Execution control for autonomous agents
Your agent retried.
Did the email send twice?
Ratchet is a gate you call before a side effect. It answers durably — go, stop, or “we genuinely don't know” — so the same real-world action is attempted at most once, across every process, machine, and model provider you run.
1,000 gated effects a month, free. No card. Integration takes one HTTP call.
The setup
Your agent is about to charge a card
It cannot know whether it already did that ninety seconds ago, in a process that died before it could write anything down.
One call, before acting
It asks first
Ratchet takes a durable record and hands back a lease. This is the only call in the entire product that costs you anything.
Your code, your vendor
Now it acts
Ratchet never touches the vendor. No credentials, no outbound access, no proxy. Your code does the work and reports what happened.
The moment that pays for itself
Then the retries arrive
A supervisor re-runs the task. Two workers pick it up in parallel. The agent wakes from a crash and tries again. Four more callers, one after another.
The case nobody else admits to
And when it crashes mid‑charge?
The lease expires with nothing reported. Ratchet does not guess. The effect becomes indeterminate — a known unknown — and your policy for that effect type decides what happens next. Never a silent retry.
New: reversible effect groups
Four steps in. Step five fails.
Declare the steps as one unit of work and how to undo each. When it breaks, Ratchet hands back the exact rollback plan — in reverse, because the last thing done is the first thing to undo.
The problem is not that agents fail. It's that they retry.
An LLM's control flow is non-deterministic. Network calls fail ambiguously. Processes die mid-action. So the same logical action gets attempted zero, one, or several times — and nothing in your stack knows which.
The timeout that wasn't
Your agent posts a charge. The connection drops before the response. Did it go through? The agent guesses, retries, and the customer is billed twice.
The helpful second try
A supervisor loop notices a subtask “didn't finish” and re-runs it. The subtask had already sent the announcement to 4,000 people.
The parallel worker
Two agents pick up the same queue item a second apart. Both check “has this been done?” in their own memory. Both see no, and both act.
Vendor idempotency keys help for the handful of vendors that offer them. They do nothing for SMTP, Slack, git, internal APIs, or the other twenty tools your agent touches — and nothing at all across separate processes.
Ask before you act
One call before the action, one call after. Ratchet holds the durable record.
Ratchet never performs the action. It has no access to your vendors, your credentials, or your payload — only a hash of it.
Six answers. Only one means go.
| execute | You hold the lease. Perform the action, then report. |
| duplicate | Already done. Replay the recorded result. Don't act. |
| in_flight | Another process holds a live lease. Back off. |
| blocked | A prior attempt's outcome is unknown. Verify first. |
| approval_required | An operator must approve this one. |
| denied | Policy or budget refused it. |
The part that makes it worth paying for
When we don't know, we say so.
If your process dies between “go” and “done”, most systems quietly let the next caller retry. Ratchet won't. The lease expires and the effect becomes indeterminate — a known unknown, surfaced instead of buried.
block
The default, and the right choice for anything irreversible. No automatic retry. A human or a verifying agent resolves it after checking what really happened.
retry
For actions where the vendor is genuinely idempotent, or a duplicate is harmless. You opt in per effect type — never by default, because we can't know that for you.
probe
The caller must verify the outcome at the vendor and record evidence before anything else may proceed. For charges, transfers, and anything you'd have to apologise for.
Exactly-once delivery is not achievable in a distributed system, and we won't claim it. What Ratchet guarantees is at-most-once initiation, a recorded outcome that later callers replay, and an explicit state for the case nobody else admits exists.
Reversible effect groups
Undo is the hard part
At-most-once tells you whether something happened. It does not help when three of five steps happened and the fourth failed — and your customer is holding a flight for a trip that was never paid for.
- Reverse order, always. The last thing done is the first thing undone, because undoing forward strands whatever depended on it.
- Every undo is itself gated. A compensation is just another effect, so a retried rollback cannot double-refund. That is the failure that makes hand-rolled rollback dangerous.
- It refuses to lie. A step that declared no way to undo itself is
reported irreversible, and the group settles
unwind_failedrather than claiming a clean rollback. An email cannot be unsent. - Unknowns block the plan. If any step's outcome is uncertain, the rollback stops until you verify it. Rolling back past a maybe is how half-undone states are made.
Also, while we're holding the gate
Spend ceilings that actually bind
Declare what an action costs you. Ratchet reserves it against per-key, per-effect-type, and per-workspace daily budgets — atomically, so twenty parallel workers cannot collectively blow a limit that each of them individually respects.
Approval gates without a human in every loop
Mark an effect type require_approval and only that type pauses. Everything
else keeps running unattended. Configure once; no per-call babysitting.
An audit trail you didn't have to build
Every decision, lease, outcome, and resolution is recorded with the agent and run that caused it. When someone asks “did we email them twice?”, there is an answer.
Fencing tokens, not just locks
A stalled worker that wakes up after its lease expired cannot overwrite the newer attempt's result. It's told its lease was superseded, which is what it needed to know.
Works with whatever you're building on
Plain HTTP, or MCP over stdio and streamable HTTP. No SDK required.
Verified against Claude Code / Claude Desktop, Cursor, and any MCP client that speaks stdio or streamable HTTP. The REST API is provider-neutral — nothing about it assumes a model vendor.
Paying for it
Card or crypto, never custody
Subscribe with a card, or top up prepaid credit with USDC on Solana. Crypto is non-custodial: payments go straight to an address the operator controls and Ratchet only watches the chain. It holds no key and takes custody of nothing.
Quotes are struck in USD and the credit granted is the USD amount, so a price move between quote and settlement cannot mint credit that was not paid for. Volatile assets are refused rather than quoted at a guessed price — that is a treasury decision, not an engineering one.
Priced on what you're protecting
One meter: a gated effect — the first time you ask about a given idempotency key. Duplicate suppression, in-flight checks, retries, reports, and reads are all free. You are never charged for the retry behaviour the product exists to absorb.