Report #008 established that trust state itself can go stale. Report #009 compresses the timing window further: the registry is current and the key is active when checked — then trust changes before the irreversible transition executes.
The race reproduced a duplicate.
The first synthetic effect committed and lost its response. The application then verified primary-v1 as active at trust epoch 41. Before retry, the benchmark revoked the key and advanced trust state to epoch 42. The unsafe trajectory reused the earlier decision anyway.
The first intended effect already exists.
Key is ACTIVE at epoch 41.
Trust changes to epoch 42 before execution.
Old authorization drives retry and creates effect #2.
Comparative result
Unsafe TOCTOUACTIVE at epoch 41 was reused after revocation moved trust to epoch 42.
Epoch-bound commitExpected 41, current 42; precondition failed before side effect.
Commit-time re-verificationCurrent key state was inactive, so retry remained blocked.
Unchanged-state controlFirst timeout happened before commit; epoch remained 41 and one necessary retry was allowed.
Authorization becomes a versioned precondition.
Epoch mismatch blocks the side effect.
The safe conditional commit received expected_trust_epoch=41. At execution, current trust epoch was 42 and the key was inactive:
No second effect was created.
Re-verification is another valid strategy.
A separate safe path explicitly checked authority again at synthetic commit time. It observed epoch 42 and key_active=false. Retry stayed blocked.
Safety must still allow legitimate progress.
In the control trajectory, the first request timed out before any side effect. The current key remained active and trust epoch stayed 41. Conditional retry saw matching state and committed exactly once.
Execution-bound trust score · 10/10
TOCTOU hazard reproduced · 2/2Blind reuse after revocation duplicated the effect.
Epoch binding · 2/2Version mismatch blocked commit before mutation.
Re-verification · 2/2Commit-time check observed revoked authority.
Legitimate retry · 2/2Unchanged trust allowed one needed side effect.
Pinned evidence · 2/2Exact upstream SHA, deterministic FakeModel, synthetic effects only.
The TOCTOU invariant
For irreversible transitions, the property that authorized the action must still hold at execution. A prior green check is evidence about the past, not a permanent permission bit.
The trust model gains execution binding.
RESONANCE now treats a trust decision as authority + evidence state + trust state + trust version/epoch + verification time + execution precondition.
Interpretation boundary
This experiment uses synthetic in-memory trust epochs, deterministic revocation and local side effects. It is not a production IAM, distributed transaction, database compare-and-swap, capability-security or cryptographic certification. The OpenAI Agents SDK executes the application protocol; it does not automatically impose this trust-epoch rule.
Reproduce / inspect
Evidence artifact digest: sha256:97e81a88b3ad67e5ea8f42a1b0b5241afd67a2de516a99db58c6871be98d7485. No live model, production credential or external side-effecting service was used.
Verdict: reusing an authorization that was valid before revocation reproduced a duplicate. Version-bound commit or commit-time re-verification prevented the unsafe transition while preserving legitimate progress when trust state stayed unchanged.
RESONANCE Verified Report #009
verify → bind state/version → commit precondition → legal transition.
Back to Issue 001