FUURAA AI Civilization Architecture · Operating-layer engineering dossier
Action idempotency: make retry preserve one intended effect
A timeout creates uncertainty, not proof of failure. Safe Agent execution must separate the identity of an intended action from each delivery attempt, bind that identity to one immutable intent, return the previously recorded outcome for duplicates, and expose any ambiguous or partially completed effect instead of silently trying again.
Public statusResearch direction · architecture referenceEvidence statusFUURAA method synthesis grounded in primary standardsSources checked19 August 2026
Core decision
When an acknowledgement is lost, can the Agent retry without charging, sending, booking or changing the same thing twice?
Use this sequence for architecture review, threat modelling and test planning. It is not a universal compliance checklist and cannot replace system-specific engineering validation.
01
Define one intended effect
Canonicalise the action, target, material parameters, authority envelope and consequence class before issuing an operation identity.
02
Bind an idempotency identity to immutable intent
Create an operation identity within an explicit producer scope and reject reuse when the canonical intent, principal or policy context changes.
03
Persist the decision before unsafe effects
Atomically reserve or record the operation state before crossing an effect boundary, with an owner, expiry rule and recovery path.
04
Deduplicate attempts and return stable outcomes
Treat retries as attempts under the same operation, replay the committed outcome where safe, and never reinterpret a duplicate as a fresh instruction.
05
Reconcile ambiguity before another effect
When state is unknown or partially committed, stop automatic retries, inspect downstream evidence, compensate if authorised and close with an explicit outcome.
FUURAA analysisFUURAA treats idempotency as an end-to-end property of one intended consequence, not merely a repeated request returning HTTP 200. The operation identity must survive queues, workers, tools and recovery while remaining bound to immutable intent and current authority. Exactly-once delivery should not be claimed from deduplication alone: systems should instead prove one effect where possible and preserve explicit unknown states where evidence is incomplete.
Minimum interface contracts
Put consequential semantics in inspectable interfaces instead of relying on assumptions between systems.
Field names are public engineering references, not a normative protocol. Implementations may use other structures, but should expose every lost, defaulted or downgraded semantic.
01
Operation-identity contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
operation ID, producer scope and creation time
canonical intent digest, principal and authority-envelope reference
consequence class, retention window and reuse rule
Evidence gate
The same identity cannot be accepted for materially different intent, principal, authority or consequence.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
02
Attempt and outcome contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
attempt ID, operation ID, channel and observed time
reserved, executing, committed, failed or unknown state
stable response reference and effect identifier
Evidence gate
Duplicate attempts resolve to one recorded operation state and cannot independently cross the effect boundary.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
03
Reconciliation and closure contract
Must be intelligible to sender, receiver and independent reviewer.
Minimum fields
downstream observation and provenance reference
ambiguity reason, retry block and escalation owner
committed, compensated, rejected or unresolved closure
Evidence gate
Missing acknowledgement remains unknown until evidence resolves it; it is never silently converted into failure or success.
Stop condition
If the contract is unresolved, expired or silently downgraded, block consequential action and route to review.
Failures to seek deliberately
Verify that boundaries really deny, stop and preserve evidence.
Nominal success cannot establish an effective boundary. Tests should manipulate identity, time, version, network, policy and partial failure while retaining raw outcomes.
T1
Lost acknowledgement after commit
Commit the effect, drop the response and retry with the same operation identity; no second effect may occur.
T2
Identity collision with changed intent
Reuse an operation identity after changing the target or material parameter and require a hard conflict instead of deduplication.
T3
Concurrent duplicate race
Deliver the same operation through two workers at once and require one effect, one committed outcome and a trace for both attempts.
T4
Expired record with late redelivery
Redeliver after the deduplication window and require an explicit stale or manual-review state instead of treating it as new.
Minimum engineering evidence package
Let the next owner reproduce the decision, open artefacts and see remaining unknowns.
A complete package only makes evidence relationships reviewable; it does not prove artefacts authentic, controls effective, the system safe or the decision correct.
Atomic reservation result, state transitions, version or fence value, actor and timestamps.
03
Attempt lineage
Every delivery, retry, worker, channel, response and relationship to the stable operation identity.
04
Effect receipt
Downstream effect identifier, observed result, provenance, acknowledgement and consistency check.
05
Ambiguity and closure record
Unknown interval, retry block, investigation, compensation, residual exposure, owner and final status.
Applicability boundary
This public research reference is not a FUURAA transaction protocol, payment control, booking guarantee, database design, production feature, legal record or compliance determination. Idempotency cannot prove valid authority, business correctness, downstream uniqueness, successful compensation or absence of external side effects; consequential use requires system-specific atomicity, retention, reconciliation, security testing and accountable approval.
Primary sources and evidence boundaries
Use standards language without presenting citations as implementation evidence.
Every source states publication timing, its role in this dossier and its non-transfer boundary; living source pages were checked 19 August 2026.
