1. One command boundary
All writes are commands: typed, tenant-scoped, carrying identity and intent, idempotent by key. Reads are free; writes are governed. Human interfaces, integrations and agents all issue commands through the same gate, so there is exactly one place to enforce policy, capture audit and emit events.
2. Atomic commit of state, audit and event
A command either fully applies — state change, audit record, outbound event — or it does not apply at all. There is no window in which the ledger and the audit trail disagree, and therefore no reconciliation job between them.
3. Policies as versioned, backtested artefacts
Allocation, carrier choice, approvals, credit and replenishment rules are data, not code paths. Each version is owned, has an activation window, and can be replayed against historical commands to show what it would have decided. Activation and rollback are commands with receipts.
4. Append-only ledger and evidence
Inventory, money and promises are ledgers. Corrections are new entries with reasons; nothing is edited in place. Evidence — scan events, weights, photos, scan-triggered video, POD — is linked to the commands that produced it, retrievable by order, shipment or settlement line.
The failure model
| Failure | What happens | What never happens |
|---|---|---|
| Provider timeout (courier, gateway, GSP) | Outcome recorded as UNKNOWN with a reconciliation task | Blind retry that double-books or double-files |
| Handheld offline | Scans queue in a task journal; replay is duplicate-safe by idempotency key | Lost picks or double-counted stock |
| Integration record rejected | Queued with the failing field named; corrected and reprocessed here | Asking the other system to re-send |
| Agent performance drop | Autonomy steps back to approval-gated; kill switch available | Silent degradation |
Scale and isolation
Design horizon of 10–20 million order transactions a day, with headroom measured in transactions rather than orders so that reporting never starves a warehouse scan. Tenancy is enforced at the boundary; data resides in Indian regions by default.