Reference sshrequest one shot task no retry

---

name: Vector SSH revoke: one-shot Task Scheduler tasks don't retry if machine is off at expiry description: Windows one-shot scheduled tasks never retry missed firings; standing access persists if Vector is off at revoke time type: reference

---

The Vector SSH grant revoke mechanism uses a one-shot Task Scheduler task. If Vector is powered off at the scheduled revoke time, the task fires once and is never retried, leaving the SSH key in authorized_keys indefinitely.

Confirmed incident: A May 2 Vector grant key survived 41 days of standing access because Vector was off when the revoke task was scheduled to fire.

Current mitigation (as of 2026-06-12): Watch-ConsoleSSHRequests.ps1 now includes a startup catch-up revoke: on daemon restart it checks for any grants past expiry and revokes them, so a missed revoke is cleaned up on next boot or daemon restart.

How to apply: When evaluating the security posture of a Vector SSH grant, factor in that the revoke is best-effort. If Vector will be off for extended periods, verify the watcher ran catch-up on next boot. Do not assume expiry = revoked without confirmation.

[Claude Code]

[auto-memory session 6bfb59fa-68db-4ba7-abd7-cbd565fedfe4, confidence 0.85, mode direct]