§ 01 · Plan / approve / apply for AI agent actions

Your agent proposes.
A human countersigns.

Agents can read anything. When one wants to change something real, it files a plan: the state it read, the exact effects, the rules it checked. Nothing moves until a person signs that exact plan. Then it runs, every step verified against the real system, and everything lands in a ledger nobody can quietly edit.

Plan pl_mw2h8e0e8c5a Pending approval

Intent: Absorb the ACME delay without breaking customer promises
Requested by: agent · mcp

0 reschedule_order compensable
Ship SO-1001 on Nov 14 instead of Nov 10
1 set_reorder_point reversible
FRIDGE-300: 3 → 6
2 email_supplier irreversible
Send “PO 4471 delay” to po@acme.co

sha256 computing…

Countersign hereDraw your signature. It is hashed into the plan.

§ 02 · Incident register

Prompts don’t fix
these.

INC-01
The world moved after you said yes. A buyer edits the item between approval and execution. The agent writes on top of a value nobody approved it against.

Filed: state is snapshotted at plan time, re-observed before apply. Drift refuses the plan. Nothing runs.
INC-02
The retry sent it twice. Timeout, crash, confused model. The supplier gets the email again. The order is booked again.

Filed: one stable idempotency key per step, forwarded downstream. A finished step is never repeated.
INC-03
“Done,” it said. The API answered 200. The write never stuck. The agent read success and reported it.

Filed: verify() is mandatory and re-reads the system of record. The report carries the evidence.
INC-04
Half a plan. Step 3 of 4 fails. Steps 1 and 2 already changed things, and nobody undoes them.

Filed: compensation runs in reverse. Whatever cannot be undone is listed for a human, never hidden.
INC-05
It approved itself. The agent that asks also holds the button that says yes.

Filed: approval lives outside the agent’s tools, pinned to the plan’s SHA-256. The requester cannot sign.

§ 03 · The action contract

Six clauses.
No fine print.

3.1observeWhat does this depend on? Snapshotted at plan time, re-checked before apply.
3.2checkBusiness rules. A violation denies the plan before a human is bothered.
3.3previewThe exact effects, in words a person can sign.
3.4executeThe change, with a stable idempotency key to pass downstream.
3.5verifyProof against the real system. Not optional.
3.6compensateThe way back. Required unless you declare the action irreversible.

export const setReorderPoint = defineAction({
  name: "set_reorder_point",
  description: "Change the reorder point of an inventory item.",
  reversibility: "reversible",
  input: t.object({ sku: t.string(), reorderPoint: t.integer({ min: 0 }) }),

  observe:    ({ sku }) => erp.getItem(sku),
  check:      (_, item) => (item ? [] : ["item does not exist"]),
  preview:    ({ sku, reorderPoint }, item) =>
                [{ target: `item:${sku}`, op: "update", before: item.reorderPoint, after: reorderPoint }],
  execute:    (i, { idempotencyKey }) => erp.update(i, idempotencyKey),
  verify:     (i) => erp.getItem(i.sku)?.reorderPoint === i.reorderPoint,
  compensate: (i, _, { before }) => erp.update({ ...i, reorderPoint: before.reorderPoint }),
});

§ 04 · Ledger, open to inspection

Go on.
Edit the history.

Every entry commits to the one before it. Change a single character in any line below and watch what happens to everything after it. This is a real SHA-256 chain, computed in your browser.

seqeventdata (editable)hash

Chain verified

§ 05 · Time of check, time of use

Approved at 3.
Not applied at 5.

ERP · item FRIDGE-300

Reorder point

A colleague can change this at any time. Try it, then apply.

Plan pl_drift · approved by christen

reorder point 3 → 6

§ 06 · Filing instructions

Zero dependencies.
Ten minutes.

$ npm install countersigned

For the agent

Ships an MCP server: Claude, Cursor and any MCP client get plan, get_plan and apply. Never an approve tool.

For the human

countersigned list, show, approve, ledger verify. Sign from the terminal, or wire your own UI to the same store.

For the auditor

A hash-chained ledger in plain files or SQLite. Anchor its head anywhere you trust.

Read the code → Concepts npm

Your agent proposes.A human countersigns.

Prompts don’t fixthese.

Six clauses.No fine print.

Go on.Edit the history.

Approved at 3.Not applied at 5.