1453 lines
60 KiB
XML
1453 lines
60 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
||
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
|
||
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.7.31 (Ruby 3.4.8) -->
|
||
|
||
|
||
<!DOCTYPE rfc [
|
||
<!ENTITY nbsp " ">
|
||
<!ENTITY zwsp "​">
|
||
<!ENTITY nbhy "‑">
|
||
<!ENTITY wj "⁠">
|
||
|
||
]>
|
||
|
||
|
||
<rfc ipr="trust200902" docName="draft-nennemann-agent-cascade-prevention-00" category="std" consensus="true" submissionType="IETF" tocInclude="true" sortRefs="true" symRefs="true">
|
||
<front>
|
||
<title abbrev="Agent Cascade Prevention">Agent Failure Cascade Prevention and Rollback</title>
|
||
|
||
<author fullname="Christian Nennemann">
|
||
<organization>Independent Researcher</organization>
|
||
<address>
|
||
<email>ietf@nennemann.de</email>
|
||
</address>
|
||
</author>
|
||
|
||
<date year="2026" month="March" day="06"/>
|
||
|
||
<area>OPS</area>
|
||
<workgroup>NMOP</workgroup>
|
||
<keyword>cascade prevention</keyword> <keyword>circuit breaker</keyword> <keyword>rollback</keyword> <keyword>failure domain</keyword> <keyword>agent recovery</keyword>
|
||
|
||
<abstract>
|
||
|
||
|
||
<?line 43?>
|
||
|
||
<t>This document defines protocols for preventing agent failures from
|
||
cascading across interconnected autonomous systems and standardized
|
||
mechanisms for real-time rollback of incorrect agent decisions. It
|
||
specifies a circuit breaker protocol with well-defined state
|
||
transitions, failure domain isolation through bulkhead patterns, cascade
|
||
detection via error rate and latency analysis, and a distributed
|
||
rollback coordination protocol that walks the Execution Context Token
|
||
(ECT) DAG backwards to revert agent actions to a known-good state.
|
||
This document absorbs and supersedes the concepts introduced in earlier
|
||
AERR and ATD proposals.</t>
|
||
|
||
|
||
|
||
</abstract>
|
||
|
||
|
||
|
||
</front>
|
||
|
||
<middle>
|
||
|
||
|
||
<?line 56?>
|
||
|
||
<section anchor="introduction"><name>Introduction</name>
|
||
|
||
<t>Autonomous AI agents increasingly operate in interconnected
|
||
multi-agent systems where a single agent's failure can propagate
|
||
through the network, causing widespread service disruption. The IETF
|
||
gap analysis <xref target="I-D.nennemann-agent-gap-analysis"/> identified two
|
||
critical gaps in existing standards:</t>
|
||
|
||
<t><list style="symbols">
|
||
<t><strong>Gap 2 (Cascade Prevention)</strong>: No standard mechanism exists for
|
||
containing failures within agent ecosystems. When one agent fails,
|
||
dependent agents continue sending requests to the failing agent,
|
||
amplifying the failure across the system.</t>
|
||
<t><strong>Gap 4 (Rollback)</strong>: No standard protocol exists for reverting
|
||
incorrect agent decisions. When an autonomous agent misconfigures
|
||
a network device or makes an erroneous API call, there is no
|
||
interoperable way to undo the action or coordinate rollback across
|
||
multiple affected agents.</t>
|
||
</list></t>
|
||
|
||
<t>This document addresses both gaps by defining:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>A circuit breaker protocol that stops failure propagation between
|
||
agents.</t>
|
||
<t>Failure domain isolation mechanisms that contain blast radius.</t>
|
||
<t>Cascade detection signals that identify propagating failures early.</t>
|
||
<t>A distributed rollback protocol that coordinates state reversion
|
||
across multiple agents using the ECT DAG
|
||
<xref target="I-D.nennemann-wimse-ect"/>.</t>
|
||
</list></t>
|
||
|
||
<t>This specification absorbs and supersedes the concepts from the earlier
|
||
Agent Error Recovery and Rollback (AERR) and Agent Task DAG (ATD)
|
||
proposals, consolidating cascade prevention and rollback into a single
|
||
coherent protocol built on ECT infrastructure.</t>
|
||
|
||
<t>Design principles:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>Agents that take consequential actions <bcp14>MUST</bcp14> be able to undo them,
|
||
or <bcp14>MUST</bcp14> declare them irreversible upfront.</t>
|
||
<t>Failure containment takes priority over failure diagnosis.</t>
|
||
<t>The protocol adds minimal overhead to the happy path.</t>
|
||
<t>All cascade prevention and rollback actions are recorded as ECT
|
||
nodes, providing a cryptographic audit trail.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="terminology"><name>Terminology</name>
|
||
|
||
<t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
|
||
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
|
||
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
|
||
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
|
||
appear in all capitals, as shown here.</t>
|
||
|
||
<?line -18?>
|
||
|
||
<dl>
|
||
<dt>Circuit Breaker:</dt>
|
||
<dd>
|
||
<t>A mechanism that stops an agent from propagating requests to a
|
||
failing downstream agent, preventing cascading failures. Modeled
|
||
after the electrical circuit breaker pattern used in microservice
|
||
architectures.</t>
|
||
</dd>
|
||
<dt>Failure Domain:</dt>
|
||
<dd>
|
||
<t>A bounded set of agents and resources within which a failure is
|
||
contained. Failures within a domain <bcp14>MUST NOT</bcp14> propagate beyond the
|
||
domain boundary without explicit escalation.</t>
|
||
</dd>
|
||
<dt>Blast Radius:</dt>
|
||
<dd>
|
||
<t>The set of agents and systems affected by a single agent's failure,
|
||
determinable by traversing the ECT DAG forward from the failing
|
||
node.</t>
|
||
</dd>
|
||
<dt>Cascade Detection:</dt>
|
||
<dd>
|
||
<t>The process of identifying that a failure is propagating across
|
||
agent boundaries, using signals such as error rate spikes, latency
|
||
increases, and resource exhaustion patterns.</t>
|
||
</dd>
|
||
<dt>Rollback Coordinator:</dt>
|
||
<dd>
|
||
<t>An agent or orchestrator responsible for coordinating distributed
|
||
rollback across multiple agents in a workflow, ensuring consistency
|
||
and resolving conflicts.</t>
|
||
</dd>
|
||
<dt>Checkpoint:</dt>
|
||
<dd>
|
||
<t>An ECT node recording an agent's state hash before a consequential
|
||
action, providing a restore point for rollback.</t>
|
||
</dd>
|
||
<dt>Compensating Action:</dt>
|
||
<dd>
|
||
<t>An action that semantically reverses the effect of a prior action
|
||
when direct state restoration is not possible (e.g., deleting a
|
||
resource that was created, rather than restoring a pre-creation
|
||
snapshot).</t>
|
||
</dd>
|
||
<dt>Recovery Point:</dt>
|
||
<dd>
|
||
<t>The most recent checkpoint in the ECT DAG to which an agent or
|
||
workflow can be safely rolled back without violating consistency
|
||
constraints.</t>
|
||
</dd>
|
||
</dl>
|
||
|
||
</section>
|
||
<section anchor="failure-cascade-prevention"><name>Failure Cascade Prevention</name>
|
||
|
||
<section anchor="cascade-model"><name>Cascade Model</name>
|
||
|
||
<t>When an agent fails in a multi-agent system, the failure can
|
||
propagate through multiple vectors. The following diagram
|
||
illustrates a typical cascade scenario:</t>
|
||
|
||
<figure title="Failure Cascade Propagation" anchor="fig-cascade"><artwork><![CDATA[
|
||
Agent A Agent B Agent C Agent D
|
||
| | | |
|
||
| request | | |
|
||
|--------------->| | |
|
||
| | request | |
|
||
| |--------------->| |
|
||
| | | request |
|
||
| | |--------------->|
|
||
| | | |
|
||
| | | FAILURE |
|
||
| | |<--- X ---------|
|
||
| | | |
|
||
| | error/timeout | |
|
||
| |<---------------| |
|
||
| | | |
|
||
| error/timeout | | |
|
||
|<---------------| | |
|
||
| | | |
|
||
| [CASCADE: all agents impacted by D's failure] |
|
||
| | | |
|
||
]]></artwork></figure>
|
||
|
||
<section anchor="failure-domain-taxonomy"><name>Failure Domain Taxonomy</name>
|
||
|
||
<t>Failures in agent ecosystems fall into the following categories:</t>
|
||
|
||
<dl>
|
||
<dt>Agent-Local Failure:</dt>
|
||
<dd>
|
||
<t>A failure confined to a single agent instance (e.g., out-of-memory,
|
||
logic error). The blast radius is limited to the agent itself and
|
||
its immediate callers.</t>
|
||
</dd>
|
||
<dt>Service Failure:</dt>
|
||
<dd>
|
||
<t>A failure affecting all instances of a particular agent service
|
||
(e.g., model endpoint unavailable). The blast radius includes all
|
||
agents that depend on the failing service.</t>
|
||
</dd>
|
||
<dt>Infrastructure Failure:</dt>
|
||
<dd>
|
||
<t>A failure in shared infrastructure (e.g., network partition,
|
||
certificate authority unavailable). The blast radius may span
|
||
multiple failure domains.</t>
|
||
</dd>
|
||
<dt>Semantic Failure:</dt>
|
||
<dd>
|
||
<t>An agent produces incorrect output without raising an error (e.g.,
|
||
misconfiguration, wrong decision). This is the hardest category
|
||
to detect and may propagate silently through the DAG.</t>
|
||
</dd>
|
||
</dl>
|
||
|
||
</section>
|
||
<section anchor="propagation-vectors-in-agent-ecosystems"><name>Propagation Vectors in Agent Ecosystems</name>
|
||
|
||
<t>Failures propagate through the following vectors:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t><strong>Synchronous request chains</strong>: An agent blocks waiting for a
|
||
failing downstream agent, causing its own callers to time out.</t>
|
||
<t><strong>Shared state corruption</strong>: An agent writes incorrect data to a
|
||
shared store, causing other agents reading that data to fail or
|
||
make incorrect decisions.</t>
|
||
<t><strong>Resource exhaustion</strong>: A failing agent consumes excessive
|
||
resources (connections, memory, compute), starving healthy agents.</t>
|
||
<t><strong>Retry amplification</strong>: Multiple agents retry requests to a
|
||
failing agent simultaneously, overwhelming it further.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
</section>
|
||
<section anchor="circuit-breaker-protocol"><name>Circuit Breaker Protocol</name>
|
||
|
||
<t>Each agent <bcp14>MUST</bcp14> implement a circuit breaker for every downstream
|
||
agent it communicates with.</t>
|
||
|
||
<section anchor="states"><name>States</name>
|
||
|
||
<t>The circuit breaker has four states:</t>
|
||
|
||
<dl>
|
||
<dt>CLOSED (normal):</dt>
|
||
<dd>
|
||
<t>Requests flow through normally. The agent tracks the error rate
|
||
over a sliding window (default: 60 seconds).</t>
|
||
</dd>
|
||
<dt>OPEN (failure detected):</dt>
|
||
<dd>
|
||
<t>When the error rate exceeds the configured threshold (default: 50%
|
||
over the window), the breaker opens. All requests to the
|
||
downstream agent are immediately rejected locally. The agent
|
||
<bcp14>MUST</bcp14> emit an ECT with <spanx style="verb">exec_act</spanx> value <spanx style="verb">"circuit_breaker_open"</spanx>.</t>
|
||
</dd>
|
||
<dt>HALF_OPEN (recovery probe):</dt>
|
||
<dd>
|
||
<t>After a cooldown period (default: 30 seconds), the breaker
|
||
transitions to HALF_OPEN and allows a single probe request. If
|
||
the probe succeeds, the breaker returns to CLOSED. If the probe
|
||
fails, the breaker returns to OPEN with doubled cooldown
|
||
(exponential backoff, maximum 300 seconds).</t>
|
||
</dd>
|
||
<dt>CLOSED (recovered):</dt>
|
||
<dd>
|
||
<t>When a probe succeeds in the HALF_OPEN state, the breaker returns
|
||
to CLOSED and the agent <bcp14>MUST</bcp14> emit an ECT with <spanx style="verb">exec_act</spanx> value
|
||
<spanx style="verb">"circuit_breaker_close"</spanx>.</t>
|
||
</dd>
|
||
</dl>
|
||
|
||
</section>
|
||
<section anchor="state-transition-rules"><name>State Transition Rules</name>
|
||
|
||
<figure title="Circuit Breaker State Machine" anchor="fig-circuit-fsm"><artwork><![CDATA[
|
||
error_rate > threshold
|
||
CLOSED ────────────────────────────────► OPEN
|
||
▲ │
|
||
│ probe succeeds │ cooldown expires
|
||
│ ▼
|
||
└──────────────────────────────── HALF_OPEN
|
||
│
|
||
probe fails │
|
||
▼
|
||
OPEN
|
||
(cooldown *= 2,
|
||
max 300s)
|
||
]]></artwork></figure>
|
||
|
||
<t>The following rules govern state transitions:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>CLOSED to OPEN: The error rate over the sliding window exceeds
|
||
the configured threshold. The agent <bcp14>MUST</bcp14> emit a
|
||
<spanx style="verb">"circuit_breaker_open"</spanx> ECT and reject all subsequent requests
|
||
to the downstream agent.</t>
|
||
<t>OPEN to HALF_OPEN: The cooldown timer expires. The agent <bcp14>MUST</bcp14>
|
||
allow exactly one probe request through.</t>
|
||
<t>HALF_OPEN to CLOSED: The probe request succeeds. The agent <bcp14>MUST</bcp14>
|
||
emit a <spanx style="verb">"circuit_breaker_close"</spanx> ECT and resume normal operation.
|
||
The error rate counters <bcp14>MUST</bcp14> be reset.</t>
|
||
<t>HALF_OPEN to OPEN: The probe request fails. The cooldown period
|
||
<bcp14>MUST</bcp14> be doubled (up to a maximum of 300 seconds).</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="circuit-breaker-registration-and-discovery"><name>Circuit Breaker Registration and Discovery</name>
|
||
|
||
<t>Agents <bcp14>MUST</bcp14> expose circuit breaker state at a well-known endpoint:</t>
|
||
|
||
<figure><artwork><![CDATA[
|
||
GET /.well-known/cascade/circuits HTTP/1.1
|
||
]]></artwork></figure>
|
||
|
||
<t>Response:</t>
|
||
|
||
<figure title="Circuit Breaker Status Endpoint" anchor="fig-circuits"><sourcecode type="json"><![CDATA[
|
||
{
|
||
"circuits": [
|
||
{
|
||
"downstream_agent": "spiffe://example.com/agent/router-mgr",
|
||
"state": "open",
|
||
"error_rate": 0.75,
|
||
"window_s": 60,
|
||
"last_failure_ect": "550e8400-e29b-41d4-a716-446655440099",
|
||
"cooldown_remaining_s": 22
|
||
}
|
||
]
|
||
}
|
||
]]></sourcecode></figure>
|
||
|
||
</section>
|
||
<section anchor="ect-integration"><name>ECT Integration</name>
|
||
|
||
<t>Each circuit breaker state change <bcp14>MUST</bcp14> produce an ECT node:</t>
|
||
|
||
<figure title="Circuit Breaker Open ECT" anchor="fig-cb-ect"><sourcecode type="json"><![CDATA[
|
||
{
|
||
"jti": "cb-open-uuid",
|
||
"exec_act": "circuit_breaker_open",
|
||
"par": ["error-ect-uuid"],
|
||
"ext": {
|
||
"cascade.downstream_agent":
|
||
"spiffe://example.com/agent/router-mgr",
|
||
"cascade.error_rate": 0.75,
|
||
"cascade.window_s": 60,
|
||
"cascade.cooldown_s": 30
|
||
}
|
||
}
|
||
]]></sourcecode></figure>
|
||
|
||
<figure title="Circuit Breaker Close ECT" anchor="fig-cb-close-ect"><sourcecode type="json"><![CDATA[
|
||
{
|
||
"jti": "cb-close-uuid",
|
||
"exec_act": "circuit_breaker_close",
|
||
"par": ["cb-open-uuid"],
|
||
"ext": {
|
||
"cascade.downstream_agent":
|
||
"spiffe://example.com/agent/router-mgr",
|
||
"cascade.total_cooldown_s": 30
|
||
}
|
||
}
|
||
]]></sourcecode></figure>
|
||
|
||
</section>
|
||
</section>
|
||
<section anchor="failure-domain-isolation"><name>Failure Domain Isolation</name>
|
||
|
||
<section anchor="blast-radius-containment-strategies"><name>Blast Radius Containment Strategies</name>
|
||
|
||
<t>Agents <bcp14>MUST</bcp14> implement the following containment strategies:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t><strong>Request rejection at the boundary</strong>: When a circuit breaker
|
||
opens, the agent <bcp14>MUST</bcp14> return a structured error to its callers
|
||
indicating that the downstream dependency is unavailable, rather
|
||
than propagating the failure.</t>
|
||
<t><strong>Timeout enforcement</strong>: Agents <bcp14>MUST</bcp14> enforce timeouts on all
|
||
downstream requests. The timeout <bcp14>MUST</bcp14> be shorter than the
|
||
caller's timeout to prevent timeout cascades.</t>
|
||
<t><strong>Graceful degradation</strong>: When a non-critical downstream agent
|
||
is unavailable, agents <bcp14>SHOULD</bcp14> continue operating with reduced
|
||
functionality rather than failing entirely.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="domain-boundary-enforcement"><name>Domain Boundary Enforcement</name>
|
||
|
||
<t>Failure domains are defined by the workflow topology in the ECT DAG.
|
||
Each workflow (identified by the <spanx style="verb">wid</spanx> claim) constitutes a failure
|
||
domain. Cross-workflow failures <bcp14>MUST</bcp14> be escalated through the HITL
|
||
mechanism <xref target="I-D.nennemann-agent-dag-hitl-safety"/> rather than
|
||
propagating automatically.</t>
|
||
|
||
<t>Agents at domain boundaries <bcp14>MUST</bcp14>:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>Validate all incoming requests against the circuit breaker state
|
||
of their downstream dependencies before accepting work.</t>
|
||
<t>Emit a <spanx style="verb">"circuit_breaker_open"</spanx> ECT when rejecting work due to
|
||
downstream unavailability.</t>
|
||
<t>Report domain health status via the circuits endpoint.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="bulkhead-patterns-for-agent-pools"><name>Bulkhead Patterns for Agent Pools</name>
|
||
|
||
<t>When multiple workflows share a common agent pool, the pool <bcp14>MUST</bcp14>
|
||
implement bulkhead isolation:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t><strong>Connection limits</strong>: Each workflow <bcp14>MUST</bcp14> have a maximum number
|
||
of concurrent connections to the shared agent pool.</t>
|
||
<t><strong>Queue isolation</strong>: Each workflow's requests <bcp14>MUST</bcp14> be queued
|
||
independently, preventing one workflow's backlog from blocking
|
||
others.</t>
|
||
<t><strong>Resource quotas</strong>: Shared agent pools <bcp14>SHOULD</bcp14> enforce per-workflow
|
||
resource quotas (CPU, memory, request rate).</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
</section>
|
||
<section anchor="cascade-detection"><name>Cascade Detection</name>
|
||
|
||
<section anchor="detection-signals"><name>Detection Signals</name>
|
||
|
||
<t>Agents <bcp14>MUST</bcp14> monitor the following signals for cascade detection:</t>
|
||
|
||
<dl>
|
||
<dt>Error Rate:</dt>
|
||
<dd>
|
||
<t>The ratio of failed requests to total requests over a sliding
|
||
window. An error rate exceeding the circuit breaker threshold
|
||
indicates a potential cascade.</t>
|
||
</dd>
|
||
<dt>Latency Spike:</dt>
|
||
<dd>
|
||
<t>A sudden increase in response latency (e.g., p99 latency exceeding
|
||
3x the baseline) indicates downstream congestion or failure.
|
||
Agents <bcp14>SHOULD</bcp14> track latency baselines using exponentially weighted
|
||
moving averages.</t>
|
||
</dd>
|
||
<dt>Resource Exhaustion:</dt>
|
||
<dd>
|
||
<t>Thread pool saturation, connection pool exhaustion, or memory
|
||
pressure above configured thresholds indicates that a cascade is
|
||
consuming resources.</t>
|
||
</dd>
|
||
</dl>
|
||
|
||
</section>
|
||
<section anchor="propagation-tracking-via-ect-dag-analysis"><name>Propagation Tracking via ECT DAG Analysis</name>
|
||
|
||
<t>Orchestrators <bcp14>SHOULD</bcp14> analyze the ECT DAG to detect cascading
|
||
patterns:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t><strong>Error clustering</strong>: Multiple <spanx style="verb">"circuit_breaker_open"</spanx> ECTs
|
||
referencing the same downstream agent within a short window
|
||
indicate a shared dependency failure.</t>
|
||
<t><strong>Depth-first propagation</strong>: Errors propagating along <spanx style="verb">par</spanx>
|
||
chains in the DAG indicate a synchronous cascade.</t>
|
||
<t><strong>Breadth-first propagation</strong>: Multiple sibling nodes in the
|
||
DAG failing concurrently indicate a shared infrastructure
|
||
failure.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="alert-format-and-escalation"><name>Alert Format and Escalation</name>
|
||
|
||
<t>When cascade detection identifies a propagating failure, the
|
||
detecting agent <bcp14>MUST</bcp14> emit a cascade alert ECT:</t>
|
||
|
||
<figure title="Cascade Alert ECT" anchor="fig-cascade-alert"><sourcecode type="json"><![CDATA[
|
||
{
|
||
"exec_act": "cascade_detected",
|
||
"ext": {
|
||
"cascade.pattern": "depth_first",
|
||
"cascade.affected_agents": 4,
|
||
"cascade.root_cause_ect": "error-ect-uuid",
|
||
"cascade.blast_radius": [
|
||
"spiffe://example.com/agent/a",
|
||
"spiffe://example.com/agent/b",
|
||
"spiffe://example.com/agent/c"
|
||
]
|
||
}
|
||
}
|
||
]]></sourcecode></figure>
|
||
|
||
<t>Cascade alerts with more than 3 affected agents <bcp14>SHOULD</bcp14> trigger
|
||
HITL escalation per <xref target="I-D.nennemann-agent-dag-hitl-safety"/>.</t>
|
||
|
||
</section>
|
||
</section>
|
||
</section>
|
||
<section anchor="real-time-rollback"><name>Real-Time Rollback</name>
|
||
|
||
<section anchor="rollback-model"><name>Rollback Model</name>
|
||
|
||
<t>Rollback reverses the effects of agent actions by walking the ECT
|
||
DAG backwards from the point of failure to the nearest valid
|
||
recovery point.</t>
|
||
|
||
<section anchor="walking-the-ect-dag-backwards"><name>Walking the ECT DAG Backwards</name>
|
||
|
||
<t>The rollback process follows <spanx style="verb">par</spanx> references in reverse:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>Identify the failing ECT node.</t>
|
||
<t>Find the checkpoint ECT associated with the failing action
|
||
(referenced via <spanx style="verb">par</spanx>).</t>
|
||
<t>Follow <spanx style="verb">par</spanx> references backwards to identify all downstream
|
||
actions that were caused by the checkpointed action.</t>
|
||
<t>Issue rollback requests to each affected agent in reverse
|
||
topological order.</t>
|
||
</list></t>
|
||
|
||
<figure title="Rollback Order via DAG Traversal" anchor="fig-rollback-order"><artwork><![CDATA[
|
||
Checkpoint A ──► Action A1 ──► Checkpoint B ──► Action B1
|
||
│
|
||
└──► Action B2
|
||
|
||
Rollback order: B2, B1, B, A1, A (reverse topological)
|
||
]]></artwork></figure>
|
||
|
||
</section>
|
||
<section anchor="compensating-actions-vs-state-restoration"><name>Compensating Actions vs State Restoration</name>
|
||
|
||
<t>Rollback can be performed through two mechanisms:</t>
|
||
|
||
<dl>
|
||
<dt>State Restoration:</dt>
|
||
<dd>
|
||
<t>The agent restores its state from the checkpoint snapshot. This
|
||
is the preferred mechanism when the checkpoint contains a complete
|
||
state snapshot (verified via <spanx style="verb">out_hash</spanx>).</t>
|
||
</dd>
|
||
<dt>Compensating Action:</dt>
|
||
<dd>
|
||
<t>When state restoration is not possible (e.g., the action involved
|
||
an external API call), the agent executes a compensating action
|
||
that semantically reverses the original action. Compensating
|
||
actions <bcp14>MUST</bcp14> be recorded as ECT nodes with <spanx style="verb">exec_act</spanx> value
|
||
<spanx style="verb">"compensate"</spanx>.</t>
|
||
</dd>
|
||
</dl>
|
||
|
||
</section>
|
||
<section anchor="rollback-scope"><name>Rollback Scope</name>
|
||
|
||
<t>Rollback can be scoped to three levels:</t>
|
||
|
||
<dl>
|
||
<dt>Single Agent:</dt>
|
||
<dd>
|
||
<t>Only the specified agent's checkpoint is rolled back. No
|
||
downstream propagation occurs.</t>
|
||
</dd>
|
||
<dt>Sub-DAG:</dt>
|
||
<dd>
|
||
<t>The checkpoint and all downstream checkpoints in the sub-DAG
|
||
are rolled back. This is the default when <spanx style="verb">cascade</spanx> is <spanx style="verb">true</spanx>.</t>
|
||
</dd>
|
||
<dt>Full Workflow:</dt>
|
||
<dd>
|
||
<t>All checkpoints in the workflow are rolled back and the workflow
|
||
is terminated. This requires Rollback Coordinator authorization.</t>
|
||
</dd>
|
||
</dl>
|
||
|
||
</section>
|
||
</section>
|
||
<section anchor="checkpoint-protocol"><name>Checkpoint Protocol</name>
|
||
|
||
<section anchor="checkpoint-creation"><name>Checkpoint Creation</name>
|
||
|
||
<t>An agent <bcp14>MUST</bcp14> create a checkpoint ECT before any consequential
|
||
action. An action is consequential if it modifies external state
|
||
(network configuration, database records, API calls with side
|
||
effects).</t>
|
||
|
||
<t>A checkpoint is an ECT with:</t>
|
||
|
||
<t><list style="symbols">
|
||
<t><spanx style="verb">exec_act</spanx>: <spanx style="verb">"checkpoint"</spanx></t>
|
||
<t><spanx style="verb">par</spanx>: the ECT of the action being checkpointed</t>
|
||
<t><spanx style="verb">out_hash</spanx>: SHA-256 hash of the agent's state snapshot</t>
|
||
</list></t>
|
||
|
||
<figure title="Checkpoint ECT" anchor="fig-checkpoint"><sourcecode type="json"><![CDATA[
|
||
{
|
||
"jti": "ckpt-uuid",
|
||
"exec_act": "checkpoint",
|
||
"par": ["action-ect-uuid"],
|
||
"out_hash": "sha256:...",
|
||
"ext": {
|
||
"cascade.reversible": true,
|
||
"cascade.rollback_uri":
|
||
"https://agent-b.example.com/.well-known/cascade/rollback",
|
||
"cascade.target": "router-07.example.com",
|
||
"cascade.description": "Update BGP peer configuration",
|
||
"cascade.ttl": 86400
|
||
}
|
||
}
|
||
]]></sourcecode></figure>
|
||
|
||
<t>The <spanx style="verb">cascade.reversible</spanx> field <bcp14>MUST</bcp14> be present. If <spanx style="verb">false</spanx>, the
|
||
agent declares that this action cannot be automatically undone and
|
||
rollback requests <bcp14>MUST</bcp14> be escalated to a human operator via the
|
||
HITL mechanism <xref target="I-D.nennemann-agent-dag-hitl-safety"/>.</t>
|
||
|
||
</section>
|
||
<section anchor="checkpoint-storage-and-retrieval"><name>Checkpoint Storage and Retrieval</name>
|
||
|
||
<t>Checkpoint ECTs <bcp14>MUST</bcp14> be stored for at least the duration specified
|
||
by <spanx style="verb">cascade.ttl</spanx>. Agents <bcp14>MUST</bcp14> store checkpoints in durable storage
|
||
that survives agent restarts.</t>
|
||
|
||
<t>Agents <bcp14>MUST</bcp14> expose a checkpoint retrieval endpoint:</t>
|
||
|
||
<figure><artwork><![CDATA[
|
||
GET /.well-known/cascade/checkpoints/{jti} HTTP/1.1
|
||
]]></artwork></figure>
|
||
|
||
<t>The response <bcp14>MUST</bcp14> include the checkpoint ECT and its verification
|
||
status (whether <spanx style="verb">out_hash</spanx> matches the current stored state snapshot).</t>
|
||
|
||
</section>
|
||
<section anchor="checkpoint-verification"><name>Checkpoint Verification</name>
|
||
|
||
<t>Before executing a rollback, the agent <bcp14>MUST</bcp14> verify the checkpoint
|
||
integrity:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>Retrieve the checkpoint ECT.</t>
|
||
<t>Verify the ECT signature chain (L2/L3).</t>
|
||
<t>Verify that the stored state snapshot matches <spanx style="verb">out_hash</spanx>.</t>
|
||
<t>Verify that the checkpoint has not expired (<spanx style="verb">cascade.ttl</spanx>).</t>
|
||
</list></t>
|
||
|
||
<t>If verification fails, the agent <bcp14>MUST</bcp14> reject the rollback request
|
||
and emit an error ECT.</t>
|
||
|
||
</section>
|
||
</section>
|
||
<section anchor="distributed-rollback-coordination"><name>Distributed Rollback Coordination</name>
|
||
|
||
<section anchor="rollback-coordinator-role"><name>Rollback Coordinator Role</name>
|
||
|
||
<t>For rollbacks spanning multiple agents (sub-DAG or full workflow
|
||
scope), a Rollback Coordinator <bcp14>MUST</bcp14> be designated. The coordinator
|
||
is typically the orchestrator or the agent that initiated the
|
||
workflow.</t>
|
||
|
||
<t>The coordinator is responsible for:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>Computing the blast radius by traversing the ECT DAG.</t>
|
||
<t>Determining rollback order (reverse topological sort).</t>
|
||
<t>Issuing rollback requests to each affected agent.</t>
|
||
<t>Tracking rollback progress and handling failures.</t>
|
||
<t>Emitting the final rollback completion ECT.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="two-phase-rollback-protocol"><name>Two-Phase Rollback Protocol</name>
|
||
|
||
<t>Distributed rollback follows a two-phase protocol:</t>
|
||
|
||
<t><strong>Phase 1: Prepare</strong></t>
|
||
|
||
<t>The coordinator sends a prepare request to each affected agent:</t>
|
||
|
||
<figure title="Rollback Prepare Request" anchor="fig-prepare"><artwork><![CDATA[
|
||
POST /.well-known/cascade/rollback/prepare HTTP/1.1
|
||
Content-Type: application/json
|
||
Execution-Context: <prepare-ect>
|
||
|
||
{
|
||
"rollback_id": "urn:uuid:...",
|
||
"checkpoint_id": "ckpt-uuid",
|
||
"scope": "sub_dag"
|
||
}
|
||
]]></artwork></figure>
|
||
|
||
<t>Each agent <bcp14>MUST</bcp14> respond with either:</t>
|
||
|
||
<t><list style="symbols">
|
||
<t><spanx style="verb">"prepared"</spanx>: The agent has verified its checkpoint and is ready
|
||
to roll back.</t>
|
||
<t><spanx style="verb">"cannot_prepare"</spanx>: The agent cannot roll back (e.g., checkpoint
|
||
expired, irreversible action).</t>
|
||
</list></t>
|
||
|
||
<t><strong>Phase 2: Execute</strong></t>
|
||
|
||
<t>If all agents respond <spanx style="verb">"prepared"</spanx>, the coordinator sends execute
|
||
requests in reverse topological order:</t>
|
||
|
||
<figure title="Rollback Execute Request" anchor="fig-execute"><artwork><![CDATA[
|
||
POST /.well-known/cascade/rollback HTTP/1.1
|
||
Content-Type: application/json
|
||
Execution-Context: <rollback-ect>
|
||
|
||
{
|
||
"rollback_id": "urn:uuid:...",
|
||
"checkpoint_id": "ckpt-uuid",
|
||
"phase": "execute"
|
||
}
|
||
]]></artwork></figure>
|
||
|
||
<t>If any agent responds <spanx style="verb">"cannot_prepare"</spanx> in Phase 1, the
|
||
coordinator <bcp14>MUST</bcp14> either:</t>
|
||
|
||
<t><list style="symbols">
|
||
<t>Proceed with partial rollback (if the unprepared agent is not
|
||
on the critical path), or</t>
|
||
<t>Abort the rollback and escalate to HITL.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="partial-rollback-handling"><name>Partial Rollback Handling</name>
|
||
|
||
<t>When a distributed rollback cannot be completed fully, the
|
||
coordinator <bcp14>MUST</bcp14>:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>Roll back all agents that responded <spanx style="verb">"prepared"</spanx>.</t>
|
||
<t>Record the partial rollback result in the ECT DAG.</t>
|
||
<t>Emit an ECT with <spanx style="verb">exec_act</spanx> value <spanx style="verb">"rollback_complete"</spanx> and
|
||
<spanx style="verb">cascade.status</spanx> set to <spanx style="verb">"partial"</spanx>.</t>
|
||
<t>Include the list of agents that could not be rolled back in
|
||
the <spanx style="verb">cascade.failed_agents</spanx> extension claim.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="conflict-resolution-during-concurrent-rollbacks"><name>Conflict Resolution During Concurrent Rollbacks</name>
|
||
|
||
<t>When multiple rollback requests target overlapping portions of the
|
||
ECT DAG:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>The rollback with the broader scope takes precedence (full
|
||
workflow > sub-DAG > single agent).</t>
|
||
<t>If scopes are equal, the earlier rollback request (by timestamp)
|
||
takes precedence.</t>
|
||
<t>The losing rollback request <bcp14>MUST</bcp14> be rejected with an error
|
||
indicating the conflicting rollback ID.</t>
|
||
</list></t>
|
||
|
||
<t>Agents <bcp14>MUST</bcp14> implement idempotent rollback: receiving the same
|
||
<spanx style="verb">rollback_id</spanx> twice <bcp14>MUST</bcp14> return the same result without
|
||
re-executing the rollback.</t>
|
||
|
||
</section>
|
||
</section>
|
||
<section anchor="rollback-evidence"><name>Rollback Evidence</name>
|
||
|
||
<section anchor="ect-nodes-for-rollback-actions"><name>ECT Nodes for Rollback Actions</name>
|
||
|
||
<t>Each rollback action <bcp14>MUST</bcp14> produce ECT nodes for audit:</t>
|
||
|
||
<dl>
|
||
<dt>Rollback Start:</dt>
|
||
<dd>
|
||
<t><spanx style="verb">exec_act</spanx>: <spanx style="verb">"rollback_start"</spanx>, <spanx style="verb">par</spanx> references the error ECT
|
||
that triggered the rollback.</t>
|
||
</dd>
|
||
</dl>
|
||
|
||
<figure title="Rollback Start ECT" anchor="fig-rb-start"><sourcecode type="json"><![CDATA[
|
||
{
|
||
"jti": "rb-start-uuid",
|
||
"exec_act": "rollback_start",
|
||
"par": ["error-ect-uuid"],
|
||
"ext": {
|
||
"cascade.rollback_id": "urn:uuid:...",
|
||
"cascade.checkpoint_id": "ckpt-uuid",
|
||
"cascade.scope": "sub_dag",
|
||
"cascade.reason": "Upstream cascading failure"
|
||
}
|
||
}
|
||
]]></sourcecode></figure>
|
||
|
||
<dl>
|
||
<dt>Rollback Complete:</dt>
|
||
<dd>
|
||
<t><spanx style="verb">exec_act</spanx>: <spanx style="verb">"rollback_complete"</spanx>, <spanx style="verb">par</spanx> references the rollback
|
||
start ECT.</t>
|
||
</dd>
|
||
</dl>
|
||
|
||
<figure title="Rollback Complete ECT" anchor="fig-rb-complete"><sourcecode type="json"><![CDATA[
|
||
{
|
||
"jti": "rb-complete-uuid",
|
||
"exec_act": "rollback_complete",
|
||
"par": ["rb-start-uuid"],
|
||
"out_hash": "sha256:...",
|
||
"ext": {
|
||
"cascade.rollback_id": "urn:uuid:...",
|
||
"cascade.status": "completed",
|
||
"cascade.state_hash_before": "sha256:...",
|
||
"cascade.state_hash_after": "sha256:...",
|
||
"cascade.cascaded": [
|
||
{
|
||
"agent": "spiffe://example.com/agent/monitor",
|
||
"status": "completed"
|
||
},
|
||
{
|
||
"agent": "spiffe://example.com/agent/classify",
|
||
"status": "escalated"
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]]></sourcecode></figure>
|
||
|
||
</section>
|
||
<section anchor="rollback-audit-trail"><name>Rollback Audit Trail</name>
|
||
|
||
<t>The complete rollback audit trail is captured in the ECT DAG:</t>
|
||
|
||
<figure title="Rollback Audit Trail in ECT DAG" anchor="fig-rb-audit"><artwork><![CDATA[
|
||
error ECT
|
||
│
|
||
▼
|
||
rollback_start ECT
|
||
│
|
||
├──► agent-A rollback_complete ECT
|
||
│
|
||
├──► agent-B rollback_complete ECT
|
||
│
|
||
└──► agent-C compensate ECT
|
||
]]></artwork></figure>
|
||
|
||
<t>Status values for individual agent rollbacks: <spanx style="verb">completed</spanx>,
|
||
<spanx style="verb">partial</spanx>, <spanx style="verb">escalated</spanx>, <spanx style="verb">failed</spanx>.</t>
|
||
|
||
</section>
|
||
</section>
|
||
</section>
|
||
<section anchor="ect-integration-1"><name>ECT Integration</name>
|
||
|
||
<t>This document defines the following new <spanx style="verb">exec_act</spanx> values for use
|
||
in ECT nodes <xref target="I-D.nennemann-wimse-ect"/>:</t>
|
||
|
||
<texttable title="New exec_act Values" anchor="fig-exec-act-values">
|
||
<ttcol align='left'>exec_act Value</ttcol>
|
||
<ttcol align='left'>Description</ttcol>
|
||
<c><spanx style="verb">circuit_breaker_open</spanx></c>
|
||
<c>Circuit breaker transitioned to OPEN state</c>
|
||
<c><spanx style="verb">circuit_breaker_close</spanx></c>
|
||
<c>Circuit breaker transitioned to CLOSED state</c>
|
||
<c><spanx style="verb">checkpoint</spanx></c>
|
||
<c>State snapshot before consequential action</c>
|
||
<c><spanx style="verb">rollback_start</spanx></c>
|
||
<c>Rollback initiated for a checkpoint</c>
|
||
<c><spanx style="verb">rollback_complete</spanx></c>
|
||
<c>Rollback finished (with status)</c>
|
||
<c><spanx style="verb">compensate</spanx></c>
|
||
<c>Compensating action executed in lieu of state restoration</c>
|
||
<c><spanx style="verb">cascade_detected</spanx></c>
|
||
<c>Cascading failure pattern detected</c>
|
||
</texttable>
|
||
|
||
<t>This document defines the following new <spanx style="verb">ext</spanx> claims for failure
|
||
context:</t>
|
||
|
||
<texttable title="New ext Claims for Cascade Prevention" anchor="fig-ext-claims">
|
||
<ttcol align='left'>Claim</ttcol>
|
||
<ttcol align='left'>Type</ttcol>
|
||
<ttcol align='left'>Description</ttcol>
|
||
<c><spanx style="verb">cascade.downstream_agent</spanx></c>
|
||
<c>string</c>
|
||
<c>SPIFFE ID of the downstream agent</c>
|
||
<c><spanx style="verb">cascade.error_rate</spanx></c>
|
||
<c>number</c>
|
||
<c>Error rate that triggered the circuit breaker</c>
|
||
<c><spanx style="verb">cascade.window_s</spanx></c>
|
||
<c>number</c>
|
||
<c>Sliding window duration in seconds</c>
|
||
<c><spanx style="verb">cascade.cooldown_s</spanx></c>
|
||
<c>number</c>
|
||
<c>Cooldown duration in seconds</c>
|
||
<c><spanx style="verb">cascade.reversible</spanx></c>
|
||
<c>boolean</c>
|
||
<c>Whether the checkpointed action can be undone</c>
|
||
<c><spanx style="verb">cascade.rollback_uri</spanx></c>
|
||
<c>string</c>
|
||
<c>URI for rollback requests</c>
|
||
<c><spanx style="verb">cascade.target</spanx></c>
|
||
<c>string</c>
|
||
<c>Target system of the checkpointed action</c>
|
||
<c><spanx style="verb">cascade.ttl</spanx></c>
|
||
<c>number</c>
|
||
<c>Checkpoint time-to-live in seconds</c>
|
||
<c><spanx style="verb">cascade.rollback_id</spanx></c>
|
||
<c>string</c>
|
||
<c>Unique identifier for a rollback operation</c>
|
||
<c><spanx style="verb">cascade.checkpoint_id</spanx></c>
|
||
<c>string</c>
|
||
<c>JTI of the checkpoint being rolled back</c>
|
||
<c><spanx style="verb">cascade.scope</spanx></c>
|
||
<c>string</c>
|
||
<c>Rollback scope: single, sub_dag, full_workflow</c>
|
||
<c><spanx style="verb">cascade.status</spanx></c>
|
||
<c>string</c>
|
||
<c>Rollback result status</c>
|
||
<c><spanx style="verb">cascade.reason</spanx></c>
|
||
<c>string</c>
|
||
<c>Human-readable reason for the action</c>
|
||
<c><spanx style="verb">cascade.pattern</spanx></c>
|
||
<c>string</c>
|
||
<c>Detected cascade pattern type</c>
|
||
<c><spanx style="verb">cascade.affected_agents</spanx></c>
|
||
<c>number</c>
|
||
<c>Count of agents affected by cascade</c>
|
||
<c><spanx style="verb">cascade.blast_radius</spanx></c>
|
||
<c>array</c>
|
||
<c>SPIFFE IDs of affected agents</c>
|
||
<c><spanx style="verb">cascade.cascaded</spanx></c>
|
||
<c>array</c>
|
||
<c>Per-agent rollback results</c>
|
||
<c><spanx style="verb">cascade.failed_agents</spanx></c>
|
||
<c>array</c>
|
||
<c>Agents that could not be rolled back</c>
|
||
<c><spanx style="verb">cascade.state_hash_before</spanx></c>
|
||
<c>string</c>
|
||
<c>State hash before rollback</c>
|
||
<c><spanx style="verb">cascade.state_hash_after</spanx></c>
|
||
<c>string</c>
|
||
<c>State hash after rollback</c>
|
||
<c><spanx style="verb">cascade.description</spanx></c>
|
||
<c>string</c>
|
||
<c>Human-readable description</c>
|
||
</texttable>
|
||
|
||
</section>
|
||
<section anchor="security-considerations"><name>Security Considerations</name>
|
||
|
||
<section anchor="rollback-weaponization"><name>Rollback Weaponization</name>
|
||
|
||
<t>Malicious agents could attempt to force unnecessary rollbacks to
|
||
disrupt workflows. Mitigations:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>Rollback requests <bcp14>MUST</bcp14> be authenticated via the ECT signature
|
||
chain. Only agents whose ECTs appear in the same workflow DAG
|
||
(identified by <spanx style="verb">wid</spanx>) are authorized to request rollback.</t>
|
||
<t>Rollback requests from outside the originating workflow <bcp14>MUST</bcp14> be
|
||
rejected with HTTP 403.</t>
|
||
<t>Agents <bcp14>SHOULD</bcp14> implement rate limiting on rollback requests to
|
||
prevent denial-of-service through rollback flooding.</t>
|
||
<t>The two-phase rollback protocol provides a prepare phase where
|
||
agents can validate the rollback request before committing.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="circuit-breaker-manipulation"><name>Circuit Breaker Manipulation</name>
|
||
|
||
<t>An adversary could attempt to manipulate circuit breaker state to
|
||
either prevent legitimate circuit breaking or force unnecessary
|
||
circuit breaks:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t><strong>False error injection</strong>: A malicious agent could emit false
|
||
error ECTs to trigger circuit breakers. At L2/L3
|
||
<xref target="I-D.nennemann-wimse-ect"/>, ECT signatures prevent forgery.
|
||
Agents <bcp14>SHOULD</bcp14> verify that error ECTs reference valid <spanx style="verb">par</spanx>
|
||
values within their own workflow DAG.</t>
|
||
<t><strong>Circuit breaker suppression</strong>: An adversary could attempt to
|
||
reset circuit breakers by sending successful probe responses.
|
||
Agents <bcp14>MUST</bcp14> only accept probe responses from the actual
|
||
downstream agent (verified via ECT identity binding).</t>
|
||
<t><strong>Status endpoint abuse</strong>: The <spanx style="verb">/.well-known/cascade/circuits</spanx>
|
||
endpoint reveals system health topology. This endpoint <bcp14>MUST</bcp14>
|
||
require authentication and <bcp14>SHOULD</bcp14> be restricted to agents within
|
||
the same administrative domain.</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
<section anchor="checkpoint-integrity"><name>Checkpoint Integrity</name>
|
||
|
||
<t>Checkpoint state snapshots contain sensitive system state. Agents
|
||
<bcp14>MUST</bcp14>:</t>
|
||
|
||
<t><list style="numbers" type="1">
|
||
<t>Encrypt stored checkpoint state at rest.</t>
|
||
<t>Reference checkpoint state via <spanx style="verb">out_hash</spanx> only in ECTs; <bcp14>MUST NOT</bcp14>
|
||
include checkpoint contents in ECT claims.</t>
|
||
<t>Verify <spanx style="verb">out_hash</spanx> integrity before executing rollback to prevent
|
||
rollback to a tampered state.</t>
|
||
<t>Enforce checkpoint storage quotas to prevent checkpoint flooding
|
||
attacks.</t>
|
||
<t>Purge expired checkpoints (past <spanx style="verb">cascade.ttl</spanx>).</t>
|
||
</list></t>
|
||
|
||
</section>
|
||
</section>
|
||
<section anchor="iana-considerations"><name>IANA Considerations</name>
|
||
|
||
<section anchor="registration-of-execact-values"><name>Registration of exec_act Values</name>
|
||
|
||
<t>This document requests registration of the following <spanx style="verb">exec_act</spanx>
|
||
values in the ECT exec_act registry:</t>
|
||
|
||
<texttable title="exec_act Value Registrations" anchor="fig-iana-exec-act">
|
||
<ttcol align='left'>Value</ttcol>
|
||
<ttcol align='left'>Description</ttcol>
|
||
<ttcol align='left'>Reference</ttcol>
|
||
<c><spanx style="verb">circuit_breaker_open</spanx></c>
|
||
<c>Circuit breaker transitioned to OPEN</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">circuit_breaker_close</spanx></c>
|
||
<c>Circuit breaker transitioned to CLOSED</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">checkpoint</spanx></c>
|
||
<c>State snapshot before consequential action</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">rollback_start</spanx></c>
|
||
<c>Rollback operation initiated</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">rollback_complete</spanx></c>
|
||
<c>Rollback operation finished</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">compensate</spanx></c>
|
||
<c>Compensating action executed</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">cascade_detected</spanx></c>
|
||
<c>Cascading failure pattern detected</c>
|
||
<c>This document</c>
|
||
</texttable>
|
||
|
||
</section>
|
||
<section anchor="registration-of-ext-claims"><name>Registration of ext Claims</name>
|
||
|
||
<t>This document requests registration of the <spanx style="verb">ext</spanx> claims listed in
|
||
<xref target="fig-ext-claims"/> in the ECT extension claims registry. All claims
|
||
use the <spanx style="verb">cascade.</spanx> namespace prefix.</t>
|
||
|
||
</section>
|
||
<section anchor="well-known-uri-registration"><name>Well-Known URI Registration</name>
|
||
|
||
<t>This document requests registration of the following well-known URI
|
||
suffixes per <xref target="RFC9110"/>:</t>
|
||
|
||
<texttable title="Well-Known URI Registrations" anchor="fig-iana-uris">
|
||
<ttcol align='left'>URI Suffix</ttcol>
|
||
<ttcol align='left'>Description</ttcol>
|
||
<ttcol align='left'>Reference</ttcol>
|
||
<c><spanx style="verb">cascade/circuits</spanx></c>
|
||
<c>Circuit breaker status</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">cascade/rollback</spanx></c>
|
||
<c>Rollback request endpoint</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">cascade/rollback/prepare</spanx></c>
|
||
<c>Rollback prepare endpoint</c>
|
||
<c>This document</c>
|
||
<c><spanx style="verb">cascade/checkpoints</spanx></c>
|
||
<c>Checkpoint retrieval</c>
|
||
<c>This document</c>
|
||
</texttable>
|
||
|
||
</section>
|
||
</section>
|
||
|
||
|
||
</middle>
|
||
|
||
<back>
|
||
|
||
|
||
<references title='References' anchor="sec-combined-references">
|
||
|
||
<references title='Normative References' anchor="sec-normative-references">
|
||
|
||
|
||
|
||
<reference anchor="RFC2119">
|
||
<front>
|
||
<title>Key words for use in RFCs to Indicate Requirement Levels</title>
|
||
<author fullname="S. Bradner" initials="S." surname="Bradner"/>
|
||
<date month="March" year="1997"/>
|
||
<abstract>
|
||
<t>In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
|
||
</abstract>
|
||
</front>
|
||
<seriesInfo name="BCP" value="14"/>
|
||
<seriesInfo name="RFC" value="2119"/>
|
||
<seriesInfo name="DOI" value="10.17487/RFC2119"/>
|
||
</reference>
|
||
<reference anchor="RFC8174">
|
||
<front>
|
||
<title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
|
||
<author fullname="B. Leiba" initials="B." surname="Leiba"/>
|
||
<date month="May" year="2017"/>
|
||
<abstract>
|
||
<t>RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
|
||
</abstract>
|
||
</front>
|
||
<seriesInfo name="BCP" value="14"/>
|
||
<seriesInfo name="RFC" value="8174"/>
|
||
<seriesInfo name="DOI" value="10.17487/RFC8174"/>
|
||
</reference>
|
||
<reference anchor="RFC7519">
|
||
<front>
|
||
<title>JSON Web Token (JWT)</title>
|
||
<author fullname="M. Jones" initials="M." surname="Jones"/>
|
||
<author fullname="J. Bradley" initials="J." surname="Bradley"/>
|
||
<author fullname="N. Sakimura" initials="N." surname="Sakimura"/>
|
||
<date month="May" year="2015"/>
|
||
<abstract>
|
||
<t>JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code (MAC) and/or encrypted.</t>
|
||
</abstract>
|
||
</front>
|
||
<seriesInfo name="RFC" value="7519"/>
|
||
<seriesInfo name="DOI" value="10.17487/RFC7519"/>
|
||
</reference>
|
||
<reference anchor="RFC7515">
|
||
<front>
|
||
<title>JSON Web Signature (JWS)</title>
|
||
<author fullname="M. Jones" initials="M." surname="Jones"/>
|
||
<author fullname="J. Bradley" initials="J." surname="Bradley"/>
|
||
<author fullname="N. Sakimura" initials="N." surname="Sakimura"/>
|
||
<date month="May" year="2015"/>
|
||
<abstract>
|
||
<t>JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based data structures. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and an IANA registry defined by that specification. Related encryption capabilities are described in the separate JSON Web Encryption (JWE) specification.</t>
|
||
</abstract>
|
||
</front>
|
||
<seriesInfo name="RFC" value="7515"/>
|
||
<seriesInfo name="DOI" value="10.17487/RFC7515"/>
|
||
</reference>
|
||
<reference anchor="RFC9110">
|
||
<front>
|
||
<title>HTTP Semantics</title>
|
||
<author fullname="R. Fielding" initials="R." role="editor" surname="Fielding"/>
|
||
<author fullname="M. Nottingham" initials="M." role="editor" surname="Nottingham"/>
|
||
<author fullname="J. Reschke" initials="J." role="editor" surname="Reschke"/>
|
||
<date month="June" year="2022"/>
|
||
<abstract>
|
||
<t>The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document describes the overall architecture of HTTP, establishes common terminology, and defines aspects of the protocol that are shared by all versions. In this definition are core protocol elements, extensibility mechanisms, and the "http" and "https" Uniform Resource Identifier (URI) schemes.</t>
|
||
<t>This document updates RFC 3864 and obsoletes RFCs 2818, 7231, 7232, 7233, 7235, 7538, 7615, 7694, and portions of 7230.</t>
|
||
</abstract>
|
||
</front>
|
||
<seriesInfo name="STD" value="97"/>
|
||
<seriesInfo name="RFC" value="9110"/>
|
||
<seriesInfo name="DOI" value="10.17487/RFC9110"/>
|
||
</reference>
|
||
|
||
<reference anchor="I-D.nennemann-wimse-ect" target="https://datatracker.ietf.org/doc/draft-nennemann-wimse-ect/">
|
||
<front>
|
||
<title>Execution Context Tokens for Distributed Agentic Workflows</title>
|
||
<author >
|
||
<organization></organization>
|
||
</author>
|
||
<date year="n.d."/>
|
||
</front>
|
||
</reference>
|
||
<reference anchor="I-D.nennemann-agent-dag-hitl-safety" target="https://datatracker.ietf.org/doc/draft-nennemann-agent-dag-hitl-safety/">
|
||
<front>
|
||
<title>Agent Context Policy Token: DAG Delegation with Human Override</title>
|
||
<author >
|
||
<organization></organization>
|
||
</author>
|
||
<date year="n.d."/>
|
||
</front>
|
||
</reference>
|
||
|
||
|
||
</references>
|
||
|
||
<references title='Informative References' anchor="sec-informative-references">
|
||
|
||
<reference anchor="I-D.nennemann-agent-gap-analysis" target="https://datatracker.ietf.org/doc/draft-nennemann-agent-gap-analysis/">
|
||
<front>
|
||
<title>Gap Analysis of IETF Standards for Autonomous AI Agent Networking</title>
|
||
<author >
|
||
<organization></organization>
|
||
</author>
|
||
<date year="n.d."/>
|
||
</front>
|
||
</reference>
|
||
|
||
|
||
</references>
|
||
|
||
</references>
|
||
|
||
|
||
<?line 914?>
|
||
|
||
<section numbered="false" anchor="acknowledgments"><name>Acknowledgments</name>
|
||
|
||
<t>This document absorbs and supersedes concepts from the earlier Agent
|
||
Error Recovery and Rollback (AERR) and Agent Task DAG (ATD) proposals.
|
||
It builds on the Execution Context Token specification
|
||
<xref target="I-D.nennemann-wimse-ect"/> for DAG-based audit trails and the Agent
|
||
Context Policy Token <xref target="I-D.nennemann-agent-dag-hitl-safety"/> for HITL
|
||
escalation of irreversible actions. The circuit breaker pattern is
|
||
adapted from microservice architecture best practices.</t>
|
||
|
||
</section>
|
||
|
||
|
||
</back>
|
||
|
||
<!-- ##markdown-source:
|
||
H4sIAAAAAAAAA7193XIjN7LmPZ4CS8fGSB0i1b/2mOvxWbaktrXbPzqSbO+J
|
||
CYcEVoEk3MVCGUBJzenuiY19Bsdc7cU+w16e2Kt9lHmSjcwEUEAVqZbtme1w
|
||
hLvJAgpI5O+XmeB4PGZOuUpO+Wi2lLXjL4SqWiP5kbCFKCU/M/JG1k7pmou6
|
||
5Oe6quaieDtiYj438iaOGz4/YoVwcqnNZsqtK1mpi1qs5ZSXRizcuJZ1Ldei
|
||
rscCJhgXNMG4iROMHz5ktp2vlbVK127TyCk/Pbl8wep2PZdmykrh5JTdTPkT
|
||
JowUUz56c3YxYrfavF0a3TZTPnr96s3ZiL2Vm1ttyinjfMz9i3j3IvpYmaJV
|
||
js+NFG+lwc+M3y3+Y+EpU+q1UDQGV86NLPSNNBvGROtW2uBrGOecL9qqoj0f
|
||
rYyyTomavw77xie0WYpa/UXAMqb8tC5lI+sSZj2XVgpTrHApnMu1UNWUK+kW
|
||
/zmSblJKxmpt1sKpGwnvPX9x9PjRoy/9X//46Iun/q9fPIuffvHs0TP/1y8f
|
||
PXoIfz0dH0+6A7lVayvHsnBTfHVgkJN3smiRE4507eQ7xy/1W1lbvtCGHyvr
|
||
jJq3TpYcOUIV/Adt3i4qfWtHNI8wS+mmfOVcY6eHh6VwwhlRvJVmAvuaaLM8
|
||
LHVx2GeQuJ7DwVKJd0qxHK+Uq8ZWLKTb5Mv2/OmXfKYrVWxo5VN+PPuGH8tK
|
||
LvEA+K1yK/5tuxY1f3MjjVGl/J1L37q+Q8ZUvUiPbdumlqIZi1pUG6tsvqNv
|
||
RMNn/huuFygU/MKJuhSmpOOYtU7Xeq1by2endCD8tXQgGqpe/kM2la7vkLHx
|
||
eMzF3MIEjrHLlbK81EW7hjeXcqFqaXljtNOFrmiNQQDrpRckL2GWL4xeM5JT
|
||
/LYw2lquaidNoetaFsBlotui3Vgn1xY1lPV0UH+RJVvLYiVqZdf0RiNFNXZq
|
||
LaNkA/lUXWhjZOH8MkpZKNA4dsL5qWO2kYVaKGm56CuJuCHinFtZVWPaK67D
|
||
SeaMqK0C5rIHPQ3CldUV8Z1bGd0uV3zeVm9XUpS8Ec5JA2O8tmKldLLAh2+U
|
||
4NIY2I5wEvdcCSfrYsPDcRzgp4KXnVCyuONCa1Oqmt4cN+BWwvFbUb213K0k
|
||
3yHrbO/k6HIfxQbmukV+c5rDSZpAP4HrxM8Ff1vr23q81NpTZNJjDTG32sz9
|
||
0bWNNFaWktZQ6LqQjcODN7psC1lyVXMpTKWkYbOT83McNrs8hn002orKTogT
|
||
16osK8nYZ/zUD0ZFz3K5wPXC/IWRwqp6WW24biTSFQ4oYzi2biuniPkjx92u
|
||
pJFccBwsacI/2HjShUASN2KJzOCPGTZXkzDCAbcwmN+qUtrGwOlbaW5UIeH4
|
||
TNvAwiecX64kWb+laOJB8/fvP6U6Pn7kCgwKsHDJ3a1mhVFOFaLiS9FYpOg7
|
||
sE31MsqOnTI25g8egKJ5zPeGtn3/wYMpf63jAB4FjSZDcWMcjtAJVcPcUbhB
|
||
VFTteUUW2pNywvkPK1lzXctEHdgDxnlnFP2BwbSqbiW3skYNYeTPrYTXOo3U
|
||
haFRr8AUYt1UarGBz8L3cD5es8BHtIxJt/GnfC94O4PtRrHpdutlQNVLxu9U
|
||
KbhLUaf6ix5aK1voeqGWQCZYc2ASXkrkB234WrwFRVSjBqgl8vHZKS9EVR3A
|
||
NozkyvJa4xqcNMjN80ryW7EB4rR1SRQiIYUpoz5ItCLRhXGOPN8AZy8WXu3i
|
||
EUz6Kl6UpZHWSsvn2q2IteYb0vyqXk4ZezThs90KFPWPdbrphCcIDqxzLt2t
|
||
lOgzhQU8nkRndaBQE72PE3s+5PNKWMeNKFVrJ+zJJLqtnXq1almLyo/zkrPp
|
||
1pJyMmiizYQ9hY0lqrYjY767jtCWdCGxjCUPNPBiR3HiddIOqJOPLkHzwrN9
|
||
sY8e0seP4WS82SqIIPdRs2B18ZOoYZEtT9DWnHsnN4sC+B4o4X3SwvjwpbBv
|
||
0TzszS6P91lUywfwGqsrVRINh044ThIpp2q0HqRWWaGBs2vXEXTeqspxXSNR
|
||
VL0wwjrTFq41csLYsYRT5I1RdQG0tJ79iKJ4GE68xa1b0By1U6KKduvVdxeX
|
||
fC45yk0iM2tQJCAx+EApi0oYiV9wZfxRwpC2WRhdu4xDPQOiqDiU4cYobZTb
|
||
cCBr5xoosay1VcSdoPPjlkVZWr5WtVqLCgehp+AV3ko0zQbchhXxY1V9ksRh
|
||
u7AJCGFMCdJtgaKwz1qX0h7A628UeWG8MJvG6aURzUoVXLSlctwZoaoJGNpL
|
||
adaq1pVeboAFJX8rNxzCLstHQLHRAf2fv36Dfz8/+dfvTs9PjuHvF9/OXr6M
|
||
f2H+iYtv33z38rj7Wzfy6M2rVyevj2nw6zeXPPuIjV7N/m1ETtDozdnl6ZvX
|
||
s5cjsHQu11kGz3cuSVc2RqKCs6yUtjBqTv7G86Oz//u/Hj3l79//Bx9dffzo
|
||
/wHx1ceP4ATU9DZdVxv/T7eSGyaaRgoDswg8kUY5FAZhuV3p25oDX08Ye/Bn
|
||
oMyPU/7VvGgePf3afwAbzj4MNMs+RJoNPxkMJiJu+WjLayI1s897lM7XO/u3
|
||
7N+B7smHX/1LpWrJx4/++C9fM8aOvC14TrZgyqZ8ljgSiUUQwV1AFZXq4tTw
|
||
C8aj4S/1bW2dkWLtfYA02ugii6DKJ5y/0qWsZAl2d+GkIUVYycIZ9JUGhos8
|
||
dN5a4pK1AvVNjhvMYYqVApOCszMW9MAxWira6ly3NciclQ7CEK/vUUal1a0p
|
||
OmfpdqWKFRdRTSjbOVeynPCgZzrvKtjEwEadG8rncqPrEjYIvhU9hmsRZoPj
|
||
deu4fNdUqlCOS1sIsqoTxp6j/TxH+wmbADEfLj+GY8FnmG92usjk3znUHahw
|
||
5xvQKahMc7sHThYEHJ2d8ofNSFlNGAvW/DhY87DGxuhCWgyWg0mn2YXLqJrx
|
||
VnSCiPc8iRRoRTLKwVWwLRyOTaMy26i38KCPzMglhCBD+uAsHDGX71aitRSM
|
||
+ahvwli0sEfBadAkIEEStOEa0CEIuB16n7bRNRmgRerVoTQkcSDve3kDjwPZ
|
||
59ZjNwdc1rY1KDYwvw37CZuobvx3i0oV6BgerWTxttGqdn7FcIBwQt7MIG3r
|
||
yAjkCq2EXfG5XGgMpzLDDC/D08ytkZHWwdP4JvLA/cZgDXrdyNrS9meRF4B8
|
||
hQ+5QbuA94SxULXxzph3iiSyLvI1WWo/jnFU77xU6N0HNw5WQo4Wet+ON9rS
|
||
WezJyXJywEG3EFPBAYSz90G35cAaTpYHwDwrVD6i9tPSZhsjx/gQrcHWorEr
|
||
7faBVYJndhZIDhy/1haRSeCVIh4I2cBOpJwOqqXjK9iiP3yMX+eSA2wFFNJV
|
||
BdIMvBP0xI1Cn3vAHvAv8A0oVvjsDlyZsc8+ix+jFmYsxkhdIEhsOYzBD7KA
|
||
rhA16zRdCLgjh9/IwmljfTi90FWlb0lAxNKINVNV1aJEIdrjNg3pfr84W8ha
|
||
GKWnjP31r39l3Pu8Mx7/0AfP+x8c9T84RgCOf+C9P/f4IIz0lu/Xjxznf77+
|
||
Fe8cPPjJRewa+elF3J9C/UXce+RgEb//VO418sXs9OV35ye/cuRXgGv9Nx6X
|
||
+09ZLZqwQ4BIQbjvP/KrHi1/J4W2j/zU4naN/PTi/gmr/fPR7OJodnwyRdc/
|
||
mNZ1I4JHdNw5QT/+3neCOno/5Z8t1DIk0ihb8KfRUPFGVGX0EXRvp5vJOeWX
|
||
4h0AU5votZLu7eF1fAH7wjjdZbrUZ/0URt2o7sYvNahRPxs5v4suMCa8PIn3
|
||
/btUDXhbEW2obt1YL8ZrudZmA35jpZeqIK7Y9yo9BXjAFldqrZyMYbKf2FlZ
|
||
LcCDAb8Mj2UtSwUWA1wBacBkXXgQduuqybNF04xEoIVa7y8I41TRVsL493Vh
|
||
gd/JGqwcl3VJRrmtxY1QFbi/2/dRF1ULcI2oquCOehiDoFGu6wz29C+cMHaa
|
||
QSPbN6NqblfCYByTPe1XG1BI3Bf6YWDfAetEeElySnsClvGpnazFhttG1Cmy
|
||
mGdFiPTklmXLDRzYUCrAJhirbl3TuuiSGKGs9zHJI6d9wDs7hFWQQ3lrNJh/
|
||
D8/SmhVyDqEqpgTLEhLZjAMjEVaIDjDsp3M3rKpk7aoNT4H+49k3ExKzRPL4
|
||
9+SIAO09yhYFKxG7oSeTi5p3ZwjdevDgYlMXK6NrQIWDUSxWQFTAryMF55Uu
|
||
3lp+KxTBmeDcgu7ZHTuHHAXICqAWXkpQqiCbpls3YQB3PXhwQZxEjjEcECUw
|
||
sgXcGuWyA4TMY4jgAy+ic9+9WqNf7FkfsiQxfguDYfnkviJKnk4f0XcGqNqD
|
||
B+fD4AsXmOcN0Idt1wD0voPoUd2ACCfB+Z7PDVF2z+slXuh10zq5fwBEMBgd
|
||
raSo3GrTYedPaRUO8FTMTHicFlbxqheOGXysD3T0lmoVyJPAjEC1OUB88HYl
|
||
qzUdG1+0Bgg4IWc7B16AMRFiZOxEQCyAMyJwoNZNJQkrGyAgwDcSA4+OYVhQ
|
||
sECFdVujfiBQwgvBBTCGJYCwP+NKQCalNcQ9wNZHL99cnBzzPaxxqPZBEZwH
|
||
QmCAEuSCHqg2XunQMjCZ7eO5GJozToir4LaiUPJW1aW+5XulXIi2clP++UNu
|
||
ZaHr0kJ89ebs5DXfi1oKhV+WuBYMU/LpkVdkGaF1SucA2mKkXemqTN7z7OF/
|
||
DKuBp2kd+xTQBJpoCGMnHBHdXpYL0ZtcVBHSjNYMg9qfCIKpdNGnD+N0yHKt
|
||
QJthUIh57Gv5ThZXonDX/EZUreTXI39UV35ZV7Cs0fWEsW9nL19cEYlCHQyo
|
||
rblEAs0QSoN4XlewVt5Io3RKgycdrbONg6rtcuew4+5NmNwGHWg7lwHfGSgE
|
||
ifsFzLAKX9i2wGPJiWukaw3NTpyGA7thHlDcPQqXgzQrdTuH4DjsFI39u0bX
|
||
PrkAQbNeLA74WrxT63bNnzzMuCxwuidiymCit4cQxHcEQXnZukiyWH5yQahf
|
||
KuCfPHvGt5x+UWkr8fijSPPLeFr8vK1AxClGzv+goFyhoHzdyQTjYYl//+W/
|
||
/3P/+9u/46Hhwv7+t//dX9+uP3//5X8w/3/eP47dQzq+l+8aRVldP8c9X/u3
|
||
/+OH/PLPpkzHToND+wRNdv0hMhF486lnt23603/utdq9eAgP/sQfH3x66rV4
|
||
B9Jp9/OwimRgvIDUBIVWfTtKgvBKFCtVSwiucpDJgFjwJYh37R2kRMWRE+fF
|
||
wKsWgvIS4xJtRc92eaMDe9tldzLLmMg+jNml31EtEND7E7q8VcVtO/fQbLRH
|
||
+FoKsPoGidxCVFKpCqeNxYMBJ9IEGRksFJPjQEQu34kC/GuoEckUfvADyMHr
|
||
FGPUfTENkIwJArz1hUSc3bovIQ34iN4B8dVDmCzhvH96hW4hz9hlmI200pE7
|
||
mK25I1G+YpQlv9yeSYXXhWmDLdprGwqrg83Ri77Z+WyLO3gulwpB0JAyPoaw
|
||
iSpcfQqd+Oddo+3QiyPOxsQKFsRhBVgMdj12+s3JJT+cdN8fetTi0M9m+beX
|
||
l2eHjyaP8HF2TukNScN/srpm7xnn4XTsaMr/jJL93sv3qOPEKzzZ0ZSPbKMW
|
||
Czk9PJTvwO2Wk0KvD/HbQ6NbJ814vTSjoCJGuBMYh9IQP+5s2GjKH06+eBa/
|
||
IWm8gtV8/jB+CgHwlfcfr2SBK3n27KH849OHD8fy8Zfz8dNH5dOx+OLR5+On
|
||
Tz///Nmzp08fPvzyy+6N4ayvDJQBQz0NvuPxY3zgI+P8R/Zxm7ayd6mq1vIT
|
||
fyoBCQKmPq2dXNLp+4Bg+wlDnnYpiRV8UB48CUj29E/qJ6dg48V8DNQct60q
|
||
cYOj4HDgt9vUED7VCANnTMSHShea4Uc/BYymox95TpoMGSCe669ggzjdjlOP
|
||
3285+/hdPD/49slDBmfWO6857GnXab1pJBIWjmkHUVEt3ZOqpMIysmbH8v+P
|
||
qE47UV3dizy0wTuIdAQPBCoNUc3TUBxGnJ5msrHGNVTnXGD6Z6nAg021XRcK
|
||
9+DOZKyNYwMk46NVb0BRodIEIeEOEb/38ocdCBT9HfSddvLtIfYJUF3pzYzT
|
||
iNF4fAZmUHWJ2EJAS3pGOpRWFhvAvBL4LqQiyaVIylh7JZQB97n0qLyEwvYC
|
||
CYWQSmov6CvuAXwLqCUhmumKglPhzVxA+4NtsyttXMiQUhDst/sHGx92OpR7
|
||
xI88x0UI6BsjCrloK16Csisj+uLPotb1ONbJ9p0apGuPWh6s8QU1sUDV+wPo
|
||
qbkVNxLLmBG/aWtkCFEBcJrmfQOyA5GjkVBhiBzr+fh5qNQ46Sjd1Zd4EBVx
|
||
gFCJDhUVAC+EpK7TDVZp9ZLBE1L28bG9pGzYT3F9q8prXlRCrfcpw6tcS7lS
|
||
zw6MFjDh/AhqC8Zxtlg0GQ7S15WQixqxzW9PL192Vfs7ypt77RQfP6bkY1kJ
|
||
R+s0dFkQ9hEFGlDDrO5F+YWR2H4vsE5RenC/0Ous1EgsgcQkSltNI0ouwgjK
|
||
bBU2eF2odSig+BIZRJu3WDN4ssv1TJxyLELwSsWP5WUL5Ww9cYpMqoDPsKrw
|
||
XDbaRAoQNokLby02FyT7stFv80z4PHQonPlaFeo2Qd10pnVlfe4+ovuBASzh
|
||
uogFrdc6ovlaU+Ey/o28707Txn6IWNkb9OpRRF4pxYMId86/yGgrcSMTB5g6
|
||
x/z5QOFra4xHegOQGyIZD0N3ywya7l9b2cpuRYMX/8F2rBKY/WcYU3p9HKrZ
|
||
AadNqtIgqEnmAMCo0kuqdkLInkqdCAkfQtk/t9oJJMNFf+VRLQUN3EgTJTOF
|
||
tP0kfO/o7LsO0A7RB9i2/UlWrhELrbyKilXUF1QalZvQta4V1CrlBjRUUWHV
|
||
Ur8ce8qYrz/GXj8KitA5hRMEpQL11ikuCh5F90kO9UJpC7ppAKjWQ9Q22La+
|
||
VKdAlTeoqPQa7Ty8Fxwaxl76XpwLqACjRJtty1LWsQIM9K4v15Kxdcfn2pov
|
||
v4wfxTUxzp+8I69BWAk1lPvJMhJhL3S9lDYU9kcLzYMZ9myAuHh8TZgzlJon
|
||
qCUUs0q1XFHd2FpjMgNq88QSLWlkvpOYR6EzwjYWlGgrXEy2dVJG33XZlwPs
|
||
bUB+YwAcSWsxzTrXN9vRDJsQwFfxBd4JtZG29Wrbp2u2ZOEugRCYSFMi1kSF
|
||
zjrG3iQFdpF42FfzF9kvo/JJwVhaykIxX9BYxMYF1BdJKOrKUj136XpLErqA
|
||
CvgicKgV6yHY0hV/opfkeT3xArFTibRD4vj1PLlj2bjVeKGMdWkLBuo52EOv
|
||
SLKCBOp1I8w1umKYbgyeBdAmfXWSn+wEBtUYOPHlrtdGMkFJHbwUa9P9S+Ct
|
||
WB3qvaZOq1ebLfvOU9whkUbbB/aYVdDI9gKbMxH8OIn1r960DXRU119lCavv
|
||
d4qggQsdfDFll2BwcU6Bbz85uuxHz1k4Rw9fhVTUaHe45pkQRpVwrFdI334U
|
||
Fup0KaSDIOxp7wmjtbuCVGwEMHpxeO95TPpfUdI/QjN3B4kiwV12PzW/11MF
|
||
Nbj+uC2S9G3mROkQSnryzwL5IYQ8Ss+Ecph8rbHjQ9T8Sb8jqlOuarmUhoEn
|
||
mxRPg829rzuLBZPn0KsKUVXstkHLGwuDfaVk/PeW8lUb67Jjs8d8g02eSWk1
|
||
y5s5Y3E1laZ4I9tSpwQ1LgooTIXskCpZl/NLnMQf8jegeD4PbyBUPG2Rwsps
|
||
8gcsaZKo7kjK/dZIk56Glqy04CWATtRzo3yeK6l7RbTWWl0oDDnwMLNGwVDd
|
||
Cxk4/+4SzQIuaB8d5xe4xuESs1bY2DIGwUOSGee8a4zFsl+J5arYP+DDq269
|
||
wFUFwchPJ/zU2jYhWeruSEzYZ5yYUIyAeYz2MJCFHh+oAaDMXFenzWch8fa3
|
||
f/fV0nz2KPksefT58NHnj+6Zr7l/FqhLeCWveczg1oLYuQ2bmfLnjw/480cH
|
||
/PkBnz064DM4QNx8uvM8lRMoOcYpghKIE7/BT+HsgXEvqRlBVAEj3VJabvmN
|
||
9dmf864WPBFOX0fdSANt/2nMe6uTZsUpY4NZgtMb7prAuhiLMA/hsFFiE3YP
|
||
9eG+nonxUNHUINuCIeyC7NtQxZBM4FEtS/FaU0mMaumFYXK+dyMN4QMoKLp1
|
||
V1DGf72/uwAfLei9q+aTRlVV3+jqhvpzIJ0KZk1Usfl1PwXJJDavy7D4uIwo
|
||
5J8o/tdGLVUdOwIBzEimYXzQKdhrn/P+yR359DBdl0SPrHJR6EYOWcfCx76O
|
||
0UjJK3kjK2QYqn9ADx8o/KauSJuEewvK2GmR9gHYtJp/wvlrnZeTpM23uiha
|
||
qols5+Pj2TeBJZP5fElGFozEb6M/aGk89kfJ3gLSujtfHUKcee1N9jV8e+1M
|
||
K4FmL9qqiheMYJgFDXbDV0Y4oPfGWAyRxMHwdmpEcrIMSwJtC2lJvq0lJ5Q+
|
||
/iU0SIF+6KjSFVZ9ln9xFFo5WCyKQ16iPhDg29x0BbCo3vRaYyKHdp0tyvb6
|
||
WtUCCrLWuiQXNcoOYVV7obyzVxkJZXUQGnrmtgdR1jxnW1VK5h0NkPhZj7+S
|
||
qhK8TqCThCmIQHx2dA1fgk2dRo+B0LOwo7lExz6xjjAiqpspv/h2Nn787HNq
|
||
Igpjs/aioLN25E/eNm5X7qRbZ5YwoaX1E1FhTZhsXInHzz6fTiaTOxz0rm14
|
||
NOXA2wPHm5juqjWqy7WEG1vIf5xPUg94W1I1zDJIv+ANMLBYn6J5+EU6V/9x
|
||
aovFek4Y812DIOnzb854I6XJGWjwKleNpvyPnz99uDW/03FOcMkzAQjFFNdD
|
||
ul3zhZJVGXUxgAdQeICVXNcLUVl5TQFYvIoB+rZDGziIuGezQtRghOYyh42x
|
||
/7vGi1bY0AfbAmdDxn2FlwgR+q9NgFUpKPjV8PZkoD8uwHIu6fIXKCNV8kZU
|
||
aecdAgdd0gR8hpIqfR2vpPDodekPq7MVbL7piOxcdT3hWQ6HWu56ehamAatt
|
||
aVWMzGtrbtSNtInjIgwWv26pIcgUngkbun/RQLeew/c/OfWxVz2AEUdA3Cib
|
||
RyX1W8OEukTvipwbqstlHh7fu11JzDR02oevhQOYiKbyeLIneK579ofn+H36
|
||
DvactDy5L77J0TPcIAeIq+uHDUxh7l7BFVgQK3nW2LZNjJS+7yaBnSMSi5X/
|
||
COPwvZePD18+odgnPupziFt3GGnRkQcDmP7gZClQ8wtSR8U/Jd/LuA9IdrrI
|
||
jiKtyMxyolih5FbDQInBiYZCR8J8kQBgrNNry4YGPgLbW23/uYYbhl4kjacW
|
||
mxvwupt+U+2e930QmAXfJfod6NntH3Cx/S2xqEfS8ciyKwAKDzHwXKhZ0Tt/
|
||
WW+wh9x9UTTea1Irp3zyTbKwlIkvy07ejg5Q1lns69SwyD0E+VmPx84GbmS5
|
||
Y9/rjdBsFsptDdy41cYRB0IUnI36RByMnBcR3hRwWAK+jHK+EnVZZRcBsGeU
|
||
gOvy3BgJJLdnYTSk6OoRL9GXt3p8tgJnKR5h5/odb7sZJsAdAiLAcYNjw00f
|
||
U8YePKDpHk2hUbYRRj54MDwcuP2IIEd8pCuG20oPr0TP3lzs0KJhcYdhvqhE
|
||
8Q6w2o0v8Q5G0cDVACgdh+hKxcvCxv6ysCn/ys8BDtLXjJyt6MuoEtyH1tRT
|
||
cJ06D6lTC/6Rnl+GkoKuVTu/KsVy1PMiwrr7Ab0nYWgdAGei3+hATO6BIalA
|
||
x5PTOvKTlqPrNA4HtRWjXyy5yGMhRU0qvmMIdk5xDk5JjsaVnzmf2DshcUQI
|
||
hRMlz4OyPMjvnSE3BlRmYJ/HU3+RG7LP6SJtRQw7Tnd44KtH+yzmA2oWJa6D
|
||
mIb40r357HfxV8Rw/pEMhnKI6DZtuM9g/uMBg3kipwwGxK43nfMDtLZbzh5I
|
||
6WWdvNSir/sTbjwDsDTAl9iOl6qmPUWRT1uHEw2AIJpYaDXxOE8obIH7gvYh
|
||
98bGfDaHlFFmP9Fuer8Wy3dPL1+GLJp/eSTBt16Tht797RdidS52QJVKtIab
|
||
7Xv3XkyUhYR90Yx5usqci9HOnGPUSphXn1BQslv170JAG3Nyj1aYyGVhC6Nr
|
||
30raec7kLl7j3ShOw+poDSPyh04T77NSNr0/xd8U1lYl95RKQQu8d5ZKccKr
|
||
KAfuUzfXGN3XFsMZKNMJLqe/ngOARV3RxY7HdKvHUVcFEQ5zUMSxxeRi5Ijp
|
||
9Uo0DUwERSWIilEAzjxd6QwzzD+i73OjBVh+VOzxXixZSEhMSr4HrAEbjiDO
|
||
1wFCgr8lvcL7eOanC5qJyp/kz63wtSX+QrPBPvgeOCtqDbHJutlH2vYWEe/h
|
||
qrTd5n0kGKDvtMLdBU9zUIIn41Up2Wynx5Nd5YaqlGsqNIiPT/FmD3WTZoPZ
|
||
daL+rrm7hebltFwwpo09+/t2WQZGOkYcqfxP8oTTyY1CinSVwq8R5lyQK0wP
|
||
eTzcG9jeXWN5rXAHlGJcCreJTRPc8wLCRQD2ctwobhLDSTBZg3RM15BHV5lR
|
||
2EFpOfJ40y1uw4PMfIzT78CEemv4jfXJn7JWaf3w3XYreXLgIvXxJClsQG8C
|
||
Ttu/DWu0BaAJFBmYPjymANEkAQypxjvOr9OeO44wuXzbhpfsPq8w3aeOLL42
|
||
O7X8wH8rlnf/AyX7gCcZ7OC2RyQu4IrQ3y3r2P443l9299P+/2WSm38fM3Oj
|
||
+/RL+FqumI737RL9TflvPx78trcUlbBWLTbbXxMxt/ianWn/hEMGLByYtasd
|
||
T7TeDG85vIRbDkMA5p/ulFt3ESKC76Khkuzcv4iXBqWqKc2JUttbrlu2PfbL
|
||
/+wyowQYzviAve838Pk9B/7SH3jUJdZoRI/WniQ9Qie0BOJ4wgDJfTsKulhk
|
||
D8Bo3qiyFVXwoYNzMuXXkb+uD9i1d61AjUSGgH+QY4T5tWFfy/b7yfPCxFre
|
||
Dvw/WlxrJVN1YsHuuI91ytiHdJrv0Y38wI87MJ1/YP27iMbj/JMPMMm2GrFr
|
||
/iE2cMVyxdhVSHB01yPMt86DrRX3mch3J6ZTRcsE4y9yNNBnrbbdskqjc2aH
|
||
GSKvdAgVegdpfJ0PDbyQjYZLh+0K4ERKVSF77fslR87FLQ8TxCHcRQmulGzB
|
||
ox3mrGmyXi0WTtk3qPGyyPAU/5CFlGNRuLFnLy8zr+UtDzxDLGMpB3JvtnW+
|
||
UJ84NpTnFz6ABqY8gq/5Bw5R906G/LCbG3e0BAEJIPSrl8ARZ6cvXpzw0+OQ
|
||
lhvULGZzdU1WMAtVa/MP/gpiQxehDJy5frVuNmNoy8rmu8i7Z2MaBG7Cod7I
|
||
fJKuQSmb5ii0YH5ygjRd9YHPta6kqPkHKIfwjQtbq39C8t9noPIpk8xgRvLv
|
||
zk+z2xC7oC0bTxFcNvKSgjq6hyYc2LZl5RO5KqdKmstby7HT40rdyN20ScOW
|
||
dB+1+hkK7UNxpfGaoEONQ69t77BSZzmb8b9cng535bPLaZSdTYcedTZN1DL4
|
||
1dQHogfcu9wHiGhcxZg1n80DA9um83GZTzX1+Afc9mwY/kzJGEBGzL3RE0ii
|
||
JHOeTeK1UDbLcdBI8bZor6ocKoV0eK9KtCcJbZ3dApvc/BpmziZLC0RhJmGM
|
||
2KT6gmoXeyWW+Tl7HzYdfibNOHcXPFV7Y3ugSTfB7D4ozOBEMz8913+Dy03j
|
||
wnbNgu77rknobuLtcyTp+bs4pcz0fGeH3Njbi8wEOTITZEW2/MgT+Mv8QhYt
|
||
3v91BImi0oulzfGDH6RodPitI8ZeCbhfOP76gfXkBvZbN4iaUa9KCz0D0lpo
|
||
eevybE4z/+sYXYcRXOKsnKKiJdthh9sT9lC5gz9ThE5G6HvK0qCxoH3CqazK
|
||
r/R25TtNLe8u+I7wShR8f1d/r48Oe+j2EaEKxUPkXMU2mw6beLxtA1jvB/2T
|
||
yiOIvlwtNoJ13U9zf2FVikwB6M6fPnxClfd5Y0gHOqGtxc4qak3amnVjeMkH
|
||
9VmWslaigvv5wq+XhBLHLudVaQ1mly48wObOmPsa/mQCXfUr0/wWPYo/ucLi
|
||
D0GgjbwJHXvb8r+dH7r2ib3t12C9ErVq2iopzCqx8tNshry5Ds/uuv/AaUbA
|
||
faRQJZfKqfVgCBLYDLmdZU/FPpIXUNHig0hV+65iur1snYuUXzVmvrEOhvEk
|
||
+qRuKXKk+nvAC6ccx/Q/u/vnJg5ykbFxuwttltJs8B6MnMtukmqAZDkR/qHT
|
||
7HpKvGfsm1uoqxK8rlTQQvNKP4KxbYPdRMkVdDsP1XfCSTcgB8ht+KkZvDXE
|
||
WmgdDpdzUGGJTbeK4oe/BkANnv1nu6pdUbhW9Jug6fzy+lr8pQtUJW7D5wpX
|
||
sx/6Z3wAHa+UFPPWStgxVk3dedMG0jgOhNPDO83JCfTdoaFlOBRFxsfDdSm+
|
||
SjLVquH2EH/qtHu4TT8USXllisca0hqoQUUJBQJ0BclN6GkeFFeehlqXrO4p
|
||
L0ix8ZdfrMRI9ib80I//NapwYKxLN53U+DsXocKl6M9NeSfns0yBZweP5SXR
|
||
xAuEGdj/FG/lp/QAJYN61dfhKnY4djLMaR1OMnOs+Ql6rkPzoybsGuLxsJKP
|
||
BYfUh4y1PJif8q3l+aao4sx3iCYd9slDQcOjdnYOLDUWVJy1ZiljiU9aPbbX
|
||
QOXIoObnM346ez3b6k6kl9PoRT9I7ofI0VqZ3rg8Zu7wGea1TQLexVf4OTYY
|
||
PW/FcRKGGITQW/71+1GdDzzf7z8E39k+6W9GerbNdgfy04V1HQZ09xxbIaBu
|
||
mggGbd/X/eGg7eN/IwI0mCt44krUIsJCwRnP2TyTAuvvOxlKRvDdf5VQZNAR
|
||
JKcRB2Pv3+dRAvysXCoiWdY5zrzxN1fSp6y1Mk9eX3P4eVTbiIJaU9Q7UvM/
|
||
gLn6r3hxFMAZ6dZ+o4QnV1F9d37KbLtYqHfgrmBbnv8pVI/Wwisv8IF7yfe9
|
||
hLxvdLdIYwj87+CyWDtznQMH5OdGq3yvKUKZVzZVcLXvN1Wiya9z5Ker4f0E
|
||
o7dGxYjzjlNHJocL8H0jJJ8VcJiVLJdrtN/vpwRGyPJPI3R2h3Dpjt9A2/n7
|
||
Z+QasN/x+2fpz1KeOvzRstKGKpwdP7GZ/3Abu8P1pt/dnX0zhjaNMk1D2djd
|
||
QlvY9uO3975bBd6C17IkzazwOzrD0rN4Nd2O30pSlolSNAjqA63T30zKfjGJ
|
||
zyV2gcO02Ln//wDbzfQ5qHoAAA==
|
||
|
||
-->
|
||
|
||
</rfc>
|
||
|