Bounded Continuity Protocol

Status: reusable design protocol; not an installed scheduler
Purpose: carry one authorised outcome across finite attempts without self-renewing workers, stale grants or limitless retries.

1. Outcome card

Create one durable card before multi-attempt work begins.

outcome_id: OUT-2026-104
requested_result: "Deliver six documents that pass the named review checklist"
scope_version: 3
requester_or_owner: accountable-person-or-role
acceptance_criteria:
  - six named documents exist
  - each exact hash has independent review
  - no critical review finding remains
terminal_authority: owner-or-designated-parent
current_state: ready
forecast_at: "2026-10-20T21:00:00+08:00"   # estimate, not permission
hard_stop_at: null                            # populate only if explicitly imposed
resource_policy: RP-12
current_grant_version: G-19
active_attempt_ids: []
dependency: null

Do not use forecast_at as hard_stop_at. Do not leave terminal_authority, acceptance criteria or resource policy implicit.

2. State model

On a narrow screen, scroll the table sideways.

Attempt states are separate: admitted, running, succeeded, failed, expired, contained. An attempt's succeeded state proves only its contracted delta.

3. Finite attempt contract

Every attempt receives an immutable contract:

attempt_id: ATT-104-B
outcome_id: OUT-2026-104
scope_version: 3
parent_controller: CTRL-7
actor: worker-identity
current_grant_version: G-19
allowed_operations: [read_sources, write_document_2, write_receipt]
prohibited_operations: [publish, deploy, send, create_successor]
targets: [document_2, attempt_receipt]
expected_delta: "Complete document 2 and its source map"
starts_at: "2026-10-20T20:20:00+08:00"
ends_at: "2026-10-20T20:40:00+08:00"
resource_budget:
  wall_minutes: 20
  incremental_bytes: 8388608
retry_policy:
  controller_layer_only: true
  max_attempts_for_same_failure_class: 1
  requires_idempotency_or_deduplication: true
containment:
  stop_processes: true
  release_locks: true
  revoke_ephemeral_grant: true
evidence_required: [artifact_hash, source_map, remaining_criteria, resource_receipt]

The contract forbids successor creation. A worker can request continuation in its receipt; only the named controller or accountable human may admit it.

4. Boundary receipt

Write this receipt whether the attempt succeeds, fails or expires:

attempt_id: ATT-104-B
ended_as: expired
contained: true
produced:
  - target: document_2
    state: partial
    sha256: "..."
acceptance_delta:
  newly_satisfied: []
  still_open: [document_2_complete, documents_3_to_6, independent_review]
side_effects:
  external_writes: []
  live_processes: []
  held_locks: []
authority_observation:
  grant_version_used: G-19
  known_change: false
resources:
  budget_observed: within_limit
progress_test:
  durable_delta: true
  uncertainty_reduced: true
failure_class: time_boundary
recommended_next_transition: ready
recommended_method_change: null
next_owner: CTRL-7

A receipt is invalid if contained is unknown, open side effects are omitted, or the remaining acceptance criteria are replaced with a vague statement such as “more work needed.”

5. Parent/controller admission test

Evaluate in this order. A later yes cannot override an earlier hard no.

1. Stop/correction: Has the owner cancelled, superseded or materially changed the outcome?
2. Yes → stopped or create a separately authorised outcome. Do not reuse the old scope.
3. Containment: Is the previous attempt stopped and accounted for?
4. No → contain or escalate; admit nothing concurrent unless concurrency was explicitly designed.
5. Acceptance: Do exact artifacts and evidence satisfy every criterion?
6. Yes → authorised reviewer may set verified_complete.
7. Authority: Is there a current grant covering the actor, action, target and side effect?
8. No → blocked. An open outcome is not a grant.
9. Resources: Are budgets and protected reserves satisfied for the proposed attempt?
10. No → blocked or select a lower-cost method; do not weaken reserves.
11. Dependency: Can useful independent work proceed now?
12. No → waiting, with owner, observable wake condition and next review.
13. Progress: Did the previous same-method attempt create a durable delta or reduce uncertainty?
14. No → require method change, human decision or block. Do not issue an identical retry.
15. Retry safety: Is the next operation transiently retryable and idempotent/deduplicated where necessary?
16. No → escalate or redesign.
17. Finite successor: Does the next contract have a new ID, explicit delta, end condition and evidence?
18. Yes → admit and set outcome to running.

6. Waiting record

A valid waiting state is a control object, not a note:

dependency_id: DEP-44
outcome_id: OUT-2026-104
blocked_criterion: independent_review
external_owner: reviewer-role
observable_wake_condition: "review exists for exact current document hashes"
not_before: "2026-10-20T20:50:00+08:00"
review_by: "2026-10-20T21:20:00+08:00"
watcher_authorized: false
fallback_if_unmet: "surface blocker to terminal authority"

Never claim a watcher exists unless it has been admitted and can be verified. If no watcher is authorised, the human/controller still owns the review time explicitly.

7. Non-progress and retry accounting

Record a method signature such as tool + source version + strategy + failure class. Increment same_method_no_progress when an attempt produces neither an accepted artifact nor new diagnostic evidence.

Suggested policy for a pilot:

• first transient failure: one bounded retry if safe;
• second failure with the same signature: stop automatic retry and change method;
• permission, revocation, invalid input or configuration failure: no automatic retry;
• unknown side-effect state: contain and reconcile before any retry;
• external dependency: move to waiting, not a polling loop;
• repeated narrative-only updates: blocked for controller review.

These are proposed defaults, not measured optimal thresholds.

8. Failure-injection suite

Run both positive and negative cases against the actual controller boundary.

On a narrow screen, scroll the table sideways.

9. Synthetic worked example

This example is illustrative, not an executed measurement.

Outcome OUT-9 requires three reviewed files. Attempt A1 has a 15-minute budget and completes file 1. Its process exits successfully. The outcome remains running until the controller receives and validates the receipt; it then returns to ready because two acceptance criteria remain.

Attempt A2 starts under a new grant and times out after issuing a mutating request whose response is lost. The receipt marks side-effect state unknown. The controller must not issue A3 to repeat the mutation. It admits a read-only reconciliation attempt instead. If reconciliation proves the mutation occurred, the controller records the exact external identity and continues from that state. If permission is revoked during reconciliation, the outcome becomes blocked; the open outcome does not restore access.

The example demonstrates three separations: process success is not outcome completion, timeout is not safe retry evidence, and unfinished work is not continuing authority.

10. Pilot measures

For each matched workflow, record:

• accepted outcomes / admitted outcomes;
• outcomes abandoned while still open;
• unauthorized or stale-grant continuation attempts;
• duplicate side effects;
• non-progress attempts before intervention;
• handoff defects and lost context;
• wall time and time beyond forecast;
• compute, storage and operator-review cost;
• waiting duration by dependency owner;
• false blocks and unnecessary approvals;
• time from revocation to enforcement;
• controller recovery after crash.

Compare at least: (a) one long-lived worker, (b) fixed stop with no continuity record, and (c) bounded continuity. Preserve failed runs. Do not report the protocol as superior unless matched evidence supports the relevant measure.

11. Operational checklist

Before the first attempt

• [ ] Outcome and acceptance criteria are explicit.
• [ ] Forecast is separate from hard stop.
• [ ] Terminal authority and dependency owner are named.
• [ ] Current grant and protected resource policy are resolved.
• [ ] Attempt has a finite delta, budget and end condition.
• [ ] Retry and deduplication policy is explicit.

At every boundary

• [ ] Prior attempt is contained.
• [ ] Artifacts and side effects are identified exactly.
• [ ] Remaining criteria are enumerated.
• [ ] Authority and resources are rechecked.
• [ ] Progress/non-progress is evidenced.
• [ ] Waiting includes owner and wake condition.
• [ ] Any successor has a new identity and finite contract.

Before completion

• [ ] Acceptance evidence covers the requested outcome.
• [ ] No live attempt or unresolved side effect remains.
• [ ] Completion was decided by the authorised role.
• [ ] Forecast misses and limitations remain visible.