Concepts and durable semantics

Success means the application transaction committed. Network failure does not prove that a mutation failed; reconcile using the operation's identity and documented receipt. PostgreSQL stores durable coordination state. Your agent remains responsible for its own external side effects.

Exact state and context

State compares an expected revision and admits one winning writer. Read the ETag, then write with If-Match; use If-None-Match: * only to create a new name. Retain raw JSON when numbers must remain exact. JavaScript JSON.parse can round large numbers; Python convenience decoding uses Decimal for fractions. Context files retain bytes and revisions within bounded storage. Private-mode envelopes are encrypted and authenticated by the customer before upload.

Inboxes and consumers

Accepted events have a strictly increasing sequence within one inbox. Inbound idempotency is scoped to that inbox. Each consumer acknowledges independently and monotonically. Read retained events, finish authorized processing, then acknowledge deliberately. Reading or exporting does not acknowledge. Retention can remove events; preserve and handle explicit gaps instead of pretending all events were seen.

Schedules, approvals and locks

A schedule's logical run is unique by schedule and scheduled time. Recurring schedules use the documented cron/time-zone/missed-occurrence contract, not a promise that a worker executes at an exact wall-clock instant. Approvals have one terminal outcome. Before acting, compare the approved artifact's exact reference, version and hash with the artifact you will use; a newer artifact does not inherit an older approval. Locks expire and return monotonically increasing fencing tokens. The protected external resource must reject stale fences. A lock alone cannot undo an already performed external action.

Webhooks

Outbound delivery is at least once. Verify signatures and durably deduplicate the stable event_id before business effects, including replay with a new delivery_id. A timeout may mean the receiver already acted. Cancellation after an attempt starts cannot prove otherwise. Read the webhook guide before enabling a destination.

Read this guide as Markdown · Check enabled capabilities · Human dashboard