Ripple

Tell Alexa one thing that changed. Ripple fixes what breaks downstream.

Comment

Inspiration / problem

Plans rarely break one thing. A cancelled flight can invalidate a ride, dinner reservation, grocery delivery, pet-care window and tomorrow's meeting. The user has to discover that cascade manually while already handling the original disruption.

Ripple starts from one changed fact and repairs what actually breaks downstream.

The user says:

“Our flight home was cancelled. We’ll land tomorrow at six.”

Ripple replies:

5 commitments are affected. $116 is at risk. Ripple can repair the cascade for $42 and preserve $74. Approve $42 repair?

After exact approval, Ripple executes only the disclosed actions, returns five authoritative receipts, and makes an exact replay produce zero new provider writes.

The core flow is:

change → dependency analysis → consequences → economic exposure → optimized repair → exact approval → bounded execution → durable receipts

Why Alexa+

Disruptions are divided-attention moments when opening five apps is the wrong interface. One utterance captures the changed fact; one compact voice + visual proposal explains the cascade; one exact approval authorizes only that snapshot.

Ripple uses Alexa+'s self-hosted MCP path as an agentic orchestration surface rather than as a Q&A wrapper. The Repair Card is a real display-only MCP App resource, so screen and voice expose the same consequences, money and approval boundary.

If an official Alexa+ production client is unavailable for the final demo, Ripple uses the rules-permitted simulated Alexa+ experience backed by the real public MCP server. No actual Alexa+ production-client session is claimed unless it is actually exercised.

What Ripple does

Ripple:

normalizes one changed fact; propagates it through a dependency graph; identifies only commitments now invalid or at risk; evaluates declarative repair options by avoidable loss − repair cost; applies deterministic safety and policy rules; presents one money-first Repair Card and exact approval; executes bounded, idempotent actions; records authoritative receipts and leaves unresolved work visible.

The LLM never chooses the money-spending repair and never receives write authority.

Golden scenario — executable evidence

5 downstream impacts $116 direct avoidable loss $42 repair cost $74 net direct cash preserved 0 provider writes during preview 0 provider writes during approval 5 authoritative execution receipts exact replay: 5/5 deduplicated fresh-session replay: authoritative unique-write count remains 5 → 5, proving 0 new provider writes

These dollar values are deterministic scenario fixtures used to demonstrate the economic decision logic; they are not market-price or ROI claims.

The canonical public judge-evidence endpoint is also adversarially gated. The frozen AWS release passed 7/7 scenarios for six consecutive public reads, including missed-deadline fail-closed behavior, ambiguous-provider blocking, hard-preference enforcement, approval-content drift detection and interruption recovery.

Real-world problem anchor

The underlying disruption problem is not an edge case. U.S. Department of Transportation Bureau of Transportation Statistics 2025 on-time-performance data reports 7,736,770 operating-carrier flight operations, including 1,685,316 delayed arrivals (21.78%) and 118,168 cancellations (1.53%).

Source: U.S. DOT Bureau of Transportation Statistics — 2025 On-Time Performance

Ripple does not treat those figures as a TAM estimate and does not assume every disruption creates a Ripple repair cascade. They anchor only the scale of the real schedule-disruption stream on top of which downstream coordination failures can occur.

Generality proof — Event Operations

Ripple is not travel-hardcoded. A second deterministic scenario models a conference-time change across AV delivery, catering, VIP transport, security staffing and a sponsor briefing:

$5,800 avoidable loss $620 repair cost $5,180 net cash preserved

A cheaper repair option is intentionally included but rejected because it preserves less net value. The same consequence graph, economic optimizer, exact-approval boundary and receipt system are used outside travel.

Safety architecture

LLM proposes → deterministic policy validates → user approves exact plan → bounded/idempotent execution → authoritative receipts

The approval binds to exact content, scope, cost and snapshot hash. Preview and approval perform zero provider writes. Provider preflight happens before execution. Durable idempotency and receipts suppress duplicate writes across replay, restart and fresh sessions.

How we built it

Ripple is a self-hosted MCP 2025-11-25 Streamable HTTP server with OAuth discovery, service credentials, authorization-code + PKCE S256, refresh-token support, stateful MCP sessions and five bounded tools:

record_change preview_repair_plan approve_repair_plan execute_repair_plan get_repair_status

The canonical public runtime runs on AWS ECS Express Mode / Fargate. Amazon Bedrock / Nova 2 Lite is used only for changed-fact normalization. DynamoDB holds durable proposal/approval state, idempotency records and authoritative receipts. CloudWatch stores redacted structured traces. Runtime identity uses IAM task roles and deployment uses GitHub OIDC; no static AWS access keys are committed.

The release boundary ties one exact Git SHA to an immutable ECR digest, ECS task definition, repeated public /readyz source-revision checks, repeated public 7/7 judge-evidence checks, authenticated MCP/OAuth smoke, live Bedrock normalization and durable fresh-session replay.

Challenges

The hardest problems were not generating a plan, but proving safe interoperability and exact runtime truth:

Alexa-compatible OAuth refresh behavior; MCP App resource binding and rendering contracts; Local Inspector request-shape compatibility; add-on media/package validation; ECS infrastructure-role identity continuity; deterministic judge evidence that never collides with production durable state; proving that the exact source revision judges reach publicly is the exact revision that passed the release gates.

Ripple turned those integration problems into executable tests and evidence gates.

Accomplishments

canonical public AWS runtime on an exact frozen SHA; MCP 2025-11-25 Streamable HTTP; exact approval binding to snapshot, scope and cost; zero provider writes before approval; durable restart/session recovery; authoritative receipts and duplicate-free replay; money-first display-only MCP App Repair Card; Alexa+ package/media validation; one bounded real external-provider proof through GitHub Issues; deterministic adversarial/failure matrix; public judge evidence stable at 7/7 for six consecutive reads; exact-SHA ECR/ECS/public-runtime proof with temporary deployment privilege removed afterward.

What we learned

Probabilistic interpretation and transaction authority should be separated. Bedrock is valuable at the language boundary; deterministic application code owns dependency state, economics, approval and execution.

And “deployed” is not enough evidence. Exact source revision, immutable image digest, control-plane convergence, public readiness, authenticated smoke and durable replay must agree.

Testing instructions

Canonical frozen source: c6766c5919ea903530a8da2d526d64a49b7f0578

Judge demo: https://ri-9fd0e66d62464ec4ae642ccf46e6864d.ecs.eu-central-1.on.aws/demo

Public runtime: https://ri-9fd0e66d62464ec4ae642ccf46e6864d.ecs.eu-central-1.on.aws

Public MCP endpoint: https://ri-9fd0e66d62464ec4ae642ccf46e6864d.ecs.eu-central-1.on.aws/mcp

Repository: https://github.com/rarescos-pixel/ripple-agentic-plan-repair

Open the Judge demo first. It presents the Alexa+ simulation and money-first decision surface without requiring production secrets. Open /readyz. It should report status=ready, runtime_mode=aws-structural, AWS components [dynamodb, bedrock, cloudwatch], and source_revision=c6766c5919ea903530a8da2d526d64a49b7f0578. Open /demo/api/evidence. The frozen release requires all 7/7 executable adversarial scenarios to pass; release proof required six consecutive 7/7 reads. Golden scenario: “Our flight home was cancelled. We’ll land tomorrow at six.” Expected deterministic fixture result: 5 affected commitments, $116 at risk, $42 repair cost, $74 net direct cash preserved, 0 writes before approval, 5 receipts after execution. Exact replay must be 5/5 deduplicated; fresh-session replay leaves authoritative writes unchanged 5 → 5, proving 0 new provider writes. Public CI evidence demonstrates the authenticated remote MCP/OAuth flow without publishing production secrets. Do not copy AWS/SSM secrets into public fields. Airline, ride, reservation, delivery, pet-care and calendar adapters are deterministic simulated provider adapters. One bounded GitHub Issues integration is the real external-provider proof.

Disclosures

Real running software/evidence: AWS-hosted MCP transport, OAuth/PKCE, dependency analysis, economic optimization, approval boundary, durable recovery, receipts, replay suppression, MCP App, Alexa package/media surfaces, one bounded real GitHub Issues provider, and live Bedrock/DynamoDB/CloudWatch behavior.

Deterministic simulated integrations: airline, ride, reservation, delivery, pet-care and calendar adapters. Ripple does not claim real third-party bookings, payments or market prices.

Alexa+ production-client disclosure: no actual Alexa+ production-client session is claimed unless the official onboarding/inspection path is actually exercised successfully. If the production client is unavailable, the final demo uses the rules-permitted simulated Alexa+ experience backed by the real public MCP server.

LLM authority disclosure: Amazon Bedrock / Nova 2 Lite normalizes a natural-language changed fact into constrained structured input. The model does not decide which repair spends money and never receives write authority. Deterministic code owns dependency state, economics, exact approval, bounded execution and authoritative receipts.

What's next

Keep the frozen AWS runtime available for judging and finish only submission/presentation work. The final video is public, in English and under three minutes. Future production work would replace the deliberately simulated provider adapters with real integrations while preserving the same approval, safety and idempotency model.

Built With

Share this project:

Updates

Submission history