Round-Trip Commit

The commit rule under which a Steward command that would trigger an action above the Physical Intervention Threshold is not executed as heard, but is rendered back to the Steward on the verification route as the specific state change it will produce, and executed only on the Steward's confirmation of that rendering — the Transcoding Layer's response to a command that is transient for the human, lossy for the agent, and irreversible in effect.

Voice is the Steward's fastest output, and the Transcoding Layer routes the command route through it for that reason. Voice is also the channel least suited to committing something that cannot be undone. A spoken command is gone the moment it is said, so the human cannot re-read what they asked for. It reaches the agent as audio and is converted to structured intent, so the agent may have heard something other than what was meant. And when the action on the far side is physical — a shipment released, a machine started, a commitment made against inventory another agent will now count on — the Rollback Cost of acting on a misheard or misspoken command is the full cost of the action. Round-Trip Commit is the rule that reconciles the fast channel with the irreversible action.

The rule has three parts and the order matters. The command is received on the command route, by voice. Before anything executes, the system renders back to the Steward, on the verification route, what it will do: not a transcript of the words, which would only confirm that the audio was captured, but the specific state change the intent resolves to — this line, these hours, this counterparty, this commitment. The Steward confirms that rendering, and only then does the action proceed. The round trip converts a transient, lossy command into a checked one by passing it through the channel where the Steward sees fastest, which is the same channel the Transcoding Layer already uses for verification. Nothing new is built; an existing route is used twice.

The rule is scoped by reversibility, not by modality. A command that is cheap to undo does not round-trip, whether spoken or typed, because the delay would be an Authorization Trap — a gate that no longer serves a function and that the operator cannot remove. A command that clears the Physical Intervention Threshold round-trips regardless of how it was issued, because the threshold is set by the cost of a single wrong action and a typed command can be wrong too. Voice raises the probability of a mismatch between intent and instruction; irreversibility sets the cost. The rule fires on the cost.

Round-Trip Commit is distinct from Exception Architecture, which governs what the system does when it meets a state it does not recognise. Here the system has recognised the state perfectly well. What it does not yet know is whether the human meant what the system heard, and the only party who can answer that is the human — quickly, by looking. Arco projects the rule as a requirement of any Steward surface that accepts voice commands with physical effect; it is not a description of a surface Arco has built.

First used: September 2026

Edition 1 · updated September 2026