From the side of the one who decides
Before the costly action
The agent may propose. Someone still has to know whether the effect occurred.
Sources and reading context
Execution Control Plane demo, scenes 1, 2, and 5; Architecture page; KB3, rendering line enacted on 19 October 2026
Simplified public rendering, read on 19 October 2026. KB3: enacted, active doctrinal rendering line. It renders meaning; it is not the code, and not a constitution. KB2: prior rendering line. This site certifies no implementation. Read the detailed status →
On this page
This page speaks to someone about to connect an agent to a payment, a record, or a tool call. It does not describe a deployment. No sector, no customer, and no impact figure is established by the public repositories.
Context
An agent proposes an action. A tool sends it. A response may arrive, arrive late, or never come back. Between intention and confirmation, the state can be UNKNOWN: the dispatch took place, the result is not confirmed.
The question is not only what the agent is allowed to say. It is what must stay true while it acts: do not double an effect that has already left, do not treat silence as proof, and do not let a local rule leave the whole inadmissible.
Pain points
- Silence. Resending because the response is missing can produce a second effect. The absence of evidence is not evidence of non-execution.
- The duplicate. The same request, submitted again, is not a new decision. The idempotency key is claimed before evaluation.
- The shared limit. A local rule can hold while the aggregate budget, invariant I8 in the drawing, no longer does. Idempotency stops the repeat. By itself it does not hold the limit of the whole.
- Intention taken for confirmation. Authorizing is not observing that the external effect occurred.
Value proposition
TENIR requires the state to be proved before acting again. The membrane decides. The execution verdicts, PASS, FLAG, HOLD, and HARD_VETO, stay a field apart from the postures NORMAL, CAUTION, and HOLDING-FIRST.
What is offered, in the public scope, is an accompanied diagnostic: one action, one agreed scope, and a sheet that separates established facts, unknowns, and the next control. Guarantees stay bounded to that scope. This site certifies no implementation. It does not promise an external effect exactly once. The service is set out on the Offer page.
Scenarios
The three situations below are those of the demonstration. They are illustrative only. They are not customer files, and not equipped sectors.
Payment
An admissible action
The demo shows a payment of 10 against a capacity of 100. The score returns FLAG, the membrane PASS, the composition FLAG. The state moves to RESERVED, then to CONFIRMED after dispatch. The key is claimed at CREATED, before evaluation.
Duplicate
The same key, again
The same key, submitted a second time, receives HARD_VETO. The resumption shown goes through the existing claim, not through a new adjudication.
Lost receipt
A timeout is not a failure
A provider timeout leads to UNKNOWN, not to FAILED. UNKNOWN is not terminal. The reconciliation shown can confirm that the effect already occurred. Treating silence as failure could double it.
The business rule cited by the drawing is of the same order: do not double-execute a payment. It is complete in its register, and not yet executable until it has crossed the levels. Payment, record change, and tool call are the action classes already named. They are not a catalogue of sectors.
Where to see the mechanics
The demonstration, the interactive walkthrough, and the illustrative drawing sit under Mechanics. The illustrative drawing is in French. The walkthrough and the control-plane demo are in English inside the artifact.
Limits
Class of this page: simplified public-facing. The scenes stay attributed to the demo. No adopter is declared. The bounds are on Status.