coulomb/approval-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add bounded source reconciliation counts and clarify receiver dependencies

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fdbf-7b93-a267-5f72b9b24526
This commit is contained in:
tegwick 2026-10-04 11:34:42 +02:00
parent 1044a5f36d
commit 24a5ecd56b
8 changed files with 231 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

34
docs/emission-cadence.md
View file

@ -40,7 +40,9 @@ accepted event counts for `source=approval-engine` and the corresponding
| `revocation` | `approval.revocation` |
| `heartbeat` | `audit-core.heartbeat` |
Undrained local rows are this engine's lag, not yet a divergence. A row
Account for occurrence versus receiver acceptance time as specified below;
identical window bounds alone do not align those populations. Undrained local
rows are this engine's lag, not yet a divergence. A row
with `drained_at` set that `audit-core` does not hold is the omission
case §9.6 names.
@ -111,3 +113,33 @@ uv run tools/emission-cadence-profile/emission_cadence_profile.py \
This supplies an owner-authored instance to NK-WP-0035; it does not accept the
proposed NetKingdom profile or claim receiver admission/observed cadence.
## Bounded source snapshot — 2026-10-04
`GET /v1/cadence?since=<timestamp>&until=<timestamp>` requires approval:observe
and the exact store tenant. Supply exactly one timezone-aware since and until,
with since earlier than until; encode plus signs in timezone offsets. Bounds
are inclusive since, exclusive until. The existing query-free lifetime response
is preserved; it cannot substitute for a bounded reconciliation.
The response identifies source, tenant, normalized UTC bounds and window_basis
created_at. Each class has committed, drained and pending counts for rows created
in that window, plus acknowledged_in_window for local drain acknowledgments in
that window regardless of creation time. All counts come from one database
statement snapshot. Zero classes are explicit; no payloads or identities are
selected or returned, and the source performs no receiver calls.
Audit Core's published `/v1/reconciliation` uses **receiver acceptance time**,
not occurrence time. Local drained_at is acknowledgment time and may follow
acceptance, especially if an accepted event's response was lost and a duplicate
was acknowledged later. Equal textual since/until bounds alone do not align
those populations. The observer must account for delayed delivery, acknowledgment
boundaries and duplicate acceptance, or use independently correlated event ids
and an agreed settled window before treating a count mismatch as omission.
Pending occurrence rows are lag; neither count agreement nor this source
snapshot proves completeness or resistance to source compromise.
This implements T04's missing bounded source computation. Receiver registration,
observed lag/findings and native reconciliation remain blocked owner acceptance;
no existing live image is promoted by this change.