This maps pretty closely to what happens in distributed systems under uncertainty.
If a system can’t tell whether something already happened, it tends to retry.
That’s fine for reads, but for side effects it creates a weird failure mode where you’re no longer dealing with “did it succeed or fail” but “did it happen once or multiple times”.
A lot of systems quietly accept “at least once” until the action is irreversible (payments, emails, etc.), and then the problem becomes very real.
That’s very similar to the pattern SafeAgent is trying to formalize.
What you described — (request_id, tool, input_hash, response) with a unique constraint — is basically the same core idea: treat the tool execution as a durable receipt and return the stored result on retries.
While experimenting with agents I kept seeing retries coming from multiple layers (agent loops, HTTP retries, queue workers), so the goal was to wrap that execution guard into a small library instead of re-implementing the pattern each time.
The tricky part you mentioned about error states is exactly what I ran into as well. If the execution fails you don’t want to record it in a way that blocks legitimate retries but also don’t want to silently replay a failure as if it succeeded.
Curious how you ended up modeling that in Postgres — did you separate failure states from successful receipts or just include a status flag in the same row?
Most systems solve this locally with idempotency keys, but in agent workflows the retries can come from multiple layers (agent loops, orchestration frameworks, API retries, etc.).
SafeAgent is a small execution guard that sits between the agent and the side effect. Every tool call gets a request_id, and SafeAgent records a durable execution receipt. If the same request is replayed, it returns the original receipt instead of executing again.
I put together a small reference implementation of a deterministic settlement
control layer for systems that rely on external outcome resolution
(oracles, APIs, AI agents, or humans).
The goal is to prevent premature or conflicting payouts by enforcing
finality, reconciliation, and exactly-once settlement semantics.
This is intentionally minimal and includes runnable scenarios
(clean resolution, conflicts, late signals, and majority-oracle cases).
I’m looking for technical feedback from people who’ve dealt with settlement
disputes, replay issues, or payout integrity in real systems.
I put together a small reference implementation of a deterministic settlement
control layer for systems that rely on external outcome resolution
(oracles, APIs, AI agents, or humans).
The goal is to prevent premature or conflicting payouts by enforcing
finality, reconciliation, and exactly-once settlement semantics.
This is intentionally minimal and includes runnable scenarios
(clean resolution, conflicts, late signals, and majority-oracle cases).
I’m looking for technical feedback from people who’ve dealt with settlement
disputes, replay issues, or payout integrity in real systems.
I put together a small reference implementation of a deterministic settlement
control layer for systems that rely on external outcome resolution
(oracles, APIs, AI agents, or humans).
The goal is to prevent premature or conflicting payouts by enforcing
finality, reconciliation, and exactly-once settlement semantics.
This is intentionally minimal and includes runnable scenarios
(clean resolution, conflicts, late signals, and majority-oracle cases).
If a system can’t tell whether something already happened, it tends to retry.
That’s fine for reads, but for side effects it creates a weird failure mode where you’re no longer dealing with “did it succeed or fail” but “did it happen once or multiple times”.
A lot of systems quietly accept “at least once” until the action is irreversible (payments, emails, etc.), and then the problem becomes very real.