Seal

seal

Public register: the Retry-Safety Index lists which agent-payment implementations pay once when the answer is lost — verified safe, found & fixed (with time-to-fix), and how to get verified. Every row links to its proof.

Your agents earn the right to spend without you.

Seal is not Coherence

Seal and EffectFence stop an irreversible action from firing twice while it happens — runtime enforcement on money movement. Coherence never touches your runtime; it reads the record afterwards and grades what an agent *claimed* against what it *proved*. Prevention versus proof. Different problems, different code, no overlap.

Free: submit any client, facilitator, SDK or toolkit that moves money — yours or someone else's — and we read it and publish a verdict on the Retry-Safety Index at no cost. Findings come back with the mechanism, the file and line, and a failing test. You are counted, never named, until you ship a fix. [Submit for grading →](https://github.com/aurumflux20/hostile-facilitator/issues/new?template=submit.yml)

Seal is an MCP server (seal-mcp, stdio, JSON-RPC 2.0) — and a Python library. It gives an MCP host 12 tools for exactly-once execution of irreversible actions: seal_propose, seal_execute, seal_paths (gateway mode — the agent holds a single-use ticket, never the provider key), plus seal_admit, seal_commit, seal_abort, seal_heartbeat, seal_get, seal_verify, seal_incident_receipt, seal_expect, seal_obligations.

docker run -i ghcr.io/aurumflux20/seal          # or: python -m seal.mcp_server

It starts in introspection-only mode with no environment — initialize and tools/list answer with no database, so a host or registry probe can connect immediately. Set SEAL_DSN to a Postgres DSN to actually admit actions, and SEAL_EXECUTORS=your.module for gateway mode.

// claude_desktop_config.json

{ "mcpServers": { "seal": { "command": "python", "args": ["-m", "seal.mcp_server"], "env": { "SEAL_DSN": "postgres://..." } } } }

Not an engineer? Read docs/PLAIN-ENGLISH.md instead —

the same thing with no jargon, including what we can't do.

Everyone else ships a *lock*: a spend cap you set once and forget. The cap never learns, so an agent that has settled ten thousand clean payments is trusted exactly as little as the one you installed this morning — and you keep clicking Approve.

Seal ships the *unlock*. It reads what a payment path has actually proven — settlements the provider confirmed, sweeps showing nothing moved behind its back — and computes the autonomy that path has earned. L0 OBSERVED → L5 AUTONOMOUS. Nobody types the level.

████████············  L2 ASSISTED      50 proven · 100% confirmed   [human required]

fifty settlements — but volume alone is not trust. ████████████········ L3 DELEGATED 50 proven · 100% confirmed [unattended] one clean sweep later: the human stops clicking Approve. ···················· L0 OBSERVED 50 proven · 100% confirmed [SUSPENDED] one charge the gateway never admitted. fifty clean ones don't outweigh it.

SEAL_DSN="..." python3 license_demo.py     # watch a path earn L3 and lose it

Since 0.4.0 the licence drives the wheel, not just the dashboard. Turn on earned autonomy — Gateway(seal, earned_autonomy=True), or SEAL_EARNED_AUTONOMY=1 for the MCP server — and the gateway lets a path move money unattended only to the extent its own record has earned (L3+), inside the operator's ceilings, never above them. Three things hand the wheel back to a human instantly: a path that hasn't earned it yet, a suspension (money moved behind the gateway's back), and a hold — an execution reached the provider and its outcome is unknown, so the path pulls over until settle() has asked the provider what happened. The hold lifts by itself once the world answers. A human can still approve any single action through the same maker-checker door (tier=LICENCE). Off by default: nothing changes until you switch it on.

Can you prove your agents won't double-charge a customer? Three rungs, one

ladder, written-only: a $300 founding conformance run — your implementation

through the battery, result published on the Index (first three only;

book) · a **$1,200 attestation

run** — your live endpoint against every ambiguous outcome, signed result, findings

within five business days, a clean run signed within 24 h

(book) · a **$12,000 fixed-scope

money-path review** — one production money path read, tested and

attested in 7–10 days, **no invoice if no real double-fire is shown on a path you

run**. For a free self-check first,

hostile-facilitator tells

you in 60 seconds.

Slow to earn, instant to lose — the only shape that makes a track record mean anything. The full level definitions: docs/AUTONOMY-LEVELS.md.

Seal's ambiguous-outcome doctrine — *"could not determine" is terminal, never absent* — is now §4.3 of the draft MCP retry-safety proposal, co-authored by us, with our conformance battery as its test suite.

Underneath: exactly-once admission

Two different agents, on two different machines, both decide to charge order 123 at the same instant. In-process idempotency can't help — the guard has to live in a store both agents talk to, and the winner has to be decided *atomically there*.

Seal is that layer. One Postgres, one row per intent, one winner:

INSERT ... ON CONFLICT DO NOTHING     -- one row, one winner, no check-then-act window

Every admitted action ends in a certificate: a content-addressed hash over intent + args digest + result digest + the previous cert's hash. Editing, deleting or reordering any cert breaks every hash after it — and anyone with the DSN can check, with no network and no trust in us:

SEAL_DSN="..." python3 -m seal verify

chain VERIFIED — 41 cert(s), every link intact (exit 0; broken chain → exit 1)

The proof

The claim is tested the hostile way: 1,000 real threads released by one barrier against one shared Postgres, where the "charge" increments a measured counter — if two callers run, the counter says 2 and the test fails loudly.

Result, four consecutive runs: ACTUAL_EXECUTIONS = 1. Every loser either replayed the sealed cert, stood down mid-flight, or failed safe when the store was unreachable. A 50-caller post-seal wave: all replayed, none re-ran. Full numbers, including the honest limits: STORM-PROOF.md.

Run it yourself:

pip install seal-kernel

export SEAL_DSN="host=... dbname=seal" python3 -m seal verify # chain check, no network, no trust in us

To run the 1,000-thread storm proof yourself, clone the repo (the harness ships with the source, not the wheel):

# Needs Python 3.10+. macOS ships 3.9 with pip 21, which fails an editable

install with a misleading "setup.py not found" error — use a venv rather

than debugging that.

git clone https://github.com/aurumflux20/seal && cd seal python3 -m venv .venv && source .venv/bin/activate python3 -m pip install -U pip && python3 -m pip install -e .

export SEAL_DSN="host=... dbname=seal" python3 storm.py --n 1000

Test YOUR server, not just ours

The exact harness above, generalized into a standalone file with zero dependency on this repo — copy it, point it at your own write-bearing tool, and find out for yourself:

python3 range_safety_test.py --n 1000

It demonstrates itself against a known-unsafe target and a known-safe one before you ever run it for real, so a pass means something. Full writeup, including the three ways an early version of this test lied to us before it was fixed: docs/RANGE-SAFETY-TEST.md.

Usage

from seal import Seal

seal = Seal(dsn); seal.setup()

adm = seal.admit("charge", {"order_id": "123", "amount": 4900}) if adm.fresh: # you won — run the effect, then seal it result = stripe_charge(...) cert = seal.seal(adm.intent, adm.fence, result) elif adm.cert is not None: # already done — here is the receipt return adm.cert else: # someone else is mid-flight — stand down raise InFlight()

If the effect fails before anything irreversible happened, release the claim so a retry is legitimate: seal.fail(adm.intent, adm.fence, reason).

When a holder dies mid-effect (its lease expires with the intent still open), the next admit() does not hand out a fresh claim. Nothing in an expiry says whether the holder crashed before the provider answered or is still inside a slow provider call, so re-running it would be executing on an unknown outcome — the one thing Seal promises never to do. You get fresh=False, cert=None, reason="lease expired with no witness…"; resolve it with a witness (Gateway.register_witness, or seal.settle(intent, witness)) which heals the record if the effect landed and releases it if it did not. Seal(dsn, blind_reclaim=True) restores the old takeover for providers that are idempotent by construction. The gateway heartbeats the lease for the whole provider call, so a slow Stripe call keeps its claim instead of losing it.

World confirmation — measured against live Stripe, not mocked

A cert saying "admitted once" is a claim about us. The next question is what Stripe (or Resend, or your bank's webhook) actually recorded — and the answer is allowed to disagree with us.

export SEAL_DSN="host=... dbname=..."

export STRIPE_TEST_KEY="sk_test_..." # your own test-mode key, Dashboard -> API keys python3 stripe_demo.py

What it does, against your real Stripe test account, no mocks:

1. Two agents fire the same charge at the same instant. Seal admits one. Exactly one real PaymentIntent is created.
2. The witness asks Stripe: *"how many charges carry this intent?"* Stripe says one → the cert upgrades to WORLD_FINAL.
3. A rogue charge is created outside the gateway — the thing no local fence can stop on its own. The witness asks again; Stripe now says two → the cert becomes WORLD_DIVERGED, the domain freezes, and further spend on it is refused automatically.

Two honest things the live run taught us, both fixed and both tested: Stripe's search index is eventually consistent (a fresh charge can take real seconds to appear — the witness polls to a definitive answer rather than ever recording a "not indexed yet" empty read as authoritative absence), and once the world has contradicted the ledger, a later flaky re-count must never quietly downgrade the cert back to WORLD_FINAL — divergence is sticky by design.

Pre-commit world freeze — don't act on facts that already moved

admit() has always taken a read_set — the world facts a decision depends on (a cart total, an inventory count) — and stored it on the cert. Until now nothing ever checked it: a caller who believed they had staleness protection had none. Same defect shape as a bug fixed earlier the same day, one layer up — a guard present in the schema, never enforced.

from seal.freshness import CallableChecker

fresh = CallableChecker(lambda rs: current_cart_total(rs["order_id"]) == rs["total"])

adm = seal.admit("charge", {"amount": 5000}, key="order-777", read_set={"order_id": "777", "total": 5000}, checker=fresh)

StaleWorldRead is raised BEFORE