Scene 1 · Normal Admissible Operation
An AI agent proposes a $10 payment. Both kernels evaluate it independently, budget is reserved atomically, and the provider confirms execution.
Two-Kernel Architecture
Continuous risk
Discrete checks
HOLD / HARD_VETO
Proposed Action
Adjudication Result
Dispatch & Execute
State Machine Path
The idempotency key is durably claimed at CREATED — before any kernel evaluation. Budget is atomically reserved at RESERVED. The provider is called only after DISPATCHING is claimed.
Scene 2 · Duplicate Adjudication Blocked
The same operation is submitted again. TENIR blocks it — the idempotency key was already claimed at CREATED.
First Submission (already processed)
Second Submission (same key)
Why This Works
resume_existing() to recover an interrupted operation — never re-adjudicateScene 3 · HOLD Lifecycle
When evidence is insufficient, TENIR doesn't deny or blindly proceed. It HOLDs — a designed suspension of agency under pressure. HOLD is TENIR's signature concept.
HOLD vs QUARANTINE_LOCK
HOLD
Per-operation suspension. The action is not denied — it's pending evidence or review. A timer (τ_K) counts down.
QUARANTINE_LOCK
Per-entity lock. Blocks ALL admission and dispatch for an entire LEI until authorized release. Distinct from HOLD.
HOLD Exit Paths
Escalation → Authorized Exit
hold_manager.enter_hold(key, tau_k_seconds=300) → state HOLD, τ_K = 300sresolve_hold(key, passage, pressure=0.1, ...) → RESERVEDescalate_hold(key, escalated_by="risk-officer") → ESCALATEDauthorize_exit(key, authorized_by="ciso@org", scope="post-incident", authorization="ceremony-G-R5-001")Key Doctrine: ESCALATED is Absorbing
ESCALATED has no time-based auto-exit. It remains until an authorized human signs an exit receipt. τ_K expiry in ESCALATED produces UNKNOWN, not resolution (v7.1 §19). This is deliberate — escalation requires human judgment, not a timer.
Scene 4 · In-Memory vs Persistent Registry
The default SDK client uses an in-memory registry. Idempotency claims are lost on restart. With a persistent store_path, they survive.
In-Memory (default)
DualKernelCompositionClient()
No store_path → registry lives in process memory only.
Persistent (store_path)
DualKernelCompositionClient(store_path="ledger.json")
Store file on disk → claims survive process restart.
require_persistence Guard
Runtime Warning (v5.3.0+)
Since the audit fix, initializing without store_path emits a visible warning:
Side-by-Side Test
Scene 5 · Provider Timeout → UNKNOWN → Reconciliation
When the provider times out, TENIR doesn't assume the payment failed. It marks the operation UNKNOWN and triggers reconciliation. A timeout does NOT prove no effect occurred.
Dispatch with Timeout
State Machine: Timeout Path
UNKNOWN is not FAILED. It means the outcome is uncertain. The operation is not terminal — it can be reconciled.
Reconciliation
Why Not FAILED?
Per doctrine v7.1: a timeout does not prove no effect occurred. The payment may have succeeded — we just didn't get the response. Treating this as FAILED could lead to a double-charge (retry a payment that already went through). UNKNOWN triggers reconciliation, not auto-failure.
Scene 6 · Guarantee Boundary
TENIR-Gov provides three tiers of guarantee. A governance decision does not, by itself, prove that an external effect occurred exactly once.
Guarantee Tiers
| Guarantee | Level |
|---|---|
| At-most-once dispatch through the governance gate | Local (in-process / single-host) |
| Fail-closed composition | Local |
| Mandatory invariants not skippable by healthy score | Local |
| Atomic budget reservations | Local (threading.Lock) |
| Cross-process serialization (single host) | Local (fcntl.flock) |
| Cross-host budget / idempotency coordination | Requires distributed infrastructure |
| Exactly-once external effects | Depends on downstream provider |
| PyPI artifact integrity | Packaging ecosystem + verification |
The Precise Guarantee Boundary
A governance decision does not, by itself, prove that an external effect occurred exactly once. TENIR-Gov guarantees that at most one dispatch is permitted through the governance gate on a single host.
Exactly-once external effects require provider-side idempotency (e.g., Stripe's Idempotency-Key header) and, for multi-host deployments, distributed coordination infrastructure.
Fail-closed is the default: when either kernel errors, when data is missing, or when the outcome is indeterminate, the composition produces HOLD — never PASS.