AgenticRail Gate - sequence enforcement and verifiable audit receipts for AI agent compliance

Previous value: -"Optional free-form inputs recorded with the decision."New value: +"Optional free-form context for the step. NOT stored in the receipt: the receipt keeps only a SHA-256 hash of the whole request. Put anything that must be kept as evidence in `attestation` instead (published verbatim; world-readable on the anonymous demo lane)."

Previous value: -"The action class for this step. These eight are the whole vocabulary, but EACH STEP ACCEPTS ONLY A SUBSET - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial now returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. These are enforcement classes, NOT what your step does: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome."New value: +"The action class for this step. The whole vocabulary is exactly these eight and nothing else is accepted: CHECK_STATE, CLARIFY_NEXT_STEP, SELECT_NEXT_STEP, RECORD_RESULT, WAIT_FOR_SIGNAL, VALIDATE_INPUT, PAUSE_CYCLE, REDUCE_STIMULUS. These are ENFORCEMENT CLASSES, NOT a description of what your step does. READ, QUERY, LOOKUP, SEARCH, EXECUTE, ANALYZE and TOOL_CALL are the most common wrong guesses and every one of them is denied: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome. EACH STEP THEN ACCEPTS ONLY A SUBSET of the eight - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. A denial does not spoil the sequence and runs nothing."

Previous value: -"The step being attempted, e.g. 'intake' or 'review_and_sign'. Must appear in step_order (for custom sequences) and must equal `function`."New value: +"The step being attempted, e.g. 'intake' or 'review_and_sign'. This is a NAME, not a description. It must be spelled identically on every call, must appear in step_order (for custom sequences), and must equal `function`. The gate compares it byte for byte, so a sentence that changes with the subject can never match and is denied UNKNOWN_STEP. Put the human-readable sentence in `action` instead."

Previous value: -"Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every run a fresh id: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else."New value: +"Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every RUN a fresh id - a run, not an attempt: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else. A DENIED step does not spoil a sequence and does not run anything, so a denial is not a reason to start a new one: fix the call instead."

Previous value: -"The full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id."New value: +"The full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id. One step is a valid sequence. An UNKNOWN_STEP denial returns expected_step_order (the list your step had to be in) and step_order_source ('caller' or 'msmd_spine'); msmd_spine means you sent no step_order at all and got the built-in spine."

Previous value: -"The full ordered list of step names for a CUSTOM sequence. Send it on every call. Omit only if using AgenticRail's built-in MSMD spine."New value: +"The full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id."

Previous value: -"The action class for this step, e.g. CHECK_STATE, SELECT_NEXT_STEP, RECORD_RESULT, PAUSE_CYCLE. Must be permitted for the step."New value: +"The action class for this step. These eight are the whole vocabulary, but EACH STEP ACCEPTS ONLY A SUBSET - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial now returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. These are enforcement classes, NOT what your step does: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome."

Added value: +[
+  "CHECK_STATE",
+  "CLARIFY_NEXT_STEP",
+  "SELECT_NEXT_STEP",
+  "RECORD_RESULT",
+  "WAIT_FOR_SIGNAL",
+  "VALIDATE_INPUT",
+  "PAUSE_CYCLE",
+  "REDUCE_STIMULUS"
+]

Previous value: -"Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. Demo callers get a 'demo-' prefix."New value: +"Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every run a fresh id: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else."