to clarification or review rather than being resolved by Skill prose.Source: §11.6 · p. 25

11.7 Ethics and dual use

  • The preprint uses synthetic identifiers, hashes, and state transitions and does not publish live malicious Skills, credentials, or exploit payloads.Production telemetry should minimize sensitive closure and effect traces, limit retention, and enforce tenant isolation.Source: §11.7 · p. 25

12 Limitations and Future Work

ClosureBound’s guarantees and evaluation are bounded by dependency and sink coverage, finite effect semantics, the evidence available for services and external evaluation, and a single-process cost model.

12 Limitations and Future Work

  • The proofs assume a sound dependency frontier and protected-sink coverage; natural-language and reflective dynamic dependencies need deployment-specific instrumentation and conservative fallback.Path invariance covers registered adapters, not arbitrary code equivalence or covert channels.Source: §12 · p. 25
  • A stable endpoint or contract cannot establish that remote service behavior is unchanged.The evaluation also relies on finite and static evidence; cross-runtime efficacy requires execution-based adapter evaluation.Source: §12 · p. 26
  • The single-process microbenchmark excludes network, storage, signatures, attestations, distributed ordering, and model latency.Source: §12 · p. 26
  • The monitor authorizes dispatch and conditionally interprets settlement, but does not guarantee exactly-once external effects or compensation.Source: §12 · p. 26
  • The authors propose runtime adapters, a broader probability-sampled Skill corpus, benchmark translation to effect contracts, distributed fencing, and independently encoded formal models.These studies target cross-runtime, ecosystem, distributed-systems, and independent formal validation.Source: §12 · p. 26

13 Conclusion

ClosureBound binds a task grant to the exact current heterogeneous dependency closure and normalized real effect. Under explicit assumptions, its guarantees address material updates and supported equivalent paths without establishing program equivalence or remote-service honesty.

13 Conclusion

  • The conclusion claims metadata non-authority, closure determinism, version non-inheritance, effect non-amplification, bound-value freshness, and path invariance under stated assumptions.Source: §13 · p. 26
  • ClosureBound complements Skill scanning, permissions, verified loading, behavioral monitoring, SBOM/provenance, and general commit-time authorization.Source: §13 · p. 26
  • The external snapshot audit motivates conservative local closure and provides a baseline for runtime-completeness validation across adapters and deployments.Source: §13 · p. 26

A Notation and Trust Summary

B.1 Correlated clauses

The appendix specifies relational policy intersection and its proof over nested dependencies, then describes the finite evaluation configuration, availability, and claim boundaries.

B.1 Correlated clauses

  • For richer policy languages, deployments must retain the exact symbolic conjunction or fail closed when an intersection cannot be represented.The executable kernel instantiates exact-valued fields and a nonnegative amount ceiling over compiled correlated clauses; it does not implement general policy intersection or dominance elimination.Source: §B.1 · p. 27
  • Relational meet soundness preserves effects allowed by both parent policies, whereas field-wise union can construct tuples allowed by neither.Dominance elimination removes exact duplicates and clauses contained in another retained clause with identical authority provenance.Source: §B.1 · p. 27

B.2 Induction over nested dependencies

  • Induction over the SCC-condensation DAG establishes the bound for nested dependencies, with each cycle treated as one component whose applicable contracts enter the meet.Source: §B.2 · p. 28

C Evaluation Configuration and Availability

  • The disclosed evaluation uses 40 lifecycle fixtures, 18 kernel contracts, six mechanism profiles, and six single-point semantic mutants.The external audit uses the identified Anthropic Skills and OpenAI Plugins snapshots and the stated inclusion and path-resolution rules.Source: C Evaluation Configuration and… · p. 28
  • The full profile reaches 84,608 states and 530,752 transitions in breadth-first exploration to a fixed point without a depth cutoff.Source: C Evaluation Configuration and… · p. 28
  • The implementation, machine-readable traces, and internal verification commands are retained internally, so independent execution requires access beyond the arXiv source bundle.Source: C Evaluation Configuration and… · p. 28

D Claim Checklist

  • Reported counts apply only to declared finite domains; unresolved dependencies and effects fail closed, while cross-runtime utility, ecosystem coverage, and production overhead need separate evaluation.Source: D Claim Checklist · p. 28
Loading 2609.05920v1…