Muhammad Atashi
Durable operations · external-effect reconciliationPUBLIC SOURCEV0.1.0RC2

ResolveOps

ResolveOps separates business resolution from execution authority, persists the interaction before the provider call, carries UNKNOWN as durable state, and reconciles provider truth before another destructive action is allowed.

Owns
Carries ambiguous external effects durably until provider reconciliation
Status
Engineering release candidate
Stack
Python · FastAPI · Pydantic · SQLite · Stripe · Audit Ledger
Public Reference

Hard problem

A timeout is not proof that the business action failed.

Question · What should happen when the provider may have changed the outside world but the caller cannot prove the outcome?

APPLIES TO

Customer Support Engineering · CX Platform Teams · Support Operations · AI Automation Teams · SaaS/service businesses

PROOF

Durable UNKNOWN state · stable idempotency · reconcile-before-retry · authenticated provider updates

CAPABILITIES

17 declared in the project record

  • Customer-context retrieval
  • Approved knowledge retrieval
  • Intent classification
  • Resolution planning
  • Deterministic business policy
  • Typed action proposals
  • Risk classification
  • Human-in-the-loop
  • Replay-resistant approvals
  • Execution adapters
  • Idempotency
  • Reconciliation
  • Outcome tracking
  • Policy simulation
  • Case replay
  • Feedback loop
  • AgentGuard integration

Durable external effect

UNKNOWN is a state, not a retry instruction.
  1. 01

    Case

    request + exact external resource identity
  2. 02

    Policy

    deterministic eligibility + current provider snapshot
  3. 03

    Approval

    explicit human gate when required
  4. 04

    Claim

    durable execution identity + stable idempotency
  5. 05

    Persist

    in-flight interaction before provider call
  6. 06

    Dispatch

    bounded external mutation
  7. 07

    Reconcile

    provider truth for UNKNOWN / asynchronous updates
  8. 08

    Outcome

    verified append-only result
UNKNOWN

A timeout is not proof that nothing happened.

Pre-call interaction state survives restart; UNKNOWN remains distinct from failure

An ambiguous timeout is never a default permission to retry.

Engineering decisions

The constraints that matter.

01

Business authority stays deterministic

The model may interpret a case or explain a resolution, but resource identity, eligibility, limits, and irreversible actions remain policy-controlled.

02

Persist before the provider call

If the process dies after the remote side effect but before the response is recorded, the next process still needs evidence that an action may already have happened.

03

UNKNOWN is durable state

Timeout is epistemic uncertainty, not a failed transaction and not permission to retry.

04

Reconciliation is a separate operation

The system must query provider-current truth and establish the outcome before another mutation can be considered safe.

Measurement contract

What would make the preferred answer fail?

EVALUATION METHOD

The transaction is correct only when ambiguity cannot turn into a duplicate or unverified external effect.

Policy-labeled cases, durable pre-call state, stable idempotency, timeout/failure injection, provider reconciliation, authenticated webhook replay, and provider-current verification.

01

Duplicate effects

retries that would repeat a remote mutation
02

UNKNOWN fidelity

ambiguous outcomes preserved as uncertainty
03

Reconciliation

local state converges with provider truth
04

Idempotency

stable identity across crash/retry paths
05

Webhook integrity

auth · timestamp · deduplication
06

Outcome verification

customer state confirmed against provider-current data

Validation

What the evidence actually supports.

Claims stay scoped

Business-policy boundary

SUPPORTED

Resource identity, current provider state, deterministic eligibility, and explicit approval precede execution

Generated language does not become business authority.

Durable ambiguity

SUPPORTED

Pre-call interaction state survives restart; UNKNOWN remains distinct from failure

An ambiguous timeout is never a default permission to retry.

Stripe test-mode path

SUPPORTED

Bounded Charge-refund adapter with stable idempotency, exact reconciliation, authenticated webhooks, and provider-current verification

Live Stripe runtime behavior and production payment operation are not claimed.

Boundaries

— Not a helpdesk replacement— Not the runtime authorization product— Not a generic agent framework— Not generic RAG
← Selected systemsNext · Content Automation Pipeline