The state machine distinguishes what was requested, what was observed and what has been verified. It makes the path through uncertainty explicit so that an incomplete signal cannot silently advance an effectful workflow.
Desired, observed and verified
Desired state is the target configuration. Observed state is the most recent collected evidence with freshness and quality. Verified state is an observation set that passed versioned rules during a defined window. Verified does not promise the system stays healthy forever.
Lifecycle
| State | Meaning | Valid direction |
|---|---|---|
| PROPOSED → VALIDATING | A typed request is authenticated and evidence is collected. | Block, simulate or seal a plan for approval. |
| PENDING_APPROVAL | The final plan is sealed and waits for required signatures/delegation. | Approve, expire or cancel. |
| APPROVED → EXECUTING | Authority exists but live preflight is still required before each effect. | Execute, invalidate on drift or stop on expiry. |
| RECONCILING | The system cannot yet determine whether an effect reached the provider. | Read provider state; verify or fail—never blind retry. |
| VERIFYING | Rules examine the resulting state and evidence window. | PASS advances; FAIL/UNKNOWN blocks the next step. |
| VERIFIED | All final checks passed. | Terminal transition state. |
| FAILED / ROLLING_BACK | Effect failed or evidence failed; a scoped recovery path may begin. | Recover, escalate or freeze. |
Safety invariants
- No effect before a verified Checkpoint 1 and human attestation for the scope.
- Permits derive only from a sealed final plan and valid authority.
- Any canonical change to the plan invalidates old authority.
UNKNOWNis different fromPASS; neither FAIL nor UNKNOWN permits the next step.- Every acknowledged effect is linked to durable intent/audit evidence.
- Simulation has no path to execution.
- Historical checkpoint and audit records are not deleted or rewritten.
- No path runs directly from model output to a credential.
Drift, concurrency and emergency
Plans bind approved precondition predicates and target UIDs. A changed target, image, schema, network route or relevant dependency can invalidate a plan. Compare-and-swap, conflict domains, capacity reservations and fencing epochs reduce concurrent writer risk, but they do not replace live read/admission checks.
The environment can be NORMAL, FROZEN or RECOVERING. A freeze blocks new permits and revokes the epoch; it does not pretend that in-flight provider effects have ceased. Returning to normal requires human authority, reconciliation, health evidence and an intact audit chain.