# Adapter, denial and retry contract

Rethinking Agents · v0.1 · October 1, 2026

**Swap a model without silently expanding its authority.** Normalize only supported adapter versions. Preserve invocation, operation and workload identity across routing and delegation. Keep enforcement outside model-generated prose.

## Decision contract

| Class | Meaning | Permitted scheduler behavior |
|---|---|---|
| terminal | This operation is not authorized under the current grant | Stop the route; do not translate it into another representation to evade denial |
| transient | Explicitly safe to retry under this operation's idempotency and budget contract | Bounded retry with backoff/deadline and a reserved billable attempt |
| unknown | Dispatch or effect may have occurred; evidence is insufficient | Reconcile before replay |
| unsupported | Adapter/schema/route is not covered by the configured contract | Hold; require supported configuration or review |

A generic error string is not a reliable machine-readable class. Keep a coarse code and correlation ID visible to the worker, with detailed diagnostics available to the authorized operator. Do not expose sensitive policy internals unnecessarily. We have not measured whether terse wording reduces adversarial model probing; wording is not the enforcement boundary.

## Upgrade checklist — NOT RUN

- Task and authorized action set: UNKNOWN
- Old/new adapter and schema version: UNKNOWN
- Provider/model and allowed fallback routes: UNKNOWN
- Tool definitions and effective grants: UNKNOWN
- Delegated child's identity, budget and inherited/reduced scope: UNKNOWN
- Success/no-op, terminal denial, safe transient failure, lost acknowledgement and unknown schema fixtures: NOT RUN
- Retry ceiling, deadline, backoff and reservation per billable attempt: UNKNOWN
- Unexpected fields/tool names and malformed results: hold unless explicitly supported
- Useful operation still succeeds under the same grant: NOT RUN
- Evidence retention/redaction and operator diagnostic channel: UNKNOWN

## Worked routing decision — fictional, NOT RUN

Adapter A returns `permission_denied`. Adapter B encodes the same denial in a structured status field. Both map to terminal. The outer scheduler must not turn either into an ungoverned provider fallback. A transport timeout after dispatch maps to unknown until the receiver resolves the operation. A known pre-dispatch rate-limit response may be transient if that provider contract establishes no effect; the string “timeout” alone cannot establish this.

The local lab executes two fixed synthetic adapter shapes and retry classifications. It does not call models, prove current SDK compatibility, compare model quality, or measure an adversarial feedback effect. Keep any future production adapter integration version-specific and test it at the same external authority boundary.