GOKU · persistent personal-agent runtime on OpenClaw
Goku is my long-lived personal agent: model choice is transient; identity, memory, tools, permissions and relationship state are durable. OpenClaw provides the runtime. Specialist agents, MCP tools, heartbeats, Memento and a DBZ-inspired scheduler let cognition scale up or down without resetting the person-like state around it.
DBZ temperament: cheerful, permanently hungry, always looking for a harder fight. The forms are compute states.
OpenClawMCPmodel routerheartbeatspecialist agentsMemento
- Base · Opus 5 — routine cognition, tool use and synthesis.
- Super Saiyan · Fable 5 — deeper multi-step planning and review.
- Ultra Instinct · Astra 6 — high-entropy escalation when quality gain justifies latency and cost.
m* = argmaxm(Qm − λLm − μCm − ρRm)
task → entropy / uncertainty / modality / tool-risk
→ latency SLO + quality floor + cost ceiling
→ deterministic | cache | Base | SSJ | Ultra Instinct
→ verifier / outcome telemetry → routing update
Context allocator / scheduler
Bctx = Bidentity + Bworking + Bretrieval + Btools + Bdecode-reserve
immutable identity prefix → prefix/provider cache · active task → working set · Memento recall → ranked evidence packet · tool output → TTL/dedupe/compaction · reserve → completion + recovery budget
- Admission control: interactive work outranks heartbeats/background jobs; deadline, expected quality gain, risk and budget decide run-now vs cheaper form vs async batch.
- Route regret: sampled shadow/challenger runs compare the chosen form with a stronger model; verifier disagreement, retries and outcome quality become routing evidence.
- Agent SLOs: p95 TTFT · tool success · context-overflow rate · fallback rate · recall precision · $/completed task · background compute/day.
Inference / hardware crossover
API burst → local Apple Silicon/private reflex work → open-weight serving with vLLM/PagedAttention → continuous batching + KV/prefix reuse → speculative decoding → FP8/INT8/4-bit only when sustained throughput and cache reuse beat provider margin after idle-time cost.
Sleep / dream cycle
idle window → episode/session flush → salience + dedupe
→ contradiction scan → Memento consolidate/reconsolidate
→ dormancy/reactivation → next-session context compile
Authority / persona state
capability registry → read/tool/write class → policy + budget + current-state precondition → optional approval → idempotency key → side effect → receipt. Stronger cognition never silently widens authority.
durable traits + relationship state + goals compile separately from transient mood/task context; behavioural regression probes catch provider/model drift without freezing personality inside one checkpoint.
Proactive autonomy / checkpointing
heartbeat tick → observe inbox/world/tool state
→ classify {ignore | remind | plan | act-within-capability}
→ reserve cost/risk budget → specialist fanout if needed
→ checkpoint plan + tool receipts → side effect
→ verify outcome → update working state / memory candidate
- Autonomy budget: background work is bounded by daily token/$ ceilings, tool-risk class and interruption policy; idle cognition cannot silently consume unlimited compute or authority.
- Checkpoint/replay: long tasks persist plan step, tool inputs/outputs, idempotency identity and outstanding commitments so process death resumes from durable work rather than repeating side effects.
- Specialist isolation: research/build/review agents receive scoped context and capabilities; results merge through typed artifacts/evidence instead of sharing one unbounded conversational memory.
Cache / token economics
stable identity + policy → long-lived prefix cache · task/tool schemas → reusable prompt blocks · retrieved evidence → short-lived semantic cache · tool results → TTL keyed by source/version · context compaction preserves commitments + causal tool history before prose.
telemetry joins model route → fresh/cache tokens → TTFT/decode → tool fanout → verifier/retry → human correction → task outcome, so optimization targets cost per successful task rather than nominal $/token.
Multi-agent concurrency / merge
parent task → spawn specialist(task_id, capability_set, context_slice, budget) → parallel tool/reasoning work → typed artifact/evidence result → verifier/conflict check → merge into parent state. Specialists do not share one mutable scratchpad; causal IDs make fanout/retry/review attributable.
- Conflict policy: deterministic state wins over prose; contradictory specialist claims remain separate evidence until a resolver can compare source, freshness and confidence.
- Failure isolation: one specialist timeout degrades that branch, not the identity/runtime; bounded retries and fallback tiers preserve the parent task's checkpoint and budget.
identity_state ∉ provider_session_state · memory, permissions, tools, relationships and behavioural continuity remain app-owned across provider/model swaps.
MEMENTO · temporal memory compiler
Memento treats memory as a lifecycle, not a vector lookup. Immutable episodes accumulate evidence; salience, corroboration, novelty, confidence and future utility decide what becomes durable semantic/self state, what weakens, what becomes contested and what is reconsolidated after new evidence arrives.
The design borrows from cognitive-neuroscience ideas: episodic vs semantic memory, consolidation, reconsolidation, salience, forgetting, retrieval strengthening and spaced repetition — implemented as inspectable software state rather than a literal brain simulation.
append-only evidencesalienceconsolidationreconsolidationdecayMCPeval harness
episode / observation (immutable)
→ encode + source/provenance
→ salience / novelty / confidence / recurrence
→ candidate memory
→ corroboration / promotion threshold
→ compiled semantic / autobiographical / relationship state
→ decay / dormancy / contradiction
→ reconsolidation → retrieval → behaviour
P(m)=wsS+wrR+wnN+wcC+wuU
strength(t)=strength₀·e−λΔt | Score(m,q)=αcos(em,eq)+βS+γR+δrelationship+εgoal
Biological analogy → software architecture
hippocampal-style episodic indexing ≈ append-only event store + retrieval pointers · systems consolidation ≈ promotion into compiled semantic/self state · reconsolidation ≈ versioned rewrite after contradictory evidence · forgetting ≈ strength decay/dormancy, not evidence deletion · rehearsal/spaced repetition ≈ scheduled refresh before retrieval probability collapses.
Memory model comparison
archive memory = append → exact replay
vector memory = embed → ANN top-k
graph memory = entity/relation → traversal
Memento = episode → evidence → promote/decay/contest
→ reconsolidate → compiled behavioural state
Runtime / data plane
Postgres/SQLite canonical state · append-only event log · JSONB provenance/version lineage · pgvector/HNSW derived recall index · background lifecycle workers · MCP remember/recall/forget/inspect/consolidate/explain surface · embedding-version migrations.
- Zero-LLM lifecycle path: timestamps, recurrence, access frequency, promotion thresholds, corroboration, decay, dormancy and versioning stay deterministic where possible.
- Write amplification: most episodes remain episodes; durable semantic/self state is compiled only after evidence crosses policy thresholds.
- Index migration: embedding version is metadata, not identity; dual-index rebuild + shadow recall permits HNSW/model migration without rewriting canonical memories.
- Memory safety: source trust, contradiction edges and status gates expose poisoning/stale belief; contested memories can be withheld from high-consequence context until reconciled.
Reconsolidation / working-set economics
semantic_conflict(new_event,memory) > τ
→ contested + contradiction edge
→ load lineage + counter-evidence
→ deterministic reconcile if possible
→ LLM only for unresolved semantic ambiguity
→ memory_state vN+1; retain vN + provenance
context compiler pins identity + active commitments first; evicts redundant/low-salience material; summaries retain source pointers; token budget is optimized for useful recalled evidence, not maximum injected context.
Evals
precision(write) · recall@k · contradiction F1 · false-memory rate · stale-memory rate · correction rate · context-compression ratio · write→promotion ratio · reconsolidation queue depth · $/1K events · behavioural continuity after provider/model swap.
Complementary learning / interference control
fast episodic capture and slower semantic consolidation follow a complementary-learning pattern: new experiences are written immediately, but durable abstractions require repeated/corroborated evidence so one surprising event cannot catastrophically rewrite identity or long-lived beliefs.
retrieval_strength ≠ storage_strength | promote when evidence_gain − contradiction_risk − rewrite_cost > τ
- Interference: semantically similar episodes are clustered/deduped but retain separate provenance; consolidation merges evidence, not source identity.
- Prediction error: large mismatch between expected and observed state raises salience and can trigger reconsolidation rather than blindly reinforcing the prior memory.
- Retrieval-induced strengthening: successful, consequence-bearing recall can increase accessibility while low-value repetition alone does not automatically increase truth confidence.
- Sleep analogy: off-critical-path lifecycle workers replay high-salience/contradictory episodes, refresh decaying memories and compile a smaller next-session state without spending frontier inference on every event.
salience acts like a write gate rather than a truth score: emotionally/operationally consequential events may be easier to retrieve, but confidence still comes from provenance and corroboration. Accessibility and belief confidence are intentionally different variables.
the eval harness therefore tests memory as behaviour over time, not only retrieval relevance on one query.
authority(memory_state)=event_lineage + promotion_policy + versioned_reconciliation · ANN/HNSW is a derived index, never canonical belief state.
SPOTNOOK · AI-native property exploration + spatial decision system
SPOTNOOK is an AI-native property exploration platform that makes search spatial, conversational and executable. Natural-language intent, live property evidence and agentic tools resolve into a persistent 3D world of Singapore buildings, floors and spaces. NOOK is the persistent spatial agent across text, voice, map and 3D: it maintains the brief, selected objects, evidence, scenarios and actions while the user moves between discovery, inspection, comparison and decision.
Describe → Spot → Inspect → Compare → Decide. Input modality changes; canonical property identity and decision state do not.
Postgres/PostGIScanonical property graphCesium / 3D TilesReact/TSWebRTCNOOK agent meshprediction ledgerUnreal R&D
Intent compiler / active search
text | voice | map click | selected geometry | direct edit
→ context resolver + entity extraction
→ hard / soft / open typed constraint graph
→ canonical subject resolution
→ feasible-set query + deterministic feature compute
→ ranking / Pareto frontier / uncertainty
→ explanation packet + provenance
→ user mutation → invalidate dependent state → recompute
F={x | ∀hj(x)=true} | rank(x)=Σwifi(x)−λ·uncertainty(x)−μ·constraint_risk(x)
q* = argmaxq E[ΔH(shortlist | answer(q))] − κ·interaction_friction(q)
- Constraint preservation: explicit headcount, budget, move date, access, fit, growth and operating needs become typed state; the model may parse ambiguity but cannot silently drop a requirement.
- Active clarification: NOOK asks only when the expected information gain can materially change the feasible set or ranking.
- Shared semantic context: “these three”, “same landlord”, “this floor”, a voice command, a map selection and a comparison edit point at the same canonical subjects/scenario.
- Specialist-agent mesh: coordinator + geometry/fit + market/history + finance + commute + evidence + decision-brief specialists; capabilities are tool-scoped and outputs mutate typed application state, not chat-only memory.
Canonical world model / evidence graph
Place → Parcel → Development → Building/Tower → Floor → Space. Listings, availability episodes, occupiers, leases, transactions, geometry assets, source observations and predictions are separate temporal objects. One provider observation is evidence; identity is resolved across sources before state attaches to the world.
source observation → raw snapshot → normalized observation
→ identity / relationship resolution → assertion + provenance
→ canonical property graph → temporal events / market state
→ deterministic analytics → agent/tool/UI projection
Spatial kernel / renderer
source CRS → canonical geographic frame → building-local ENU
→ floor-local XY / unit polygon
→ PostGIS GiST/R-tree + spatial joins
→ mesh / glTF-GLB / 3D Tiles hierarchy
→ frustum + screen-space-error selection
→ GPU tile cache / picking / camera state
MultiPolygon parts/holes · geometry versioning · ST_Contains/ST_Intersects/ST_DWithin-class queries · shared physical scale · floor slicing · adjacency · building hit targets · ray/frustum logic · solar/shadow inputs only when geometry capability allows it.
God's-eye / digital-twin R&D
OSM / Overture / URA / OneMap
+ rights-cleared CAD / IFC / GLB / floorplans
+ imagery / photos / future licensed capture
→ identity reconciliation + CRS / datum normalization
→ geometry capability + provenance envelope
→ footprint / parts / massing / floorplate
→ SfM / photogrammetry / NeRF / 3DGS candidates
→ LOD / 3D Tiles / Cesium streamed Singapore
→ Unreal-class scene / ECS / navmesh / embodied-agent path
Typed brief / dependency graph
Constraint {
subject_id?; predicate; op; value; unit;
priority: HARD | SOFT | OPEN;
confidence; provenance; status;
depends_on[]; invalidates[];
}
Brief = DAG<Constraint, Scenario, Evidence>
an edit is not “new chat”: mutate one node, walk invalidation edges, recompute only affected candidate features/ranks/visuals, retain unaffected evidence and preserve the originating camera/selection/scenario.
Query execution / cache topology
brief hash + scenario version
→ canonical candidate IDs
→ PostGIS spatial filters / joins
→ temporal market snapshot
→ deterministic feature vector
→ model/ranker only where learned judgment adds value
→ explanation/evidence packet
→ cache by {subject,scenario,method,version}
- Incremental recompute: moving a budget threshold should not rerun geometry conversion or rebuild the world; changing a floor/unit invalidates fit/adjacency/cost descendants but not unrelated market history.
- Temporal engine: availability episode, asking update, occupier/lease event, transaction and source observation keep effective time + observed time + provenance; “current” is a projection over versioned facts, not a mutable row.
- Prediction ledger: every learned estimate stores feature/version/method/time alongside later actual outcome so calibration, drift and cohort error can be measured by district/building/size band rather than only globally.
Scene graph / agent embodiment
entity = canonical property subject · components = transform/geometry/floor/space/evidence/availability/selection/analysis · systems = render/picking/LOD/navigation/sun/fit/annotation. NOOK references entity IDs and capabilities, so “this building” or a voice interruption resolves to the same scene object the renderer and evidence graph use.
camera_state + selected_entity + scenario_version + time_cursor = spatial_context
NOOK planner / tool contract
Intent {utterance, selection, scenario, time_cursor}
→ resolve references to canonical subject_ids
→ planner emits PlanStep[]
{tool, subjects, preconditions, cost, reversible, output_schema}
→ capability registry checks evidence + authority
→ deterministic tool / specialist agent executes
→ typed Artifact {data, method, provenance, confidence}
→ compositor chooses map | plan | table | chart | 3D | brief
→ state patch + explanation + next-action candidates
- Model boundary: LLMs parse intent, choose/sequence tools and explain trade-offs; PostGIS, route engines, financial calculators, geometry kernels and evidence stores own numerical/physical truth.
- Reversible planning: inspect/filter/compare actions are cheap and replayable; enquiry, save/share or external mutation is capability-gated with explicit preconditions and receipts.
- Context compaction: NOOK persists canonical IDs, constraints, scenario version, pinned evidence and unresolved checks; prose history can compact without losing the decision state needed to resume.
Spatial relation graph / physical computation
unit adjacency · floor-above/below · same-stack · same-landlord · walkable entrance/MRT graph · frontage/orientation · floor/core/column obstacles become typed relations over the canonical subject graph. Fit and navigation can therefore be computed from geometry/topology instead of inferred from listing prose.
fit(space,brief)=usable_polygon − core − circulation − exclusions → seat/room/adjacency constraints
external sun/view work, when inputs qualify, becomes geometry math: solar vector(time,lat,lon) + facade/opening orientation + obstruction mesh + ray/frustum/occlusion. Capability gates distinguish approximate massing from measured floor/opening geometry so a photoreal scene never masquerades as measurement.
Decision vector / sensitivity engine
x = [occupancy_cost, cash_required, commute_p50/p95,
fit_score, growth_headroom, move_risk, market_pressure,
landlord/history signals, evidence_confidence]
feasible(x) = all HARD constraints
frontier = non_dominated(feasible_set)
scenario Δ = rank(vN+1) − rank(vN)
recommendation stability is measured, not asserted: perturb rent, fit-out, attendance, headcount, weighting or move date and record which candidates stay on the Pareto frontier. Explanations cite the feature/evidence deltas that moved an option.
Prediction / decision science
hard constraints define feasibility; preferences rank inside the feasible set; sensitivity/Pareto checks expose unstable recommendations. Market models can score asking-vs-achieved, availability pressure, expiry risk, time-on-market and likely-clearing bands; every prediction is versioned against later actual outcomes for calibration/drift.
Realtime / compute / cost
CPU/server: intent graph + PostGIS + finance/route/scenario math · client GPU: Cesium/WebGL scene, LOD, picking, camera · offline/batch: geometry conversion, tiles, embeddings, historical aggregates · frontier LLM: ambiguity, planning and explanation only · WebRTC/VAD/barge-in dispatch into the same state graph.
- Render SLOs: time-to-first-useful-world · p95 action/camera latency · tile-cache hit · GPU memory · draw calls · long-task budget · geometry-upgrade success.
- Decision evals: constraint-preservation · entity-resolution accuracy · provenance coverage · ranking stability under perturbation · geometry-capability coverage · tool success · cost/decision session.
World-cache / invalidation economics
immutable geometry/source artifacts cache by content/version; property packets cache by canonical subject + evidence revision; scenario outputs cache by brief/scenario hash. A changed asking term invalidates cost/rank descendants, not the 3D mesh; a geometry revision invalidates spatial analyses, not historical transaction evidence.
- Compute placement: expensive reconstruction/tiling runs offline once and streams many times; per-session work stays incremental so richer worlds do not imply frontier-model or GPU recomputation on every question.
- Failure semantics: if a renderer/provider/agent fails, canonical selection, brief and evidence state survive; the product can fall back in representation without losing the decision graph.
state restoration key = {brief_id, scenario_version, selected_subject_ids, camera, lens, time_cursor}; deep links and reloads can resume the same analytical object instead of reconstructing context from prose.
cache eviction follows evidence/version invalidation before LRU so stale property truth never survives merely because it is hot.
canonical(subject_id) > provider/listing IDs · analysis = inputs + method/version + capability + provenance · NOOK can interpret and plan, but cannot manufacture geometry, rent, route or evidence state.
BLUEBALLS · virtualised JIT liquidity + open financial OS
Blueballs is an open-source banking and FX operating system for institutions that want to own the financial control plane. Banking APIs, exact accounting, policy, pricing, provider orchestration, multi-source liquidity, reservations and settlement live behind one developer surface. The unusual layer is a just-in-time virtual market: heterogeneous balance sheets remain independent until executable capacity is policy-authorised and reserved.
181 banking ops12-package monorepoBigInt route mathJIT reservationsDurable ObjectsSolidity / FoundryOpenAPI
PRIVATE_MARKET ┐
ISSUER │
INSTITUTIONAL_LP├→ policy-authorised slices
NEOBANK │ {price, capacity, expiry, auth, source}
BANK_TREASURY │
BANK_PRINCIPAL ┘
↓
BigInt rational price ordering → exact-output split
→ reservePlan(routeId) → reservationHandle[]
→ firm executable route → execute → finality / reconciliation
Implemented route planner
validateSlice() enforces source type, asset pair, policyAuthorizationId, positive BigInt capacity/price terms and expiry. comparePrice() cross-multiplies integer rationals, avoiding floating-point FX ordering error. Eligible slices sort O(n log n); exact-output allocation is O(n).
- Virtual liquidity: private orders, issuers, institutional LPs, neobanks, treasury and principal inventory become one policy-normalised executable surface without pretending the underlying capital is one pool.
- Firmness is a state transition: route construction is provisional; a firm route exists only after every selected leg returns a reservation handle.
- Compensating rollback: a later reservation failure releases already-reserved legs in reverse order; release failures are retained as structured recovery evidence.
- Finality: command commit, provider submission, provider acceptance, chain/fiat settlement and reconciliation are separate states with stable idempotency identity.
Routing R&D / next optimizer
min Σpᵢxᵢ + λ·fragmentation + μ·settlementRisk + ν·reserveTime s.t. Σxᵢ=D, 0≤xᵢ≤capacityᵢ
shadow scoring can add source reliability, historical fill probability, settlement latency and expected reconciliation cost before any learned policy receives authority over live capacity reservation.
Distributed runtime / release proof
API command → tenant principal / auth → domain transition
→ ledger + event/outbox → provider intent → adapter/side effect
→ evidence / finality / reconciliation → projection / webhook
Node/SQLite ↔ Cloudflare Workers/Durable Objects · provider-neutral adapters · OpenAPI/SDK contracts · Solidity AtomicRouter · Foundry fuzz/invariants · restart/eviction · migrations/recovery · load/chaos · SBOM · dependency/container scanning · source-SHA parity.
- Single writer where money requires it: authoritative account/market shards serialize the irreversible mutation; read projections and analytics fan out separately.
- Backpressure: quote fanout/provider jobs are bounded per tenant/source; replayable work scales independently from irreversible writes.
- Race objective: minimise snapshot→completed-reservation time; measure stale-slice rejection, reservation conflict, quote→firm latency and released-capacity recovery.
- Failure containment: one provider/source failure shrinks the eligible set or fails the route; it must not silently downgrade a firm quote or corrupt unrelated balances.
metrics: quote p50/p95 · eligible-source fanout · fill ratio · route fragmentation · price improvement · reservation latency · locked-capital ms · compensating-release failure · reconciliation age · $/successful settlement.
Financial command kernel
request → authenticated tenant/human principal
→ lifecycle + contract preflight
→ domain transition
→ exact ledger postings (integer minor/atomic units)
→ durable event + outbox + idempotency result
→ audit/correlation evidence
→ COMMIT
external provider work starts only from durable intent
- Accounting invariants: every transaction balances exactly; balances derive from postings; customer accounts cannot cross below zero at the posting layer; decimal API values are parsed into integer authoritative units before arithmetic.
- Exactly-once financial effect over retrying infrastructure: idempotency identity survives HTTP retries, worker restarts and provider ambiguity; reconciliation closes the gap between transport evidence and business finality.
Money primitives / programmable institution
reserve-backed instruments · settlement receipts · coverage accounting · custody/wallet/account primitives · cards/payments · approvals · treasury/principal capacity · stablecoin FX · optional AtomicRouter settlement all share the same ledger/policy/finality contracts.
- Coverage model: issued liabilities, backing reserves and settlement receipts can be reconciled as typed positions rather than product-specific counters; new monetary products reuse the accounting kernel instead of inventing a parallel truth system.
- Atomic token path: signed taker intent + maker liquidity + cancellation + segregated vault accounting + atomic token settlement sit inside the onchain transaction; fiat/provider edges retain independent evidence/finality state.
Provider conformance / product compiler
brief {markets,currencies,capabilities,rails} → explicit requirements graph → provider capability/market/rail evidence → explainable match → isolated sandbox → implementation contract. Provider adapters keep bank/card/KYC/custody/liquidity behavior behind conformance boundaries, so a market-specific provider swap does not rewrite ledger or lifecycle semantics.
AI may propose architecture/configuration; credentials, quotas, approvals, kill switches and protected financial commands remain deterministic authority. Release proof binds lifecycle, FX, Worker eviction/restart, migrations, chaos, Foundry invariants, SBOM and container scans to the exact source tree.
Reservation / contention semantics
market snapshot vN → eligible slices
→ deterministic exact-output plan
→ reserve legs in plan order
→ conflict/stale slice? fail + compensate prior handles
→ all handles live? quote becomes FIRM
→ execution consumes reserved capacity
→ unused/failed capacity releases with evidence
price math remains integer/rational end-to-end; ceilDiv() prevents underfunding exact-output legs. Reservation is the synchronization boundary between embarrassingly parallel discovery and scarce executable capacity, so read fanout can scale aggressively while contention stays explicit.
Settlement / reconciliation automaton
PROPOSED → RESERVED → SIGNED → SUBMITTED
→ PROVIDER_ACCEPTED | ONCHAIN_PENDING | FIAT_PENDING
→ PARTIAL | SETTLED
→ RECONCILE {missing_receipt, amount_mismatch, timeout, duplicate}
→ CLOSED with final evidence
- Evidence before belief: HTTP 200, tx broadcast or provider acknowledgement are transport states; canonical money state changes only when the required settlement/coverage evidence closes the lifecycle.
- Recovery: restart/eviction reloads durable command, reservation/provider intent, idempotency key and last accepted evidence; workers resume reconciliation rather than resubmitting blind.
- Operational SLOs: reservation conflict rate · stale-quote rejection · provider acceptance latency · settlement tail p95/p99 · reconciliation age · orphaned reservation count · ledger/evidence divergence = 0.
Scale-out / consistency model
partition authoritative writes by tenant/account/market shard · serialize ledger-critical transitions · transactional outbox for provider/webhook work · replayable read projections for balances/market views/analytics · bounded queues + circuit breakers per external source · PITR/migration proof before shard movement.
the trusted core therefore stays small: exact accounting, policy, authority, reservation/finality and evidence. Product UI, provider selection, analytics, read models and generated blueprints can scale or change independently around those invariants.
Monetary coverage engine
instrument liability → reserve asset position → coverage ratio / eligibility policy → mint/burn or transfer lifecycle → settlement receipt → reconciliation. The same typed coverage state can support reserve-backed money products without hiding reserve sufficiency inside an issuer-specific API.
Provider orchestration / durable side effects
domain command committed
→ provider_job PENDING {idempotency_key, encrypted_payload}
→ SUBMITTING → SUBMITTED(provider_ref)
→ ACCEPTED | PENDING_FINALITY | FAILED_RETRYABLE
→ evidence poll/webhook/reconcile
→ FINAL | RECONCILE | DEAD_LETTER
- Outbox-before-I/O: external work becomes durable before network submission, so a process crash between commit and provider call cannot erase intent.
- Retry discipline: stable provider/idempotency identity distinguishes safe replay from a new money movement; retry policy is specific to lifecycle state rather than generic exponential backoff around an opaque request.
- Provider ambiguity: timeout after submission is not “failed”; the job moves to evidence/reconciliation until remote state proves whether value moved.
- Adapter conformance: providers implement the same lifecycle/evidence contract even when upstream APIs expose different status vocabularies, webhook models or settlement rails.
IAM / attribution contract
tenant principal → machine credential / human session → scope + resource authority → optional human approval → signed attribution bound to credential + method + path + query + body → audit correlation. A machine can operate only inside delegated capability; approval identity is preserved through async provider work.
authority(command)=tenant ∩ credential_scope ∩ resource_policy ∩ lifecycle_precondition ∩ approval
Treasury / capacity risk
available liquidity is not merely balance: executable capacity is balance × policy × tenor/expiry × venue/provider availability × settlement path × concentration limits. Reservations therefore consume risk-adjusted capacity, not just quoted notional.
- Exposure controls: source/asset/counterparty ceilings, minimum residual inventory and route concentration can reject a mathematically cheap route before execution.
- Rebalancing signal: reserved/settled flows update treasury exposure and can trigger replenish/rebalance jobs without coupling the trading request to one hard-coded venue.
firm(route):=∀legᵢ[policyᵢ=authorized ∧ reservationHandleᵢ≠∅ ∧ expiryᵢ>now] · transport success and business finality remain separate states.