Artifact Specification — Where Changing Direction Stops Being Free

Build this first

Three specs in your queue circle the same moment, and none of them draws it. Issue #13 routes stakes, reversibility, and tolerance into terminal states. Issue #8 separates receipt from incorporation from verified improvement. Issue #11 names the Authorized/Committed transition as the point where stopping ceases to be free, and then leaves it in prose.

This one goes first because it produces a single visual that does what the other three describe: the same user correction producing different system behavior depending on when it arrives and what the economics look like at that moment.

The organizing concept is the commitment boundary, the point in a workflow where changing direction starts to cost something. Corrections before it are cheap. Corrections after it require explanation, confirmation, compensation, or some mix of the three. The artifact makes the boundary visible and shows what happens on either side of it.

What the diagram shows

Left to right. It extends CarrierIQ's parallel-lane architecture.

Top strip: the correction input. One user message enters from the left, with a timestamp beneath it and a label naming the correction type: revised preference, factual override, scope change. That single instruction feeds every lane below. Each lane answers it differently.

Middle: three parallel condition lanes. Each lane runs the same workflow under different conditions. Keep CarrierIQ's carrier-lane structure — horizontal rows, stage pills reading Session, Navigate, Fill, Extract, Verify, colored progress indicators — and swap carrier identity for condition identity. Lane A carries a label like "Low stakes / Reversible / $0.03 inference / 2 min invested." Lanes B and C carry different condition sets against the same correction.

Each lane adds two elements to CarrierIQ's five-stage sequence.

The commitment boundary marker is a vertical dashed line between two stages, and its placement varies by lane. In a low-stakes reversible lane it sits late, between Extract and Verify, or past Verify entirely. In a high-stakes irreversible lane it sits early, between Navigate and Fill, because Fill triggers an external form submission that can't be withdrawn. The position of that line is the first thing a reviewer should register, before reading a single label.

The effort indicator marks any stage where the user contributed manual work: data entry during Fill, document upload during Session, manual checking during Verify. Render it as a small user icon or a distinct fill on the stage pill, so user-contributed stages read differently from system-only ones.

High user effort changes where the boundary falls. When a stage carries significant manual investment, the lane renders an advisory boundary ahead of the commitment boundary, a lighter dashed line meaning "correction after this point throws away work you did by hand." The two boundaries mark different failures. The commitment boundary is where the system can no longer undo what it did. The advisory boundary is where the system still can, but the user can't get back what they put in. At TinyFish, the mid-run corrections that produced the most operator friction in enterprise deployments were the ones that quietly discarded twenty minutes of configuration. External calls were understood to be final. Lost configuration was not expected, and nothing warned anyone it was coming.

Stage states relative to the correction. When the correction lands, each stage in each lane takes one of four treatments:

• Completed and retainable (solid, muted). Work that finished before the correction and survives it. A carrier session that was already established doesn't need re-establishing because the user changed vendor preference.
• Completed and invalidated (solid, struck through). Work that finished and is now wrong. An extracted quote from Vendor A is dead once the correction says Vendor B. Where the invalidated stage also carries an effort indicator, weight the strike-through more heavily — the user is losing their own hours, not the system's seconds.
• In-progress and redirectable (pulsing, highlighted). Work currently running that can absorb the correction without restarting. Fill can change mid-execution as long as the form hasn't submitted.
• Not yet started (outline only). Stages that will run under the corrected instruction from the beginning.

These extend CarrierIQ's running/completed/queued states. What's new is the relationship between a stage's state and the correction: what this correction means for this stage, given where the stage sits relative to the boundary. The "completed and invalidated" state came up constantly in TinyFish governance work, where an enterprise policy change would retroactively invalidate agent work that had been correct under the previous policy. Operators who couldn't tell "done and still good" from "done and now wrong" stopped trusting the dashboard and called support.

Where the Trust essay's handoffs sit. The lane states after a correction lands are the Trust essay's Output Review handoff made spatial. The user inspects what the system found, what it missed, and what the correction killed — the evidence for whether the system understood the correction before anything consequential follows. The commitment boundary is the Decision Gate. When a correction crosses it, the system stops and presents the receipt instead of auto-applying, because the downstream action is irreversible or expensive enough to need human authorization. Output Review supplies the evidence; the Decision Gate is where the user acts on it.

Right side: the change receipt. It occupies the position CarrierIQ gives the Bind Review drawer, but it reports operational effect rather than requesting approval. Four things:

1. What changed. Which stages in which lanes took the correction and will now run differently.
2. What couldn't change. Which stages had already passed the commitment boundary, each with a one-line reason: "Quote submitted to Progressive at 2:14 PM. Cannot be withdrawn."
3. What it costs. Re-inference in dollars and latency, plus the effort level selected and the rationale for it. Workflow cost, not token price: re-running tools, re-fetching external data, re-verifying results. A correction that costs two cents in tokens can cost four dollars in workflow once it invalidates a verification cycle. If the re-run uses a different effort level than the original, show both. "Previous run: high effort. Re-run: standard. Vendor-comparison tasks show no accuracy gain above standard on this carrier set."
4. What authority remains. Which pending actions the user can still cancel, redirect, or confirm. In TinyFish deployments, operators asked this before they asked whether the correction had worked. The receipt should answer it unprompted.

What each element proves to a reviewer

The commitment boundary marker is the artifact's core contribution. Every earlier spec describes the Authorized/Committed transition in concept. This renders it as a position — a line whose location moves with conditions. A reviewer reading it sees that you model system behavior as a sequence of economic transitions, not a fixed set of interface states.

The effort indicator and advisory boundary show that you treat user investment as a design variable with the same structural weight as stakes and reversibility. The advisory boundary makes a claim: the system owes the user a warning before discarding their work, even when discarding it is technically clean.

Parallel condition lanes demonstrate identical inputs producing different outputs by context. A system that asks "Are you sure?" in the same words for a three-cent reversible change and a twelve-dollar irreversible one has evaluated neither of them. The lanes are the evaluation.

The four stage treatments extend CarrierIQ's vocabulary instead of replacing it. A reviewer who has read CarrierIQ will recognize the grammar and read the addition as fluency.

The change receipt closes the Trust essay mapping: evidence in the lanes, authorization at the gate.

Same correction, two conditions

Both scenarios use the same correction: "Actually, use the smaller vendor."

Scenario A: the correction arrives before tool dispatch

Conditions. Internal cost estimate only. No forms submitted, no APIs called. Re-running the comparison costs $0.08. Two minutes invested. No stage carries an effort indicator; the user entered profile data but hasn't done manual work during execution.

What the flow shows. Commitment boundaries sit late in every lane, after Extract and before Verify. The correction lands while lanes are in Navigate or early Fill. Active stages take the redirectable treatment. Nothing is struck through. No advisory boundary appears, because no stage holds meaningful user effort. The receipt is four lines: "Vendor set updated. Re-running comparison. Est. $0.08, standard effort, 12 seconds. No prior work invalidated."

Design decision. Auto-apply. No confirmation dialog, no account of what couldn't change, because nothing couldn't. The receipt is a status line, not a negotiation.

Scenario B: the correction arrives after an irreversible external action

Conditions. A binding quote request has already gone to the original vendor. The vendor's system received and logged it; withdrawal requires a phone call and may carry a cancellation fee. Re-inference costs $3.40, because the original run used a cached context window that has since gone stale and must be rebuilt. Thirty-eight minutes invested, including manual data entry the user performed during Fill.

What the flow shows. The commitment boundary sits early, between Fill and Extract, because Fill triggered the submission. An advisory boundary appears ahead of Fill, since Fill carries a prominent effort indicator for those thirty-eight minutes. Session and Navigate read as retainable. Fill reads invalidated with the heavier strike reserved for user-contributed stages. Extract reads invalidated with a struck quote amount. Verify hasn't started.

The receipt is dense:

• What changed: "New vendor substituted. Stages after Navigate will re-execute with the corrected vendor set."
• What couldn't change: "Quote request submitted to [Original Vendor] at 2:14 PM. External system confirmed receipt. Withdrawal requires manual contact and may incur a cancellation fee. This system cannot reverse that submission."
• What it costs: "Re-inference: $3.40 (cached context expired, full rebuild required). Effort: standard — no accuracy gain from high effort on a single-vendor comparison. Estimated time: 45 seconds. Your prior data entry (38 min) for [Original Vendor] does not transfer to [New Vendor]; a new fill is required."
• What authority remains: "You may cancel the new vendor run before its Fill stage submits. You may proceed with both vendors and compare. You may contact [Original Vendor] to withdraw manually."

Design decision. No auto-apply. The system presents the receipt and waits, because the correction crossed a commitment boundary. The thirty-eight minutes appear in the lane with visual weight, as operational fact: that work doesn't transfer, and the user should know before authorizing another cycle.

Read side by side, the two scenarios carry the diagram's argument. The instruction is identical and the system behavior isn't, and the difference comes entirely from where the correction lands relative to the boundary and what the four variables — stakes, reversibility, inference cost, user effort — look like at that moment. That's evidence that you handle correction as a conditional system, not a feature with one behavior.

How inference economics enter the flow

Three conclusions from the pricing work drive visual states here.

Workflow cost diverges from token cost. Input token prices across frontier models have converged. What a correction actually costs to execute has not, because it depends on cache state, tool re-invocation, and external API fees. The receipt reports workflow cost. Token price is an infrastructure metric; workflow cost is the number the user is deciding against.

Effort escalation is not automatic. Current products show cases where escalated compute produced worse outcomes on specific task types. So effort level belongs in the flow as a visible parameter rather than a hidden default. When a correction triggers re-inference, the receipt names the level and the task-specific reason, including when the system selects a lower level than the original run. The user should be able to see that the system isn't spending more compute for appearance.

Cache invalidation multiplies correction cost. A correction that invalidates a cached context window can cost several times more to execute than one that fits inside it. The commitment boundary therefore has to account for cache boundaries, not only external-action boundaries: a stage that builds an expensive context window carries a soft boundary even when nothing external has been touched. TinyFish agent traces showed this repeatedly. The corrections that drove cost were frequently the ones that destroyed carefully constructed context, and nothing in the interface told anyone before they typed.

Company resonance

Ranked by fit.

Stripe — Senior Staff Product Designer, Data & AI. Strongest. The posting talks about shared systems, policy and edge cases, consequential trust. A flow that varies system behavior by economic condition shows how you handle platform problems where one interface serves several risk profiles. Lead with this artifact when you reach Stripe's design leader.

Anthropic — Product Designer, Safeguards. The branching logic maps cleanly: higher stakes and lower reversibility produce more conservative system behavior. A safeguards system needs to know when intervention stops being cheap, which is the question the commitment boundary answers. The "what couldn't change" section is the most relevant element here, because it puts irreversibility on screen as an explicit object.

OpenAI — Product Designer, Identity. The posting names human-to-agent authorization and stronger confirmation. The authority inventory in the receipt maps to identity's core question: who can do what, and when does that change.

Build scope

Produce. One high-fidelity diagram, landscape, showing the correction input, three condition lanes with stage pills, effort indicators, advisory and commitment markers, and the receipt panel. Beside or below it, the two annotated scenarios with callouts tying each visual element to its rationale.

Extend, don't rebuild. CarrierIQ's color system, stage-pill shape, and lane structure carry over. New work: the two boundary markers, effort indicators, four stage-state variants, receipt layout. Everything else is inherited vocabulary.

Time. If CarrierIQ's visual system is componentized in your file, the new work is those four elements plus annotation and layout. Two to three focused days for the diagram and scenarios, half a day for the annotations. The annotations do as much positioning work as the diagram, so don't shortcut them.

Where it lives. Standalone artifact page, linked from your portfolio index. It won't be discoverable from CarrierIQ's page, so every outreach message that references it carries the direct URL.