BengarTrust infrastructure

Docs · Guides

Execution

The four outcomes, why UNKNOWN is not FAILED, and how idempotency works.

The states

StatusWhat it means
PENDINGIn flight.
SUCCEEDEDThe other side confirmed it.
FAILEDThe other side refused, and said so. Nothing happened.
UNKNOWNWe do not know. The request may have arrived, been performed, and the response lost.

UNKNOWN is not FAILED

UNKNOWN ≠ FAILED, and there is no blind retry. Retrying an action that may already have happened is how one purchase becomes two. The budget stays held, the execution waits, and a person establishes what actually happened.

It is settled with POST /v1/projects/:id/executions/resolve, or from the Console's Executions page, by recording what was checked and where. If two people resolve the same execution, the first statement stands and the second is a conflict.

AVAILABLE Reconcile an UNKNOWN execution — /projects/:id/executions

Where: Executions → Reconcile

First: An execution whose outcome is UNKNOWN.

Requires: ADMIN

Idempotency

execution.nonce binds one execution to one action. Repeating a request with the same nonce returns the stored outcome as decision: "REPLAY": no merchant call, no budget spent, no approval consumed and no new decision. The response references the ALLOW that authorized the original.

{
  "execution": {
    "merchant":  "acme-procurement",
    "operation": "create_purchase_order",
    "payload":   { "sku": "…", "quantity": 2 },
    "nonce":     "po-2026-08-24-0001"
  }
}

What a caller cannot choose

There is no url field, and sending one is refused by name rather than ignored. The caller names a merchant; where that name points is the deployment's configuration.

Related