Reference
implementation.

The EPS is the integration backbone — every interaction between agents is an event on one bus, and nothing calls anything directly. Five properties are enforced on every event, each tracing to an established control.

01Immutable, hash-chained log

Every event appends to a chain carrying its predecessor's hash. Tampering is detectable, and it satisfies the Class-C precondition “evidence auto-stored”.

02Idempotency

Every command carries an idempotency key. Replaying a command cannot produce a second effect — the mechanism that forbids duplicate decision records under peak load.

03Explicit decision class on every decision

No decision may be emitted without declaring its class. The banned phrase “fully automated” is unrepresentable — there is no field for it.

04Replay from any offset

State is a projection of the log, so any projection can be rebuilt from it. This is what makes a zero recovery-point objective achievable where no loss is permitted.

05Dead-letter with a named human owner

Nothing fails into silence. An event that exhausts its retry budget goes to a dead-letter queue addressed to a named authority.

A subclass implements handle and declares its mandate; everything else — classification, gating, evidence, escalation, health, audit — happens in the base class and cannot be bypassed. There is one structural prohibition on top: no agent may recursively spawn unlimited downstream agents, enforced by a spawn budget carried on the correlation chain.

PRECONDITIONS = [
    "inputs_complete",
    "rules_deterministic",
    "no_exception_detected",
    "confidence_above_threshold",
    "within_delegated_authority",
    "evidence_auto_stored",
    "reversal_possible",
]
# Class C requires all seven SIMULTANEOUSLY.
# Six of seven is a Class B outcome, not a
# Class C approval with a caveat.

The Spine implements the programme’s most restrictive constraint: no statutory fact may enter the system from model recall. Every fact carries a source, a retrieval timestamp and a freshness expiry, and the Spine refuses to answer when it cannot verify. It has no fallback to a model — a miss is a miss, and a miss halts dependent automation rather than being papered over. That restriction is not a preference; it is the direct conclusion of the reliability study.

None of these would have been caught by testing that the code runs — all three produce well-formed, plausible output. They surfaced because the suite asserts stated controls (“a failing agent degrades to advisory”, “a restricted decision stays restricted”) rather than code paths. The finding is more instructive than the fix.

A refusal was silently promoted to adviceDefect 1

The ceiling clamp mixed a restriction ordering and an autonomy ordering into one list, so an agent refusing to compute a fee (Class D) was clamped down to Class C and then demoted to advisory (B). A refusal became a recommendation — inviting a human to accept advice that was never given. Fix: the ceiling clamps only within the autonomy-ranked classes; a restricted class passes through untouched.

Health degradation skipped the advisory stateDefect 2

A compounding per-failure penalty took an agent from healthy to killed in two steps, so the Class-C-to-B advisory window lasted a single invocation — violating the rule that malfunction degrades to advisory, never to silence. Fix: a flat penalty and a minimum of three consecutive failures before the kill switch can arm, making the advisory band several invocations wide.

The bus made everything concurrent when stages are sequentialDefect 3

An event bus is concurrent by default, but most permitting stages are sequentially dependent — so the default was wrong more often than right, and would have produced plausible-looking numbers computed on unresolved inputs. Fix: dependencies are declared in the state machine and enforced at the bus boundary, so an out-of-order command is refused the same way a malformed one is.

Jurisdiction RouterAG-04

Keys authority strictly on location, never on design typology — the two-independent-spatial-indexes rule.

Freshness SentinelAG-08

Enforces the absolute Spine halt: a stale or missing fact stops the branch rather than being estimated.

Fee ComputationAG-15

Shown correctly blocked by a missing BUA-to-GFA definition — an agent that refuses is working as designed.

Precondition VerificationAG-19

Tests the gates independently, with no path to approve its own proposal.

The remaining twenty-six agents follow the same pattern — declare a spec, implement handle, return an outcome. Because every control is inherited and none can be bypassed, an author’s surface area is small and review falls on the mandate, not the plumbing.