Stable action and attempt IDs
Bind principal, domain, material hash and source-state reference. Changed material or stale context must fail closed.
Integrate the control contract without inventing authority.
Use stable proposal and attempt identity, bounded grants, independent admission, truthful outcomes and explicit reconciliation.
PROPOSE→DECIDE→ALLOW / DENY / ESCALATE
ALLOW→GRANT→EXECUTION→OUTCOME→RECEIPT
The implementation binds the request before consequence.
operation · consequence_class · attempt_id · sender_domain · receiver_domain · source_state_ref · freshness · receiver_authority_ref
Stale state does not progress.
Consequential work without receiver authority does not progress.
Replay or conflicting material is refused.
Unknown external effect stays non-final and is reconciled without blind retry.
Do not retry unknown effects blindly
Retry only when non-application is proven, or when the owning durable mechanism proves the same identity cannot create a second effect.
Preserve uncertainty
UNKNOWN_EFFECT is non-final. Reconciliation observes the original attempt and preserves uncertainty until stronger truth exists.
Projection is not authority
Validate field scope, purpose, provenance, freshness and expiry. The receiver then makes its own decision and, if allowed, its own grant.
ACTIVE EXECUTION→STOP→CONTAIN→SAFE STATE→RECONCILE→STOP RECEIPT
STOP is a control semantic, not a universal public HTTP endpoint. Each integration must bind STOP to its qualified interrupt path.
Required checks
Decision topology · material/state/authority binding · grant expiry · freshness · duplicate refusal · stable attempt identity · UNKNOWN preservation · reconciliation · STOP ordering · receipt-chain integrity · projection/authority separation · malformed/rebound input handling.
Current bounded local integration: 17/17 PASS