Engine

A deterministic layer between the agent and the irreversible call

Irrevon is an open-source reference engine and benchmark — local-first, no hosted service, no accounts. The engine is the “proposed system” baseline inside the benchmark, not a product: it registers intent, persists before dispatch, gates deterministically, and reconciles ambiguity by querying the destination.

Evidence: Design specificationTechnical provenance

Architecture

One path in, one authority out

Conceptual

Conceptual rendering of the architecture in master doc §6.2 — not fixture data. Dashed boxes sit outside the deterministic core; the classifier’s edge is advice only and carries no authority.

Prose twin: components and responsibilities

Intent Registrar: Validates the business-intent contract; requires at least one stable upstream identifier; creates the ledger record (INTENDED → PERSISTED). Rejects intents lacking a stable identifier.
Effect Ledger: Append-only Postgres store of effect records, dispatch receipts, and reconciliation findings. Single writer in the POC — a documented scaling limit.
Commit Gate: Deterministic pre-dispatch checks: authority freshness and binding, dedup, branch-lineage validity. Owns the deny-list for incident containment.
Dispatcher: Executes adapter dispatch with derived idempotency evidence; records receipts; classifies transport outcomes as SETTLED or AMBIGUOUS.
Reconciliation Engine: Deterministically resolves AMBIGUOUS effects by querying destination status; assigns reconciliation classifications; runs the out-of-ledger Orphan Sweep.
Outcome Classifier (advisory): Optional model-assisted triage proposing classifications for human review. Advisory only — architecturally unable to reach gate or resolve APIs.
Adapters: Per-destination dispatch, status-query, and dedup-check, plus a version-pinned, cited capability declaration.

Evidence: Design specificationTechnical provenance

Implemented today

The first slice is code, not slideware

The engine core is implemented and tested: identity derivation, the append-oriented ledger with locked transition functions in plain SQL, the commit gate, dispatch and receipts, reconciliation with confirmed-absence, crash recovery, and the orphan sweep — plus reference destinations, the CLI, and the read-only workbench.

Ledger in plain SQL

The state tables and locked transition functions live in reviewable migrations; the ledger is the sole transition writer.

migrations/

Design on the record

The mechanics — claim protocol, commit gate, confirmed-absence protocol, recovery order — are specified in RFC-002 and implemented from it.

RFC-002

Machine-readable contracts

Intent contracts, effect records, receipts, findings, and capability declarations are JSON-schema pinned, with valid and invalid example suites enforced in CI.

schemas/

Evidence: Verified evidenceTechnical provenance

Capability declarations

Adapters must prove their destination’s semantics, in writing

Every adapter ships a version-pinned, cited declaration of what its destination actually guarantees: the tier, the idempotency semantics, what is queryable, and the consistency bounds. Contract drift forces a declaration update, a retest, and a deviation record before any benchmark use.

{
  "adapter": "refdest-c2",
  "destination": "Irrevon reference destination (C2 profile)",
  "api_version": "refdest-1",
  "tier": "C2",
  "idempotency": { "supported": false },
  "queryable": {
    "supported": true,
    "by": ["destination_ref", "client_ref"]
  },
  "client_ref_field": "client_ref",
  "list_queryable": true,
  "consistency": {
    "status_settlement_lag": "PT0S",
    "listing_lag": "PT0S"
  },
  "compensation_hook": null,
  "citations": ["https://irrevon.dev/refdest/contract#c2"],
  "evidence_quality": "VF"
}

This is the loaded declaration for the reference C2 destination the recorded demo runs against — verbatim from the repository’s example suite. "idempotency": { "supported": false }plus "queryable": true is exactly the C2 shape: the destination won’t honor your key, but it will answer for what exists.

Where a destination’s docs list parameters but never state “no idempotency,” the C2 classification is an evidence-backed inference and the declaration says so (evidence_quality).

Evidence: Design specificationTechnical provenance

The workbench

Evidence you can open locally

Irrevon workbench inspecting the flagship effect: identity, lifecycle, classification and resolution panels with the recorded transition history. — The flagship effect opened in the workbench. Read-only by construction: no build of this app can mutate anything. The workbench pictured is running against schema-validated fixtures captured from a real engine run — the SYNTHETIC FIXTURE banner is part of the product.

Irrevon workbench inspecting the flagship effect in dark theme: identity, lifecycle, classification and resolution panels with the recorded transition history. — The flagship effect opened in the workbench. Read-only by construction: no build of this app can mutate anything. The workbench pictured is running against schema-validated fixtures captured from a real engine run — the SYNTHETIC FIXTURE banner is part of the product.

Recorded artifact

Evidence: Verified evidenceTechnical provenance

Roadmap boundary

What exists, and what is gated

Scroll table horizontally

Stage	Contents	Status
Engine core	Identity, ledger, gate, dispatcher, reconciliation, recovery, sweep, reference destinations, CLI, workbench	Implemented
Provider adapters	Real sandbox adapters (C1 Stripe test mode; one C2 sandbox) with cited capability declarations	Gated — sandbox selection and API-version pins require human review
Benchmark harness	Seeded workloads, fault schedules, oracle, the full baseline ladder	Developmental S-REF pilots only; live and confirmatory runs remain freeze-gated
Release	Published `v0.1.0` software package; research preprint	Software published; scientific publication and provider qualification remain gated

Evidence: Verified evidenceTechnical provenance