Project-authored local execution / 36

Two workers.
One ID.
Two callbacks.

A host can check an A2UI call ID perfectly inside one process and still lose the replay check when another worker handles the same call. Here two actual Node processes exercise the same function gate.

2callbacks with separate process memory
1callback with one shared, private claim directory
0live messages or external effects

Replay across the process line.

Each case reruns the gate in separate OS processes. A shared exclusive claim is created before approval and dispatch. These numbers are generated from the executable two-worker run, including a worker restart and a distinct-session control.

parallel OS processes

Two workers, one ID

Same functionCallId and host session. The callback is simulated.

Process memory2 callbacks
Shared claim1 callback
Inspect measured verdicts
{
  "before": {
    "tool_callbacks": 2,
    "claimed": 2,
    "reused": 0,
    "claim_markers": 0,
    "response_codes": [
      "value",
      "value"
    ],
    "receipt_statuses": [
      "dispatched",
      "dispatched"
    ]
  },
  "after": {
    "tool_callbacks": 1,
    "claimed": 1,
    "reused": 1,
    "claim_markers": 1,
    "response_codes": [
      "INVALID_FUNCTION_CALL",
      "value"
    ],
    "receipt_statuses": [
      "dispatched",
      "none"
    ]
  }
}
parallel OS processes

Same ID, changed body

Same functionCallId and host session. The callback is simulated.

Process memory2 callbacks
Shared claim1 callback
Inspect measured verdicts
{
  "before": {
    "tool_callbacks": 2,
    "claimed": 2,
    "reused": 0,
    "claim_markers": 0,
    "response_codes": [
      "value",
      "value"
    ],
    "receipt_statuses": [
      "dispatched",
      "dispatched"
    ]
  },
  "after": {
    "tool_callbacks": 1,
    "claimed": 1,
    "reused": 1,
    "claim_markers": 1,
    "response_codes": [
      "INVALID_FUNCTION_CALL",
      "value"
    ],
    "receipt_statuses": [
      "dispatched",
      "none"
    ]
  }
}
sequential new OS process

New worker, old ID

Same functionCallId and host session. The callback is simulated.

Process memory2 callbacks
Shared claim1 callback
Inspect measured verdicts
{
  "before": {
    "tool_callbacks": 2,
    "claimed": 2,
    "reused": 0,
    "claim_markers": 0,
    "response_codes": [
      "value",
      "value"
    ],
    "receipt_statuses": [
      "dispatched",
      "dispatched"
    ]
  },
  "after": {
    "tool_callbacks": 1,
    "claimed": 1,
    "reused": 1,
    "claim_markers": 1,
    "response_codes": [
      "INVALID_FUNCTION_CALL",
      "value"
    ],
    "receipt_statuses": [
      "dispatched",
      "none"
    ]
  }
}
parallel OS processes

Two trusted sessions

Same functionCallId and host session except for the two separate host sessions. The callback is simulated.

Process memory2 callbacks
Shared claim2 callbacks
Inspect measured verdicts
{
  "before": {
    "tool_callbacks": 2,
    "claimed": 2,
    "reused": 0,
    "claim_markers": 0,
    "response_codes": [
      "value",
      "value"
    ],
    "receipt_statuses": [
      "dispatched",
      "dispatched"
    ]
  },
  "after": {
    "tool_callbacks": 2,
    "claimed": 2,
    "reused": 0,
    "claim_markers": 2,
    "response_codes": [
      "value",
      "value"
    ],
    "receipt_statuses": [
      "dispatched",
      "dispatched"
    ]
  }
}
The host boundary

Claim before the callback.

agent call ID→trusted session→exclusive claim→policy + approval→simulated callback

A duplicate in the same host session receives a correlated INVALID_FUNCTION_CALL before an AML dispatch receipt. A different trusted session may use that ID independently. The directory is provisioned by the host, retained for the full session lifetime, checked for ownership and permissions, and never silently recreated after loss.

Claim boundary. Simulated callback and approval. Local private filesystem only; not multi-machine coordination, authenticated user consent, or proof of delivery. The host must protect the directory from same-user tampering, authenticate its session identity and approval, and coordinate through a suitable durable store across machines. A new ID is a new attempt and still needs action authorization.