Agentic workflows, durable approvals and generative UI

Mental model and learning outcome

A model can propose; the server authorizes and executes. Separate the durable run, event history, UI projection and side-effecting operation. A tool call is not automatically an agent, and a deterministic workflow is often easier to evaluate and recover.

Executable run protocol

The SQLite fixture creates a run with started, progress and draft events. A proposal contains an allowlisted operation and validated arguments. Editing creates a new canonical payload hash. Approval must name that hash and pass current ownership/role checks. In one local transaction, the service records its action ledger entry and terminal events. A repeated approval recovers the existing result rather than recording another action.

This establishes one durable local action record under SQLite's transaction boundary. It does not guarantee exactly-once effects in an unrelated remote tool. A real external integration needs its own idempotency key, retry/reconciliation contract and outbox or equivalent recovery mechanism.

Approval, revocation and cancellation

Approval is bound to content, actor and run; a stale hash fails after revision. Recheck permission at execution, not just when displaying the button. Cancellation and completion race against the same authoritative state. Once terminal, the run cannot be resurrected by an old event or a reconnect.

Disconnecting the browser releases the subscription; it does not cancel the run. On reconnect, authorize again and rebuild from durable state. Keep user-edited drafts distinct from generated updates. The pure reducer takes event timestamps and IDs as input and rejects gaps/terminal transitions; it does not create authority by rendering an “approved” badge.

Tool and protocol trust

For MCP integrations, validate audience and resource binding, avoid token passthrough, minimize scopes and prevent confused-deputy behavior. A discovered tool description is untrusted metadata, not permission to execute it. Validate arguments and outputs, restrict network destinations, and bind approval to the final operation after any model transformation.

A2A, AG-UI and A2UI are adoption tracks with compatibility and trust decisions, not prerequisites for every frontend. Keep your domain run protocol independent enough to adapt to a provider change. Bound steps, elapsed time, tool concurrency, output size and cost; stop with a recoverable explanation when the budget is exhausted.

Adversarial exercise and expected answer

Disconnect after commit, replay old events, edit a proposal before approval, revoke the actor, restart the service and race cancel with approve. Inspect the ledger and terminal snapshot. A passing answer shows no unauthorized action, stable recovery and preserved user edits; a polished animation is insufficient.

Add one external tool only after documenting its idempotency and reconciliation boundary. Roll back model planning to the deterministic draft path without deleting run history or accepted actions. Human review should examine authorization and failure traces separately from generated-answer quality.

Executable reference and sources

Implementation · Behavioral evidence · Primary source.

Run the projects and assessment. Human review is pending.