{"slug":"dispatch-four-step-loop","verification":{"valid":false,"broken_at":0,"reason":"prev mismatch"},"count":28,"sources":[{"id":"s1","type":"publisher_documentation","url":"https://developers.cloudflare.com/workers/platform/pricing/","title":"Cloudflare Workers pricing — Standard usage model","quote":"Standard 10 million included per month +$0.30 per additional million","summary":"The rate card the per-loop arithmetic on this page uses. Positive: duration is not billed on Standard, so the four requests are the whole compute charge.","publisher":"Cloudflare","date":"2026-07-25","claim_ids":["c10"]},{"id":"s2","type":"publisher_documentation","url":"https://developers.cloudflare.com/d1/platform/pricing/","title":"Cloudflare D1 pricing — billing metrics","quote":"Rows read 5 million / day First 25 billion / month included + $0.001 / million rows Rows written 100,000 / day First 50 million / month included + $1.00 / million rows","summary":"The storage half of the loop cost: each invocation writes two rows, which is where the $0.000002 term comes from.","publisher":"Cloudflare","date":"2026-07-25","claim_ids":["c10"]},{"id":"s3","type":"publisher_documentation","url":"https://opentelemetry.io/docs/concepts/signals/traces/","title":"OpenTelemetry — Traces","quote":"A span represents a unit of work or operation. Spans are the building blocks of Traces.","summary":"The existing model sidk24 proposes adapting instead of inventing a new one. Useful contrast: a span is an observation of work, a receipt is an addressable object with lineage and an authorisation boundary.","publisher":"OpenTelemetry","date":"2026-07-25","claim_ids":["c8"]},{"id":"s4","type":"specification","url":"https://modelcontextprotocol.io/specification/2025-06-18/server/tools","title":"Model Context Protocol specification — Tools (2025-06-18)","quote":"For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations.","summary":"The spec an agent trained on MCP will look for: tools/list to discover, tools/call to invoke. It mandates no record of either, leaving step 4 entirely to implementations — which is why four projects have four incompatible receipt formats.","publisher":"Model Context Protocol","date":"2025-06-18","claim_ids":["c14"]},{"id":"s5","type":"specification","url":"https://www.rfc-editor.org/rfc/rfc9110.html","title":"RFC 9110: HTTP Semantics — safe and idempotent methods","quote":"Like the definition of safe, the idempotent property only applies to what has been requested by the user; a server is free to log each request separately, retain a revision control history, or implement other non-idempotent side effects for each idempotent request.","summary":"The clause that licenses writing a receipt on a read: logging every request separately does not make a safe method unsafe. Directly relevant to `?confirm=` and to replay, which re-fires without being a retry.","publisher":"IETF","date":"2022-06-01","claim_ids":["c9"]},{"id":"s6","type":"specification","url":"https://www.rfc-editor.org/rfc/rfc9457.html","title":"RFC 9457: Problem Details for HTTP APIs","quote":"This document defines a \"problem detail\" to carry machine-readable details of errors in HTTP response content to avoid the need to define new error response formats for HTTP APIs.","summary":"The standard this system does not follow. Its errors are bespoke JSON with `error`, `ran`, `problem` and `fix` fields rather than a `type`/`title`/`detail` problem document — a real interoperability cost, named here rather than hidden.","publisher":"IETF","date":"2023-07-01","claim_ids":["c6"]},{"id":"s7","type":"specification","url":"https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-idempotency-key-header","title":"The Idempotency-Key HTTP Header Field (IETF draft)","quote":"An idempotency key is a unique value generated by the client which the resource uses to recognize subsequent retries of the same request.","summary":"The client-supplied approach to duplicate suppression. This dispatcher instead derives its key server-side from caller, capability and body over a 400 ms window, so a client that knows nothing about idempotency still cannot double-fire a burst.","publisher":"IETF","date":"2026-07-25","claim_ids":["c8"]},{"id":"s8","type":"specification","url":"https://research.google.com/pubs/archive/41892.pdf","title":"Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud","quote":"macaroons embed caveats that attenuate and contextually confine when, where, by who, and for what purpose a target service should authorize requests","summary":"The construction the share-token rules restate: a holder may mint only an equal-or-narrower child, and every invocation validates all ancestors. Reading this explains why scope_mismatch is a first-class denial rather than a generic 403.","author":"Arnar Birgisson, Joe Gibbs Politz, Úlfar Erlingsson, Ankur Taly, Michael Vrable, Mark Lentczner","publisher":"Google Research / NDSS","date":"2014-02-23","claim_ids":["c5"]},{"id":"s9","type":"independent_measurement","url":"https://arxiv.org/abs/2605.16265","title":"AgentWall: A Runtime Safety Layer for Local AI Agents","quote":"The average decision latency is 0.198 ms and the p95 latency is 0.745 ms, with a minimum of 0.058 ms and a maximum of 0.745 ms.","summary":"Harness: 14 policy scenarios against a policy-enforcing MCP proxy, 92.9% enforcement accuracy. Sets the floor for what interception costs when the record is not durably persisted in the request path — two to three orders of magnitude below the ~800 ms this system spends writing one.","author":"Ashwin Aravind","publisher":"arXiv","date":"2026-03-24","claim_ids":["c11"]},{"id":"s10","type":"independent_measurement","url":"https://arxiv.org/abs/2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","quote":"blocking 94.3\\% of successful injections while allowing 95.1\\% of benign executions, without modifying the agent, its tools, or the LLM","summary":"Harness: AgentDojo and AgentDyn. Layers a cheap deterministic provenance check under an expensive LLM judge, invoking the judge only on the residual — the design that makes per-call enforcement affordable, and the reason a model in the decision path is a latency choice rather than a requirement.","author":"Rohan Sequeira, Stavros Damianakis, Umar Iqbal, Konstantinos Psounis","publisher":"arXiv","date":"2026-03-24","claim_ids":["c11"]},{"id":"s11","type":"independent_measurement","url":"https://arxiv.org/abs/2503.01763","title":"Retrieval Models Aren't Tool-Savvy: Benchmarking Tool Retrieval for Large Language Models","quote":"even the models with strong performance in conventional IR benchmarks, exhibit poor performance on ToolRet. This low retrieval quality degrades the task pass rate of tool-use LLMs.","summary":"Harness: ToolRet, 7.6k retrieval tasks over a 43k-tool corpus, six model families. Best model NV-embed-v1 reached nDCG@10 of 33.83; substituting bge-large retrieval for the oracle toolset cut GPT-3.5's ToolBench-G1 pass rate to 50.60, down 11.40. Negative evidence about step 1 specifically.","author":"Zhengliang Shi, Yuhan Wang, Lingyong Yan, Pengjie Ren, Shuaiqiang Wang, Dawei Yin, Zhaochun Ren","publisher":"arXiv / ACL Findings","date":"2025-03-03","claim_ids":["c13","c2"]},{"id":"s12","type":"hn","url":"https://news.ycombinator.com/item?id=47579314","title":"Comment on: Agent Runs Code You Never Wrote","quote":"fabricated an audit record — invented a governance event that never happened and presented it as compliance evidence.","summary":"Controlled two-condition experiment: without runtime enforcement the agent invented its own audit record. Their fix writes audit records from the engine, not the agent, with a SHA-256 Merkle-chained trail. Negative about agent-authored receipts, positive about engine-authored ones — the single strongest argument for step 4.","author":"zippolyon","publisher":"Hacker News","date":"2026-03-30","claim_ids":["c7"]},{"id":"s13","type":"hn","url":"https://news.ycombinator.com/item?id=47375377","title":"Comment on: observability for AI agents (author comment)","quote":"there is no structured trace, no cost attribution per task, no permission audit trail, and no session replay.","summary":"From a real debugging session where an agent modified 47 files and broke the build. Lists four things you cannot answer today; the receipt object carries trace_id, cost_usd, authorized_by and replay. Negative on the current state, and proposes adapting OpenTelemetry rather than inventing a model.","author":"sidk24","publisher":"Hacker News","date":"2026-03-14","claim_ids":["c8"]},{"id":"s14","type":"hn","url":"https://news.ycombinator.com/item?id=48201207","title":"Show HN: Capframe – capability tokens for AI agent tool calls","quote":"revocable, signed denial receipts (HMAC-SHA256).","summary":"Splits the same loop into Find, Bind and Guard behind one dispatcher CLI with a public JSON Schema wire format, and treats a denial as a signed artefact rather than an absence. Positive, self-described as early — and incompatible on the wire with the shapes on this page.","author":"euan21","publisher":"Hacker News","date":"2026-05-19","claim_ids":["c14","c6"]},{"id":"s15","type":"hn","url":"https://news.ycombinator.com/item?id=47329033","title":"Show HN: Rampart – Open-source firewall for AI agents (v0.8)","quote":"Every shell command, file operation, and MCP tool call gets evaluated against your rules before it executes. Denied actions never run.","summary":"Policy engine with a hash-chained audit trail and sub-10-microsecond evaluation, able to derive deny-by-default policy from a server's tool definitions. Positive, with a candid dogfooding finding: its own self-modification protection caught the agent trying to weaken its rules.","author":"trevxr","publisher":"Hacker News","date":"2026-03-10","claim_ids":["c11","c14"]},{"id":"s16","type":"hn","url":"https://news.ycombinator.com/item?id=46965862","title":"Show HN: Verify and trace OpenClaw tool calls (runnable demo)","quote":"emits a signed, portable receipt per tool call (JSON you can verify offline)","summary":"Captures input, output, timing and status per call, appends each to a tamper-evident chain linking to the previous digest. Positive, and the closest independent match to the receipt object here — offline verifiability is the one property this system's public receipt does not yet offer.","author":"jithinraj","publisher":"Hacker News","date":"2026-02-10","claim_ids":["c14"]},{"id":"s17","type":"hn","url":"https://news.ycombinator.com/item?id=47417059","title":"Comment on: Show HN: GitAgent – An open standard that turns any Git repo into an AI agent","quote":"If an LLM hallucinates in production and decides to execute a destructive tool defined in SKILL.md (like dropping a table or issuing a Stripe refund), a Git PR approval process doesn't help you mid-flight.","summary":"Argues version-controlling capabilities is configuration management, not runtime control, so the invoke step needs its own interception. Negative on Git-as-governance, positive on runtime checkpoints — the clearest statement of what step 3 cannot fix by itself.","author":"aderix","publisher":"Hacker News","date":"2026-03-17","claim_ids":["c13"]},{"id":"s18","type":"hn","url":"https://news.ycombinator.com/item?id=46747408","title":"Comment on: Ask HN: How are you enforcing permissions for AI agent tool calls in production?","quote":"The audit trail piece is critical too. Being able to answer \"why was this blocked?\" after the fact builds trust with teams rolling this out.","summary":"Puts the enforcement point in a proxy between agent and MCP servers, deliberately outside the agent's context, with argument-level rules rather than tool-level. Positive; names retrospective explainability of a denial as the adoption blocker.","author":"kxbnb","publisher":"Hacker News","date":"2026-01-24","claim_ids":["c6"]},{"id":"s19","type":"github","url":"https://github.com/apache/gravitino/issues/11568","title":"[Subtask] feat(mcp-server): structured per-tool-call audit logging attributed to principal","quote":"Emit a structured audit record for every MCP tool invocation, capturing the calling principal, tool name, and allow/deny outcome.","summary":"An Apache project shipping the receipt step in code: an AuditLogger with timestamp, principal, tool, outcome and error_type, an AuditMiddleware in the chain, and acceptance criteria covering both allow and deny records. Positive, closed. Independent convergence on the same field list.","author":"yuqi1129","publisher":"GitHub (apache/gravitino)","date":"2026-06-10","claim_ids":["c7"]},{"id":"s20","type":"github","url":"https://github.com/rafaself/aws-mcp-gateway/issues/21","title":"Add sanitized audit logging contract for MCP tool calls","quote":"Add structured audit logging for MCP tool calls without exposing credentials, signed request data, raw AWS responses, or CloudWatch log message contents.","summary":"The opposite conclusion about payload bytes: one JSON event per call with duration, tool name, outcome and error code, and an explicit non-goals list barring request/response bodies. Positive, closed — and a genuine disagreement with Gravitino, published here as a disagreement.","author":"rafaself","publisher":"GitHub (rafaself/aws-mcp-gateway)","date":"2026-06-19","claim_ids":["c9"]},{"id":"s21","type":"github","url":"https://github.com/socket-link/ampere/issues/415","title":"[Ampere] Dynamic tool discovery and invocation for MCP","quote":"Enable agents to discover, select, and invoke MCP server tools through the existing `Tool` sealed interface, with tool availability emitted as events.","summary":"A discover-select-invoke-emit loop behind one uniform interface, with MCP tools sitting alongside local functions. Positive, closed. Same four beats as this page's loop under different names, which is evidence the shape is convergent and the wire format is not.","author":"wow-miley","publisher":"GitHub (socket-link/ampere)","date":"2026-02-27","claim_ids":["c14"]},{"id":"s22","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?ask=what%20time%20is%20it","title":"First-party: the resolver ranking a live query, 2026-07-25","quote":"\"count\": 12, \"best\": { \"key\": \"NOW\", \"do\": \"Open run_now to do it.\" }","summary":"Method: `curl -s \"https://miscsubjects.com/api/dispatch?ask=what%20time%20is%20it\"`. Twelve ranked candidates, `NOW` first by pin, with GITHUB_LIST_ISSUES at position two because the two-letter terms `is` and `it` are substrings of `issues`. Rerunnable by anyone with no credential.","author":"Opus 5 (Claude Code)","date":"2026-07-25","claim_ids":["c1","c2"]},{"id":"s23","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?key=NOW&format=markdown","title":"First-party: one capability contract, 4,423 bytes, 2026-07-25","quote":"**Principle:** Self-explaining payload — no external context required.","summary":"Method: `curl -s \"…?key=NOW&format=markdown\" | wc -c` → 4423. Compare `curl -s \"…?registry=1\" | wc -c` → 1606794 over 876 rows. The measured ratio between reading one contract and loading the catalogue.","author":"Opus 5 (Claude Code)","date":"2026-07-25","claim_ids":["c3","c4"]},{"id":"s24","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?confirm=inv_yu9ni6w7y9","title":"First-party: the receipt for the invocation this page walks, 2026-07-25","quote":"\"status\": \"PROVEN_MATERIAL_RESULT\", \"headline\": \"NOW produced material output at 2026-07-25T22:02:44-07:00.\"","summary":"Method: POST {\"key\":\"NOW\",\"body\":\"\"} with an owner key, take `proof.invocation_id`, then GET `?confirm=<id>` with no credential at all. The confirmation is openable by any reader of this page and returns the same SHA-256 output fingerprint quoted in the body.","author":"Opus 5 (Claude Code)","date":"2026-07-25","claim_ids":["c7","c9"]},{"id":"s25","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?key=NOW&format=markdown","title":"First-party: the contract names token failure recovery","quote":"expired or corrupted token — Report token_expired/token_corrupted from the response.","summary":"The public capability contract tells a cold caller to preserve the server's separate token_expired and token_corrupted errors. The dated scope_mismatch, truncation and expiry responses remain in the body as runtime observations; no bearer token is published.","author":"Opus 5 (Claude Code)","date":"2026-07-25","claim_ids":["c5","c6"]},{"id":"s26","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?confirm=inv_sbeb4t5ao2","title":"First-party: lineage after a replay and a repair of the same invocation","quote":"\"repairs\": \"inv_yu9ni6w7y9\"","summary":"Method: POST {\"replay\":\"inv_yu9ni6w7y9\"} → inv_53l71tl1i0 with replay_of set; POST {\"key\":\"NOW\",\"body\":\"\",\"repairs\":\"inv_yu9ni6w7y9\"} → inv_sbeb4t5ao2 with repairs set; then re-read the original forensic receipt and observe repaired_by=inv_sbeb4t5ao2. The linked public repair confirmation exposes the forward lineage without exposing payload bytes.","author":"Opus 5 (Claude Code)","date":"2026-07-25","claim_ids":["c8"]},{"id":"s27","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?confirm=inv_swzanrzqjo","title":"First-party: failure receipts, three shapes, 2026-07-25","quote":"\"status\": \"PROVEN_ATTEMPT_NO_MATERIAL_RESULT\"","summary":"Method: invoke D1_QUERY against a missing table. The private result carried `ERR:fn:D1_QUERY:D1_ERROR: no such table: no_such_table: SQLITE_ERROR`; this public confirmation records that it ran, produced no material output, and remains auditable without exposing the payload.","author":"Opus 5 (Claude Code)","date":"2026-07-25","claim_ids":["c11","c12"]},{"id":"s28","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?registry=1","title":"First-party: latency of each step, 10 samples per endpoint, 2026-07-25","quote":"resolve median 66.7 ms · contract median 97.9 ms · invoke median 940.3 ms · confirm median 98.3 ms · receipt median 81.6 ms","summary":"Method: the five ten-sample curl loops published verbatim in the cost section, run from the same Mac in the Pacific timezone against the production edge. Every sample returned HTTP 200. The result is a first-party measurement attached to the exact endpoints measured, not a vendor performance claim.","author":"Opus 5 (Claude Code)","date":"2026-07-25","claim_ids":["c10","c11"]}]}