The action lifecycle
Every action moves through the same state machine, and the database refuses any edge that isn’t in it.
Every edge as text (22 edges, 15 states)
received → authenticatedauthenticated → evaluatedevaluated → deniedevaluated → pending_approvalevaluated → executingdenied → sealedpending_approval → executingpending_approval → deniedpending_approval → expiredpending_approval → cancelledexecuting → executedexecuting → failedexecuted → witnessingfailed → sealedwitnessing → verifiedwitnessing → mismatchwitnessing → unverifiableverified → sealedmismatch → sealedunverifiable → sealedexpired → sealedcancelled → sealed
The diagram is drawn at build time from the Gate’s edge table, the same table a database trigger mirrors. Dashed lines lead to sealed.
The paths, in words
Section titled “The paths, in words”- Denied:
received → authenticated → evaluated → denied → sealed. Nothing ran. - Approved:
evaluated → pending_approval → executing. A person’s countersign moves it on; if no one decides in time it goes toexpired, and an agent or admin can move it tocancelled. - Ran:
executing → executed → witnessing → verified | mismatch | unverifiable → sealed. - Failed:
executing → failed → sealed. Failed means the tool certainly did not apply.
Honest unknowns
Section titled “Honest unknowns”When Deedglass can’t know whether a tool ran (a timeout, a crash, a lost connection), the action goes executing → executed with execution.status = unknown, then witnessing → unverifiable. There is no other edge for this, and recovery after a crash never invents one.
A later verdict never edits an existing deed. It seals an amendment deed that points to the first.
What it doesn’t do
Section titled “What it doesn’t do”statuson the API is a short summary (processing,executed, …);stateis the exact lifecycle state. Usestatewhen you need the edge.- A sealed action never changes. Undo is a new action, with its own deed.