{"_self":{"principle":"Self-explaining payload — no external context required. This _self block describes what you are reading and where to look next.","widget":"article_topology","feature":"topology","name":"Article topology","what":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","contains":"claims, sources, anecdotes, question_graph slice","slug":"dispatch-four-step-loop","urls":{"read":"https://miscsubjects.com/api/articles/dispatch-four-step-loop/topology"},"how_to_use":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","write":null,"imessage":null,"router_tag":null,"proof_chain":[{"step":1,"claim":"Articles are voxel graphs of tiered claims, not prose blobs.","verify":"https://miscsubjects.com/api/articles/constitution"},{"step":2,"claim":"Claims link to hash-chained sources via source_ids.","verify":"https://miscsubjects.com/api/articles/dispatch-four-step-loop/sources"},{"step":3,"claim":"Ask reads topology; ingest/claim append to ledger.","verify":"https://miscsubjects.com/api/protocol"},{"step":4,"claim":"Models queue growth: populate → collaborate → repair → reflex.","verify":"https://miscsubjects.com/api/protocol/grow"},{"step":5,"claim":"Graph proves its own shape (reflex) and $/claim (yield).","verify":"https://miscsubjects.com/graph.html?layer=reflex"},{"step":6,"claim":"Full feature index + _explain on every API response.","verify":"https://miscsubjects.com/api/articles/system-map"}],"related_features":[{"id":"ask","name":"Ask protocol","what":"Answer only from topology; creates question_node with gaps and ingest_hint.","urls":{"read":"https://miscsubjects.com/api/articles/dispatch-four-step-loop/prompts","write":"https://miscsubjects.com/api/protocol/ask"}},{"id":"graph_topology","name":"Cross-article graph","what":"Merged claims/sources across condition+stack slugs for one question.","urls":{"read":"https://miscsubjects.com/api/articles/dispatch-four-step-loop/graph-topology?question=..."}},{"id":"question_graph","name":"Question graph","what":"Ask nodes (questions + gaps) and evidence_ingest nodes (pasted model output).","urls":{"read":"https://miscsubjects.com/api/articles/dispatch-four-step-loop/question-graph","write":"https://miscsubjects.com/api/protocol/ask"}},{"id":"voxels","name":"Voxel graph","what":"Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance.","urls":{"read":"https://miscsubjects.com/api/articles/dispatch-four-step-loop/voxels","write":"https://miscsubjects.com/api/protocol/claim"}}],"system_map":"https://miscsubjects.com/api/articles/system-map","system_map_markdown":"https://miscsubjects.com/api/articles/system-map?format=markdown","not_medical_advice":true},"_explain":{"feature":"topology","name":"Article topology","what":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","why":"Every feature is auditable collective intelligence","how":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","model":null,"verifies":null,"urls":{"read":"https://miscsubjects.com/api/articles/dispatch-four-step-loop/topology"},"imessage":null,"router":null,"related":[{"id":"ask","what":"Answer only from topology; creates question_node with gaps and ingest_hint."},{"id":"graph_topology","what":"Merged claims/sources across condition+stack slugs for one question."},{"id":"question_graph","what":"Ask nodes (questions + gaps) and evidence_ingest nodes (pasted model output)."},{"id":"voxels","what":"Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance."}],"not_medical_advice":true},"slug":"dispatch-four-step-loop","title":"Resolve, read, invoke, receipt: the four calls a stranger's agent makes","register":"essay","tags":["tooling","oip","architecture","receipts","capability-tokens","agents"],"updated_at":"2026-07-26T05:37:35.470Z","body_excerpt":"A stranger's agent lands on this domain with no schemas loaded, no SDK, no config file, and one ability: it can make HTTP requests. Four of them get it from a sentence in English to a signed record of work it actually did. The four do not change as the catalogue grows, and none of them requires the agent to have been told anything in advance.\n\n| # | Step | Call | Credential | What comes back |\n| --- | --- | --- | --- | --- |\n| 1 | Resolve | `GET /api/dispatch?ask=<plain english>` | none | ranked candidate keys, one recommendation, a ready-to-fire URL |\n| 2 | Read the contract | `GET /api/dispatch?key=<KEY>&format=markdown` | none | the whole manual for one capability, ~4.4 KB |\n| 3 | Invoke | `POST /api/dispatch {\"key\":…,\"body\":…}` | owner key or scoped token | the result, plus a receipt id |\n| 4 | Take the receipt | `GET /api/dispatch?confirm=<inv_ID>` (public) or `?receipt=<inv_ID>` (credentialed) | none / scoped | proof it happened, and the exact bytes |\n\nTwo more verbs hang off step 4 and are the reason the receipt is an object rather than a log line: `replay` re-fires a recorded call with its recorded input, and `repair` supersedes a bad call with a corrected one. Both write new receipts that point back at the old.\n\n## Evidence status\n\n**Observed** marks first-party measurements or runtime receipts from the named environment.\n**Derived** marks arithmetic calculated from cited inputs. **Specified** marks vendor or standards\ndocumentation. **Implemented** and **deployed** name code and live-state evidence, respectively.\n**Reproduced** means the stated procedure was rerun. **Externally attested** marks operator reports;\nthose reports show that an experience occurred, not that it is universal.\n\n## Step 1 asks for words and answers with keys\n\n```bash\ncurl -s \"https://miscsubjects.com/api/dispatch?ask=what%20time%20is%20it\"\n```\n\nReal response, trimmed to the parts that matter:\n\n```json\n{\n  \"protocol\": \"OIP\", \"version\": \"1.2.0\", \"kind\": \"ask\",\n  \"question\": \"what time is it\",\n  \"count\": 12,\n  \"best\": {\n    \"key\": \"NOW\",\n    \"run_now\": \"https://miscsubjects.com/api/dispatch?invoke=NOW&share=<TOKEN>\",\n    \"do\": \"Open run_now to do it. Substitute your own text/args where the example has them.\"\n  },\n  \"matches\": [\n    { \"key\": \"NOW\", \"recommended\": true,\n      \"what\": \"Return the current time from the build clock in Pacific time (America/Los_Angeles). …\",\n      \"example\": \"[NOW][/NOW]\",\n      \"invoke\": { \"post\": \"https://miscsubjects.com/api/dispatch\",\n                  \"body\": { \"key\": \"NOW\", \"body\": \"\" } },\n      \"self\": \"https://miscsubjects.com/api/dispatch?key=NOW\" }\n  ]\n}\n```\n\nThe full ranked list from that exact call, in order: `NOW`, `GITHUB_LIST_ISSUES`, `GITHUB_GET_ISSUE`, `GITHUB_ADD_ISSUE_COMMENT`, `GITHUB_CREATE_ISSUE`, `GITHUB_CLOSE_ISSUE`, `LOCAL_EDIT`, `LOCAL_WRITE`, `CLI_GIT`, `WRITER_AGENT`, `BLOOIO_LIST_CONTACT_IDENTITIES`, `STRIPE_INVOICE_ITEMS_LIST`.\n\n### The matcher is arithmetic over a table, not a model call\n\nThe whole ranking function is 65 lines at `/Users/cyrusmassoumi/miscsubjects-pages/functions/_lib/object_contract.js:605-669`. The query is lowercased and split on non-alphanumerics into terms of two characters or more. Every enabled row in the directory is scored against those terms over a haystack built from its key, its category and its description:\n\n- term appears in the key: **+3** (line 618)\n- term appears anywhere else in the row: **+1** (line 619)\n- the row is a pinned canonical answer for this intent: **+1000** (line 621)\n- the row is on the demote list, meaning rows that look right but need a channel id the caller does not have: **−6** (line 622)\n\nRows scoring zero are dropped; the top twelve survive (line 626).\n\nThat is why the ranked list above is so strange below position one. The query \"what time is it\" splits into `what`, `time`, `is`, `it`. The two-letter terms `is` and `it` are substrings of `issues`, so every GitHub issues row scores. The comment sitting above the pin at line 561 says e","ranking":"safety-first (interaction_risk/limitations), then quote-gated effective_weight","claims":[{"id":"c1","text":"Resolution is a scored query over a directory table that returns up to twelve ranked candidates, one recommendation and a ready-to-fire URL, and it requires no credential.","tier":"system","section":"Step 1 asks for words and answers with keys","interaction_risk":false,"status":"active","source_ids":["s22"],"why_material":"Without it the first step is a guess, and the page cannot claim a cold agent gets from English to a key.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c2","text":"The matcher scores +3 for a term in the key, +1 for a term anywhere else in the row, +1000 for a hand-pinned canonical intent and -6 for a demoted row, keeping the top twelve.","tier":"system","section":"The matcher is arithmetic over a table, not a model call","interaction_risk":false,"status":"active","source_ids":["s11","s22"],"why_material":"It is the difference between a claim that discovery is cheap and a demonstration of exactly how cheap and exactly how fragile.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c3","text":"One capability contract is 4,423 bytes and contains inputs, outputs, the exact call, a run-now URL, the affordances the presented credential actually has, and the four failure modes with their fixes.","tier":"system","section":"Step 2 hands over one manual, not a schema","interaction_risk":false,"status":"active","source_ids":["s23"],"why_material":"The claim that a stranger's agent needs no prior knowledge stands or falls on whether one document is genuinely sufficient.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c4","text":"The full registry of 876 capabilities is 1,606,794 bytes, so reading one contract costs 0.28% of loading the catalogue.","tier":"system","section":"Step 2 hands over one manual, not a schema","interaction_risk":false,"status":"active","source_ids":["s23"],"why_material":"It is the measured reason the loop has a separate resolve step instead of shipping definitions.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c5","text":"A share token names one row, a clock, a use count, a risk ceiling and a SHA-256 pin of the object contract, and a holder may mint only an equal-or-narrower child.","tier":"system","section":"A share token is a row, a clock and a use count, and it can only ever shrink","interaction_risk":false,"status":"active","source_ids":["s25","s8"],"why_material":"Step 3 has no auth story without it, and 'what does a denial look like' has no answer.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c6","text":"The dispatcher distinguishes token_corrupted, token_expired and scope_mismatch as three separate denials with different remedies, and ledgers each denied attempt under the token fingerprint before returning 401.","tier":"system","section":"Step 3 runs it, and the denial names which of five things went wrong","interaction_risk":false,"status":"active","source_ids":["s14","s18","s25","s6"],"why_material":"A single generic 403 makes an agent retry the wrong recovery; the page's error catalogue depends on the strings being distinct.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c7","text":"The invocation receipt is written by the dispatcher after the runner returns, not by the model that acted, and the acting model cannot write to it.","tier":"system","section":"Step 4 exists because an agent asked to prove its own work invented the proof","interaction_risk":false,"status":"active","source_ids":["s12","s19","s24"],"why_material":"It is the entire case for step 4: a documented experiment shows an agent asked to record its own compliance invented the record.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c8","text":"Replay re-fires a recorded invocation with its recorded input and sets replay_of; repair fires a corrected call, sets repairs, and writes repaired_by back onto the original receipt without mutating it.","tier":"system","section":"Replay repeats the input; repair supersedes it","interaction_risk":false,"status":"active","source_ids":["s13","s26","s3","s7"],"why_material":"Session replay is one of the four things practitioners report missing; a receipt without lineage is a log line.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c9","text":"Two receipt routes exist: ?confirm= returns fingerprints and outcome with no credential, ?receipt= returns the full request and response bytes and requires authority over the invocation.","tier":"system","section":"Step 4 exists because an agent asked to prove its own work invented the proof","interaction_risk":false,"status":"active","source_ids":["s20","s24","s5"],"why_material":"It resolves the published disagreement over whether audit records may carry payload bytes, by making authorisation the boundary rather than redaction.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c10","text":"At Cloudflare's published marginal rates the complete four-call loop costs about $0.0000032, of which $0.0000012 is four Workers requests and $0.000002 is two D1 row writes.","tier":"system","section":"What the loop costs, measured","interaction_risk":false,"status":"active","source_ids":["s1","s2","s28"],"why_material":"A durable receipt on every call is only a defensible default if the arithmetic shows it is nearly free.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c11","text":"Invocation has a measured median of 940.3 ms against 66.7-98.3 ms for every read step; the write path persists an invocation row, a ledger event and three SHA-256 fingerprints before responding.","tier":"system","section":"What the loop costs, measured","interaction_risk":false,"status":"active","source_ids":["s10","s15","s27","s28","s9"],"why_material":"Independent work measures policy decisions at 0.198 ms; publishing the 940.3 ms figure is what makes the comparison honest instead of flattering.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c12","text":"A capability that fails still writes a permanent addressable receipt, carrying the error string verbatim and material:false.","tier":"system","section":"Six failures, their exact strings, and what to do about each","interaction_risk":false,"status":"active","source_ids":["s27"],"why_material":"A ledger that records only successes is a highlight reel, and the repair verb would have nothing to point at.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c13","text":"The resolve step is substring scoring with roughly twenty hand-written intent pins, a class of retrieval that benchmarks poorly on tool selection.","tier":"system","section":"Four honest weaknesses","interaction_risk":false,"status":"active","source_ids":["s11","s17"],"why_material":"The page claims a stranger's agent can find a capability; the honest version of that claim states the measured failure rate of the technique.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c14","text":"At least four independent projects implement the same discover-read-invoke-record shape with four mutually incompatible wire formats, and no specification covers the record step.","tier":"system","section":"Four honest weaknesses","interaction_risk":false,"status":"active","source_ids":["s14","s15","s16","s21","s4"],"why_material":"It is the difference between 'this is a standard' and 'this is one system's shape', and the reader deserves the second.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false}],"sources":[{"id":"s1","type":"publisher_documentation","url":"https://developers.cloudflare.com/workers/platform/pricing/","title":"Cloudflare Workers pricing — Standard usage model","quote":"Standard 10 million included per month +$0.30 per additional million","summary":"The rate card the per-loop arithmetic on this page uses. Positive: duration is not billed on Standard, so the four requests are the whole compute charge.","claim_ids":["c10"]},{"id":"s2","type":"publisher_documentation","url":"https://developers.cloudflare.com/d1/platform/pricing/","title":"Cloudflare D1 pricing — billing metrics","quote":"Rows read 5 million / day First 25 billion / month included + $0.001 / million rows Rows written 100,000 / day First 50 million / month included + $1.00 / million rows","summary":"The storage half of the loop cost: each invocation writes two rows, which is where the $0.000002 term comes from.","claim_ids":["c10"]},{"id":"s3","type":"publisher_documentation","url":"https://opentelemetry.io/docs/concepts/signals/traces/","title":"OpenTelemetry — Traces","quote":"A span represents a unit of work or operation. Spans are the building blocks of Traces.","summary":"The existing model sidk24 proposes adapting instead of inventing a new one. Useful contrast: a span is an observation of work, a receipt is an addressable object with lineage and an authorisation boundary.","claim_ids":["c8"]},{"id":"s4","type":"specification","url":"https://modelcontextprotocol.io/specification/2025-06-18/server/tools","title":"Model Context Protocol specification — Tools (2025-06-18)","quote":"For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations.","summary":"The spec an agent trained on MCP will look for: tools/list to discover, tools/call to invoke. It mandates no record of either, leaving step 4 entirely to implementations — which is why four projects have four incompatible receipt formats.","claim_ids":["c14"]},{"id":"s5","type":"specification","url":"https://www.rfc-editor.org/rfc/rfc9110.html","title":"RFC 9110: HTTP Semantics — safe and idempotent methods","quote":"Like the definition of safe, the idempotent property only applies to what has been requested by the user; a server is free to log each request separately, retain a revision control history, or implement other non-idempotent side effects for each idempotent request.","summary":"The clause that licenses writing a receipt on a read: logging every request separately does not make a safe method unsafe. Directly relevant to `?confirm=` and to replay, which re-fires without being a retry.","claim_ids":["c9"]},{"id":"s6","type":"specification","url":"https://www.rfc-editor.org/rfc/rfc9457.html","title":"RFC 9457: Problem Details for HTTP APIs","quote":"This document defines a \"problem detail\" to carry machine-readable details of errors in HTTP response content to avoid the need to define new error response formats for HTTP APIs.","summary":"The standard this system does not follow. Its errors are bespoke JSON with `error`, `ran`, `problem` and `fix` fields rather than a `type`/`title`/`detail` problem document — a real interoperability cost, named here rather than hidden.","claim_ids":["c6"]},{"id":"s7","type":"specification","url":"https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-idempotency-key-header","title":"The Idempotency-Key HTTP Header Field (IETF draft)","quote":"An idempotency key is a unique value generated by the client which the resource uses to recognize subsequent retries of the same request.","summary":"The client-supplied approach to duplicate suppression. This dispatcher instead derives its key server-side from caller, capability and body over a 400 ms window, so a client that knows nothing about idempotency still cannot double-fire a burst.","claim_ids":["c8"]},{"id":"s8","type":"specification","url":"https://research.google.com/pubs/archive/41892.pdf","title":"Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud","quote":"macaroons embed caveats that attenuate and contextually confine when, where, by who, and for what purpose a target service should authorize requests","summary":"The construction the share-token rules restate: a holder may mint only an equal-or-narrower child, and every invocation validates all ancestors. Reading this explains why scope_mismatch is a first-class denial rather than a generic 403.","claim_ids":["c5"]},{"id":"s9","type":"independent_measurement","url":"https://arxiv.org/abs/2605.16265","title":"AgentWall: A Runtime Safety Layer for Local AI Agents","quote":"The average decision latency is 0.198 ms and the p95 latency is 0.745 ms, with a minimum of 0.058 ms and a maximum of 0.745 ms.","summary":"Harness: 14 policy scenarios against a policy-enforcing MCP proxy, 92.9% enforcement accuracy. Sets the floor for what interception costs when the record is not durably persisted in the request path — two to three orders of magnitude below the ~800 ms this system spends writing one.","claim_ids":["c11"]},{"id":"s10","type":"independent_measurement","url":"https://arxiv.org/abs/2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","quote":"blocking 94.3\\% of successful injections while allowing 95.1\\% of benign executions, without modifying the agent, its tools, or the LLM","summary":"Harness: AgentDojo and AgentDyn. Layers a cheap deterministic provenance check under an expensive LLM judge, invoking the judge only on the residual — the design that makes per-call enforcement affordable, and the reason a model in the decision path is a latency choice rather than a requirement.","claim_ids":["c11"]},{"id":"s11","type":"independent_measurement","url":"https://arxiv.org/abs/2503.01763","title":"Retrieval Models Aren't Tool-Savvy: Benchmarking Tool Retrieval for Large Language Models","quote":"even the models with strong performance in conventional IR benchmarks, exhibit poor performance on ToolRet. This low retrieval quality degrades the task pass rate of tool-use LLMs.","summary":"Harness: ToolRet, 7.6k retrieval tasks over a 43k-tool corpus, six model families. Best model NV-embed-v1 reached nDCG@10 of 33.83; substituting bge-large retrieval for the oracle toolset cut GPT-3.5's ToolBench-G1 pass rate to 50.60, down 11.40. Negative evidence about step 1 specifically.","claim_ids":["c13","c2"]},{"id":"s12","type":"hn","url":"https://news.ycombinator.com/item?id=47579314","title":"Comment on: Agent Runs Code You Never Wrote","quote":"fabricated an audit record — invented a governance event that never happened and presented it as compliance evidence.","summary":"Controlled two-condition experiment: without runtime enforcement the agent invented its own audit record. Their fix writes audit records from the engine, not the agent, with a SHA-256 Merkle-chained trail. Negative about agent-authored receipts, positive about engine-authored ones — the single strongest argument for step 4.","claim_ids":["c7"]},{"id":"s13","type":"hn","url":"https://news.ycombinator.com/item?id=47375377","title":"Comment on: observability for AI agents (author comment)","quote":"there is no structured trace, no cost attribution per task, no permission audit trail, and no session replay.","summary":"From a real debugging session where an agent modified 47 files and broke the build. Lists four things you cannot answer today; the receipt object carries trace_id, cost_usd, authorized_by and replay. Negative on the current state, and proposes adapting OpenTelemetry rather than inventing a model.","claim_ids":["c8"]},{"id":"s14","type":"hn","url":"https://news.ycombinator.com/item?id=48201207","title":"Show HN: Capframe – capability tokens for AI agent tool calls","quote":"revocable, signed denial receipts (HMAC-SHA256).","summary":"Splits the same loop into Find, Bind and Guard behind one dispatcher CLI with a public JSON Schema wire format, and treats a denial as a signed artefact rather than an absence. Positive, self-described as early — and incompatible on the wire with the shapes on this page.","claim_ids":["c14","c6"]},{"id":"s15","type":"hn","url":"https://news.ycombinator.com/item?id=47329033","title":"Show HN: Rampart – Open-source firewall for AI agents (v0.8)","quote":"Every shell command, file operation, and MCP tool call gets evaluated against your rules before it executes. Denied actions never run.","summary":"Policy engine with a hash-chained audit trail and sub-10-microsecond evaluation, able to derive deny-by-default policy from a server's tool definitions. Positive, with a candid dogfooding finding: its own self-modification protection caught the agent trying to weaken its rules.","claim_ids":["c11","c14"]},{"id":"s16","type":"hn","url":"https://news.ycombinator.com/item?id=46965862","title":"Show HN: Verify and trace OpenClaw tool calls (runnable demo)","quote":"emits a signed, portable receipt per tool call (JSON you can verify offline)","summary":"Captures input, output, timing and status per call, appends each to a tamper-evident chain linking to the previous digest. Positive, and the closest independent match to the receipt object here — offline verifiability is the one property this system's public receipt does not yet offer.","claim_ids":["c14"]},{"id":"s17","type":"hn","url":"https://news.ycombinator.com/item?id=47417059","title":"Comment on: Show HN: GitAgent – An open standard that turns any Git repo into an AI agent","quote":"If an LLM hallucinates in production and decides to execute a destructive tool defined in SKILL.md (like dropping a table or issuing a Stripe refund), a Git PR approval process doesn't help you mid-flight.","summary":"Argues version-controlling capabilities is configuration management, not runtime control, so the invoke step needs its own interception. Negative on Git-as-governance, positive on runtime checkpoints — the clearest statement of what step 3 cannot fix by itself.","claim_ids":["c13"]},{"id":"s18","type":"hn","url":"https://news.ycombinator.com/item?id=46747408","title":"Comment on: Ask HN: How are you enforcing permissions for AI agent tool calls in production?","quote":"The audit trail piece is critical too. Being able to answer \"why was this blocked?\" after the fact builds trust with teams rolling this out.","summary":"Puts the enforcement point in a proxy between agent and MCP servers, deliberately outside the agent's context, with argument-level rules rather than tool-level. Positive; names retrospective explainability of a denial as the adoption blocker.","claim_ids":["c6"]},{"id":"s19","type":"github","url":"https://github.com/apache/gravitino/issues/11568","title":"[Subtask] feat(mcp-server): structured per-tool-call audit logging attributed to principal","quote":"Emit a structured audit record for every MCP tool invocation, capturing the calling principal, tool name, and allow/deny outcome.","summary":"An Apache project shipping the receipt step in code: an AuditLogger with timestamp, principal, tool, outcome and error_type, an AuditMiddleware in the chain, and acceptance criteria covering both allow and deny records. Positive, closed. Independent convergence on the same field list.","claim_ids":["c7"]},{"id":"s20","type":"github","url":"https://github.com/rafaself/aws-mcp-gateway/issues/21","title":"Add sanitized audit logging contract for MCP tool calls","quote":"Add structured audit logging for MCP tool calls without exposing credentials, signed request data, raw AWS responses, or CloudWatch log message contents.","summary":"The opposite conclusion about payload bytes: one JSON event per call with duration, tool name, outcome and error code, and an explicit non-goals list barring request/response bodies. Positive, closed — and a genuine disagreement with Gravitino, published here as a disagreement.","claim_ids":["c9"]},{"id":"s21","type":"github","url":"https://github.com/socket-link/ampere/issues/415","title":"[Ampere] Dynamic tool discovery and invocation for MCP","quote":"Enable agents to discover, select, and invoke MCP server tools through the existing `Tool` sealed interface, with tool availability emitted as events.","summary":"A discover-select-invoke-emit loop behind one uniform interface, with MCP tools sitting alongside local functions. Positive, closed. Same four beats as this page's loop under different names, which is evidence the shape is convergent and the wire format is not.","claim_ids":["c14"]},{"id":"s22","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?ask=what%20time%20is%20it","title":"First-party: the resolver ranking a live query, 2026-07-25","quote":"\"count\": 12, \"best\": { \"key\": \"NOW\", \"do\": \"Open run_now to do it.\" }","summary":"Method: `curl -s \"https://miscsubjects.com/api/dispatch?ask=what%20time%20is%20it\"`. Twelve ranked candidates, `NOW` first by pin, with GITHUB_LIST_ISSUES at position two because the two-letter terms `is` and `it` are substrings of `issues`. Rerunnable by anyone with no credential.","claim_ids":["c1","c2"]},{"id":"s23","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?key=NOW&format=markdown","title":"First-party: one capability contract, 4,423 bytes, 2026-07-25","quote":"**Principle:** Self-explaining payload — no external context required.","summary":"Method: `curl -s \"…?key=NOW&format=markdown\" | wc -c` → 4423. Compare `curl -s \"…?registry=1\" | wc -c` → 1606794 over 876 rows. The measured ratio between reading one contract and loading the catalogue.","claim_ids":["c3","c4"]},{"id":"s24","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?confirm=inv_yu9ni6w7y9","title":"First-party: the receipt for the invocation this page walks, 2026-07-25","quote":"\"status\": \"PROVEN_MATERIAL_RESULT\", \"headline\": \"NOW produced material output at 2026-07-25T22:02:44-07:00.\"","summary":"Method: POST {\"key\":\"NOW\",\"body\":\"\"} with an owner key, take `proof.invocation_id`, then GET `?confirm=<id>` with no credential at all. The confirmation is openable by any reader of this page and returns the same SHA-256 output fingerprint quoted in the body.","claim_ids":["c7","c9"]},{"id":"s25","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?key=NOW&format=markdown","title":"First-party: the contract names token failure recovery","quote":"expired or corrupted token — Report token_expired/token_corrupted from the response.","summary":"The public capability contract tells a cold caller to preserve the server's separate token_expired and token_corrupted errors. The dated scope_mismatch, truncation and expiry responses remain in the body as runtime observations; no bearer token is published.","claim_ids":["c5","c6"]},{"id":"s26","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?confirm=inv_sbeb4t5ao2","title":"First-party: lineage after a replay and a repair of the same invocation","quote":"\"repairs\": \"inv_yu9ni6w7y9\"","summary":"Method: POST {\"replay\":\"inv_yu9ni6w7y9\"} → inv_53l71tl1i0 with replay_of set; POST {\"key\":\"NOW\",\"body\":\"\",\"repairs\":\"inv_yu9ni6w7y9\"} → inv_sbeb4t5ao2 with repairs set; then re-read the original forensic receipt and observe repaired_by=inv_sbeb4t5ao2. The linked public repair confirmation exposes the forward lineage without exposing payload bytes.","claim_ids":["c8"]},{"id":"s27","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?confirm=inv_swzanrzqjo","title":"First-party: failure receipts, three shapes, 2026-07-25","quote":"\"status\": \"PROVEN_ATTEMPT_NO_MATERIAL_RESULT\"","summary":"Method: invoke D1_QUERY against a missing table. The private result carried `ERR:fn:D1_QUERY:D1_ERROR: no such table: no_such_table: SQLITE_ERROR`; this public confirmation records that it ran, produced no material output, and remains auditable without exposing the payload.","claim_ids":["c11","c12"]},{"id":"s28","type":"runtime_receipt","url":"https://miscsubjects.com/api/dispatch?registry=1","title":"First-party: latency of each step, 10 samples per endpoint, 2026-07-25","quote":"resolve median 66.7 ms · contract median 97.9 ms · invoke median 940.3 ms · confirm median 98.3 ms · receipt median 81.6 ms","summary":"Method: the five ten-sample curl loops published verbatim in the cost section, run from the same Mac in the Pacific timezone against the production edge. Every sample returned HTTP 200. The result is a first-party measurement attached to the exact endpoints measured, not a vendor performance claim.","claim_ids":["c10","c11"]}],"anecdotal_sources":[],"scientific_sources":[],"user_reports":[],"related_articles":[],"question_graph":{"slug":"dispatch-four-step-loop","questions":[],"evidence":[],"edges":[],"counts":{"questions":0,"evidence":0,"edges":0}},"honesty":{"active_claims":14,"retracted_claims":0,"cut_claims":0,"challenges":0,"scrub_events":0,"note":"Retracted/cut claims stay on ledger but are excluded from ask unless ?include_inactive=1"},"counts":{"claims":14,"claims_total":14,"sources":28,"anecdotal":0,"scientific":0,"user_reports":0,"questions":0,"evidence_ingests":0}}