Evidence ledger
Proof has a class.And a boundary.
Every artifact identifies what happened, what evidence exists, what changed, and what the evidence cannot support. Labs, client work, prior experience, and illustrative traces are never interchangeable.
Whitestone lab
Agent Control Lab
- Mechanism
- Billing owns refunds and the ledger owns credits. Each enforces its own rules; the ceiling across both has no owner, and the agent reads a lagging view.
- Evidence
- Deterministic schedules with negative controls, an oracle that proves itself before it judges, 19 catalogued failure modes, and model-driven runs.
- Claim
- Every local control holds and the business still ends at $1,100 against a $1,000 ceiling. One coordination authority turns the same schedule clean.
- Boundary
- One machine, local services, synthetic data. Not a production frequency, and not a statement about model behaviour.
Illustrative system trace
Refund consequence sequence
- Mechanism
- A downstream customer-record timeout after payment and order mutations.
- Evidence
- Synthetic trace used to explain authority, idempotency, reconciliation, and independent state verification.
- Claim
- Shows how one operation identity suppresses a duplicate financial effect while state repair continues.
- Boundary
- Not a client incident, benchmark, or measured production result.
Inside the lab · Schedule S1
Three green signals. One wrong business state.
Agent B starts reading strictly after agent A has committed. Nothing overlaps. It is still wrong, because it read a view that had not applied A's event. Serialising the agents does not fix it; an authority that sees every input to the invariant does.
sum(refunds) + sum(credits) ≤ authorized_compensation- Task successBoth agents completed. Neither errored or retried.Healthy
- Distributed tracingOne trace, agent → crm → ledger. Every span OK.Healthy
- ReconciliationNo lag, no drift, no duplicate keys, no orphans.Healthy
- Business invariant$1,100.00 committed against a $1,000.00 ceiling.Violation
make reproduce SCHEDULE=S1
- 19
- failure modes, each runnable by its id
- 3
- schedules end with the business state wrong
- 5 / 5
- model-driven runs breach; with an authority, 5 / 5 clean
- ~700
- replays, and the release order never varied
Every verdict, generated by the run that asserts it The failure catalogue
Use cases · How we'd engineer it
Six sectors. Every failure mode listed is reproduced in the lab.
Use case · Illustrative
Banking & financial services
Two support agents each compensate the same dispute correctly. Together they pay out more than was authorised, and no signal notices.
Boundary Illustrative engagement, not a client engagement or a measured production result. The failure modes listed are reproduced in the public lab.
Next step
Want this standard applied to your system?
The diagnostic maps one consequential workflow, names the owner of every invariant, and reproduces the failures that matter.
Real systems. Higher standards.