Skip to main content
HAIP separates a person’s decision from the system that might act on it. The protocol defines portable requests, responses, signatures and authority bindings. The reference service stores and authenticates those records; an executor is responsible for enforcing them before a protected effect. The service uses PostgreSQL transactions to order authority changes per tenant. A state change, its audit record, producer event and delivery job commit together. The delivery worker may retry notifications, but cannot renew a deadline or authorise an effect. For execution, independent checkpoint acceptance must precede a usable grant. Separate permanent safety records fence generations, occurrences and execution identities across restoration. The current production design permits one process per generation; a restart needs offline recovery and fresh provisioning rather than transparent failover. The generic counter exercises this boundary with one fixed mock effect. It is not a general execution engine. Live contexts, credentials, durable continuations and approval-bound execution evidence belong to Plasm’s separate integration, not to this HAIP implementation. See the protocol overview, service configuration and execution verification guide for the contracts at each boundary.