Exact-plan authorization
Approval binds to a SHA-256 digest of the precise effects, constraints and canonical base version. Any substitution invalidates authority.
PREVENTS: plan swapping after approvalTRUST MODEL
Trust without blind access
PACT does not ask you to trust an agent's judgment after giving it broad permissions. It constrains what can happen before authority exists and verifies what happened afterward.
Short-lived capability lease
Commit authority exists only for the approved transaction and expires automatically.
PREVENTS: durable ambient privilegeStale-state rejection
If canonical state changes after preview, the approved transaction cannot commit against the new world.
PREVENTS: acting on obsolete assumptionsNegative invariants
PACT verifies what must not change—billing and deletion in the reference transaction—not only intended positive effects.
PREVENTS: collateral side effectsFail-closed persistence
If durable storage fails after an in-memory operation, PACT restores the pre-operation snapshot rather than leaving ghost state.
PREVENTS: memory/durable divergenceTamper-evident receipt chain
Receipts and audit entries are independently hashed and linked so post-hoc mutation is detected.
PREVENTS: unverifiable success claimsDetached durable replay index
Provider idempotency evidence is stored as immutable replay records outside the hot canonical CAS object. Replay guarantees remain durable while high-volume resources avoid an ever-growing state record and the contention that comes with rewriting the full replay history on every transaction.
PREVENTS: replay-loss shortcuts and unbounded hot-record growthOne approval across a durable cross-resource saga
PACT can freeze an ordered multi-resource plan, bind one human approval to its exact plan hash, execute each provider step with stable idempotency keys, compensate only where a handler explicitly supports a safe inverse, and stop on uncertain outcomes until reconciliation proves what actually happened. Terminal outcomes distinguish committed, compensated and partially committed workflows instead of claiming distributed ACID that providers do not offer.
PREVENTS: unapproved cross-system drift, blind rollback and false all-or-nothing claimsStep-verifiable cryptographic saga evidence
Terminal saga receipts now carry an ordered SHA-256 evidence chain rather than only one aggregate success hash. The frozen plan, approval binding, execution authorization, every durable provider-step outcome and fencing context, operator recovery decisions, and the terminal state are individually hashed with monotonic sequence numbers and previous-hash links. Verification fails closed if an event payload is changed, reordered, deleted, or relinked, while exact receipt replay preserves the same evidence head.
PREVENTS: hiding or rewriting one step inside an otherwise valid-looking multi-provider receiptNegotiated provider guarantees
The production provider registry declares each handler's exact resource and atomic domain plus its conditional-write, idempotency, mutation, reconciliation, compensation and reversibility guarantees. Saga preview rejects a step before approval when its requested guarantees exceed the registered provider contract, and server-only credential references are resolved without exposing token values in public registry metadata.
PREVENTS: approving a workflow whose provider cannot actually deliver the promised safety semanticsDurable saga execution leases and fencing
Every executing saga is owned by one worker lease with a monotonically increasing fencing generation. A second worker cannot enter while that lease is live; after expiry, takeover advances the generation and forces any in-flight step through reconciliation before new provider work can continue. The stale worker is prevented from verifying, persisting success, compensating or advancing later steps once its generation is no longer current.
PREVENTS: zombie workers, split-brain saga advancement and stale post-timeout commitsProvider-enforced remote fencing
Providers that can enforce monotonic fencing may declare a server-side fencing contract in the registry. PACT then includes the current saga generation on every forward mutation, compensation and reconciliation write, and saga preview can require this guarantee before approval. Providers without remote enforcement cannot satisfy that requirement and remain explicitly classified as relying on idempotency, conditional writes and reconciliation for residual in-flight risk.
PREVENTS: pretending PACT-side worker fencing can cancel or supersede an already-sent remote mutationExact saga approval-artifact replay binding
PACT canonicalizes and hashes the original saga approval artifact together with its saga ID and frozen plan hash before authority is persisted. A later approval call is idempotent only when that approval artifact is canonically identical to the first one; materially different evidence fails closed before approval verification is invoked again. Approved records created without this replay digest cannot silently replay.
PREVENTS: approval substitution, replay audit ambiguity and conflicting approval evidence being reported as the same authorizationEvidence-bound operator recovery
When a remote outcome is uncertain, PACT can freeze a recovery snapshot containing the exact affected step, failure, fencing generation and canonical provider evidence, then hash that snapshot before an operator can resolve it. Resolution requires fresh human approval bound to that recovery hash, is idempotent only for the exact same decision, persists a pending decision before reconciliation for crash recovery, and records the completed resolution in the terminal saga receipt.
PREVENTS: blind retry, stale-evidence recovery, unaudited operator intervention and post-incident ambiguityQualified conditional-write guarantees
PACT no longer treats the mere presence of an HTTP ETag as proof of a strong concurrency primitive. REST providers are classified conservatively as conditional-write with unknown strength unless they explicitly opt into strong-validator enforcement; in that mode PACT verifies that each canonical pre-write read carries a syntactically strong, non-weak entity tag before any mutation can be sent. Unsupported guarantee declarations fail during registry construction instead of being advertised to planners.
PREVENTS: overstating provider CAS strength and approving writes on weak concurrency evidencePROVE IT