Summary

  • The SAMP individual Internet-Draft, revision 04, adds record_revision to AI-agent CONFIG and EXEC outcomes. A changed result gets a higher revision; earlier snapshots remain in append-only audit history. Revision 03 had no such field.
  • A late success requires evidence tied to the original operation. A retry reads the latest recorded result without running the command again. If the endpoint cannot establish which revision is current, it returns back_pressure without an outcome.

A late answer cannot erase an earlier question

Consider a configuration command sent to an agent during a noisy handover. The endpoint reports indeterminate: perhaps a field changed, perhaps the reply was lost before the result was known. A dashboard that turns that cell straight into “failed” invites an operator to press the button again. One that silently overwrites it with “succeeded” loses the moment when nobody knew. Both can falsify the account of the same command.

The 28 October draft makes an operation's original reference and authenticated request binding persistent. Its first authoritative outcome starts at revision 1. If correctly bound evidence later establishes that the command succeeded, the endpoint may record revision 2. The earlier uncertainty, authorization context, evidence reference and resolution time remain in the audit trail. An identical retry retrieves the newest result. It does not execute the change twice.

The evidentiary bar is sharper than “the desired state is now visible.” Another actor could have changed the setting. The draft requires a recognized evidence profile that attributes the effect to this operation. A policy verdict or a health reading by itself cannot close an uncertain case. If a terminal outcome was already confirmed, contradictory later observations become an audit inconsistency; they do not quietly rewrite that outcome.

A failure of the audit store creates an awkward but honest pair of facts: the command may have succeeded while proof persistence failed. SAMP reports execution and audit_persistence separately if it can commit a valid current revision. If it cannot prove the latest committed revision after a crash or replica handover, it sends back_pressure without presenting an old checkpoint as current. The manager also retains the highest revision it has accepted. A lower one is a rollback anomaly; an equal number with different content is a conflict. Arrival order cannot vote a stale reply into office.

The Datatracker record lists an individual Experimental-intended proposal, with no deployment result. An authenticated trace through uncertain response, late effect evidence, revision increment and restart would show whether an implementation actually keeps this promise.

Sources: revision 04; revision 03; IETF status.