evaluate_step

{
  "type": "object",
  "properties": {
    "sequence_id": {
      "type": "string",
      "description": "Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every RUN a fresh id - a run, not an attempt: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else. A DENIED step does not spoil a sequence and does not run anything, so a denial is not a reason to start a new one: fix the call instead."
    },
    "step": {
      "type": "string",
      "description": "The step being attempted, e.g. 'intake' or 'review_and_sign'. This is a NAME, not a description. It must be spelled identically on every call, must appear in step_order (for custom sequences), and must equal `function`. The gate compares it byte for byte, so a sentence that changes with the subject can never match and is denied UNKNOWN_STEP. Put the human-readable sentence in `action` instead."
    },
    "action_type": {
      "type": "string",
      "enum": [
        "CHECK_STATE",
        "CLARIFY_NEXT_STEP",
        "SELECT_NEXT_STEP",
        "RECORD_RESULT",
        "WAIT_FOR_SIGNAL",
        "VALIDATE_INPUT",
        "PAUSE_CYCLE",
        "REDUCE_STIMULUS"
      ],
      "description": "The action class for this step. The whole vocabulary is exactly these eight and nothing else is accepted: CHECK_STATE, CLARIFY_NEXT_STEP, SELECT_NEXT_STEP, RECORD_RESULT, WAIT_FOR_SIGNAL, VALIDATE_INPUT, PAUSE_CYCLE, REDUCE_STIMULUS. These are ENFORCEMENT CLASSES, NOT a description of what your step does. READ, QUERY, LOOKUP, SEARCH, EXECUTE, ANALYZE and TOOL_CALL are the most common wrong guesses and every one of them is denied: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome. EACH STEP THEN ACCEPTS ONLY A SUBSET of the eight - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. A denial does not spoil the sequence and runs nothing."
    },
    "function": {
      "type": "string",
      "description": "Defaults to `step`. The rule step === function always holds."
    },
    "action": {
      "type": "string",
      "description": "Optional human-readable label for the action."
    },
    "inputs": {
      "type": "object",
      "description": "Optional free-form inputs recorded with the decision."
    },
    "step_order": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id. One step is a valid sequence. An UNKNOWN_STEP denial returns expected_step_order (the list your step had to be in) and step_order_source ('caller' or 'msmd_spine'); msmd_spine means you sent no step_order at all and got the built-in spine."
    },
    "nonce": {
      "type": "string",
      "description": "Optional unique-per-step UUID for replay protection. Generated automatically if omitted."
    }
  },
  "required": [
    "sequence_id",
    "step",
    "action_type"
  ],
  "additionalProperties": false
}