Writes are enabled
Sourced form fields and reversible transitions execute automatically inside the assigned workflow scope.
Inspectable demonstration
This synthetic, provider-neutral trace demonstrates MODU's execution model without exposing private code, credentials, account data, or live provider responses.
Scenario
The workflow uses sourced company data and an opaque vault credential, routes human verification as a bounded gate, resumes the same operation, executes the account action once, and captures confirmation evidence.
Sourced form fields and reversible transitions execute automatically inside the assigned workflow scope.
Passwords and one-time codes are consumed in memory and excluded from public traces and durable receipts.
The verification lease is bound to the workflow, session, origin, page and operation, then accepted once.
After a durable submit event, recovery may verify or capture completion but cannot emit another submit.
Synthetic trace
Every step below corresponds to a structured entry in demo-workflow.json.
Bind the goal, company identity, allowed origin, duplicate guard, consequences and completion criteria.
authorizedFill the sourced business email and record its source without exposing the value in public evidence.
executingConsume an opaque credential handle once inside the audited browser action.
executingIssue an expiring lease bound to the exact workflow, page, session and operation.
gate_presentedVerify a one-time signed completion; reject an expired, replayed or mismatched token.
gate_satisfiedRevalidate origin, page and action identity before another mutation.
resumingBind the requested operation, selected adapter, worker, exit status and observed result.
submittedRecord the completion marker and receipt, then disable duplicate submission.
completedWhat this proves
The trace makes the control model concrete: writes are permitted within scope, secrets remain separated, external gates do not erase state, and completion is backed by bound evidence rather than an assistant's assertion.
It does not claim a customer deployment, production certification, live provider approval, or independent security assessment.