SkillEffect: Checked Lowering for Memory-Bounded Agent Tools

SkillEffect：面向内存受限智能体工具的检查式降级技术

Abstract: Agent Skills can specify procedural and resource obligations for tool use, and language models instantiate them as concrete programs. However, when models turn this guidance into code for existing tool interfaces, even a semantically correct program may load an entire input and exceed the memory available to one tool call.

摘要： 智能体技能（Agent Skills）可以为工具使用指定程序和资源义务，而语言模型则将其实例化为具体的程序。然而，当模型将这些指导转化为现有工具接口的代码时，即使是语义正确的程序，也可能加载整个输入并超出单次工具调用所能提供的内存限制。

We present SkillEffect, a checked-lowering runtime for computations with a recoverable source relation, an audited bounded implementation, and a registered output postcondition. Before granting execution authority, an independent checker rebuilds each proposed lowering from the submitted program and immutable input.

我们提出了 SkillEffect，这是一个用于计算的检查式降级（checked-lowering）运行时，具备可恢复的源关系、经过审计的受限实现以及已注册的输出后置条件。在授予执行权限之前，一个独立的检查器会根据提交的程序和不可变输入，重新构建每一个拟议的降级过程。

Every relation plugin supplies a source recognizer, input-fact extractor, bounded-IR constructor, arena-bound function, and postcondition; one common runtime provides checked selection, bounded-VM execution, atomic capacity leasing, and staged publication.

每个关系插件都提供源识别器、输入事实提取器、受限中间表示（IR）构造器、内存区域边界函数和后置条件；一个通用的运行时则提供检查式选择、受限虚拟机执行、原子容量租赁和分阶段发布功能。

Generality in SkillEffect is architectural rather than automatic: each supported computation requires an audited relation plugin, while the dispatch, resource-control, execution, and publication mechanisms are shared across plugins.

SkillEffect 的通用性体现在架构层面而非自动化层面：每种支持的计算都需要一个经过审计的关系插件，而调度、资源控制、执行和发布机制则在各个插件之间共享。

Across six operator families, bounded access substantially reduces peak memory and improves completion under externally fixed caps. Six plugins instantiate the same contract across five execution patterns, from streaming reduction to bounded-heap Top-k.

在六个算子族中，受限访问显著降低了峰值内存，并在外部固定上限的情况下提高了完成率。六个插件在五种执行模式下实例化了相同的契约，涵盖了从流式归约（streaming reduction）到受限堆 Top-k 的各种场景。

The XLSX onboarding study and Top-k extension show that a new relation and a new retained-state pattern reuse the same trust boundary, while the checker accepts all evaluated legal configurations and rejects all adversarial proposals. Together, these results show that one checked-lowering architecture can enforce heterogeneous registered memory relations at Agent tool dispatch.

XLSX 入门研究和 Top-k 扩展表明，新的关系和新的保留状态模式可以复用相同的信任边界，同时检查器能够接受所有经过评估的合法配置，并拒绝所有对抗性提议。总之，这些结果表明，一种检查式降级架构可以在智能体工具调度时强制执行异构的注册内存关系。