PaperlayerView exact revision on arXiv

Source-linked AI summary

Matoi: Selective Revalidation of Consequence Evidence for Agent Authorization

Zexun Wang

arXiv:2610.21394v1cs.CRcs.AI

TL;DR

Matoi addresses when consequence evidence remains applicable as runtime state changes, while separating that evidence from current authority and execution obligations. Its bounded implementations and studies report both limits and costs, rather than establishing a general incremental algorithm or arbitrary-tool coverage.

  • Problem

    An unchanged action entry point may activate different consequences after configuration changes, so authorization depends on more than the textual invocation.

    Source: §1 · p. 1

  • Method

    Matoi separates prospective consequence evidence from a fixed authority envelope and current execution obligations, with bounded implementations and durable recovery that reconstructs evidence and retains uncertain reservations.

    Source: §23 · p. 49

  • Results

    Against matched full checking, aggregate preparation rises 3.24% and child lifecycle rises 1.06% in the first repair campaign.

    Source: §17.2 · p. 37

  • Takeaways & Limitations

    The demonstrated contract makes evidence applicability, live permission, and durable occurrence history separately inspectable without equating local dispatch with atomic remote commitment.

    Source: §23 · p. 49

    The implementations do not establish closure for arbitrary tools, binaries, or hidden service internals, and the bounded query-aware kernel shares trusted parsing and reference semantics.

    Source: §22 · p. 48

Abstract

from arXiv · show

Matoi separates reusable consequence evidence from current execution authority and durable occurrence history. Its finite query-aware contract covers branches, ordered collections and negative lookups. A consumer reuses only its own checked evidence whose observations remain valid; signed requests, live grants, quota and uncertain outcomes remain separate obligations. Conditional correctness arguments distinguish locally serialized claims from nontransactional remote effects. Two studies strengthen cost attribution and domain evaluation. A 1,440-cell matched-wire study repeats 144 authored inputs. With compact input bytes identical, reuse reduces complete lifecycle cost by 3.49 percent in JS and 1.79 percent in Python. Combined representation/reuse reductions against full proof are 10.87 and 16.53 percent; five of twelve family intervals for the matched comparison cross one in each language. A prospectively frozen AgentDojo Banking mapping covers 5/16 user plans and 7/9 attack plans. Both governed strategies preserve five exact benign transfers and refuse 35 reused attack-plan/policy crosses. Pre-satisfied utility predicates are reported separately from completed work. These are original scripted synthetic tools, not autonomous agents or a real bank. Earlier studies retain cheaper protected-cache alternatives, policy-compatible phishing, provider duplication and post-claim revocation. Separate JS/Python consumers establish finite-profile interoperability within the same project; durable recovery rechecks evidence and retains uncertain reservations. The results support a bounded, auditable reuse and execution contract, not a new general incremental algorithm, arbitrary-tool closure, atomic third-party commitment or production superiority.

1 Introduction

Matoi asks when consequence evidence can be reused in a changing environment without widening authority or replacing current commitment checks. Its contribution is a bounded applicability contract and an evaluation that distinguishes reuse from other authorization obligations and established techniques.

1 Introduction

  • The research question is when consequence evidence remains applicable across runtime changes without widening requested authority or replacing current commitment checks, and when reuse costs less than reanalysis.The motivating distinction is between reusing a computation and caching away revocation, shared quotas, or the exact effect that will commit.Source: §1 · pp. 1–2
  • Matoi separates prospective consequence evidence, a fixed authority envelope, and current execution obligations, with conditional arguments for receiver-serialized commitment and nonparticipating remote providers.Its durable extension reconstructs evidence after restart and retains uncertain dispatch reservations.Source: §1 · p. 2
  • Two later studies add a matched compact-packet cost control and externally authored Slack and Banking plan evaluations, reporting eligibility, mappings, mutations, refusals, and utility separately.The introduction cautions that repeated attack-policy crosses and pre-satisfied predicates are not independent attacks or recovered task utility.Source: §1 · p. 2

2 Relationship to Existing Work

  • Matoi’s scope is narrower than general dependency discovery, distributed authority, and independently validated workflow generalization; exact query tracking and validation interpreters are established techniques, not a claimed new algorithm.Checked ingestion narrows a trust boundary within the finite implementation but does not make conventional dependency caches unsound.Source: §1 · p. 2, §2 · p. 4

2.1 The comparison unit is an obligation, not a brand

  • The comparison is about obligations and measured trade-offs, not inventing typed effects, attenuation, dependency tracking, or final enforcement, nor claiming benchmarked superiority over cited systems.The cited work comparisons describe research relationships rather than benchmarked implementations.Source: Table 1 · p. 5, §2.1 · p. 5

3 Worked Example and Threat Model

The worked example separates consequence evidence from requested authority, current permission, and occurrence history. The threat model and formal framing bound claims to declared effects, trusted components, and supported semantics.

3.1 One invocation, several different reasons to reconsider it

  • An unchanged resolve_case action can invoke consequences that change with configuration; analysis tracks effect-relevant amounts and destinations, not an irrelevant dashboard theme.The example bounds notification text size but does not classify it for confidentiality, so an allowed internal destination is not a general data-loss-prevention guarantee.Source: §3.1 · pp. 5–6

3.2 Assets, attacker capabilities and trusted components

  • The threat model trusts the issuer, analyzer, controller, interpreter, owner, database, and operating-system isolation; it does not establish protection against host access to the owner’s database or signing key.The configured mediated effect domain excludes uninstrumented services, arbitrary binary behavior, and side channels; signatures authenticate an issuer, not the correctness of its judgment.Source: §3.2 · pp. 6–7

3.3 Three distinct success conditions

  • Prospective coverage, receiver safety, and task success are distinct: a blocked consequence can preserve safety while preventing workflow completion or exposing an earlier coverage error.Reporting one of these conditions as all three would make the evaluation circular.Source: §3.3 · p. 7

4.1 Semantic identity is not execution identity

  • Repeated executions may share a canonical action but must retain separate occurrence identities, consumed nonces, and unresolved outcomes.Equality of the action or executable target does not entail equality of activated effects.Source: §4.1 · p. 7

4.2 Authority is a constraint on traces

  • The effective authority boundary intersects requested authority, current runtime authority, and the original lease; runtime may narrow or deny but cannot use prediction or an old lease to expand permission.The executable model covers finite tuples and a conservative scalar aggregate budget, not every trace constraint such as ordering or delegation depth.Source: §4.2 · pp. 7–8

4.3 Prospective bounds and retrospective evidence

  • Prospective certificates bound traces within a declared horizon and must identify the analyzer, supported language, dependencies, identities, validity conditions, and exclusions.Observed lineage can expose ambiguity over supplied occurrences but cannot establish all future program behavior or discover uninstrumented SaaS actions; missing records are not empty consequence sets.Source: §4.3 · p. 8

5 Selective Revalidation

Selective revalidation reuses consequence evidence only when its declared dependencies remain stable, while keeping authority and current execution obligations separate. The decision procedure preserves effect-owner checks and distinguishes receiver-serialized commitments from local dispatch to remote providers.

5.1 A coverage and dependency certificate

  • A reusable certificate requires stable projected dependency values and a valid analysis profile; a hash comparison alone does not establish the required conditional stability.The dependency model must justify why changes outside the declared set are irrelevant.Source: §5.1 · pp. 8–9

5.2 Validity is obligation-specific

  • Effect-dependency equality supports evidence applicability only; target authority, current policy, issuer-key lifecycle, quota, and occurrence state require separate validity checks.Evidence remains tied to a fixed grant, and refreshing it cannot extend that grant or authorize a replacement executable.Source: §5.2 · pp. 9–10, §5.1 · p. 9

5.3 Decision procedure

  • The procedure validates authority and invocation state, refuses when required evidence is missing, refreshes evidence under the same coverage contract, and checks bounds before commitment.At the effect owner, current state, authority, scope, nonce, and remaining budget are checked with the mutation; uncertain outcomes are reconciled before replay. Receiver guarantees require a shared serialization order, while local dispatch cannot make remote commitment atomic. Receiver safety does not establish prospective workflow coverage, and reuse preserves coverage only under the stated stability and boundary-check conditions.Source: §5.3 · pp. 10–11

5.4 Operational decomposition and refusal ownership

  • Preparation may select evidence but cannot commit effects; each participating effect owner checks the exact mutation and residual obligations before committing.A cache mismatch is not permission, unavailable analysis leads to review, and unknown outcomes are resolved against the original occurrence rather than retried as a new execution.Source: §5.4 · p. 12

6 Cost Model and Break-Even Conditions

The cost model compares avoided analysis against validation and preparation costs, while distinguishing preparation savings from total workflow speedup. Its measured dependency hit path still traverses the supplied state, and faster preparation does not itself establish faster end-to-end execution.

6.1 Account for checking the cache

  • Dependency reuse beats whole-snapshot caching only when avoided analysis exceeds added validation costs; comparison with fresh analysis must also amortize initial preparation.The accounting identity does not imply improvement merely because dependency reuse has a higher hit fraction.Source: §6.1 · pp. 12–13

6.2 The measured implementation still traverses the input

  • The dependency hit path retains O(N + W) traversal, so small workflows with large state can regress; its 64-leaf and four-queue-level limits bound the supported language.Immutable handles or authenticated change indexes might avoid traversal, but would shift work to construction and maintenance and add trust and invalidation obligations.Source: §6.2 · p. 13

6.3 What a faster preparation does not imply

  • Preparation speedup has a ceiling under the additive model, and whole-workflow measurements are needed because queueing and scheduling can violate its assumptions.Quantiles cannot be subtracted to estimate stage costs, and closed-loop timings do not establish throughput under independently scheduled offered load.Source: §6.3 · p. 13

7 Counterexamples and Scope Limits

Matoi’s scope is bounded by declared consequence coverage and by the effect owner’s enforcement boundary. The local studies show fewer analyses under dependency reuse, but do not establish a general or end-to-end speed advantage.

7 Counterexamples and Scope Limits

  • An omitted hidden dependency defeats workflow coverage; partial execution can retain earlier effects, while remote SaaS internals lack independently computed closure coverage.Per-effect authorization at a genuinely mediated export receiver can still block an export, but does not restore the earlier whole-workflow coverage claim.Source: §7 · pp. 13–14

8 Finite Model and Counterexample Checks

  • The candidate matched all 35 fixture decisions, but a broken-premise fixture admitted an unauthorized export hidden from the declared dependencies.These are consistency checks against authored expectations, not evidence that an analyzer generalizes.Source: §8 · p. 15

9.1 Closed workflow semantics and a read-footprint lemma

  • In the closed workflow fragment, equal values for every key in the read footprint imply equal concrete effect traces; unsupported syntax is rejected rather than analyzed as empty.The language bounds operations and queued children and excludes arbitrary code and undisclosed service internals.Source: §9.1 · pp. 15–16

9.2 Effect-owner serialization and actual mutations

  • The owner checks signed commitments, current authority, indexed effects, idempotency and shared budget in the same SQLite transaction that writes each synthetic effect.Re-delivery returns the prior receipt; revocation between a refund and queued notification preserves the refund and rejects the notification.Source: §9 · p. 15, §9.2 · p. 17

9.3 Matched cached comparisons and measurement boundaries

  • The three cached-comparison arms share execution and final checks, while differing in whether evidence is always recomputed, reused for equal snapshots, or reused by dependency footprint.The fixed schedule matrix covers drift, revocation, duplicate delivery, partial execution and other adversarial conditions; timing separates cache priming from request-time work.Source: §9.3 · p. 17

9.4 Local real-process results

  • Across 60 concurrent schedules, exactly one 7,300-cent refund consumes the shared 10,000-cent budget; the other is refused, and lost acknowledgments reconcile without duplicate effects.The local campaign’s declared outcomes matched after replay, not an independently labeled false-allow-rate estimate.Source: §9.4 · p. 18
  • Dependency reuse removes 20 of 160 request-time analyses (12.5%) and 20 of 560 analyses including priming (3.6%) versus whole-snapshot caching, without established end-to-end improvement.For irrelevant-state drift, selection p95 was 0.040 ms versus 0.079 ms, while elapsed p95 was 77.442 versus 76.675 ms.Source: §9.4 · p. 18

9.5 Azure Linux reproduction

  • Azure Linux reproduced the stated boundary behavior, but dependency caching showed no uniform or statistically established speed advantage over the cached comparator.Its elapsed p95 was 238.182 ms versus 242.746 ms for whole-snapshot caching, while its p99 was 258.589 ms versus 255.759 ms.Source: §9.5 · p. 18

10 Receiver-Bound Evidence and Reconciliation

The Matoi–AREG bridge links expected occurrences to receiver-confirmed observations without inferring effects or replacing enforcement. Its retained campaign records partial and absent confirmations as distinct outcomes, with coverage and containment still unestablished.

10 Receiver-Bound Evidence and Reconciliation

  • The bridge projects signed expected occurrences separately from receiver-confirmed occurrences; it tests an occurrence-evidence interface, not consequence discovery or effect-owner enforcement.Its matching key binds run, root, lease digest, effect index and effect identity, so action-entry equality alone is insufficient.Source: §10 · p. 19, §10.1 · p. 19

10.2 Snapshot outcomes and verification

  • A confirmed node requires signature, snapshot-binding, ordered-journal and exact-readback checks, while none-confirmed does not establish that no hidden action occurred.The owner does not attest physical process ancestry, and the resulting graph coverage remains incomplete with containment unestablished.Source: §10.1 · p. 19, §10.2 · p. 19
  • Of 96 signed expected occurrences, the receiver confirmed 54 synthetic effects across 24 all-confirmed, six partial and 18 none-confirmed outcomes.The campaign had no replay failures or unknown evidence in its valid-snapshot matrix; counts agree with authored expectations rather than estimate false-allow rate.Source: §10.2 · p. 20

11 Preparation Cost Boundary Study

The preparation study finds that dependency reuse’s costs depend on workload and change type: it beats whole-snapshot caching in all 64 cells but fresh analysis in only 23. Its controlled boundary measures preparation, not end-to-end authorization or production speed.

11.1 Question, protocol and measured boundary

  • The fixed grid crosses 1, 8, 32, and 64 workflow leaves with four base-state sizes and four change classes, yielding 64 cells.Each leaf reads a destination and alternating refund leaves read an amount, so read-key count grows with workflow size; repeated requests are correlated, not independent examples.Source: §11.1 · p. 20
  • The timer includes lookup, required analysis, key construction, cache maintenance, return, and real initial cache preparation, while excluding input construction and final owner execution.The selector reuses a snapshot key computed during lookup, avoiding a second full-snapshot hash on misses.Source: §11.1 · pp. 20–21

11.2 Predictions and accounting

  • The accounting predicts 16 timed analyses for fresh and one prime for each cache; hit-only streams require one analysis including priming, while miss-only streams require 17.The study compares paired costs within cells and epochs and retains raw timings; its separately coded verifier shares the analyzer and is not an independent oracle.Source: §11.2 · p. 21

11.3 Measured response surface

  • Dependency caching reduces analysis calls by 43.75% against always-fresh and 30.77% against whole-snapshot caching, including priming, but these are not elapsed-time reductions.Each arm has 12,288 measured requests; dependency caching performs 6,912 analyses including 768 primes.Source: §11.3 · p. 21
  • Dependency caching’s median paired cost is lower than whole-snapshot caching in all 64 cells, but lower than fresh analysis in only 23.Against fresh analysis, it is cheaper in 11/16 stable and 12/16 irrelevant-state cells, but in neither relevant-state nor workflow-content streams.Source: §11.3 · pp. 21–22
  • For 64 leaves and one unread mutation key, the median paired dependency/fresh ratio is 0.741 and dependency/snapshot ratio is 0.343.At one leaf and 4,096 unread keys with no drift, dependency/fresh is 1.071; under relevant drift at 64 leaves and 4,096 unread keys, it is 1.844.Source: §11.3 · p. 22

11.4 What the result changes

  • The preparation study does not include final authorization checks, and the earlier process campaigns establish neither a consistent elapsed-time advantage nor a full-lifecycle speedup.The results support bounded refinement and further matched testing, not a faster production release; an adaptive selector or immutable snapshot would need separately measured costs.Source: §11.4 · pp. 22–23

12 Checked Query-Aware Evidence

The query-aware kernel records execution-dependent observations and ordered effects for a bounded workflow language. Checked ingestion reconstructs and compares that evidence before retention; a GitHub pilot composes reuse with live local checks while preserving uncertainty about remote outcomes.

12.1 A distinct finite semantics

  • The bounded JSON language supports branches, ordered collections, keyed lookups including absence, nested item scopes, and queued child traces; invalid or over-limit inputs return review.The profile caps workflows at 256 nodes, collections at 16 members, expanded visits at 4,096, effects at 64, and nested queues at four.Source: §12.1 · p. 23
  • The active footprint records query observations and ordered effects, so adding a previously absent callback invalidates a negative lookup while an unrelated key need not.Changing or reordering membership in an iterated collection changes its observation; exact observation equality can conservatively prevent reuse even when a changed effect remains authorized.Source: §12.1 · p. 23

12.2 Checking completeness before retaining evidence

  • Checked ingestion independently reconstructs active observations and ordered effects, requiring exact map and effect-list equality before retaining the original summary behind a process-private handle.This conditional guarantee depends on the accepted finite profile, trusted reference reconstruction, shared semantics and storage; it is not arbitrary-program closure.Source: §12.2 · p. 24

12.3 Developer conformance and its denominator

  • The conformance suite passed 69 tests and refused 12 single-dependency deletions and six effect-list mutations; these are test cases, not independent attacks.A 16-state product yielded 48 applicable trace-preserving pairs and 208 exact-query non-reuses, not authorization denials; no net cost benefit was measured.Source: §12.3 · p. 25

13.1 Bounded composition with a remote provider

  • The GitHub pilot retained signature, grant, current-authority, revocation, quota, order, and occurrence checks, with the final authority check immediately before transport dispatch.The local journal and GitHub are not transactional partners, so the check does not establish permission at an atomic remote commit point or recall an in-flight request.Source: §13.1 · pp. 25–26

13.2 Observed outcomes

  • The two pilot arms produced 20 dispatched POSTs and 20 confirmed comments; 24 actor submissions yielded 12 admissions, ten denials, and two duplicate responses.Provider readback reconciled confirmation-loss cases without resubmission, while post-effect revocation retained the first comment and refused the second.Source: §13.2 · p. 26, Table 8 · p. 26

13.3 Counted work, verification and inference limits

  • Checked reuse avoided eleven repeated analyses in the pilot’s counted-work comparison, but this does not establish net cost savings or a latency ratio.The workload was deliberately applicable at preparation; the fresh arm’s ten unused primes make the difference protocol-dependent, and neither production hit rates nor generalization follows.Source: §13.3 · pp. 26–27
  • The pilot demonstrates checked consequence reuse with live local authorization and non-atomic outcome handling, not global exactly-once execution, external recovery, or a full product stack.It uses two issues and one workflow; host integrity, issuer custody, administration, and snapshot capture remain trusted.Source: §13.3 · p. 27

14 Durable Evidence and Conservative Recovery

Durable recovery rechecks persisted evidence and separates evidence applicability from authority and occurrence history. Its local journal conservatively handles uncertain steps, but does not make dispatch atomic with a remote provider.

14.1 A persisted summary is not a recovered authorization

  • On reopening, the durable runtime reruns checked ingestion from the retained workflow, issuance snapshot, summary bytes, checker version, and implementation identity before reconstructing a private handle.Current-state applicability is checked separately from authority; a saved digest alone is insufficient.Source: §14.1 · pp. 27–28

14.2 One local owner, three crash meanings

  • Recovery classifies an intent without an observed result as unknown, cancels the unstarted suffix, and keeps the uncertain prefix’s reservation charged.A matching provider observation can confirm a nonconflicted unknown step, but zero matches preserve uncertainty and multiple distinct matches mark a conflict.Source: §14.2 · p. 28
  • The local claim and reservation guarantees assume one protected, non-rolled-back, non-forked journal history; copied or restored journals violate that premise.The package has no external anti-rollback or fork-detection service, and remote execution lies outside the local serialization guarantee.Source: §14.2 · pp. 28–29

14.3 Dispatch is still not remote commitment

  • The dispatcher’s final synchronous claim fences local state before adapter invocation, but cannot fence a provider or make the interval atomic with remote commitment.Send or readback errors leave uncertainty without automatic retry; an unknown result may remain charged indefinitely.Source: §14.3 · p. 29

14.4 Real local process recovery

  • The recovery campaign used actual owner processes and a loopback receiver, not external-SaaS restart recovery, machine power loss, or a latency experiment.The duplication fixture deliberately produced ambiguous receiver effects, which were not all confirmed as successful steps.Source: §14.4 · pp. 29–30, Table 9 · p. 30
  • Across 20 recovery cells, the 40 admitted steps ended as 24 confirmed, four pending, eight cancelled, and four unknown.Unknown prefixes remained charged five bytes while only unstarted six-byte suffixes were refunded; all cells matched the frozen oracle.Source: §14.4 · p. 29, Table 9 · p. 30

15 Same-Kernel Qualification Against Protected Caches

The qualification compares preparation strategies while holding security checks and execution infrastructure constant, then tests cost, fault, and complete-mediation boundaries. Results retain refusals, unknown outcomes, and coverage failures rather than treating them as successful protection.

15.1 Match the security obligations, not just the workload

  • All four arms retain the same authorization, signature, quota, duplicate, fencing, and final-claim checks while using the same durable state machine and provider adapter.Snapshot equality selects preparation only; it does not replace current authorization.Source: §15.1 · p. 30

15.2 Full-lifecycle cost with no unused primes

  • The full-lifecycle comparison does not establish an advantage for checked reuse over a competent protected cache; Table 10’s 0.934 point estimate is not evidence of a demonstrated 6.6% speedup.Eleven intervals include one, and the remaining cold-start interval is more expensive.Source: Table 10 · p. 31, §15.2 · p. 31

15.3 Fixed offered load, including refused work

  • At the highest offered load, 541 of 15,360 offered occurrences are harness-capacity refusals; lower rates complete all offered work, but short batches do not establish production throughput.The protocol uses 25, 100, or 400 arrivals per second and retains refusals in the denominator.Source: §15.3 · p. 32, Table 11 · p. 32

15.4 Retention growth is charged, not primed away

  • Checked-reuse median fill-and-probe cost rises from 664.838 ms at 255 attempts to 7,285.965 ms at 900 and 9,463.619 ms at 1,025, close to reference-cache medians.The bounded journal has no compaction or authorized release procedure for unknown reservations; these samples do not estimate production tail latency.Source: §15.4 · pp. 32–33

15.5 Fault outcomes remain in the result

  • Across fault schedules, 312 admitted steps end as 144 confirmed, 132 cancelled, and 36 unknown; unknown steps retain 180 bytes of reserved quota.Revocation during pacing prevents sends, whereas post-claim revocation permits the already claimed first send and refuses the second; absent observation does not establish non-execution.Source: §15.5 · p. 33

16 Testing the Complete-Mediation Premise

  • The mediation study tests whether selected guards are actually eligible, active, and on every covered consequence path, using real process and database mutations.Enqueue is not email delivery, and the mediated-owner transaction is not a distributed SaaS transaction.Source: §16 · p. 33, §16.1 · pp. 33–34

16.2 Coverage failures are retained, not scored as protection

  • In 135 physically qualified cells, the study records 135 authorized receipted per-effect occurrences, 189 denials, and zero observed unauthorized effects; this does not estimate a real-world false-allow probability.Four configurations refuse deployment in 180 cells, while the falsely complete configuration claims coverage in all 45 of its cells and produces 45 unauthorized mutations.Source: §16.2 · p. 34, Table 12 · p. 34
  • Across unqualified runs, 294 mutations lack atomic occurrence and budget consumption; 225 unauthorized mutations arise across five unqualified configurations, not solely from inventory omissions.A raw write can satisfy the current effect bound while still lacking a serialized enforcement record.Source: §16.2 · pp. 34–35

17 Portable Evidence and Explicit Durable Integration

The paper specifies a finite portable evidence contract and connects it to durable authorization and recovery, then evaluates repair and local integration. Its results show that fewer rule checks do not necessarily reduce end-to-end cost, and the integration remains bounded by explicit trust and deployment assumptions.

17.1 An exact result that another implementation can check

  • The finite result records an ordered effect trace and exact active query observations; accepted repairs must match fresh evaluation in both effects and observations.The profile treats absence, collection order, and lexical binding as observable dependencies, and refuses unknown syntax or missing required input.Source: §17.1 · pp. 35–36
  • The local reuse argument assumes a fixed workflow, syntax position, and full binding context; whole-workflow bounds and fresh global effect ordinals still require separate validation.The local lemma does not itself authorize dispatch.Source: §17.1 · pp. 35–36
  • The v2 profile fixes canonical encoding, ordering, numeric rules, resource limits, and refusal precedence, but does not retroactively repair the earlier locale-dependent implementation.The bounded workflow and state inputs each have a 262,144-byte limit.Source: §17.1 · p. 36

17.2 Negative repair results and a narrower positive region

  • Across the first repair campaign, preparation rises 3.24% and child lifecycle rises 1.06% against matched full checking, despite fewer new rules being checked.The campaign covers five strategies, 1,200 process cells, 18,800 evaluations, and 188 authored state positions; results match the same-project oracle.Source: §17.2 · p. 37
  • The older portable campaign’s combined benefit does not isolate semantic reuse from transport caching; a separate matched control distinguishes full rule rechecking from accepted-subtree reuse.That older campaign lacked a matched protected-incremental comparator, so neither result establishes superiority over a competent external implementation.Source: §17.2 · p. 37, Table 13 · p. 37

17.3 Evidence is connected to dispatch, not promoted into permission

  • The durable profile connects portable evidence to current authority, signatures, occurrence, quota, and recovery; actual body hashes and request order remain separately bound by the host.On restart, records are checked against issuance inputs rather than imported as trusted handles; possible prior dispatch can remain unknown until trusted readback.Source: §17.3 · p. 37
  • Across local integration schedules, admitted steps finish as 234 confirmed, 162 cancelled, and 36 unknown; negative controls expose duplicate provider effects and post-claim revocation.The local serialization point does not atomically control a remote provider.Source: §17.3 · p. 38

17.4 What remains outside this integration

  • The contract assumes a trusted host, correct checker, authenticated provider observations, and one non-forked journal; it excludes arbitrary providers and customer-controlled actions.No Hook is enabled, and the study does not include long-lived retention or a public hosted deployment.Source: §17.4 · p. 38

18 Externally Defined Message Plans

The message-plan study separates task utility, authorization, and actual mutations; the matched compact-packet control then measures a modest reuse benefit against complete rechecking while retaining null and adverse regimes.

18 Externally Defined Message Plans

  • Both governed strategies preserve all ten selected benign Slack tasks, including fourteen exact message appends, while refusing twelve cases per strategy across six stated refusal conditions.Two additional cases per strategy show duplicate admission without extra messages or reservations, not universal concurrency behavior.Source: §18 · p. 39
  • The Slack phishing send succeeds in all ten unmediated contexts; Matoi blocks seven unauthorized routes but permits three policy-authorized routes, including one with simultaneous user-utility and attacker-success predicates.Four other attack goals are unsupported or outside the message boundary and are not credited as prevented.Source: §18 · p. 39

19.1 Identical packets, different checking obligations

  • The matched study uses three arms: explicit full proofs, compact packets with every current rule rechecked, and identical compact packets with applicability-checked reuse.The reuse consumer resolves references only from its own previously accepted records; refusal retains the preceding checkpoint.Source: §19.1 · p. 40

19.2 Frozen population and complete cost boundary

  • The frozen matched-cost campaign comprises 1,440 cells and 17,280 repeated positions from 144 authored input positions, with complete producer/consumer lifecycle costs and sealed replay checks.The repeated positions are not independent tasks; all 17,280 proof-output and opposite-fresh-output comparisons pass.Source: §19.2 · p. 40

19.3 A modest residual, with null and adverse regimes retained

  • 3.49% in JS and 1.79% in Python lower aggregate whole-cell cost for reuse versus recheck with compact input bytes held fixed.The combined reuse/explicit reductions of 10.87% and 16.53% also change representation, encoding, parsing, and transport.Source: Table 17 · p. 41, §19.3 · p. 41
  • Five of twelve primary family intervals cross one in each language, and dense-scalar and branch-flip have no reusable references in either compact arm.The study uses shared helper mechanics on one local host, so neither aggregate nor favorable families establish universal speed gains.Source: §19.3 · pp. 41–42, Table 18 · p. 42

20 Externally Defined Banking Transfer Plans

The Banking study evaluates frozen synthetic plans through fixed mappings, policies, and local mutations. It preserves benign transfers and refuses attack-plan/policy crosses, while reporting pre-satisfied utility and study boundaries separately.

20.5 Strict replay and remaining limits

  • The study uses synthetic local tools and externally authored plans, not an LLM, live bank, or independent-laboratory replication; the original tool appends transactions without debiting balances.Only five eligible benign plans are covered, all with one transfer and the same finite iteration shape; the study makes no Banking performance claim.Source: §20 · p. 42, §20.2 · p. 43, §20.5 · pp. 45–46

20.1 Whole-plan coverage before outcome measurement

  • Whole-plan eligibility covers 5/16 original user tasks and 7/9 original attack plans; excluded mixed plans remain in the coverage inventory rather than being reduced to convenient supported effects.The 35 attack crosses reuse seven plans across five eligible user policies, not 35 independent attack goals.Source: §20.1 · pp. 42–43

20.2 Mapping, authority and actual local effects

  • Both governed arms achieve 80/80 exact selected-plan mappings and 80/80 exact original-authority-plan mappings, with matching calls, scores, and refusal outcomes in paired cells.These are repeated mapping checks, not eighty independent tasks.Source: §20.2 · p. 43
  • Both governed arms execute all five eligible benign transfers and refuse all 35 reused attack-plan/policy crosses at the kernel recipient boundary, appending no attack transactions.Only four benign utility predicates become newly satisfied; five are true after the attempt.Source: §20.2 · p. 43, Table 19 · p. 44

20.3 Pre-satisfied utility is not successful recovery

  • One of five benign utility predicates is already true at reset, leaving seven attack crosses utility-true before and after refusal despite zero governed appended transfers.The unchanged predicates mean refusal is not itself restored task utility; mapping, policy compliance, mutation, and utility remain distinct outcomes.Source: §20.3 · p. 44

20.4 First decisive layer, not an undifferentiated block count

  • Per governed arm, refusals occur at kernel admission, kernel claim, money adapter, and count adapter; all 35 original attack crosses are refused at the recipient boundary before financial checks.The 10,001 amount controls violate both global and recipient-specific ceilings, so they do not isolate those constraints.Source: §20.2 · p. 44, §20.4 · p. 45

21 External Validity and Further Evaluation

The paper calls for frozen semantics, matched comparisons, and workflow-level evaluation before broader claims. Its studies remain bounded by finite implementations, synthetic or local settings, and unestablished external generalization.

21.1 Freeze semantics before expanding cases

  • Broader validation should freeze authority, state-variation delegation, effect language, coverage assumptions, unknown handling, commitment semantics, and units before held-out workflows.Independent skill authors and a separate curator should define traces, changes, and expected outcomes before evaluator predictions.Source: §21.1 · p. 46

21.2 Matched comparisons

  • The matched compact-input study finds 3.49% JS and 1.79% Python aggregate benefits over complete rechecking, but does not establish integrated latency, universal family benefit, or an external-baseline win.Comparators should share authority and commitment boundaries and charge reference traversal, retention, and invalidation.Source: §21.2 · p. 47

21.3 Metrics and rejection criteria

  • Evaluation should report false commitments, unnecessary refusals, review rate, mapping accuracy, coverage, unknowns, and cross-runtime consistency, grouped by workflow family.Performance accounting should include preparation through reconciliation, with failures and timeouts retained; fewer analysis calls alone do not establish lower latency.Source: §21.3 · p. 47

22 Discussion and Limitations

  • Complete mediation requires every covered consequence to encounter effective enforcement; escaped callbacks, uninstrumented receivers, or separate credentials violate that premise.Finite placement tests do not solve topology discovery or establish complete mediation for arbitrary deployments.Source: §22 · p. 48
  • The query-aware kernel covers bounded branches, collections, and lookups, but neither implementation establishes consequence closure for arbitrary tools, binaries, or hidden service internals.Finite tests and developer conformance are not independent semantic labels.Source: §22 · p. 48
  • The Banking study covers only five eligible user plans and synthetic local transactions; it establishes neither real-bank safety nor financial settlement or broad generalization.The studies also do not establish hosted activation, globally exactly-once remote effects, or production integration.Source: §22 · pp. 48–49

23 Conclusion

Matoi’s contribution is a bounded separation of consequence evidence, current authority, and durable occurrence history, with reuse limited to applicable evidence. The conclusion retains cost and coverage qualifications rather than claiming general incremental or production superiority.

23 Conclusion

  • The durable extension reconstructs evidence after restart and retains uncertain reservations rather than reviving serialized handles or creating a new execution opportunity.Receiver evidence and recovery make refusal and reconciliation inspectable, without equating local dispatch with atomic remote commitment.Source: §23 · p. 49
  • The matched control measures a 3.49% JS and 1.79% Python whole-cell reuse benefit over complete rechecking, without establishing universal or integrated speedup.The Banking study covers 5/16 user plans and 7/9 attack plans; neither plan study evaluates an LLM or real-bank operation.Source: §23 · p. 49

A Evidence Accounting and Reproduction

A.1 Same-kernel qualification archives

The archived studies preserve replayable records for the same-kernel qualification, an earlier engineering study, and portable and integrated artifact checks. The earlier study showed a lower prepared-admission gate p95, but did not establish end-to-end speedup.

A.1 Same-kernel qualification archives

  • The qualification archives freeze protocols and sources for replay, while retained internal archive paths are not public downloads or external attestations.The same-kernel qualification separates protected-reference profiles from checked derivations; its 132 v2 pilot cells and stopped 82-cell v1 collection are excluded from the 1,416 formal observations.Source: §A.1 · pp. 51–52

B Earlier Engineering Study

  • 0.741917 ms versus 1.078042 ms fresh was the prepared-admission gate p95, while elapsed p95 was 54.291958 ms versus 52.848292 ms, so end-to-end speedup was not established.The study used real child processes, HTTP, SQLite, and a separate authenticated receiver journal; its effect was a synthetic SaaS-style journal append, not a customer refund.Source: B Earlier Engineering Study · p. 52

C Portable and Integrated Artifact Accounting

  • Integrated replay checks signatures, exact bodies and attempts, journal transitions, and reopened databases without resending mutations; it is a same-project verification path, not outside attestation.The local conformance bundle passes 128 JS and 70 Python tests in two clean exports, but has not been uploaded and does not reproduce the paper’s timing and execution claims.Source: C Portable and Integrated Artifact… · p. 53

Related papers

Loading 2610.21394v1…