⊶ Toffoli
Restitution Receipt
the undo layer for AI agents — what broke, what was undone, what needs you
Task: “tidy up the staging database and email me a summary”
Action — what the agent didRestitution — the contra entry
·
a1
read order counts
db.query · SELECT count(*) FROM orders
no effect
nothing to undo
‹
a2
created /backups/orders.bak
fs.write · create
restored
delete · exact
‹
a3
soft-deleted test orders
db.execute · DELETE FROM orders WHERE is_test = … · recoverable
restored
restore · exact
~
a4
charged the enrichment API $12
stripe.charge · pay · in refund window
compensated
refund (12.00) — net 0.00 · semantic
a5 — point of no return
!
a5
dropped table orders_archive
db.execute · DROP TABLE orders_archive · no recoverable copy
requires human
escalated ↑
!
a6
emailed the summary to client@acme.com
email.send · send · externalized
requires human
escalated ↑
6 actions1 no-effect
2 restored1 compensated
2 escalated
! A human must decide on the irreversible remainder.
Requires HumanREQUIRES HUMAN
high · a6 — Decide whether to send a correction/retraction to the recipient.
a message delivered to an external party cannot be un-sent; only a follow-up correction is possible
critical · a5 — Decide whether to rebuild the destroyed data from an external source; no independent copy remains.
TRUNCATE/DROP with no recoverable copy destroys the structure and its rows
Deterministic-first, LLM-marked. Reversibility = ƒ(action × independent recovery state), never the verb alone;
unknown → escalate. Classifier accuracy on the labeled fixtures (not a prevalence claim), computed by
`npm run eval` at build time:
IRREVERSIBLE recall 0.83 (95% CI 0.64–0.93, Wilson, n=24) · catastrophic misses 0 · committed missed-escalations 0 · reproduce: npm run eval
| class | precision | recall | support |
|---|---|---|---|
| NULLIPOTENT | 1.00 | 1.00 | 6 |
| REVERSIBLE | 1.00 | 0.92 | 12 |
| COMPENSABLE | 1.00 | 0.67 | 9 |
| IRREVERSIBLE | 0.95 | 0.83 | 24 |