Operation Guide

Operation Guide

Ordinary checks never dispatch. The only operation lifecycle is:

adapter-check -> plan -> preflight -> approve -> dispatch -> verify -> reconcile

Dispatch requires a digest-bound plan, fresh scoped signatures, an unused nonce, resource limits, and adapter restrictions. HTTPS adapters block SSRF-prone addresses and redirects. Process adapters require fixed executable digests, fixed arguments, shell=false, timeouts, and output limits.

A receipt proves only a provider call. Independent signed observation is needed for physical_outcome_verified=true; physical_outcome_proven stays false.

Dry-Run Example

From a source checkout:

npx pic-ts operation adapter-check --manifest examples/operation/https_readonly.adapter.json
npx pic-ts operation plan --manifest examples/operation/https_readonly.adapter.json --request examples/operation/https_readonly.request.json --output operation-plan.json

Planning does not dispatch. Approval binds the adapter, arguments/body digest, limits, scope, expiry, nonce, rollback, hazard, and verifier contract.

Read-only operations require explicit policy. Reversible writes require an independent signature and rollback. Irreversible or physical operations require two distinct signers plus hazard and verifier contracts. Crash-uncertain dispatch is reconciled and never automatically retried.