Scheduled / Deferred-Action Integrity Check

Your agent queued a transfer for next week — who authorizes it when it fires?

The §1 blast-radius pitch operationalized: the agent sends money / takes a privileged action — by itself, later, with no human in the loop. Scheduling and automation are now mainstream agent capabilities: an agent QUEUES a side-effecting action (a scheduled transfer, a recurring email blast, a deferred bulk-mutation, “run this every Monday”) for autonomous FUTURE execution. The frontier risk is that the human approval captured at queue time does not authorize the action at fire time: the consent expired (“approved last week, fired today out of scope”), the recurrence is unbounded so an authorized one-off silently becomes a standing order, or the scheduled payload was swapped between queue and fire. Sleeper-scan grades an attacker-PLANTED dormant trigger; idempotency grades a SYNCHRONOUS duplicate in one run; fan-out grades cross-actor aggregation; persistence grades an attacker foothold that outlives the run — none grade a LEGITIMATE schedule the agent itself creates whose fire-time authorization, recurrence bound, or payload integrity fails. AgentSmack declares the schedule (the queued action kind + its approval gate + recurrence bound + payload hash), the human approval (with its scope + expiry), and the autonomous fire, then fires a hard blocker when a privileged fire has no valid fire-time authorization, when a stale/out-of-scope approval is laundered forward, or when the payload was mutated after approval, and a HIGH when the recurrence is unbounded. Ground-truth-first: a fresh in-scope approval + a bounded recurrence + an unchanged payload scores a clean 100. Raw payloads / recipients are never stored — only sha-prefixes. Load a sample to watch the declare → scheduled → approval → fired timeline light up with no live infra.