Python and Claude · 2 of 6
The ledger.
Claude proposes. Python issues every id, checks every cap, and commits every write. The model never touches the table.
Why Python holds this
If the model can mint an order id, it can mint one that belongs to someone else. If it can set an amount, it can be talked into a large one. So the model never invents an identifier or a total it can act on. The server issues every id from random bytes, the tool that commits an order only accepts a draft the server created in this session, and each tool caps the state it can produce: a maximum total, a maximum number of items, one write at a time per session.
Credit where it is due. Staged-then-committed writes, propose, preview, approve, apply, are the reference's own design. The unguessable ids, the per-session caps, and the rule that a record cannot exist without its audit entry are mine. The ledger subclasses the reference's ChangeLedger; the reference's sequential chg-0001 ids let one merchant's operator guess another's, so they became random.
The code
skoor_harness/ledger.py, merchant agent harness. Condensed; the real stage() carries actor, timestamps, and the store/chain adapters.
CHANGE_ID_RANDOM_CHARS = 10
def new_change_id() -> str:
# token_urlsafe(8) is 11 url-safe characters; 10 of them carry 60 bits.
return "chg-" + secrets.token_urlsafe(8)[:CHANGE_ID_RANDOM_CHARS]
class AuditedChangeLedger(ChangeLedger):
"""The reference ledger with every record persisted to a change store and every
transition appended to the audit chain, before the in-memory map changes.
A record therefore never exists without its change.staged entry, and a
transition the chain refused never happened."""
def stage(self, actor: ActorKind, kind: ChangeKind, items: list[ChangeItem]) -> StagedChange:
check_guardrails(self._config, kind, items) # the reference's rules, re-run on apply
change = StagedChange(id=new_change_id(), ...) # server-issued, unguessable
self._store.save(change) # durable first
self._chain.append("change.staged", change.id) # chained second
self._changes[change.id] = change # visible last
return changeWhat it does not stop
A bad decision inside the cap. A capped refund is still a refund. Caps bound the damage; they do not judge it. Judgment is the approval step, which is a person.