Contracts

What are preconditions in a Traverse contract?

Preconditions are conditions that must be true before a capability can execute. They are declared in the contract and checked by the runtime before the WASM binary ever loads.

The contract's [inputs] section defines the schema and any constraints on each field. These constraints are the preconditions. If any constraint fails, the runtime moves to error state with a precondition_failed reason. The capability never runs.

Examples of preconditions

  • A party_size field must be greater than 0. Passing 0 or a negative number fails immediately.
  • A user_tier field must be one of ["standard", "premium"]. Passing "trial" fails immediately.
  • A loan_amount field must not exceed the declared credit limit. Passing a value above the limit fails before any loan logic runs.
  • A required field that is missing from the call fails immediately, regardless of other values.
# Preconditions declared in [inputs]
[[inputs.fields]]
name     = "party_size"
type     = "integer"
required = true
min      = 1
max      = 20

[[inputs.fields]]
name        = "user_tier"
type        = "string"
required    = true
allowed     = ["standard", "premium"]

Preconditions vs validation inside the capability

You can write validation logic inside your Rust capability code. That is normal application logic. Preconditions are different.

Preconditions are structural. They are declared in the contract by whoever governs the capability, not by the capability author. They are enforced by the runtime, not by the code. This means:

  • They cannot be bypassed by a bug in the implementation.
  • They apply regardless of who calls the capability — an agent, a service, or a human-facing UI.
  • They are auditable. The contract is the spec, and the spec is stored in the registry.

When a precondition fails, the trace artifact records the reason. The caller gets a clear precondition_failed error, not a mid-execution crash or a silent incorrect result.

Why this matters for AI agents

An AI agent calling a capability via MCP reads the contract before deciding to call it. The agent knows the preconditions upfront. If the agent's context does not satisfy the preconditions, it should not call the capability. If it calls anyway with invalid inputs, the runtime rejects the call before any state changes. This is one of the core mechanisms Traverse uses to make agent behavior safe and auditable.