Guide

Beyond one action

Three checks that look across actions or across time. The library contract payout_workflow uses all three; none of them knows what money is.

A total across many actions

Every other check judges one action. aggregate_limits judges the effects of all the actions in scope: this agent's, this subject's, or every action under the contract, over a lookback that ends when this action's window closes. A payout that is under its own limit still fails when it pushes the agent's day over the total. The same line bounds goodwill credits per customer per month, or deploys per agent per hour.

aggregate_limits:
  - aggregate_exceeds: {source: payments, type: payout_created, attr: amount, max: 5000, over: "24h", by: agent}
  # by: agent | subject | contract.  Omit attr to count effects instead of summing one.

A value that must equal its reference

effect_attr_differs compares what a system of record shows with what it should be: the action's own parameter, or an attribute of the latest state record before the action, plus or minus a parameter. The amount the payment system shows must equal the amount requested; the balance after must equal the balance before minus the amount; the quantity shipped must equal the quantity ordered. No reference recorded, no violation: use a precondition to require the reference.

forbidden_effects:
  - effect_attr_differs: {source: payments, type: payout_created, attr: amount, equals_param: amount}
  - effect_attr_differs:
      source: ledger
      type: account_balance
      attr: balance
      equals_state: {source: ledger, type: account_balance, attr: balance}
      minus_param: amount
      tolerance: 0.005

A later record that undoes the action

reversed_by names the records that mean the action did not hold: a returned payout, a chargeback, a rollback after a deploy, an offer declined after it was marked accepted. They arrive long after the window, so the lookahead defaults to 30 days, and pushing one re-verifies the action it undoes. The new verdict is FAIL on both lenses and the webhook fires again.

reversed_by:
  - effect_observed: {source: payments, type: payout_returned, within: "30d", message: "The payout was returned"}

The action contracts reference lists every check with its fields, and the API reference every endpoint.