Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound
A signed skill directory is not the whole running skill. ClosureBound binds authority to the complete dependency closure—and checks it again when an external effect becomes durable.
Overview
An agent skill can depend on files, packages, tools, models, and remote services that sit outside its signed root directory. Those dependencies can change recursively or load only when the skill runs, allowing the operational system to drift while root-level evidence still looks valid.
ClosureBound resolves this heterogeneous dependency graph into a typed closure, binds each grant to its exact root and effect ceiling, then re-resolves both closure and state at operation time. A durable effect is admitted only when one joint witness satisfies every bound; alternate paths to the same effect cannot amplify authority.
Core contributions
- 01
Operational identity
Defines an agent skill by its typed transitive dependency closure rather than by a manifest or signed directory alone.
- 02
Operation-time witness
Re-resolves closure and state at durability, normalizes equivalent operation surfaces, and requires one witness to satisfy every bound.
- 03
Mechanized invariants
Formalizes non-inheritance, non-amplification, freshness, and path invariance, then exercises them through lifecycle fixtures, kernel contracts, mutants, and state exploration.
- 04
Public-skill audit
Audits 549 public Skills to measure how rarely bundled dependencies are explicitly declared and where paths resolve outside skill roots.
How ClosureBound extends the governance stack
OpenPort, IGAC, and EBTE govern which tool effects are eligible and why. ClosureBound adds a complementary question: is the executing skill still the same dependency-closed system that received the grant?
The grant is bound to a resolved closure, purpose, provenance, validity window, epochs, and effect ceiling. Any material dependency or state change must be reflected in a fresh operation-time witness before a durable effect can proceed.
- 01Agent skill
- 02Resolved closure
- 03Bound grant
- 04Governed effect
Evidence and scope
This is an arXiv preprint and a reference-monitor design, not a claim of production readiness. Its guarantees assume complete mediation and dependency discovery, authenticated freshness, sound effect normalization, cryptographic binding, and authoritative linearization. It does not establish program equivalence or remote-service honesty, and the public-skill study is a lexical audit rather than an estimate of exploitable prevalence.
Abstract
Agent Skills combine instructions with files, packages, tools, models, and services, so operational identity can exceed a signed directory. Recursive or lazy dependencies may change while root-level evidence remains valid, and different surfaces may reach the same durable effect. We present ClosureBound, a reference monitor that prevents authorization transfer across material changes to this heterogeneous closure. Its resolver commits typed graph nodes and topology. Each grant binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs. At durability, it re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound. Supported equivalent paths share one ceiling. Assuming complete mediation and discovery, authenticated freshness, sound normalization, cryptographic binding, and authoritative linearization, we establish metadata non-authority, closure determinism, version non-inheritance, effect non-amplification, bound-value freshness, and path invariance. We do not establish program equivalence or remote-service honesty. A provider-free implementation matches 40 frozen lifecycle fixtures; 18 kernel contracts and six mutants cover binding and downgrade cases. Full-profile exploration reaches 84,608 states and 530,752 transitions without a declared invariant violation; six weakened profiles yield witnesses. A lexical audit of 549 public Skills (4,872 unique files) finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field. These observations motivate conservative closure discovery and define concrete targets for broader runtime, interoperability, efficacy, and production validation.
Cite this work
Use the DOI record for stable bibliographic information and citation formats.