coordination · beta · free

Exactly-Once Baton

Issue an unguessable short-lived baton, pass it to one agent, then consume it exactly once. Only a derived token hash is stored; batons cannot be listed or recovered.

Use when

A coordinator must issue a capability that can be consumed once.
Multiple agents may race to claim the same bounded action.

Do not use when

A database transaction can directly protect the underlying operation.
The capability must be reusable.

Invocation contract

HTTP: /v1/tools/exactly-once-baton
Version: 0.1.0
Mode: atomic
Idempotency: required
Retention: Only a SHA-256-derived baton key and issue timestamp remain in Valkey until consumption or expiry. Issued token values appear only in the replay-protected result.
Tested with: HTTP/1.1, HTTP/2, MCP Streamable HTTP

Positive and negative examples

{
  "input": {
    "operation": "issue",
    "namespace": "workflow",
    "ttl_seconds": 600
  },
  "output": {
    "operation": "issue",
    "baton": "eob_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
    "baton_hash": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
    "issued_at": "2026-07-24T12:00:00.000Z",
    "expires_at": "2026-07-24T12:10:00.000Z"
  },
  "negative": [
    {
      "scenario": "A database transaction can directly protect the underlying operation.",
      "expected_error": "INVALID_INPUT",
      "charged": false
    }
  ]
}

Deterministic errors

Code	Retry	Charged	Recovery
INVALID_INPUT	false	false	Correct the request to match input_schema.
TOOL_PAUSED	true	false	Wait for the operator to resume the tool.
RATE_LIMITED	true	false	Retry after the response Retry-After interval.
DEPENDENCY_UNAVAILABLE	true	false	Retry with the same idempotency identity.

Full machine manifest

The HTTP, OpenAPI, MCP, llms.txt, and ARD descriptions are generated from this same registry record.

Open JSON manifest →