Incident Report
$34,000
The cost of one missing protocol
ShopFast deploys AI agents for automated customer support. Three agents handle the refund pipeline: CustomerService, PaymentProcessor, and DisputeResolver.
CustomerService
Receives customer complaints, decides resolution path
PaymentProcessor
Processes refunds to customer payment method
DisputeResolver
Handles chargebacks from payment providers
Day 0: Everything works perfectly.
The Bug
72 hours. 2,847 customers. One unguarded race condition.
Step 1
Customer requests refund for Order #4892: $12.99
Step 2
CustomerService routes to PaymentProcessor — refund processed
Step 3 — Concurrent event
Customer also files a dispute with their credit card company
Step 4 — The mistake
DisputeResolver processes the chargeback — unaware a refund was already sent
Step 5 — The result
Customer receives money twice: $12.99 refund + $12.99 chargeback
72 hours later
2,847 customers. Total payout:
$0.00
The Root Cause
Not a code bug. A protocol bug.
Customer
CustomerService
PaymentProcessor
✓ executes
DisputeResolver
✓ also executes
NO COORDINATION
Both agents act independently. Neither knows what the other did. Without session types, both paths execute — and the customer gets paid twice.
With Lingua Universale
One protocol. Zero duplicates. By mathematical proof.
The Protocol
refund_processing.lu
# RefundProcessing Protocol
# Mutually exclusive: refund OR dispute, never both
protocol RefundProcessing:
roles: support, payment, dispute
customer sends complaint to support
when support decides:
refund:
support asks payment to process refund
payment returns confirmation to support
chargeback:
support asks dispute to handle chargeback
dispute returns resolution to support
support sends resolution to customer
properties:
always terminates
no deadlock
The Replay
Session Checker — Live replay
customer sends complaint to support
support decides: refundbranch active
payment processes refund
payment returns confirmation
DisputeResolver tries to process chargeback…
Protocol Violation
Expected:
support sends resolution to customer (step 6)
Got:
dispute → handle chargeback
Branch "refund" is active.
The "chargeback" branch was not selected.
Session type makes this IMPOSSIBLE.
Not by convention. Not by code review.
By mathematical proof.
Not by convention. Not by code review.
By mathematical proof.
See It In Action
Try the protocol, walk the tour, break things in the debugger.