Skip to case content
TLSelected work

Agent operations · External side effects

ORINX

The order closed. The position did not.

One close appeared complete in the local ledger while the exchange still held the position. I designed ORINX to preserve both records, retry once under a fixed limit, check both sides again, and hand the unresolved position to a person.

Created and operated by Titus Lai.

Reconstruct the incidentOpen the public evidence
A split-state apparatus showing the local ledger closed while the exchange track remains open
LOCALCLOSED
EXCHANGEOPEN
Incident stateLOCAL CLOSED / EXCHANGE OPENHUMAN · FINAL REPAIR DECISION

One close · Two records

The same position had two incompatible endings.

Overwriting either record would hide real exposure. I made the disagreement a first-class incident: preserve both, retry once, observe again, then stop.
02 / 05Close splits

The local close commits, but no matching exchange receipt arrives.

One close command separates into a closed local ledger and an open exchange position before a single retry and human handoff
Close commandCLOSE / pos_017
LOCAL LEDGERLOCAL COMMIT

OPENCLOSED

EXCHANGE RECORDEXCHANGE OBSERVATION

OPENOPEN

INCIDENTexit_not_committed
A1ONE BOUNDED RETRY
A1RE-OBSERVE BOTH
A3HUMAN BOUNDARY
KILL SWITCH ARMED
Lifecycle
pos_017
pos_017
Last confirmed state
close committed
position open · no close receipt
Retry budget
0 / 1 available
not used

The incident that changed the architecture

What happened, what it risked, and what I changed.

A partial side effect turned a routine close into a question of who was allowed to change real money state.
  1. 01Before
    OPEN / OPEN

    Both records described the same open position.

    The local lifecycle and the exchange observation shared one position identity.

  2. 02Failure
    CLOSED / OPEN

    Only the local close completed.

    The interface implied that exposure had ended, but the exchange still carried the position.

  3. 03Decision
    PRESERVE BOTH

    I refused to manufacture agreement.

    ORINX kept both timestamped records, classified exit_not_committed, and checked ownership plus kill-switch state.

  4. 04Permanent fix
    RETRY × 1

    Retry once, read both sides again, then stop.

    If the records still disagree, automation latches off and hands a typed evidence packet to a person.

Repair limits

Seeing a failure does not give software permission to repair it.

Ownership, kill-switch state, evidence age, and whether a change can be reversed determine the next step.
A0

Observe

Always allowed

Keep both records and classify the disagreement without rewriting either side.

A1

One limited action

Allowed once

Retry one confirmed transient exit owned by this system, then read both sides again.

A2

Agent review

No lasting change

Compare lifecycle identity, assemble the evidence packet, and recommend the least powerful next step.

A3

Human handoff

Final repair decision

A person handles unclear ownership, lasting changes, or any exchange exposure that remains unresolved.

Any unresolved exchange exposure is handed to a person with both records attached.

Second engineering case

A watchdog can report healthy after it has gone blind.

When the scheduler died silently, a responsive local process still looked healthy. I added an independent external heartbeat and a restart token that can be spent only once.
01

Independent heartbeat

No outside observation means unhealthy, even when the local process responds.

02

One restart

The system may restart once; another failure goes to a person instead of looping.

03

Notification cooldown

Cooldown reduces duplicate messages. It never changes health or suppresses recovery.

Inspectable evidence, explicit boundary

The public case proves the decisions—not an exchange connection.

The curated repository uses synthetic records and fixed outcomes to demonstrate reconciliation and watchdog limits without credentials, accounts, network calls, or the private runtime.
Public evidence

Two runnable examples, 50 tests, a bilingual incident account, three diagrams, and fail-closed boundary checks.

Remains private

The original runtime, strategies, parameters, operating data, identifiers, deployment topology, and exchange connections.

MIT License · Clean-room demonstration only.Boss0320 / orinx-agent-operations
Inspect the public repository