railiance-clock/docs/acceptance-coverage.md

# Acceptance coverage — 2026-09-28

This maps the current repository tests to the obligations in
[acceptance v0.1](../specs/acceptance-v0.1.md). A listed test is evidence for its
specific assertion, not completion of the whole criterion. The local suite uses
disposable keys, fake clocks and loopback HTTP/TLS; it does not prove independent UTC
accuracy, production admission or native consumer correctness.

Test names below are in `tests/test_*.py`; the added protocol, transport,
attribution and interval sweeps have dedicated files. Parameterized cases count as tests,
not additional acceptance criteria. The release smoke script is separate from
pytest and runs against an installed wheel.

| ID | Existing local evidence | Uncovered or native obligation; existing owner record |
| --- | --- | --- |
| C01 | `test_interval_contains_send_with_asymmetric_delay` changes `time.time` and exercises the injected timer | No complete ±5-minute/zone/wall-step platform matrix; native Windows is unsupported by LinuxTimer. Supported Linux/WSL evidence: 0002-T03, 0004-T02 |
| C02 | `test_interval_encloses_true_receipt_across_asymmetry_and_drift` sweeps 324 combinations of outbound/inbound delay, processing, authority error, verification delay and timer drift; delayed exchange refusal | A finite deterministic sweep under explicit error assumptions is not measured network or oscillator evidence: 0002-T03, 0004-T02 |
| C03 | `test_signed_wrong_binding_refuses`, `test_bad_signature`, signed invalid version/number samples, unadmitted and malformed headers, modified uncertainty, signer rotation; wheel smoke refuses wrong key | Finite adversarial cases do not exhaust possible inputs; accepted signing/trust profile: 0002-T02 |
| C04 | `test_replay_refused`, delayed-exchange refusal, `test_restart_preserves_floor`, `test_new_client_cannot_reset_expired_trust` | Exact replay across process restart and every nonce-timeout interleaving are not separately tested; native lifecycle evidence: 0004-T02 |
| C05 | `test_authority_refuses_unusable_health`, `test_restart_changes_epoch`, `test_step_at_final_timestamp_latches_refusal`, `test_health_expires_during_sample_preparation`, `test_health_model_refusals`, collector replacement test | Disposable host upstream outage/reboot/recovery and accepted error model: 0005-T02/T05, RAIL-HO-WP-0013 |
| C06 | `test_lifecycle_during_exchange_refuses[suspend/domain/backward]`; boot-bound admission; 45 elapsed-time cases spanning drift bounds and timer disagreement | Fake timer disruption does not establish real VM suspend/reboot detection or oscillator bounds: 0002-T03, 0004-T02 |
| C07 | `test_validity_uses_entire_interval` checks entirely valid, not-before overlap and exact expiry | Native signed-artifact semantics and protected-side-effect recheck remain consumer-owned: 0002-T04, 0004-T03 |
| C08 | Expired-session, delayed-sample and lifecycle refusals; health expiry during preparation | No general offline holdover offered; native loss/age/uncertainty policy evidence: 0004-T02 |
| C09 | Real TLS positive control and expired/not-yet-valid/wrong-host/untrusted certificate refusals; all five redirect statuses refused without following; wrong signer and changed/revoked trust refusal | Disposable CA tests do not prove production bootstrap or trust distribution. Transport trust acceptance: 0002-T02, 0005-T03 |
| C10 | No approval/CAS concurrency fixture in this repository | Clock interval checks do not establish atomic consume or check-to-use safety. Consumer native proof: 0002-T04, 0004-T03 |
| C11 | `test_recording_evidence_preserves_original_event` verifies additive recording-time labels and preservation when merged; disabled, unavailable and expired-clock paths are tested | No historical occurrence translation or calibration-domain proof is implemented here. Audit/consumer contract and native evidence: 0002-T04, 0004-T03 |
| C12 | No occurrence-ordering test; application clock returns intervals | Overlap/order handling belongs to the consuming event system; audit acceptance: 0002-T04, 0004-T03 |
| C13 | Signed numeric overflow, units/types, malformed headers/envelopes and nonfinite exponent refusal; strict JSON, HTTP framing, malformed health/policy/helper tests | Coverage is not exhaustive numeric/schema fuzzing. Profile acceptance remains 0002-T02/T03 |
| C14 | `test_rotation_requires_fresh_client_and_matching_signer`, changed-trust refusal, expired admission and persisted rollback tests | Local file replacement is not distributed revocation; custody visibility deadlines and compromise recovery: 0002-T02, 0005-T03/T05 |
| C15 | `test_connection_limit_and_capacity_recovery`, HTTP liveness/readiness separation, unexpected status/media/encoding refusals, framing and delayed-exchange tests | Eight held connections and recovery are not sustained-load/SLO proof. Host measurements and alerts: 0004-T02, 0005-T06 |
| C16 | `tools/wheel_smoke.py` checks installed CLI and signed authority/client HTTP exchange, wrong-key and unhealthy refusal | This is reference integration only. Named native consumer identity/tenant/expiry/CAS migration: 0004-T03 |

## Release and dependency evidence

`tools/verify_release.py` separately checks byte equality of two builds from
separate source roots with different file mtimes, packaged/spec schema equality,
wheel installation into a fresh runtime environment, CLI startup and a signed
loopback exchange. Build tools are hash-pinned in `tools/build-requirements.txt`;
runtime dependencies are installed from a hash-bearing export of `uv.lock`.
The SBOM lists installed runtime distributions and versions, not all platform
libraries, transitive native-library internals, licenses or vulnerability findings.

See [release verification](release-verification.md) for the exact receipt and
reproduction procedure. No test or artifact publication makes the proposed
contract adopted. The 0003 closeout is limited to the reference implementation;
its original task prose is broader than the evidence in several rows above.
Those unproven native claims remain in existing 0002/0004/0005 records.


## Local gap follow-up

The expanded suite passes 167 tests and 4 subtests. The two arithmetic sweep
tests additionally exercise 324 signed-exchange scenarios and 45 elapsed-time
scenarios internally; these are not separate pytest counts. The true-time oracle
uses independent simulated transit/processing/verification time and authority
error, with ±500ppm simulated timer drift inside the declared 1000ppm allowance.
This validates containment under that model, not a universal platform drift bound.

The nonfinite exponent regression exposed a parser gap: Python JSON parsing can
turn `1e999` into infinity without invoking the literal-constant callback. The
parser now rejects nonfinite floats at every nesting level while retaining finite
JSON numbers. All certificates and keys in the transport tests are disposable;
TLS verification remains enabled and each refusal checks its certificate reason.