Interlock

Tests and experiments

Generated by python3 tests/report.py; do not edit by hand. Every number here is read from the repo or from the suite run that produced this page, on Python 3.14.6.

Numbers you can quote

Tests: 465 in 43 files; 412 passed, 53 skipped, 0 failed (Python 3.14.6).
CI runs the suite on Python 3.9, 3.12, 3.13 on every push and pull request, and fails if results/ drifts from the code.
Live Stripe test-mode runs: 282 Stripe test-mode payments and subscriptions recorded (unique pi_ and sub_ ids) across 6 results files; the end-to-end audit reports “22/22 cells verified against Stripe”.
Real-world scenarios: 8 written, 7 ran against live services, 1 blocked. Invariant held, summed over the cells of the 7 that ran: the standard setup (no_check) 17/67; the strongest hand-written check 67/67; the strongest Interlock arm 67/67 (in two scenarios only with code outside the core, per results/scenarios/README.md); every Interlock variant together 98/114.
Goal: cut two thirds of manual agent approvals. Synthetic day (the mix is an assumption, not measured data): 65 of 95 requests (68.4%) cleared with no person, 65 of those with receipts that verify.
Bugs found by our own testing and reviews and fixed, each with a test: 15 before the escalation build, 30 distinct in its three adversarial hardening rounds (33 fixes, some sharing a root cause), 6 in the merge review.

1. Unit and integration tests

Run with python3 -m unittest discover -s tests. Stdlib only.

CI (.github/workflows/test.yml): a matrix over Python 3.9, 3.12, 3.13 with fail-fast: false. Steps: “Invariants, fault sweep, integration”; “Results tables match the code”. The last step reruns experiments/run_all.py and viewer/build.py, then git diff --exit-code on results/, so a results table that no longer matches the code fails the build.

Last run: 465 tests, 412 passed, 53 skipped, 0 failed, on Python 3.14.6.

file	tests
`tests/test_approval_recovery_fixes.py`	7
`tests/test_approvals.py`	9
`tests/test_azure_deploy.py`	10
`tests/test_backend.py`	6
`tests/test_confirmations.py`	16
`tests/test_contract.py`	8
`tests/test_demo.py`	16
`tests/test_demo_standalone.py`	7
`tests/test_escalation_fixes.py`	37
`tests/test_escalation_flow.py`	6
`tests/test_escalation_receipts.py`	14
`tests/test_explained.py`	11
`tests/test_export.py`	13
`tests/test_export_authority_fixes.py`	2
`tests/test_integration_recovery_fixes.py`	5
`tests/test_integrations.py`	23
`tests/test_interlock.py`	20
`tests/test_langchain.py`	2
`tests/test_lockin_review_fixes.py`	10
`tests/test_mcp_proxy.py`	10
`tests/test_merge_defects.py`	9
`tests/test_public.py`	27
`tests/test_receipts.py`	8
`tests/test_recovery_locking.py`	5
`tests/test_repair.py`	11
`tests/test_repo_recovery_fixes.py`	5
`tests/test_review_fixes.py`	12
`tests/test_routing.py`	24
`tests/test_runtime.py`	21
`tests/test_runtime_gate_parity.py`	12
`tests/test_runtime_sql_races.py`	9
`tests/test_runtime_stateful.py`	1
`tests/test_scenario_billing_credit.py`	7
`tests/test_scenario_calendar.py`	6
`tests/test_scenario_connect_payout.py`	6
`tests/test_scenario_email_tier3.py`	14
`tests/test_scenario_gcp_resource.py`	13
`tests/test_scenario_github_merge.py`	10
`tests/test_scenario_shared_cap.py`	8
`tests/test_scenario_stripe_dispute.py`	9
`tests/test_scoreboard.py`	5
`tests/test_site.py`	9
`tests/test_temporal_helper.py`	2
total	465

`tests/test_approval_recovery_fixes.py` (7)

Regressions for approval audit records and retries after a fast restart.

ApprovalRecoveryFixes (7)

test_invalid_maximum_fails_closed: Invalid maximum fails closed.
test_last_allowed_attempt_has_a_valid_receipt: Last allowed attempt has a valid receipt.
test_last_allowed_attempt_remains_valid_during_recovery: Last allowed attempt remains valid during recovery.
test_nonfinite_amounts_never_reach_the_function: Nonfinite amounts never reach the function.
test_recovery_refuses_retry_with_a_different_payload: Recovery refuses retry with a different payload.
test_retry_rechecks_original_facts_without_requesting_new_approval: Retry rechecks original facts without requesting new approval.
test_retry_recovers_after_startup_skipped_a_live_claim: Retry recovers after startup skipped a live claim.

`tests/test_approvals.py` (9)

The approval inbox: routine requests never reach a person, judgment calls do, and a person’s approval is re-checked against the world when the refund is actually sent.

ApprovalInbox (9)

test_approval_from_someone_without_authority_is_refused: Approval from someone without authority is refused.
test_crash_mid_send_is_recovered_once_with_no_person: Crash mid send is recovered once with no person.
test_crash_nobody_can_verify_goes_to_a_person: Crash nobody can verify goes to a person.
test_duplicate_request_is_ignored_not_queued: Duplicate request is ignored not queued.
test_expired_approval_is_refused: Expired approval is refused.
test_ineligible_order_needs_a_person_even_under_the_limit: Ineligible order needs a person even under the limit.
test_judgment_call_waits_then_runs_under_the_approver: Judgment call waits then runs under the approver.
test_routine_request_runs_with_no_person: Routine request runs with no person.
test_stale_approval_is_refused_and_comes_back_explained: Stale approval is refused and comes back explained.

`tests/test_azure_deploy.py` (10)

Offline checks for infra/azure/deploy.sh. The dry run prints the plan without calling az or leaking secret values, and a Stripe key that is not test mode is refused. A real run against a stub az (logs its argv, returns canned values) in a throwaway git repo covers the app PUT and provisioning wait, the FQDN re-apply, the empty-FQDN stop, the env-name guard, the committed-only build context and temp file cleanup. Skipped if bash or git is missing.

AzureDeployScript (10)

test_create_then_reapply_with_real_fqdn: Create then reapply with real fqdn.
test_dry_run_redacts_secrets: Dry run redacts secrets.
test_empty_fqdn_stops: Empty fqdn stops.
test_failed_environment_is_replaced_and_existing_group_kept: Failed environment is replaced and existing group kept.
test_limits_pass_through_only_when_set: Limits pass through only when set.
test_name_only_in_comment_readme_or_longer_name_is_refused: Name only in comment readme or longer name is refused.
test_port_is_consistent: Port is consistent.
test_refuses_env_names_the_server_does_not_read: Refuses env names the server does not read.
test_refuses_live_stripe_key: Refuses live stripe key.
test_rerun_keeps_role_and_failed_provisioning_stops: Rerun keeps role and failed provisioning stops.

`tests/test_backend.py` (6)

Offline checks for backend/: approval leases shared across connections and capped at the approved amount, the one-shot crash marker (a real SIGKILL of a child process), and validation of the model’s refund call.

Backend (6)

test_a_hand_refund_before_the_decision_is_part_of_the_premise: A hand refund before the decision is part of the premise.
test_approval_caps_what_the_gate_sends: Approval caps what the gate sends.
test_crash_marker_kills_once: Crash marker kills once.
test_leases_are_shared_across_connections: Leases are shared across connections.
test_model_refund_call_is_validated: Model refund call is validated.
test_receipt_records_what_recovery_observed: Receipt records what recovery observed.

`tests/test_confirmations.py` (16)

Target-confirmed receipts: a signed Stripe webhook (or a refunds lookup) appends CONFIRMED to the effect’s chain. Unsigned, replayed, live-mode or mismatched events are never recorded. Offline: signed locally with a test endpoint secret, against a fake Stripe client.

Recording (8)

test_concurrent_deliveries_record_once: Concurrent deliveries record once.
test_non_refund_event_ignored: Non refund event ignored.
test_pull_confirmation_by_lookup: Pull confirmation by lookup.
test_replayed_event_and_same_status_are_duplicates: Replayed event and same status are duplicates.
test_status_change_is_recorded: Status change is recorded.
test_unknown_effect_other_payment_intent_or_amount_never_recorded: Unknown effect other payment intent or amount never recorded.
test_webhook_appends_confirmed: Webhook appends confirmed.
test_webhook_before_ack_does_not_close_dispatch: Webhook before ack does not close dispatch.

Signature (8)

test_bad_signature_missing_header_or_v1_rejected: Bad signature missing header or v1 rejected.
test_livemode_event_rejected: Livemode event rejected.
test_non_whsec_secret_and_non_positive_tolerance_refused: Non whsec secret and non positive tolerance refused.
test_old_and_future_timestamps_rejected: Old and future timestamps rejected.
test_reserialized_body_fails: Reserialized body fails.
test_rotated_secret_any_v1_accepted_and_v0_ignored: Rotated secret any v1 accepted and v0 ignored.
test_secret_header_and_payload_never_in_error_text: Secret header and payload never in error text.
test_valid_signature_returns_event: Valid signature returns event.

`tests/test_contract.py` (8)

The escalation contract every lane builds on: atomic append_if, the gate refusing to send an escalated effect without a person’s decision on its latest escalation, and the shared shapes.

AppendIf (2)

test_append_if_blocker_writes_nothing: Append if blocker writes nothing.
test_append_if_writes_once_under_threads: Append if writes once under threads.

GateBlocker (4)

test_closed_effect_is_never_dispatched: Closed effect is never dispatched.
test_gate_records_code_and_request: Gate records code and request.
test_person_lease_needs_decision_on_latest_escalation: Person lease needs decision on latest escalation.
test_policy_send_over_open_escalation_is_awaiting_decision: Policy send over open escalation is awaiting decision.

Shapes (2)

test_explain_and_describe_on_old_entries: Explain and describe on old entries.
test_record_rejects_missing_or_unknown_fields: Record rejects missing or unknown fields.

`tests/test_demo.py` (16)

Offline checks for backend/demo.py: the verdict and wording shown on the page, the one-run-at-a-time guard, and that a mock run is the in-process simulation with every event marked mock. For backend/api.py: its routes for both demos (the standalone engine stubbed), Temporal unavailable, one run across both demos, and that the server starts without temporalio. No Stripe, model or Temporal.

ApiRequestChecks (1)

test_checks: Checks.

ApiRoutes (4)

test_one_run_across_both_demos: One run across both demos.
test_pages: Pages.
test_standalone_routes: Standalone routes.
test_temporal_unavailable: Temporal unavailable.

Demo (9)

test_elapsed_stops_when_the_run_ends: Elapsed stops when the run ends.
test_headline_counts_refund_objects_not_just_money: Headline counts refund objects not just money.
test_journal_lines: Journal lines.
test_live_needs_keys_and_says_which: Live needs keys and says which.
test_live_workers_never_get_crash_or_emulation_switches: Live workers never get crash or emulation switches.
test_mock_run_is_the_simulation_and_says_so: Mock run is the simulation and says so.
test_one_run_at_a_time: One run at a time.
test_result_reads_stripe_and_the_receipt: Result reads stripe and the receipt.
test_stripe_client_is_made_only_when_stripe_is_read: Stripe client is made only when stripe is read.

NoTemporal (2)

test_serve_starts_without_temporalio: Serve starts without temporalio.
test_server_modules_import_without_temporalio: Server modules import without temporalio.

`tests/test_demo_standalone.py` (7)

Offline checks for backend/standalone.py and backend/standalone_worker.py: nothing they import pulls in temporalio, the one-run guard is shared with the Temporal demo, the mock run is labeled, and the worker’s saved decision and refund step behave as described, against a fake Stripe. No Stripe, model, Temporal or worker process.

Standalone (7)

test_decision_is_saved_once_and_a_restart_loads_it: Decision is saved once and a restart loads it.
test_info_has_the_temporal_demo_fields_and_its_own_columns: Info has the temporal demo fields and its own columns.
test_interlock_restart_refuses_after_a_hand_refund: Interlock restart refuses after a hand refund.
test_mock_run_is_the_simulation_and_says_so: Mock run is the simulation and says so.
test_nothing_it_imports_pulls_in_temporalio: Nothing it imports pulls in temporalio.
test_one_run_at_a_time_across_both_demos: One run at a time across both demos.
test_standard_and_checked_refund_steps: Standard and checked refund steps.

`tests/test_escalation_fixes.py` (37)

Regressions for confirmed defects in escalation, routing, confirmation and scoreboard code. Each test failed before its fix.

AmbiguousKeepsItsGuard (1)

test_conflicting_retry_before_reconcile: Conflicting retry before reconcile.

BoundRequest (2)

test_resubmit_with_other_amount_does_not_change_what_queue_shows: Resubmit with other amount does not change what queue shows.
test_retry_with_other_amount_after_crash_routes_by_bound_amount: Retry with other amount after crash routes by bound amount.

ConfirmationPayment (1)

test_refund_on_other_payment_is_refused: Refund on other payment is refused.

Confirmations (5)

test_confirmation_of_another_refund_id_is_refused_and_flagged: Confirmation of another refund id is refused and flagged.
test_confirmed_resend_in_flight_after_resolved_refusal_verifies: Confirmed resend in flight after resolved refusal verifies.
test_late_pending_does_not_downgrade_succeeded: Late pending does not downgrade succeeded.
test_late_succeeded_does_not_overwrite_failed: Late succeeded does not overwrite failed.
test_receipt_reads_final_status_by_precedence: Receipt reads final status by precedence.

ExplainPicksTheOutcome (1)

test_ambiguous_after_conflicting_retry: Ambiguous after conflicting retry.

OneBadCapture (3)

test_reconcile_escalates_the_rest: Reconcile escalates the rest.
test_restart_escalates_the_rest: Restart escalates the rest.
test_tick_moves_the_rest: Tick moves the rest.

PersonLeaseAtDispatch (3)

test_approval_lease_on_facts_the_approver_never_saw_is_not_sent: Approval lease on facts the approver never saw is not sent.
test_honest_approval_still_sends: Honest approval still sends.
test_lease_naming_another_group_is_not_sent: Lease naming another group is not sent.

ProxySettlesOnlyItsOwnSend (3)

test_declined_send_is_still_settled: Declined send is still settled.
test_failed_read_while_in_flight_does_not_settle_the_send: Failed read while in flight does not settle the send.
test_failed_read_with_nothing_in_flight_says_nothing_was_sent: Failed read with nothing in flight says nothing was sent.

ReadmeMatchesResults (1)

test_table_and_headline: Table and headline.

ReescalationReason (1)

test_restart_after_awaiting_decision_keeps_stale_reason_and_repair: Restart after awaiting decision keeps stale reason and repair.

RepairAutoApprovalWait (1)

test_time_to_decision_skips_it: Time to decision skips it.

RepairChildCrash (1)

test_restart_does_not_overpay: Restart does not overpay.

RepairChildIsNotCleared (1)

test_cleared_matches_scoreboard: Cleared matches scoreboard.

RouteLostItsSla (1)

test_tick_after_sla_removed_from_config: Tick after sla removed from config.

ScoreboardCountsOnce (2)

test_superseded_repair_after_crash: Superseded repair after crash.
test_superseded_repair_after_stale_approval: Superseded repair after stale approval.

StaleCachedApproval (1)

test_second_inbox_does_not_discard_newer_approval: Second inbox does not discard newer approval.

StaleRepairs (1)

test_restart_after_second_hand_refund_drops_repair: Restart after second hand refund drops repair.

StripeSubclassPremises (1)

test_override_still_refuses: Override still refuses.

TamperedReceipt (1)

test_missing_hash_or_kind_is_a_problem: Missing hash or kind is a problem.

TargetRejection (3)

test_rejected_resend_at_recovery_is_settled: Rejected resend at recovery is settled.
test_rejected_send_goes_to_a_person: Rejected send goes to a person.
test_stripe_4xx_is_a_rejection_and_5xx_is_not: Stripe 4xx is a rejection and 5xx is not.

TemporalOutcome (1)

test_ambiguous_outcome_is_the_status: Ambiguous outcome is the status.

TickAfterOutage (2)

test_late_tick_keeps_the_next_deadline: Late tick keeps the next deadline.
test_outage_past_every_deadline: Outage past every deadline.

`tests/test_escalation_flow.py` (6)

The lanes together: a real gate refusal becomes a routed escalation, a person’s decision becomes the send’s authority, verify() checks it, a signed webhook confirms it, and the scoreboard reads it all back from the journal, before and after a restart.

Flow (6)

test_accepting_still_fits_counts_as_an_accepted_repair: Accepting still fits counts as an accepted repair.
test_crash_to_person_then_webhook_confirmation: Crash to person then webhook confirmation.
test_mcp_and_temporal_describe_match_inbox_changes: Mcp and temporal describe match inbox changes.
test_partial_hand_refund_end_to_end: Partial hand refund end to end.
test_refund_remaining_repair_end_to_end: Refund remaining repair end to end.
test_restart_mid_day_scoreboard_identical: Restart mid day scoreboard identical.

`tests/test_escalation_receipts.py` (14)

Escalations in receipts: verify() checks that a send a person authorized has that person’s decision, on the facts they saw, before the send, from someone the item was routed to, and reports what the target itself confirmed.

EscalationReceipts (14)

test_confirmation_of_never_landed_effect_is_a_problem: Confirmation of never landed effect is a problem.
test_confirmation_without_send_or_wrong_amount_is_a_problem: Confirmation without send or wrong amount is a problem.
test_confirmed_by_target_follows_last_status: Confirmed by target follows last status.
test_decision_after_the_send_is_a_problem: Decision after the send is a problem.
test_decision_by_someone_not_routed_is_a_problem: Decision by someone not routed is a problem.
test_legacy_person_lease_stays_valid: Legacy person lease stays valid.
test_person_approved_send_verifies: Person approved send verifies.
test_policy_send_after_escalation_is_a_problem: Policy send after escalation is a problem.
test_send_after_close_is_a_problem: Send after close is a problem.
test_send_citing_an_escalation_not_in_the_receipt_is_a_problem: Send citing an escalation not in the receipt is a problem.
test_send_citing_superseded_escalation_is_a_problem: Send citing superseded escalation is a problem.
test_send_on_facts_the_approver_never_saw_is_a_problem: Send on facts the approver never saw is a problem.
test_two_decisions_on_one_escalation_is_a_problem: Two decisions on one escalation is a problem.
test_two_refund_ids_break_happened_once: Two refund ids break happened once.

`tests/test_explained.py` (11)

Explained refusals: a stale or unverifiable outcome names what changed and, where nothing landed, suggests safe repairs. Suggestions only: nothing here sends a repair.

Explained (11)

test_ambiguous_never_carries_repairs: Ambiguous never carries repairs.
test_easy_function_target_reports_changes: Easy function target reports changes.
test_full_hand_refund_or_ineligible_suggests_nothing: Full hand refund or ineligible suggests nothing.
test_mcp_refusal_carries_structured_escalation: Mcp refusal carries structured escalation.
test_over_remaining_suggests_refund_remaining: Over remaining suggests refund remaining.
test_partial_hand_refund_suggests_same_amount_when_it_fits: Partial hand refund suggests same amount when it fits.
test_refusal_at_recovery_carries_changes_and_repairs: Refusal at recovery carries changes and repairs.
test_stale_refusal_names_the_change: Stale refusal names the change.
test_stripe_explain_with_fake_client: Stripe explain with fake client.
test_target_without_explain_still_refuses_with_strings: Target without explain still refuses with strings.
test_temporal_refusal_message_names_the_change: Temporal refusal message names the change.

`tests/test_export.py` (13)

Receipt exporters, offline: payload shapes, the ids that make re-exporting harmless, the BigQuery schema, and that a destination’s partial rejection is reported as a failure. No network: HTTP calls are patched.

BigQuery (5)

test_merge_selects_columns_in_schema_order_and_matches_on_the_hash: Merge selects columns in schema order and matches on the hash.
test_merge_sends_rows_as_one_parameter_and_counts_inserts: Merge sends rows as one parameter and counts inserts.
test_no_column_is_a_reserved_keyword_and_the_doc_shows_the_real_queries: No column is a reserved keyword and the doc shows the real queries.
test_rows_follow_the_schema_and_rebuild_a_verifiable_chain: Rows follow the schema and rebuild a verifiable chain.
test_stream_uses_the_shared_insert_id_and_insert_errors_fail: Stream uses the shared insert id and insert errors fail.

Logging (4)

test_one_log_entry_per_journal_entry_plus_the_receipt: One log entry per journal entry plus the receipt.
test_partial_rejection_is_a_failure: Partial rejection is a failure.
test_reexport_is_identical_and_a_grown_bundle_does_not_change_earlier_entries: Reexport is identical and a grown bundle does not change earlier entries.
test_refused_is_a_warning_with_the_final_state: Refused is a warning with the final state.

Otlp (2)

test_no_project_attribute_without_a_project_and_rejected_spans_fail: No project attribute without a project and rejected spans fail.
test_one_span_per_effect_with_an_event_per_entry: One span per effect with an event per entry.

Siem (2)

test_appending_the_same_receipt_twice_writes_once: Appending the same receipt twice writes once.
test_cef_escapes_and_carries_the_event_id: Cef escapes and carries the event id.

`tests/test_export_authority_fixes.py` (2)

All exporters name the authority of the send and preserve historical entry attribution.

ExportAuthority (2)

test_all_exporters_attribute_the_commit_to_alice: All exporters attribute the commit to alice.
test_growing_the_chain_does_not_rewrite_historical_attribution: Growing the chain does not rewrite historical attribution.

`tests/test_integration_recovery_fixes.py` (5)

Failed tool reads stay unresolved, and ADK recovery keeps the recorded target.

AdkRecordedTarget (1)

test_changed_payment_on_replay_recovers_only_the_recorded_payment: Changed payment on replay recovers only the recorded payment.

ToolReadFailures (4)

test_bad_recovery_lookup_never_resends_a_landed_action: Bad recovery lookup never resends a landed action.
test_explicit_negative_lookup_allows_recovery_send: Explicit negative lookup allows recovery send.
test_failed_or_missing_premises_do_not_send_and_can_retry: Failed or missing premises do not send and can retry.
test_failure_at_dispatch_recheck_does_not_send: Failure at dispatch recheck does not send.

`tests/test_integrations.py` (23)

Offline checks for interlock/integrations. Without google-adk or the AP2 SDK installed, the tests that need them skip; the ADK callback logic and the mandate checks around the SDK still run, against fakes.

AdkGuard (8)

test_a_re_decided_amount_is_refused: A re decided amount is refused.
test_approval_revoked_during_the_outage: Approval revoked during the outage.
test_crash_after_the_refund_then_restart: Crash after the refund then restart.
test_hand_refund_during_the_outage_is_not_repeated: Hand refund during the outage is not repeated.
test_plugin_wraps_the_same_callback: Plugin wraps the same callback.
test_replayed_call_recovers_before_it_submits: Replayed call recovers before it submits.
test_sends_once_and_reports_the_recorded_result_on_replay: Sends once and reports the recorded result on replay.
test_ungated_tool_runs_normally: Ungated tool runs normally.

MandateChecks (9)

test_an_open_mandate_without_an_amount_cap_authorizes_nothing: An open mandate without an amount cap authorizes nothing.
test_covers_exactly_the_mandated_payment: Covers exactly the mandated payment.
test_fails_closed: Fails closed.
test_nonce_comes_from_the_verifier_and_is_single_use: Nonce comes from the verifier and is single use.
test_one_closed_mandate_pays_once_and_an_open_mandate_its_cap_in_total: One closed mandate pays once and an open mandate its cap in total.
test_re_closing_the_same_mandate_after_a_refusal_is_refused_too: Re closing the same mandate after a refusal is refused too.
test_references: References.
test_revoking_the_open_mandate_ends_its_closings: Revoking the open mandate ends its closings.
test_the_payment_the_target_acts_on_must_be_the_mandated_one: The payment the target acts on must be the mandated one.

RealMandates (6)

test_expired_with_no_skew: Expired with no skew.
test_gate_refuses_at_recovery_after_revocation_and_records_the_mandate: Gate refuses at recovery after revocation and records the mandate.
test_over_the_cap: Over the cap.
test_re_closings_share_one_authority_and_one_cap: Re closings share one authority and one cap.
test_untrusted_issuer_or_wrong_agent_key_or_nonce: Untrusted issuer or wrong agent key or nonce.
test_verified_chain_covers_the_payment: Verified chain covers the payment.

`tests/test_interlock.py` (20)

Every claim in the README, as an assertion, plus a randomized fault sweep and the three-line integration. If a table in results/ and these tests disagree, the table is wrong.

ExperimentClaims (4)

test_coding_agent_boundary_is_exactly_one_row: Coding agent boundary is exactly one row.
test_each_baseline_fails_exactly_where_the_readme_says: Each baseline fails exactly where the readme says.
test_gate_holds_every_refund_fault_at_every_tier: Gate holds every refund fault at every tier.
test_only_tier3_gives_up_liveness: Only tier3 gives up liveness.

RandomFaultSweep (1)

test_invariants_hold_on_random_interleavings: Invariants hold on random interleavings.

Receipts (4)

test_ambiguous_is_unknown_not_executed: Ambiguous is unknown not executed.
test_committed_is_executed: Committed is executed.
test_refused_at_recovery_was_not_executed: Refused at recovery was not executed.
test_stripe_target_refuses_live_keys: Stripe target refuses live keys.

Resubmission (1)

test_retry_after_refusal_is_checked_against_the_original_decision: Retry after refusal is checked against the original decision.

SharedJournal (3)

test_concurrent_recovery_resolves_once: Concurrent recovery resolves once.
test_concurrent_submits_dispatch_once: Concurrent submits dispatch once.
test_recover_only_touches_named_effects: Recover only touches named effects.

ThreeLineIntegration (7)

test_crash_after_effect_recovers_once_after_restart: Crash after effect recovers once after restart.
test_happy_path_then_duplicate: Happy path then duplicate.
test_human_refund_during_outage_is_refused_after_restart: Human refund during outage is refused after restart.
test_no_dedup_no_lookup_is_ambiguous_and_never_resent: No dedup no lookup is ambiguous and never resent.
test_permission_revoked_during_outage_is_refused_after_restart: Permission revoked during outage is refused after restart.
test_premise_change_before_dispatch_is_refused: Premise change before dispatch is refused.
test_redecided_amount_is_refused: Redecided amount is refused.

`tests/test_langchain.py` (2)

uv run –no-project –with langchain-core –with langgraph python -m unittest tests.test_langchain

LangChainTools (2)

test_inside_a_langgraph_tool_node: Inside a langgraph tool node.
test_refusal_is_the_tool_output_and_a_correction_is_sent_once: Refusal is the tool output and a correction is sent once.

`tests/test_lockin_review_fixes.py` (10)

Regressions for the lock-in review of the recovery, approval, export and repository fixes.

LockinReviewFixes (10)

test_backends_agree_a_claim_is_expired_at_its_expiry_instant: 4
test_call_reports_an_effect_another_worker_committed_meanwhile: 3: recovery finds nothing to do because the other worker committed; the status comes from the journal.
test_different_payload_reports_what_recovery_did: 2: tier 2 resend, and tier 3 AMBIGUOUS, are reported by the call that caused them.
test_lookup_error_while_settling_a_rejected_send_never_resends: 5
test_match_does_not_equate_bool_and_int: 8
test_nan_expiry_never_approves: 6
test_reapproved_repo_retry_runs_after_a_refusal_proved_nothing_landed: 10
test_repo_write_honors_umask_and_writes_through_symlinks: 11
test_slow_lookup_does_not_resend_what_a_later_recovery_sent: 1 and 7: our claim and then another recoverer’s claim expire during our lookup.
test_unresolved_send_is_attributed_to_its_dispatcher_not_a_later_refused_proposer: 9

`tests/test_mcp_proxy.py` (10)

The MCP proxy against a real subprocess MCP server: passthrough, one refund per request, recovery after the proxy is killed mid-call (with and without the initialize handshake), and refusal when support refunded by hand while it was down.

McpProxy (6)

test_a_change_after_the_agents_own_read_is_caught: A change after the agents own read is caught.
test_agent_repairs_a_refused_call_within_its_approval: Agent repairs a refused call within its approval.
test_killed_mid_call_is_recovered_once_on_restart: Killed mid call is recovered once on restart.
test_passthrough_and_one_refund_per_request: Passthrough and one refund per request.
test_refund_by_hand_during_outage_is_refused_even_when_the_agent_retries: Refund by hand during outage is refused even when the agent retries.
test_tool_error_gets_an_answer_and_is_not_resent: Tool error gets an answer and is not resent.

RealSdk (1)

test_a_modern_clients_first_request_is_a_gated_call: A modern clients first request is a gated call.

StartupRecovery (3)

test_a_client_on_the_stateless_spec_gets_recovery_before_its_first_gated_call_is_sent: A client on the stateless spec gets recovery before its first gated call is sent.
test_concurrent_triggers_run_recover_once_and_never_at_the_same_time: Concurrent triggers run recover once and never at the same time.
test_the_handshake_still_triggers_recovery_once: The handshake still triggers recovery once.

`tests/test_merge_defects.py` (9)

Defects the escalation merge kept or introduced, each reproduced before its fix.

EasyPremiseReads (2)

test_a_patched_validate_premises_still_runs: A patched validate premises still runs.
test_one_read_per_check_and_the_change_is_recorded: One read per check and the change is recorded.

EnvelopeLeaseMessage (1)

test_over_limit_says_no_approval_covers_it: Over limit says no approval covers it.

OldNames (1)

test_names_callers_of_either_parent_import: Names callers of either parent import.

ProxyUpstreamExit (1)

test_upstream_exit_mid_send_is_unknown_not_refused: Upstream exit mid send is unknown not refused.

SameArgsRedecision (1)

test_same_arguments_after_a_stale_refusal_are_a_new_decision: Same arguments after a stale refusal are a new decision.

TargetErrorIsFinal (3)

test_a_settled_target_error_is_never_sent_again: A settled target error is never sent again.
test_easy_rejected_is_never_sent_again: Easy rejected is never sent again.
test_receipt_flags_a_send_after_a_target_error: Receipt flags a send after a target error.

`tests/test_public.py` (27)

Offline checks for public mode in backend/api.py (docs/deploy.md): settings, the Host allowlist, which X-Forwarded-For entry is trusted, per-client and daily limits on a fake clock, /healthz, security headers, errors without exception text, and that with public mode off none of it applies. No Stripe, model, Temporal or worker.

ConnectionCap (1)

test_connections_past_the_cap_are_closed: Connections past the cap are closed.

Limits (6)

test_a_start_that_fails_gives_its_slot_back: A start that fails gives its slot back.
test_daily_cap_across_clients_resets_at_utc_midnight: Daily cap across clients resets at utc midnight.
test_global_hourly_cap_spreads_the_day: Global hourly cap spreads the day.
test_ipv6_counts_by_64: Ipv6 counts by 64.
test_per_client_sliding_hour: Per client sliding hour.
test_per_visitor_daily_cap_under_the_global_cap: Per visitor daily cap under the global cap.

PublicModeOff (1)

test_nothing_public_applies: Nothing public applies.

PublicProcess (2)

test_api_binds_all_interfaces_and_serves_healthz: Api binds all interfaces and serves healthz.
test_serve_stops_the_api_on_sigterm: Serve stops the api on sigterm.

PublicServer (10)

test_busy_and_bad_requests_do_not_use_a_slot: Busy and bad requests do not use a slot.
test_cases_routes_are_off: Cases routes are off.
test_errors_carry_no_exception_text: Errors carry no exception text.
test_healthz_answers_any_host_and_touches_nothing: Healthz answers any host and touches nothing.
test_host_allowlist_and_security_headers: Host allowlist and security headers.
test_info_says_public: Info says public.
test_limits_per_client_and_per_day: Limits per client and per day.
test_posts_only_from_the_https_origin: Posts only from the https origin.
test_run_events_carry_no_exception_text: Run events carry no exception text.
test_temporal_failure_text_stays_out_of_result_and_retry_events: Temporal failure text stays out of result and retry events.

Runs (1)

test_only_the_last_runs_are_kept: Only the last runs are kept.

Settings (6)

test_defaults_and_bad_settings: Defaults and bad settings.
test_host_allowlist: Host allowlist.
test_off_unless_exactly_1: Off unless exactly 1.
test_pages_say_live_runs_are_limited: Pages say live runs are limited.
test_serve_refuses_public_mode_without_hosts: Serve refuses public mode without hosts.
test_trusted_proxy_hops: Trusted proxy hops.

`tests/test_receipts.py` (8)

Receipts as proof: verify() re-derives “happened once, authorized when it fired, assumptions held” from the hash-chained entries, and notices when they were tampered with.

Receipts (8)

test_ambiguous_is_reported_as_unknown: Ambiguous is reported as unknown.
test_committed_refund_proves_all_three_claims_on_both_backends: Committed refund proves all three claims on both backends.
test_crash_recovered_by_retry_still_proves_the_recheck: Crash recovered by retry still proves the recheck.
test_edited_amount_is_detected: Edited amount is detected.
test_refused_at_recovery_proves_nothing_was_sent: Refused at recovery proves nothing was sent.
test_removed_entry_is_detected: Removed entry is detected.
test_revoked_at_recovery_does_not_claim_it_was_authorized: Revoked at recovery does not claim it was authorized.
test_rewritten_chain_fails_the_signature: Rewritten chain fails the signature.

`tests/test_recovery_locking.py` (5)

Recovery ownership and file locks must hold across calls, threads and processes.

RecoveryLocking (5)

test_concurrent_recovery_on_same_gate_has_one_sender: Concurrent recovery on same gate has one sender.
test_jsonl_dispatch_is_exclusive_across_spawned_processes: Jsonl dispatch is exclusive across spawned processes.
test_same_gate_waits_out_a_timed_out_recovery: Same gate waits out a timed out recovery.
test_slow_lookup_cannot_resend_after_another_recovery_finishes: Slow lookup cannot resend after another recovery finishes.
test_slow_lookup_cannot_resend_after_another_recovery_takes_over: Slow lookup cannot resend after another recovery takes over.

`tests/test_repair.py` (11)

The repair loop through tools.protect(): a refused call says what changed, a corrected call inside its approval is sent once, and nothing outside the approval, or after it was used, is sent at all.

RepairLoop (11)

test_a_change_between_the_agents_read_and_its_call_is_caught: A change between the agents read and its call is caught.
test_attempts_cap_counts_the_same_arguments_sent_again: Attempts cap counts the same arguments sent again.
test_attempts_cap_stops_a_model_that_keeps_re_deciding: Attempts cap stops a model that keeps re deciding.
test_crash_holds_the_approval_until_recovery_settles_it: Crash holds the approval until recovery settles it.
test_duplicate_is_ignored_and_a_second_decision_cannot_use_the_approval: Duplicate is ignored and a second decision cannot use the approval.
test_experiment_claims: Experiment claims.
test_overshoot_is_refused_with_the_limit_then_corrected: Overshoot is refused with the limit then corrected.
test_revoked_approval_is_not_retryable: Revoked approval is not retryable.
test_stale_fact_is_named_and_a_corrected_call_goes_once: Stale fact is named and a corrected call goes once.
test_tools_not_in_the_config_pass_through: Tools not in the config pass through.
test_without_an_approval_a_refusal_names_the_fact_but_stays_refused: Without an approval a refusal names the fact but stays refused.

`tests/test_repo_recovery_fixes.py` (5)

Repository recovery recognizes this effect’s durable postimages, including partial writes.

RepositoryRecovery (5)

test_crash_after_last_write_is_found_without_reapplying: Crash after last write is found without reapplying.
test_external_edit_after_partial_write_is_left_unresolved: External edit after partial write is left unresolved.
test_partial_append_resumes_without_repeating_the_first_file: Partial append resumes without repeating the first file.
test_preexisting_text_does_not_prove_the_new_append_ran: Preexisting text does not prove the new append ran.
test_stale_partial_effect_never_claims_nothing_was_executed: Stale partial effect never claims nothing was executed.

`tests/test_review_fixes.py` (12)

Regression tests for the defects an adversarial review of the package found. Each one reproduced the defect before its fix.

ReviewFixes (12)

test_a_different_payload_cannot_win_the_dispatch_race: A different payload cannot win the dispatch race.
test_a_resend_that_raised_keeps_its_claim: A resend that raised keeps its claim.
test_approval_after_a_stale_refusal_uses_the_facts_the_approver_saw: Approval after a stale refusal uses the facts the approver saw.
test_empty_claims_file_does_not_stop_recovery: Empty claims file does not stop recovery.
test_functions_with_the_same_name_get_separate_journals: Functions with the same name get separate journals.
test_nobody_can_approve_as_policy: Nobody can approve as policy.
test_one_failing_effect_does_not_stop_recovery_of_the_others: One failing effect does not stop recovery of the others.
test_recovery_never_resends_an_effect_that_is_still_being_applied: Recovery never resends an effect that is still being applied.
test_recovery_rechecks_the_lease_the_send_actually_ran_under: Recovery rechecks the lease the send actually ran under.
test_temporal_helper_asks_for_a_retry_while_an_attempt_is_unsettled: Temporal helper asks for a retry while an attempt is unsettled.
test_torn_final_journal_line_is_ignored_then_repaired: Torn final journal line is ignored then repaired.
test_verify_rejects_a_forged_lone_commit_and_an_empty_receipt: Verify rejects a forged lone commit and an empty receipt.

`tests/test_routing.py` (24)

Routing, SLAs and a restart-safe inbox: an escalation goes to the group its route names, only that group decides it, an unanswered item moves up the chain, a repair is a new decision, and a fresh inbox rebuilds the same queue from the journal without losing or duplicating anything.

Routing (24)

test_accepted_repair_closes_original_against_direct_gate_submit: Accepted repair closes original against direct gate submit.
test_ambiguous_item_cannot_be_approved_but_can_be_closed: Ambiguous item cannot be approved but can be closed.
test_approval_racing_sla_is_superseded: Approval racing sla is superseded.
test_concurrent_approvals_decide_once: Concurrent approvals decide once.
test_crash_after_proposed_before_escalation_resubmits: Crash after proposed before escalation resubmits.
test_crash_between_refusal_and_escalation_escalates_once: Crash between refusal and escalation escalates once.
test_crash_between_repair_decision_and_child_submit_submits_child_once: Crash between repair decision and child submit submits child once.
test_decision_records_members_and_binds_the_lease: Decision records members and binds the lease.
test_expired_approval_reescalates_with_fresh_facts_and_diff: Expired approval reescalates with fresh facts and diff.
test_in_flight_status_is_not_escalated: In flight status is not escalated.
test_member_removed_after_decision_is_refused_at_send_and_reescalated: Member removed after decision is refused at send and reescalated.
test_non_member_of_routed_group_cannot_decide: Non member of routed group cannot decide.
test_reconcile_after_restart_uses_journal: Reconcile after restart uses journal.
test_repair_accepted_twice_or_concurrently_is_one_effect: Repair accepted twice or concurrently is one effect.
test_repair_goes_back_through_rules_or_the_routed_person: Repair goes back through rules or the routed person.
test_repair_on_changed_facts_is_superseded: Repair on changed facts is superseded.
test_repair_refused_while_original_in_flight_or_committed: Repair refused while original in flight or committed.
test_repair_with_new_amount_is_a_new_effect_never_the_refused_id: Repair with new amount is a new effect never the refused id.
test_restart_after_decision_sends_once: Restart after decision sends once.
test_restart_rebuilds_queue_and_approved_without_duplicates: Restart rebuilds queue and approved without duplicates.
test_resubmit_of_escalated_request_returns_queued: Resubmit of escalated request returns queued.
test_route_by_amount_flag_and_reason: Route by amount flag and reason.
test_top_of_chain_breach_recorded_once: Top of chain breach recorded once.
test_unanswered_item_escalates_up_the_chain_after_sla: Unanswered item escalates up the chain after sla.

`tests/test_runtime.py` (21)

interlock_runtime against real Postgres and real worker subprocesses.

Composition (3)

test_child_workflow_result: Child workflow result.
test_continue_as_new: Continue as new.
test_migrate_and_drain_report: Migrate and drain report.

Decisions (1)

test_decision_recorded_once_across_sigkill: Decision recorded once across sigkill.

Effects (6)

test_agent_refund_commits_once_with_a_valid_receipt: Agent refund commits once with a valid receipt.
test_approval_is_bound_to_the_payload: Approval is bound to the payload.
test_fork_never_resends: Fork never resends.
test_late_response_after_takeover_is_committed_by_compare_and_set: SIGSTOP the sender while the target is processing, for longer than its lease but inside send_timeout (A1 holds).
test_recover_orphans: Recover orphans.
test_send_timeout_waits_out_the_deadline_before_lookup: The target takes 3s and send_timeout is 2s. Either the socket timeout fires (the worker suspends until

FirstGate (1)

test_takeover_and_zombie_fence: Takeover and zombie fence.

Signals (3)

test_cancel_mid_sleep: Cancel mid sleep.
test_two_signals_buffered_under_one_name: Two signals buffered under one name.
test_wait_timeout_returns_none: Wait timeout returns none.

Steps (3)

test_retry_backoff_on_database_clock: Retry backoff on database clock.
test_step_never_reruns_across_sigkill: Step never reruns across sigkill.
test_suspend_swallowed_goes_stuck: Suspend swallowed goes stuck.

Timers (1)

test_timer_survives_worker_sigkill_and_postgres_crash: Timer survives worker sigkill and postgres crash.

Versioning (3)

test_changed_step_name_goes_stuck_and_runs_nothing: Changed step name goes stuck and runs nothing.
test_patched_marker: Patched marker.
test_v2_worker_never_claims_v1: V2 worker never claims v1.

`tests/test_runtime_gate_parity.py` (12)

Differential test: interlock.Gate against interlock_runtime, fault by fault, tier by tier.

GateParity (12)

test_conflicting_payload: Conflicting payload.
test_crash_before_ack: Crash before ack.
test_crash_before_send: Crash before send.
test_duplicate_submit: Duplicate submit.
test_happy_path: Happy path.
test_key_expired: Key expired.
test_lease_revoked: Lease revoked.
test_lease_revoked_during_outage: Lease revoked during outage.
test_model_redecides: Model redecides.
test_refund_during_outage: Refund during outage.
test_stale_eligibility: Stale eligibility.
test_verify_reads_the_runtime_snapshot_shape: A DISPATCHED whose recorded grant snapshot has revoked set must verify as not authorized.

`tests/test_runtime_sql_races.py` (9)

Interleaved races on real Postgres, no subprocesses: two connections, one transaction held open while the other runs.

Races (9)

test_cancel_before_dispatch_refuses: Cancel before dispatch refuses.
test_cancel_waits_for_dispatch: Cancel waits for dispatch.
test_concurrent_submit_with_different_payloads: Concurrent submit with different payloads.
test_dispatch_waits_for_revoke_and_refuses: Dispatch waits for revoke and refuses.
test_forked_chain_is_rejected: Forked chain is rejected.
test_revoke_waits_for_dispatch_and_returns_the_effect: Revoke waits for dispatch and returns the effect.
test_second_commit_and_mutations_are_rejected: Second commit and mutations are rejected.
test_signal_during_suspend_wakes_the_workflow: Signal during suspend wakes the workflow.
test_suspend_after_signal_consumes_it: Suspend after signal consumes it.

`tests/test_runtime_stateful.py` (1)

R6: a Hypothesis RuleBasedStateMachine against real Postgres, real worker subprocesses and a real HTTP target.

Stateful (1)

test_runtime_state_machine: Runtime state machine.

`tests/test_scenario_billing_credit.py` (7)

Offline logic of scenarios/billing_credit: premises, judging, the target, and the hand check. No network.

HandCheck (2)

test_refuses_on_billing_credit_or_revoked_approval: Refuses on billing credit or revoked approval.
test_sends_once_then_finds_by_lookup: Sends once then finds by lookup.

Judge (2)

test_approval_lease_store: Approval lease store.
test_want_comes_from_the_premises_not_the_system: Want comes from the premises not the system.

Premises (2)

test_counts_credit_notes_and_others_adjustments_only: Counts credit notes and others adjustments only.
test_target_sees_a_billing_credit_and_finds_its_own_send: Target sees a billing credit and finds its own send.

PublishedReceipts (1)

test_every_published_interlock_receipt_reverifies_offline: Every published interlock receipt reverifies offline.

`tests/test_scenario_calendar.py` (6)

Offline logic for scenarios/calendar: an in-memory calendar stands in; the live run uses Google Calendar and SIGKILL.

CalendarScenario (6)

test_a_change_only_premise_books_over_a_slot_taken_before_the_decision: A change only premise books over a slot taken before the decision.
test_decision_must_match_the_request: Decision must match the request.
test_event_ids_are_base32hex: Event ids are base32hex.
test_hand_check_and_interlock_hold_every_fault: Hand check and interlock hold every fault.
test_interlock_recovery_paths_and_receipts: Interlock recovery paths and receipts.
test_no_check_replays_a_queued_send_without_rechecking: No check replays a queued send without rechecking.

`tests/test_scenario_connect_payout.py` (6)

Offline logic for scenarios/connect_payout: an in-memory Stripe stands in; the live run uses real Stripe and SIGKILL.

ConnectPayoutLogic (6)

test_crash_after_commit_lands_once_everywhere: Crash after commit lands once everywhere.
test_hand_check_decision: Hand check decision.
test_interlock_receipt_records_the_refusal: Interlock receipt records the refusal.
test_order_reversed_during_outage: Order reversed during outage.
test_paid_out_ignores_reversed: Paid out ignores reversed.
test_seller_restricted_during_outage: Seller restricted during outage.

`tests/test_scenario_email_tier3.py` (14)

Scenario email_tier3, offline logic only: no network, no keys. The live run is experiments/scenario_email_tier3.py.

HandCheck (3)

test_failed_refund_sends_nothing: Failed refund sends nothing.
test_used_key_reports_sent_without_reading_the_refund: Used key reports sent without reading the refund.
test_without_the_probe_a_sent_email_reads_as_skipped: Without the probe a sent email reads as skipped.

Probe (3)

test_anything_else_is_not_an_answer: Anything else is not an answer.
test_never_sends_to_a_real_inbox: Never sends to a real inbox.
test_reads_used_and_unused: Reads used and unused.

Recovery (5)

test_after_the_key_window_nothing_is_asked_or_sent: After the key window nothing is asked or sent.
test_refund_failed_and_never_sent_is_refused: Refund failed and never sent is refused.
test_refund_failed_but_already_sent_is_found: Refund failed but already sent is found.
test_tier3_never_resends: Tier3 never resends.
test_without_the_probe_a_failed_refund_is_ambiguous: Without the probe a failed refund is ambiguous.

RefundAlreadyFailedAtDecision (1)

test_interlock_sends_nothing: Interlock sends nothing.

Scoring (2)

test_a_log_without_checks_proves_nothing: A log without checks proves nothing.
test_claimed: Claimed.

`tests/test_scenario_gcp_resource.py` (13)

Offline logic of the gcp_resource scenario: no network. The live run is experiments/scenario_gcp_resource.py.

HandCheck (3)

test_lookup_finds_own_write_after_a_redeploy_only_with_versioning: Lookup finds own write after a redeploy only with versioning.
test_own_write_already_there_reads_as_applied: Own write already there reads as applied.
test_redeploy_since_decision_is_not_overwritten: Redeploy since decision is not overwritten.

Judging (3)

test_client_refuses_resources_outside_the_sandbox: Client refuses resources outside the sandbox.
test_judge_and_claims: Judge and claims.
test_model_may_only_pick_the_approved_version: Model may only pick the approved version.

Record (4)

test_interlock_without_versioning_misses_its_replaced_write: Interlock without versioning misses its replaced write.
test_lookup_resolves_the_unfinished_send: Lookup resolves the unfinished send.
test_no_check_retry_leaves_the_first_send_unresolved: No check retry leaves the first send unresolved.
test_unfinished_send_then_412_without_lookup_cannot_say: Unfinished send then 412 without lookup cannot say.

Target (3)

test_gate_recovery_refuses_after_redeploy_before_send: Gate recovery refuses after redeploy before send.
test_own_write_is_not_a_stale_premise: Own write is not a stale premise.
test_redeploy_is_stale_and_lookup_still_finds_the_earlier_write: Redeploy is stale and lookup still finds the earlier write.

`tests/test_scenario_github_merge.py` (10)

Offline logic for scenarios/github_merge. The live run is experiments/scenario_github_merge.py.

Decision (1)

test_parse: Parse.

Judge (2)

test_after_commit: After commit.
test_before_send: Before send.

Systems (7)

test_forged_receipt_passes_unsigned_fails_signed: Forged receipt passes unsigned fails signed.
test_hand_check: Hand check.
test_hand_check_after_commit: Hand check after commit.
test_hand_check_push_between_check_and_send: Hand check push between check and send.
test_interlock_after_commit: Interlock after commit.
test_interlock_before_send: Interlock before send.
test_no_check_merges_the_push: No check merges the push.

`tests/test_scenario_shared_cap.py` (8)

Offline logic of scenarios/shared_cap: the cap reservation, the headroom premise, the hand check, ground truth.

SharedCap (8)

test_ground_truth: Ground truth.
test_hand_check_decision: Hand check decision.
test_headroom_left_lets_both_land: Headroom left lets both land.
test_headroom_premise: Headroom premise.
test_in_flight_reservation_refuses_the_other_bot_and_recovery_lands_once: In flight reservation refuses the other bot and recovery lands once.
test_race_mechanism: Race mechanism.
test_refused_at_recovery_gives_the_reservation_back: Refused at recovery gives the reservation back.
test_two_processes_racing_one_dispatches: Two processes racing one dispatches.

`tests/test_scenario_stripe_dispute.py` (9)

Offline logic for scenarios/stripe_dispute: an in-memory Stripe stands in; the live run uses real Stripe, a real model and SIGKILL.

StripeDisputeLogic (9)

test_crash_after_send_lands_once_everywhere: Crash after send lands once everywhere.
test_crash_before_send: Crash before send.
test_hand_check_decision: Hand check decision.
test_inquiry_is_not_a_chargeback: Inquiry is not a chargeback.
test_interlock_receipt_names_the_chargeback_and_the_refund: Interlock receipt names the chargeback and the refund.
test_model_asking_for_more_than_approved_sends_nothing: Model asking for more than approved sends nothing.
test_proof_is_scored_from_records: Proof is scored from records.
test_published_receipts_reverify: Published receipts reverify.
test_verdict_counts_failed_refunds_as_issued: Verdict counts failed refunds as issued.

`tests/test_scoreboard.py` (5)

The approvals scoreboard is derived from the journal alone, so it survives restarts and can be recomputed by anyone holding the entries.

Scoreboard (4)

test_cleared_verified_counts_only_valid_receipts: Cleared verified counts only valid receipts.
test_empty_and_pre_feature_journals: Empty and pre feature journals.
test_scoreboard_counts_a_scripted_journal: Scoreboard counts a scripted journal.
test_time_to_decision_uses_at_not_ts: Time to decision uses at not ts.

SyntheticDay (1)

test_synthetic_day_scoreboard_is_consistent: Synthetic day scoreboard is consistent.

`tests/test_site.py` (9)

The landing page and the short README stay correct: the copied prompt matches docs/install-with-ai.md, snippets parse, the live demo URL lives in one constant, and every relative link in the moved docs resolves.

PromptCrashRecipe (1)

test_restart_recovers_with_one_effect: Restart recovers with one effect.

Site (8)

test_adk_premises_come_from_decision_time: Adk premises come from decision time.
test_live_demo_url_is_one_constant: Live demo url is one constant.
test_prompt_matches_doc_and_is_short: Prompt matches doc and is short.
test_proof_test_counts_match_tests_readme: Proof test counts match tests readme.
test_python_snippets_parse: Python snippets parse.
test_relative_links_resolve: Relative links resolve.
test_report_rewrites_proof_counts: Report rewrites proof counts.
test_tabs_use_the_pressed_button_pattern: Tabs use the pressed button pattern.

`tests/test_temporal_helper.py` (2)

interlock.temporal.gated() without a Temporal server: each attempt recovers before it submits, and refusals stop the retries. experiments/temporal_live.py covers a real server.

GatedActivity (2)

test_refusal_stops_the_retries: Refusal stops the retries.
test_second_attempt_recovers_instead_of_resending: Second attempt recovers instead of resending.

2. Experiments and live runs

Tables are copied from each results file; its check marks are written as words (held, VIOLATED, held, availability lost) and its middle-dot separators as /. Real Stripe ids are as they appear there.

refund_agent

Script: experiments/refund_agent.py
Tests: Whether one approved $20 refund lands exactly once under crashes, duplicates, a re-deciding model, a revoked approval, a changed order and an expired idempotency key, for a naive agent, idempotency keys, durable execution and the gate at tiers 1 to 3.
Ran: Simulated in process: an in-memory payments service and injected SimulatedCrash faults; no network.
Full results: results/refund_agent.md

fault	naive	idempotency@tier1	durable@tier1	gate@tier1	gate@tier2	gate@tier3
`happy_path`	APPLIED $20 held	APPLIED:ok $20 held	COMPLETED:ok $20 held	COMMITTED $20 held	COMMITTED $20 held	COMMITTED $20 held
`crash_before_send`	RETRIED $20 held	RETRIED $20 held	RERUN:ok $20 held	COMMITTED_BY_RETRY $20 held	REAPPLIED_AFTER_QUERY $20 held	AMBIGUOUS $0 held, availability lost
`crash_before_ack`	RETRIED $40 VIOLATED	RETRIED $20 held	RERUN:already_processed $20 held	COMMITTED_BY_RETRY $20 held	COMMITTED_ON_QUERY $20 held	AMBIGUOUS $20 held, availability lost
`duplicate_submit`	APPLIED $40 VIOLATED	APPLIED:already_processed $20 held	REPLAYED:ok $20 held	DUPLICATE_IGNORED $20 held	DUPLICATE_IGNORED $20 held	DUPLICATE_IGNORED $20 held
`model_redecides`	APPLIED $50 VIOLATED	APPLIED:key_reused_with_different_params $20 held	REPLAYED:RERUN:already_processed $20 held	REFUSED:conflicting_payload $20 held	REFUSED:conflicting_payload $20 held	REFUSED:conflicting_payload $20 held
`conflicting_payload`	APPLIED $50 VIOLATED	APPLIED:key_reused_with_different_params $20 held	REPLAYED:ok $20 held	REFUSED:conflicting_payload $20 held	REFUSED:conflicting_payload $20 held	REFUSED:conflicting_payload $20 held
`lease_revoked`	APPLIED $20 VIOLATED	APPLIED:ok $20 VIOLATED	COMPLETED:ok $20 VIOLATED	REFUSED:lease $0 held	REFUSED:lease $0 held	REFUSED:lease $0 held
`stale_eligibility`	APPLIED $20 VIOLATED	APPLIED:ok $20 VIOLATED	COMPLETED:ok $20 VIOLATED	REFUSED:stale_premise $0 held	REFUSED:stale_premise $0 held	REFUSED:stale_premise $0 held
`refund_during_outage`	RETRIED $40 VIOLATED	RETRIED $40 VIOLATED	RERUN:ok $40 VIOLATED	REFUSED:stale_premise_at_recovery $20 held	REFUSED:stale_premise_at_recovery $20 held	AMBIGUOUS $20 held, availability lost
`lease_revoked_during_outage`	RETRIED $20 VIOLATED	RETRIED $20 VIOLATED	RERUN:ok $20 VIOLATED	REFUSED:lease_at_recovery $0 held	REFUSED:lease_at_recovery $0 held	AMBIGUOUS $0 held, availability lost
`key_expired`	RETRIED $40 VIOLATED	RETRIED $40 VIOLATED	RERUN:ok $40 VIOLATED	COMMITTED_ON_QUERY $20 held	COMMITTED_ON_QUERY $20 held	AMBIGUOUS $20 held, availability lost

coding_agents

Script: experiments/coding_agents.py
Tests: Whether two parallel coding agents can land a change that breaks at runtime, duplicates work, or lands under a revoked lease, with no gate, a file-hash gate and a symbol gate.
Ran: Simulated in process: two scripted agents on a temporary repo, injected SimulatedCrash faults; the code B added is executed.
Full results: results/coding_agents.md

fault	naive	gate/file	gate/symbol
`rename_break`	APPLIED landed_BROKEN VIOLATED	REFUSED:stale_premise not_landed held	REFUSED:stale_premise not_landed held
`duplicate_work`	APPLIED 2 impl VIOLATED	REFUSED:claimed_by_A 1 impl held	REFUSED:claimed_by_A 1 impl held
`benign_reformat`	APPLIED landed_ok held	REFUSED:stale_premise not_landed held, availability lost	COMMITTED landed_ok held
`crash_before_commit`	RETRIED landed_ok VIOLATED	COMMITTED_BY_RETRY landed_ok held	COMMITTED_BY_RETRY landed_ok held
`duplicate_submit`	APPLIED landed_ok VIOLATED	DUPLICATE_IGNORED landed_ok held	DUPLICATE_IGNORED landed_ok held
`lease_revoked`	APPLIED landed_ok VIOLATED	REFUSED:lease not_landed held	REFUSED:lease not_landed held
`semantic_only`	APPLIED landed_BROKEN VIOLATED	REFUSED:stale_premise not_landed held	COMMITTED landed_BROKEN VIOLATED

stripe_live

Script: experiments/stripe_live.py
Tests: The refund faults from the refund agent experiment against real Stripe in test mode.
Ran: Real: Stripe test-mode API calls, one new payment per row.
Results file says: “Every row made real Stripe API calls: a $100 test card payment, one approved $20 partial refund, then the fault.”
Full results: results/stripe_live.md

fault	naive (today)	idempotency key only	gate (Stripe: key + lookup)
`crash_before_ack`	RETRIED $40 VIOLATED	RETRIED $20 held	COMMITTED_BY_RETRY $20 held
`duplicate_submit`	APPLIED $40 VIOLATED	APPLIED:already_processed $20 held	DUPLICATE_IGNORED $20 held
`refund_during_outage`	RETRIED $40 VIOLATED	RETRIED $40 VIOLATED	REFUSED:stale_premise_at_recovery $20 held

temporal_live

Script: experiments/temporal_live.py
Tests: Whether Temporal’s own retry policy, with the idempotency key its docs recommend, refunds correctly when the facts change during a worker outage, with and without Interlock as the activity body.
Ran: Real Temporal dev server and retries; the refund target is the in-process payments service.
Results file says: “Generated 2026-09-13 17:37 UTC by experiments/temporal_live.py with temporalio 1.32.0 and Temporal’s local dev server.”
Full results: results/temporal_live.md

fault	Temporal, recommended idempotency key	Temporal with Interlock as the activity body
`crash_before_ack`	COMPLETED / 2 attempts / $20 held	COMMITTED_BY_RETRY / 2 attempts / $20 held
`refund_during_outage`	COMPLETED / 2 attempts / $40 VIOLATED	REFUSED:stale_premise_at_recovery / 2 attempts / $20 held
`lease_revoked_during_outage`	COMPLETED / 2 attempts / $20 VIOLATED	REFUSED:lease_at_recovery / 2 attempts / $0 held
`stale_eligibility`	COMPLETED / 1 attempt / $20 VIOLATED	REFUSED:stale_premise / 1 attempt / $0 held

e2e_live

Script: experiments/e2e_live.py
Tests: A real LLM refund agent on a real Temporal server against Stripe test mode, with workers killed by SIGKILL, comparing plain Temporal, Temporal plus a hand-written re-check, and Interlock.
Ran: Real: Stripe test mode, Anthropic model calls, Temporal, SIGKILL. Two rows are EMULATED (a pruned idempotency key).
Results file says: “key_pruned_after_24h: worker SIGKILLed after Stripe’s response to the refund POST arrived, before anything recorded it; restarted with Stripe’s memory of the key EMULATED as gone (and, for Interlock only, its clock moved 25h)”
Results file says: “no_lookup_after_24h: as key_pruned_after_24h, with a target that cannot look refunds up (EMULATED).”
Results file says: “Stripe: every payment, refund, lookup and idempotency replay is a real test-mode API call. No mock.”
Full results: results/e2e_live.md

scenario	Temporal: idempotency key, no re-check in the activity	Temporal: idempotency key plus a hand-written re-check	Temporal with Interlock as the activity body
`crash_after_commit`	REPLAYED_BY_STRIPE; $20 in 1 refund (want $20 in 1); attempt 2, 15.2s crash to close; held; answer matches Stripe	FOUND_BY_LOOKUP; $20 in 1 refund (want $20 in 1); attempt 2, 14.7s crash to close; held; answer matches Stripe	COMMITTED_BY_RETRY; $20 in 1 refund (want $20 in 1); attempt 8, 44.0s crash to close; held; answer matches Stripe
`hand_refund_before_decision`	REPLAYED_BY_STRIPE; $25 in 2 refunds (want $25 in 2); attempt 2, 15.1s crash to close; held; answer matches Stripe	FOUND_BY_LOOKUP; $25 in 2 refunds (want $25 in 2); attempt 2, 14.7s crash to close; held; answer matches Stripe	COMMITTED_BY_RETRY; $25 in 2 refunds (want $25 in 2); attempt 8, 42.8s crash to close; held; answer matches Stripe
`hand_refund_during_outage`	REFUNDED; $40 in 2 refunds (want $20 in 1); attempt 2, 16.8s crash to close; VIOLATED, $20 too much; answer matches Stripe	REFUSED:stale_premise; $20 in 1 refund (want $20 in 1); attempt 2, 16.0s crash to close; held; answer matches Stripe	REFUSED:stale_premise_at_recovery; $20 in 1 refund (want $20 in 1); attempt 8, 43.6s crash to close; held; answer matches Stripe
`unrelated_refund_during_outage`	REFUNDED; $25 in 2 refunds (want $25 in 2); attempt 2, 16.5s crash to close; held; answer matches Stripe	REFUSED:stale_premise; $5 in 1 refund (want $25 in 2); attempt 2, 15.7s crash to close; SHORT by $20; answer matches Stripe	REFUSED:stale_premise_at_recovery; $5 in 1 refund (want $25 in 2); attempt 8, 43.3s crash to close; SHORT by $20; answer matches Stripe
`approval_revoked_during_outage`	REFUNDED; $20 in 1 refund (want $0 in 0); attempt 2, 16.8s crash to close; VIOLATED, $20 too much; answer matches Stripe	REFUSED:lease; $0 in 0 refunds (want $0 in 0); attempt 2, 16.0s crash to close; held; answer matches Stripe	REFUSED:lease_at_recovery; $0 in 0 refunds (want $0 in 0); attempt 8, 43.6s crash to close; held; answer matches Stripe
`approval_revoked_after_commit`	REPLAYED_BY_STRIPE; $20 in 1 refund (want $20 in 1); attempt 2, 14.8s crash to close; held; answer matches Stripe	FOUND_BY_LOOKUP; $20 in 1 refund (want $20 in 1); attempt 2, 14.8s crash to close; held; answer matches Stripe	COMMITTED_ON_QUERY; $20 in 1 refund (want $20 in 1); attempt 8, 43.3s crash to close; held; answer matches Stripe
`key_pruned_after_24h` (EMULATED)	REFUNDED; $40 in 2 refunds (want $20 in 1); attempt 2, 15.9s crash to close; VIOLATED, $20 too much; answer CONTRADICTS Stripe	FOUND_BY_LOOKUP; $20 in 1 refund (want $20 in 1); attempt 2, 15.0s crash to close; held; answer matches Stripe	COMMITTED_ON_QUERY; $20 in 1 refund (want $20 in 1); attempt 8, 43.1s crash to close; held; answer matches Stripe
`no_lookup_after_24h` (EMULATED)	n/a	n/a	AMBIGUOUS; $20 in 1 refund (want $20 in 1); attempt 8, 42.1s crash to close; held; answer matches Stripe

e2e_audit

Script: experiments/e2e_audit.py
Tests: an independent check of results/e2e_live.json against Stripe itself, trusting nothing in the file and using none of the repo’s code.
Ran: real Stripe test-mode reads.
Full results: results/e2e_audit.txt

scenario                        mode              cents  want  audit  flag      detail
crash_after_commit              temporal          2000   2000  PASS             
crash_after_commit              temporal_checked  2000   2000  PASS             
crash_after_commit              interlock         2000   2000  PASS             
hand_refund_before_decision     temporal          2500   2500  PASS             
hand_refund_before_decision     temporal_checked  2500   2500  PASS             
hand_refund_before_decision     interlock         2500   2500  PASS             
hand_refund_during_outage       temporal          4000   2000  PASS             
hand_refund_during_outage       temporal_checked  2000   2000  PASS             
hand_refund_during_outage       interlock         2000   2000  PASS             
unrelated_refund_during_outage  temporal          2500   2500  PASS             
unrelated_refund_during_outage  temporal_checked  500    2500  PASS             
unrelated_refund_during_outage  interlock         500    2500  PASS             
approval_revoked_during_outage  temporal          2000   0     PASS             
approval_revoked_during_outage  temporal_checked  0      0     PASS             
approval_revoked_during_outage  interlock         0      0     PASS             
approval_revoked_after_commit   temporal          2000   2000  PASS             
approval_revoked_after_commit   temporal_checked  2000   2000  PASS             
approval_revoked_after_commit   interlock         2000   2000  PASS             
key_pruned_after_24h            temporal          4000   2000  PASS   EMULATED  
key_pruned_after_24h            temporal_checked  2000   2000  PASS   EMULATED  
key_pruned_after_24h            interlock         2000   2000  PASS   EMULATED  
no_lookup_after_24h             interlock         2000   2000  PASS   EMULATED  receipt AMBIGUOUS, Stripe has 1 refund(s) for 6cce6c06a86a

22/22 cells verified against Stripe

approval_inbox

Script: experiments/approval_inbox.py
Tests: Of a synthetic day of refund requests, how many still need a person, and how many are refunded the wrong amount, with everyone approving, rules only, and rules plus Interlock.
Ran: Simulated: a synthetic day whose mix is an assumption, not measured data.
Results file says: “The mix is an assumption, not measured data; so are reviewer latency (exponential, mean 90 min) and the routing.”
Results file says: “On this synthetic day, whose mix is an assumption and not measured data, 65 of 95 requests cleared with no person, 65 of those with receipts that verify.”
Full results: results/approval_inbox.md

system	reviews a person did	orders refunded the wrong amount
everyone approves	100	10
rules only	25	10
rules + Interlock	36	0

repair_loop

Script: experiments/repair_loop.py
Tests: Whether an agent told what changed and what the approval leaves can repair a refused refund without paying out wrong.
Ran: Simulated: a scripted agent loop, not a model; the mix is an assumption.
Results file says: “The mix is an assumption (see the script); the agent is a scripted loop, not a model.”
Full results: results/repair_loop.md

system	no person	person	wrong payouts	overpaid
no gate	100	0	40	$558
hand check	97	3	0	$0
interlock	83	17	13	$130
interlock+repair	97	3	0	$0

escalation_live

Results file says: “Every step made real Stripe test-mode API calls on one PaymentIntent, pi_3UFOFi88KhIqqdFL1ueAaUx9. No mock data.”
Full results: results/escalation_live.md

step	wall clock (UTC)	detail
payment	2026-09-14T01:00:11+00:00	payment_intent=pi_3UFOFi88KhIqqdFL1ueAaUx9, amount=10000
listener	2026-09-14T01:00:13+00:00	ready=True
request	2026-09-14T01:00:13+00:00	request_id=refund-50/pi_3UFOFi88KhIqqdFL1ueAaUx9, status=QUEUED, reason=needs_judgment, detail=[‘amount at most 1000 cents’], group=ap-leads
approved	2026-09-14T01:00:13+00:00	by=ana, status=APPROVED
hand refund	2026-09-14T01:00:15+00:00	refund=re_3UFOFi88KhIqqdFL1Qpt3qv8, amount=3000, status=succeeded
send	2026-09-14T01:00:16+00:00	status=REFUSED:stale_premise, reason=stale_premise, changes=[{‘field’: ‘refunded_by_others’, ‘was’: 0, ‘now’: 3000}], repairs=[‘still_fits’]
repair accepted	2026-09-14T01:00:17+00:00	by=ana, repair=still_fits, status=COMMITTED
second request	2026-09-14T01:00:18+00:00	request_id=refund-15/pi_3UFOFi88KhIqqdFL1ueAaUx9, status=QUEUED, group=ap-leads
sla tick	2026-09-14T01:00:18+00:00	moved={‘refund-15/pi_3UFOFi88KhIqqdFL1ueAaUx9’: ‘finance-manager’}, group=finance-manager, level=1, breach=True
ap-leads after breach	2026-09-14T01:00:18+00:00	by=ana, status=REFUSED:lease
approved up the chain	2026-09-14T01:00:19+00:00	by=fm, status=COMMITTED
confirmation	2026-09-14T01:00:20+00:00	path=webhook

Real-world scenario suite (`experiments/scenario_*.py`)

Each scenario runs one agent step against the standard setup, a fair hand-written check and Interlock, with a real SIGKILL and ground truth read back from the live service. Offline logic for each is in tests/test_scenario_<key>.py. Summary: results/scenarios/README.md.

scenario	system	held	proof	settle (s)	source
stripe_dispute	no_check	2/2	0/2	6.8, 8.6	`results/scenarios/stripe_dispute.md`
	hand_check	2/2	2/2	6.4, 11.2	same
	interlock	2/2	2/2	42.4, 43.0	same
shared_cap	no_check	0/40	0/40	median 1.1 / 2.3	`results/scenarios/shared_cap.md`
	hand_check (no shared state)	4/40	0/40	median 1.1 / 2.3	same
	hand_lock (hand_check inside an flock)	40/40	0/40	median 0.5 / 1.4	same
	interlock_core (unmodified Gate)	25/40	40/40	median 40.1 / 41.0	same
	interlock + CapJournal (scenario subclass)	40/40	40/40	median 40.1 / 41.7	same
billing_credit	no_check	5/6	0/6	median 17 (13.7 to 25.7)	`results/scenarios/billing_credit.md`
	hand_check	6/6	6/6	median 17 (14.1 to 23.7)	same
	interlock	6/6	6/6	median 41 (41.0 to 41.8)	same
github_merge	no_check	3/6	0/6	median 8.5 / 2.4	`results/scenarios/github_merge.md`
	hand_check	6/6	6/6	median 7.7 / 2.5	same
	interlock	6/6	6/6	median 26.1 / 24.4	same
calendar	no_check	5/7	0/7	median 0.6	`results/scenarios/calendar.md`
	hand_check	7/7	0/7	median 0.6	same
	interlock (slot premise must be empty)	7/7	7/7	median 31.2	same
	interlock_change_only (easy.py as shipped)	0/1	1/1	31.5	same
email_tier3	no_check	2/3	0/3	median 2	`results/scenarios/email_tier3.md`
	hand_check (with key probe)	3/3	3/3	median 3	same
	hand_check_noprobe (idiomatic)	3/3	2/3	median 2	same
	interlock (with key probe)	3/3	3/3	median 37	same
	interlock_noprobe	3/3	1/3	median 36	same
	interlock_tier3	3/3	0/3	median 36	same
gcp_resource	no_check	0/3	0/3	0.4 to 2.0	`results/scenarios/gcp_resource.md`
	hand_check	3/3	3/3	0.5 to 2.1	same
	interlock	3/3	3/3	30.6 to 30.9	same
connect_payout	all	BLOCKED	BLOCKED	not run	`results/scenarios/connect_payout.md`

stripe_dispute

Script: experiments/scenario_stripe_dispute.py
Tests: A refund decided before a chargeback opens during the worker outage, Stripe test mode.
Results file says: “Stripe test mode, model claude-haiku-4-5-20251001, every crash a real SIGKILL of the worker process. Nothing emulated.”
Results file says: “The refund read succeeded 10, 30, 60 and 120s after, and again 144s after (failure_reason null); the charge shows amount_refunded 2000 and disputed true. Out $120 on a $100 payment, in test mode.”
Full results: results/scenarios/stripe_dispute.md

fault	no_check	hand_check	interlock
`crash_before_send_chargeback_during_outage`	STRIPE_ERROR; 0 refund object(s) (final: none), want 0; created at or after the chargeback: none; money returned: no; dispute needs_response; held; answer vs refund objects: matches; answer vs final money: matches; 6.8s; proof no (checks no, outcome no, tamper-evident no)	REFUSED:charged_back; 0 refund object(s) (final: none), want 0; created at or after the chargeback: none; money returned: no; dispute needs_response; held; answer vs refund objects: matches; answer vs final money: matches; 6.4s; proof yes (checks yes, outcome yes, tamper-evident no)	REFUSED:stale_premise_at_recovery; 0 refund object(s) (final: none), want 0; created at or after the chargeback: none; money returned: no; dispute needs_response; held; answer vs refund objects: matches; answer vs final money: matches; 42.4s; proof yes (checks yes, outcome yes, tamper-evident yes)
`crash_after_send_chargeback_during_outage`	REPLAYED_BY_STRIPE; 1 refund object(s) (final: failed (charge_for_pending_refund_disputed)), want 1; created at or after the chargeback: none; money returned: no; dispute needs_response; held; answer vs refund objects: matches; answer vs final money: CONTRADICTS; 8.6s; proof no (checks no, outcome no, tamper-evident no)	FOUND_BY_LOOKUP; 1 refund object(s) (final: failed (charge_for_pending_refund_disputed)), want 1; created at or after the chargeback: none; money returned: no; dispute needs_response; held; answer vs refund objects: matches; answer vs final money: CONTRADICTS; 11.2s; proof yes (checks yes, outcome yes, tamper-evident no)	COMMITTED_ON_QUERY; 1 refund object(s) (final: failed (charge_for_pending_refund_disputed)), want 1; created at or after the chargeback: none; money returned: no; dispute needs_response; held; answer vs refund objects: matches; answer vs final money: CONTRADICTS; 43.0s; proof yes (checks yes, outcome yes, tamper-evident yes)

shared_cap

Script: experiments/scenario_shared_cap.py
Tests: Two agents sharing one $30 approval cap on one Stripe test payment.
Results file says: “Ground truth is Stripe’s refund list. Nothing is emulated in any cell.”
Results file says: “Model claude-haiku-4-5-20251001, Stripe test mode, 20 runs per cell, 4 runs at a time (each run has its own PaymentIntent, run directory and journal).”
Results file says: “Stripe: every payment, refund, list and idempotent replay is a real test-mode API call.”
Full results: results/scenarios/shared_cap.md

crash point	no_check (stable idempotency key, retry on restart)	hand_check (read Stripe refunds, then send; no shared state)	hand_lock (hand_check inside an flock on the shared dir)	interlock_core (unmodified Gate, headroom premise)	interlock + CapJournal (scenario subclass, cap reserved at dispatch)
`after_commit`	held 0/20; Stripe: 20x $40 in 2; crash in 20/20; median 1.1s crash to settled; provable 0/20	held 3/20; Stripe: 3x $20 in 1, 17x $40 in 2; crash in 20/20; median 1.1s crash to settled; provable 0/20	held 20/20; Stripe: 20x $20 in 1; crash in 20/20; median 0.5s crash to settled; provable 0/20	held 5/20; Stripe: 5x $20 in 1, 15x $40 in 2; crash in 20/20; median 40.1s crash to settled; provable 20/20	held 20/20; Stripe: 20x $20 in 1; crash in 20/20; median 40.1s crash to settled; provable 20/20
`before_send`	held 0/20; Stripe: 20x $40 in 2; crash in 20/20; median 2.3s crash to settled; provable 0/20	held 1/20; Stripe: 1x $20 in 1, 19x $40 in 2; crash in 20/20; median 2.3s crash to settled; provable 0/20	held 20/20; Stripe: 20x $20 in 1; crash in 20/20; median 1.4s crash to settled; provable 0/20	held 20/20; Stripe: 20x $20 in 1; crash in 20/20; median 41.0s crash to settled; provable 20/20	held 20/20; Stripe: 20x $20 in 1; crash in 20/20; median 41.7s crash to settled; provable 20/20

billing_credit

Script: experiments/scenario_billing_credit.py
Tests: A goodwill credit against a Stripe Billing renewal on test clocks.
Results file says: “Stripe Billing test mode with test clocks, model claude-haiku-4-5-20251001, every crash a real SIGKILL of the worker process.”
Full results: results/scenarios/billing_credit.md

crash / outage	no_check	hand_check	interlock
`before_send` / `renewal`	CREDITED; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof no; 18.1s crash to settled (0.8s after restart)	CREDITED; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 23.7s crash to settled (1.5s after restart)	COMMITTED_BY_RETRY via `retry-idempotent`; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 41.8s crash to settled (14.0s after restart)
`before_send` / `billing_credit`	CREDITED; 1 case credit(s), $10 (want 0, $0); VIOLATED; answer matches Stripe; proof no; 19.1s crash to settled (0.4s after restart)	REFUSED:stale_premise; 0 case credit(s), $0 (want 0, $0); held; answer matches Stripe; proof yes; 21.4s crash to settled (1.2s after restart)	REFUSED:stale_premise_at_recovery; 0 case credit(s), $0 (want 0, $0); held; answer matches Stripe; proof yes; 41.5s crash to settled (27.5s after restart)
`before_send` / `proration`	CREDITED; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof no; 16.6s crash to settled (0.8s after restart)	CREDITED; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 17.0s crash to settled (1.4s after restart)	COMMITTED_BY_RETRY via `retry-idempotent`; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 41.0s crash to settled (24.1s after restart)
`after_send` / `renewal`	REPLAYED_BY_STRIPE; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof no; 15.5s crash to settled (0.4s after restart)	FOUND_BY_LOOKUP; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 15.3s crash to settled (0.3s after restart)	COMMITTED_BY_RETRY via `retry-idempotent`; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 41.1s crash to settled (20.3s after restart)
`after_send` / `proration`	REPLAYED_BY_STRIPE; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof no; 13.7s crash to settled (0.3s after restart)	FOUND_BY_LOOKUP; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 14.1s crash to settled (0.8s after restart)	COMMITTED_BY_RETRY via `retry-idempotent`; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 41.2s crash to settled (27.4s after restart)
`before_send` / `unrelated_credit`	CREDITED; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof no; 25.7s crash to settled (0.7s after restart)	CREDITED; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 16.5s crash to settled (1.2s after restart)	COMMITTED_BY_RETRY via `retry-idempotent`; 1 case credit(s), $10 (want 1, $10); held; answer matches Stripe; proof yes; 41.1s crash to settled (21.0s after restart)

github_merge

Script: experiments/scenario_github_merge.py
Tests: Merging a reviewed PR after a human pushed to its branch during the outage, live GitHub.
Results file says: “GitHub: every PR, read, merge, push and ground-truth read is a real call against a real private repo. No mock.”
Results file says: “Emulated: nothing.”
Results file says: “LLM: every review is a real Anthropic Messages API call on the diff pinned to the reviewed sha.”
Full results: results/scenarios/github_merge.md

fault	no_check	hand_check	interlock
`before_send`	MERGED x3; held 0/3; answer matched 3/3; proof 0/3; median 8.5s	REFUSED:head_modified x3; held 3/3; answer matched 3/3; proof 3/3; median 7.7s	REFUSED:stale_premise_at_recovery x3; held 3/3; answer matched 3/3; proof 3/3; median 26.1s
`after_commit`	MERGED x3; held 3/3; answer matched 3/3; proof 0/3; median 2.4s	ALREADY_MERGED x3; held 3/3; answer matched 3/3; proof 3/3; median 2.5s	COMMITTED_ON_QUERY x3; held 3/3; answer matched 3/3; proof 3/3; median 24.4s

calendar

Script: experiments/scenario_calendar.py
Tests: Double booking a slot on a real Google Calendar.
Results file says: “Calendar: every insert, get, list, freebusy and delete is a real Calendar API v3 call as the service account.”
Results file says: “LLM: every decision is a real Anthropic Messages API call (claude-haiku-4-5-20251001, temperature 0), made once per job and persisted; all decisions are listed below.”
Results file says: “The booking request system: a JSON file per request in a temp directory, read by the worker (allowed for interlock, the live check for hand_check and at enqueue for no_check) and rewritten by the harness to cancel. Every cell’s emulated field says so.”
Full results: results/scenarios/calendar.md

fault	no_check	hand_check	interlock	interlock_change_only
`after_commit/none`	ALREADY_EXISTS_409; 1 agent event (want 1); held; answer matches; 0.6s; proof: none	FOUND_BY_LOOKUP; 1 agent event (want 1); held; answer matches; 0.4s; proof: none	COMMITTED_BY_RETRY; 1 agent event (want 1); held; answer matches; 31.5s; proof: receipt	n/a
`after_commit/slot_busy`	ALREADY_EXISTS_409; 1 agent event (want 1); held; answer matches; 1.2s; proof: none	FOUND_BY_LOOKUP; 1 agent event (want 1); held; answer matches; 1.0s; proof: none	COMMITTED_ON_QUERY; 1 agent event (want 1); held; answer matches; 30.7s; proof: receipt	n/a
`after_commit/request_cancelled`	ALREADY_EXISTS_409; 1 agent event (want 1); held; answer matches; 0.6s; proof: none	FOUND_BY_LOOKUP; 1 agent event (want 1); held; answer matches; 0.3s; proof: none	COMMITTED_ON_QUERY; 1 agent event (want 1); held; answer matches; 31.1s; proof: receipt	n/a
`before_send/none`	BOOKED; 1 agent event (want 1); held; answer matches; 0.5s; proof: none	BOOKED; 1 agent event (want 1); held; answer matches; 0.8s; proof: none	COMMITTED_BY_RETRY; 1 agent event (want 1); held; answer matches; 31.2s; proof: receipt	n/a
`before_send/slot_busy`	BOOKED; 1 agent event (want 0); VIOLATED, double booked; answer matches; 1.0s; proof: none	REFUSED:slot_busy; 0 agent events (want 0); held; answer matches; 1.2s; proof: none	REFUSED:stale_premise_at_recovery; 0 agent events (want 0); held; answer matches; 32.1s; proof: receipt	n/a
`before_send/request_cancelled`	BOOKED; 1 agent event (want 0); VIOLATED; answer matches; 0.5s; proof: none	REFUSED:request_cancelled; 0 agent events (want 0); held; answer matches; 0.4s; proof: none	REFUSED:lease_at_recovery; 0 agent events (want 0); held; answer matches; 31.2s; proof: receipt	n/a
`before_send/pre_busy`	REFUSED:slot_busy; 0 agent events (want 0); held; answer matches; 0.3s; proof: none; no crash (refused before the send)	REFUSED:slot_busy; 0 agent events (want 0); held; answer matches; 0.6s; proof: none; no crash (refused before the send)	REFUSED:stale_premise; 0 agent events (want 0); held; answer matches; 0.8s; proof: receipt; no crash (refused before the send)	COMMITTED_BY_RETRY; 1 agent event (want 0); VIOLATED, double booked; answer matches; 31.5s; proof: receipt

email_tier3

Script: experiments/scenario_email_tier3.py
Tests: An email that cannot be undone, sent through live Resend after a Stripe refund.
Results file says: “interlock_tier3: Nothing about Resend is emulated; the gate is told Resend has no dedup and no lookup (ResendEmail tier=3, queryable=False), the README’s assumption for most email and what a sending-only key leaves after Resend’s 24h key window.”
Results file says: “Everything else is live: Resend sends to delivered@resend.dev, Stripe test-mode payments and refunds, Anthropic model calls, and SIGKILLs of separate worker processes. No mocks.”
Results file says: “Model claude-haiku-4-5-20251001, Resend API, Stripe test mode.”
Full results: results/scenarios/email_tier3.md

system	`crash_after_send`	`refused_before_send`	`refused_after_send`
no_check	`SENT_REPLAYED`; 1 email (want 1); held; answer matches Resend; record proves it: no; 0.2s	`SENT`; 1 email (want 0); VIOLATED (1 email, want 0); answer matches Resend; record proves it: no; 2.0s	`SENT_REPLAYED`; 1 email (want 1); held; answer matches Resend; record proves it: no; 2.5s
hand_check	`ALREADY_SENT`; 1 email (want 1); held; answer matches Resend; record proves it: yes; 0.8s	`SKIPPED:refund_failed`; 0 email (want 0); held; answer matches Resend; record proves it: yes; 4.6s	`ALREADY_SENT`; 1 email (want 1); held; answer matches Resend; record proves it: yes; 2.6s
hand_check_noprobe	`SENT_REPLAYED`; 1 email (want 1); held; answer matches Resend; record proves it: yes; 0.5s	`SKIPPED:refund_failed`; 0 email (want 0); held; answer matches Resend; record proves it: yes; 1.6s	`SKIPPED:refund_failed`; 1 email (want 1); held; answer CONTRADICTS Resend; record proves it: no; 6.1s
interlock	`COMMITTED_BY_RETRY`; 1 email (want 1); held; answer matches Resend; record proves it: yes; 35.9s	`REFUSED:stale_premise_at_recovery`; 0 email (want 0); held; answer matches Resend; record proves it: yes; 36.7s	`COMMITTED_ON_QUERY`; 1 email (want 1); held; answer matches Resend; record proves it: yes; 36.8s
interlock_noprobe	`COMMITTED_BY_RETRY`; 1 email (want 1); held; answer matches Resend; record proves it: yes; 35.8s	`AMBIGUOUS`; 0 email (want 0); held; answer cannot know (said so); record proves it: no; 36.0s	`AMBIGUOUS`; 1 email (want 1); held; answer cannot know (said so); record proves it: no; 35.8s
interlock_tier3	`AMBIGUOUS`; 1 email (want 1); held; answer cannot know (said so); record proves it: no; 35.4s	`AMBIGUOUS`; 0 email (want 0); held; answer cannot know (said so); record proves it: no; 35.9s	`AMBIGUOUS`; 1 email (want 1); held; answer cannot know (said so); record proves it: no; 35.9s

gcp_resource

Script: experiments/scenario_gcp_resource.py
Tests: Rolling back a live GCS config object that a human redeployed during the outage.
Results file says: “The service under test (GCS) is real and nothing about it is emulated.”
Results file says: “A real model (get_config, then rollback_config) reads the live object, including its generation, and decides the rollback.”
Full results: results/scenarios/gcp_resource.md

fault	want	no_check	hand_check	interlock
`crash_before_send_redeploy`	the human’s v43 stays live; the stale rollback never lands	WRITTEN; 1 agent write(s) [‘1789338914659713’]; live generation 1789338914659713 deployed by agent; VIOLATED; answer matches GCS; record cannot say which writes landed; proof no; 2.0s	PRECONDITION_FAILED; 0 agent write(s) []; live generation 1789338918615028 deployed by human-redeploy; held; answer matches GCS; record says 0 agent write(s); proof yes; 1.8s	REFUSED:stale_premise_at_recovery; 0 agent write(s) []; live generation 1789338923362145 deployed by human-redeploy; held; answer matches GCS; record says 0 agent write(s); proof yes; 30.9s
`crash_after_commit_redeploy`	the rollback landed once before the redeploy; the human’s v43 stays live	WRITTEN; 2 agent write(s) [‘1789338955635377’, ‘1789338957530186’]; live generation 1789338957530186 deployed by agent; VIOLATED; answer matches GCS; record cannot say which writes landed; proof no; 1.9s	ALREADY_APPLIED; 1 agent write(s) [‘1789338960381877’]; live generation 1789338961882231 deployed by human-redeploy; held; answer matches GCS; record says 1 agent write(s); proof yes; 2.1s	COMMITTED_ON_QUERY; 1 agent write(s) [‘1789338965667223’]; live generation 1789338967121211 deployed by human-redeploy; held; answer matches GCS; record says 1 agent write(s); proof yes; 30.9s
`crash_after_commit_no_change`	control: the rollback landed once and stays live; nothing writes it twice	WRITTEN; 2 agent write(s) [‘1789338999316263’, ‘1789338999749322’]; live generation 1789338999749322 deployed by agent; VIOLATED; answer matches GCS; record cannot say which writes landed; proof no; 0.4s	ALREADY_APPLIED; 1 agent write(s) [‘1789339002316691’]; live generation 1789339002316691 deployed by agent; held; answer matches GCS; record says 1 agent write(s); proof yes; 0.5s	COMMITTED_ON_QUERY; 1 agent write(s) [‘1789339006019783’]; live generation 1789339006019783 deployed by agent; held; answer matches GCS; record says 1 agent write(s); proof yes; 30.6s

connect_payout

Script: experiments/scenario_connect_payout.py
Tests: A marketplace seller payout through Stripe Connect.
Results file says: “Generated 2026-09-13 22:22 UTC by experiments/scenario_connect_payout.py. Status: BLOCKED.”
Full results: results/scenarios/connect_payout.md

3. Bugs found by testing

Every fix below has a test in tests/ that failed before the fix.

Before the escalation build (15, from docs/proof.md)

The first six were found writing the tests; the other nine by an adversarial review of the package.

Recovery resent an action without re-checking premises or the lease.
A duplicate submission could resend an action whose outcome was still unresolved.
Concurrent workers could dispatch the same action twice.
An agent retrying after a refusal was checked against freshly read facts instead of the ones it decided on.
A SQLite lock could make a concurrent worker lose its request.
The approval inbox crashed reconciling after a crash.
Critical: a recovery running while a send was still being applied could send it a second time.
Recovery re-checked the wrong lease.
A payload could win a race against the recorded decision.
The MCP proxy could leave a call unanswered.
One failing effect could stop recovery of the rest.
Same-named functions shared a journal.
A torn journal line stopped the gate.
The Temporal helper reported an unsettled attempt as done.
verify() accepted a forged lone commit.

Escalation build, adversarial hardening rounds (33)

Each round, reviewers hunted for defects, each was reproduced, and the fixer reported it fixed. Regression tests: tests/test_escalation_fixes.py.

Round 1 (17)

A person’s send could go out on facts they had not seen; dispatch now requires the latest escalation’s facts.
A lease naming a different group could send, so an approver removed from the routed group could still send.
explain described an AMBIGUOUS status with a later conflicting_payload refusal.
A restarted inbox lost the stale_premise reason and its still_fits repair.
A retry with a different amount re-routed the escalation on the retry instead of the request bound in the journal.
Resubmitting a different amount changed what the approval queue showed.
A late, lower-ranked Stripe confirmation could overwrite a later status in receipts and the scoreboard.
The scoreboard counted a superseded repair re-escalation as a second escalation and a second crash case.
A late succeeded after failed was accepted and read as confirmed by the target.
Same root cause as the first: an approved send could dispatch on re-read facts the approver never saw.
Same root cause as the second: a group mismatch between lease and escalation was not refused at dispatch.
After a commit, a webhook could confirm a refund id other than the one the commit recorded.
Repairs computed on old facts were shown again after a restart, allowing a refund past the order total.
An honest in-flight resend confirmed by a webhook failed verify() as never landed.
The approval inbox results read as a double count of escalations (27 against 26); the counts were right and the label was rewritten.
Same root cause as the out-of-order confirmation: a late pending after succeeded was recorded.
verify() raised instead of reporting an altered receipt when an entry lacked kind or hash.

Round 2 (8)

The MCP proxy settled a failed send that belonged to another call, and returned IN_FLIGHT with nothing journaled.
The backend Temporal workflow no longer reported AMBIGUOUS runs as AMBIGUOUS.
After a crash, the inbox decided on re-read facts instead of the facts saved in the PROPOSED entry.
One step raising in refresh or reconcile stopped the inbox from starting and other escalations from being written.
One capture raising in tick stopped SLA moves for every other item.
tick kept a due time when the route no longer had an SLA.
StripeRefunds.explain skipped premise checks a subclass added, so a refund could go out.
The README’s approval inbox numbers disagreed with results/approval_inbox.md.

Round 3 (8)

A retry refused after an AMBIGUOUS entry cleared the item’s ambiguous guard.
A send the target turned down was not settled, so it could be sent again instead of going to a person.
A second inbox’s stale cached approval could override a newer decision and send.
After an outage, tick recorded SLA breaches at the wrong times instead of each missed deadline.
Webhook confirmation checked the refund against the caller’s payment instead of the one the send recorded.
Inbox.cleared counted repair children and disagreed with the scoreboard’s cleared_no_person.
The README’s split of extra reviews into gate refusals and repair decisions was wrong.
The scoreboard counted the instant approval of a repair child as a person’s decision time.

Merge review (6 reproduced, all fixed)

Found reviewing the merge of origin/main into the escalation build. Regression tests: tests/test_merge_defects.py.

A settled REFUSED:target_error could be dispatched again without a person’s escalation; verify() now flags a send after one.
The MCP proxy treated an upstream that exits mid-call as the tool saying no instead of outcome unknown.
Under an approval, the same arguments after a refusal reused the effect id, so the re-decision was not checked on current facts.
_FunctionTarget.explain read premises twice and did not record the structured change.
tools.WHY lost its status keys, so REFUSED:lease no longer said no live approval covers it.
Public names from before the merge were lost (tools.repair by effect id, mcp_proxy helpers, .key on gated tools).

This site is open source. Improve this page.

Interlock

Tests and experiments

Numbers you can quote

1. Unit and integration tests

tests/test_approval_recovery_fixes.py (7)

tests/test_approvals.py (9)

tests/test_azure_deploy.py (10)

tests/test_backend.py (6)

tests/test_confirmations.py (16)

tests/test_contract.py (8)

tests/test_demo.py (16)

tests/test_demo_standalone.py (7)

tests/test_escalation_fixes.py (37)

tests/test_escalation_flow.py (6)

tests/test_escalation_receipts.py (14)

tests/test_explained.py (11)

tests/test_export.py (13)

tests/test_export_authority_fixes.py (2)

tests/test_integration_recovery_fixes.py (5)

tests/test_integrations.py (23)

tests/test_interlock.py (20)

tests/test_langchain.py (2)

tests/test_lockin_review_fixes.py (10)

tests/test_mcp_proxy.py (10)

tests/test_merge_defects.py (9)

tests/test_public.py (27)

tests/test_receipts.py (8)

tests/test_recovery_locking.py (5)

tests/test_repair.py (11)

tests/test_repo_recovery_fixes.py (5)

tests/test_review_fixes.py (12)

tests/test_routing.py (24)

tests/test_runtime.py (21)

tests/test_runtime_gate_parity.py (12)

tests/test_runtime_sql_races.py (9)

tests/test_runtime_stateful.py (1)

tests/test_scenario_billing_credit.py (7)

tests/test_scenario_calendar.py (6)

tests/test_scenario_connect_payout.py (6)

tests/test_scenario_email_tier3.py (14)

tests/test_scenario_gcp_resource.py (13)

tests/test_scenario_github_merge.py (10)

tests/test_scenario_shared_cap.py (8)

tests/test_scenario_stripe_dispute.py (9)

tests/test_scoreboard.py (5)

tests/test_site.py (9)

tests/test_temporal_helper.py (2)