AgenticRail Gate - sequence enforcement and verifiable audit receipts for AI agent compliance

{'type': 'object', 'required': ['sequence_id', 'step', 'action_type'], 'properties': {'step': {'type': 'string', 'description': "The step being attempted, e.g. 'intake' or 'review_and_sign'. This is a NAME, not a description. It must be spelled identically on every call, must appear in step_order (for custom sequences), and must equal `function`. The gate compares it byte for byte, so a sentence that changes with the subject can never match and is denied UNKNOWN_STEP. Put the human-readable sentence in `action` instead."}, 'nonce': {'type': 'string', 'description': 'Optional unique-per-step UUID for replay protection. Generated automatically if omitted.'}, 'action': {'type': 'string', 'description': 'Optional human-readable label for the action.'}, 'inputs': {'type': 'object', 'description': 'Optional free-form inputs recorded with the decision.'}, 'function': {'type': 'string', 'description': 'Defaults to `step`. The rule step === function always holds.'}, 'step_order': {'type': 'array', 'items': {'type': 'string'}, 'description': "The full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id. One step is a valid sequence. An UNKNOWN_STEP denial returns expected_step_order (the list your step had to be in) and step_order_source ('caller' or 'msmd_spine'); msmd_spine means you sent no step_order at all and got the built-in spine."}, 'action_type': {'enum': ['CHECK_STATE', 'CLARIFY_NEXT_STEP', 'SELECT_NEXT_STEP', 'RECORD_RESULT', 'WAIT_FOR_SIGNAL', 'VALIDATE_INPUT', 'PAUSE_CYCLE', 'REDUCE_STIMULUS'], 'type': 'string', 'description': 'The action class for this step. The whole vocabulary is exactly these eight and nothing else is accepted: CHECK_STATE, CLARIFY_NEXT_STEP, SELECT_NEXT_STEP, RECORD_RESULT, WAIT_FOR_SIGNAL, VALIDATE_INPUT, PAUSE_CYCLE, REDUCE_STIMULUS. These are ENFORCEMENT CLASSES, NOT a description of what your step does. READ, QUERY, LOOKUP, SEARCH, EXECUTE, ANALYZE and TOOL_CALL are the most common wrong guesses and every one of them is denied: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome. EACH STEP THEN ACCEPTS ONLY A SUBSET of the eight - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. A denial does not spoil the sequence and runs nothing.'}, 'sequence_id': {'type': 'string', 'description': "Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every RUN a fresh id - a run, not an attempt: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else. A DENIED step does not spoil a sequence and does not run anything, so a denial is not a reason to start a new one: fix the call instead."}}, 'additionalProperties': False}

{'type': 'object', 'required': ['sequence_id'], 'properties': {'sequence_id': {'type': 'string', 'description': "The sequence to verify. Use a 'demo-' sequence for keyless verification."}}, 'additionalProperties': False}