ARCHITECTURE

Approve the action before you send it.

alienctl reads the current trusted state. It saves the approved action and an audit record in one step. Only one process can then send the action. If the result is unclear, alienctl keeps that state.

One path from goal to result

Person or operator
  ↓ Mission and Mandate
  ↓ verified identity and active policy
  ↓ exact ActionIntent and Decision
  ↓ saved attempt, audit record, and Receipt
  ↓ one connector sends the action
  ↓ saved result or outcome_unknown
  ↓ read-only check of the provider

Who controls each part

Customer

The customer controls identity, policy, credentials, deployment, and risk decisions.

alienctl

alienctl checks the request. It saves the action, controls who can send it, and records the result.

Provider

GitHub is the source of truth for the status. A GitHub read shows provider state. It does not prove approval or code quality.

How alienctl prevents unsafe repeats

Memory uses one write lock. SQLite uses one database transaction.
An idempotency key identifies one logical request for one tenant and capability.
The same request returns the same logical attempt.
A changed request with the same key causes a conflict.
Only one process can move an attempt from prepared to dispatching.
After a restart, a saved dispatching attempt cannot run again. It must be checked with the provider.
Version 1 has no queue or automatic retry for an unclear result.