railiance-clock/docs/acceptance-coverage.md

Acceptance coverage — 2026-09-28

This maps the current repository tests to the obligations in acceptance v0.1. A listed test is evidence for its specific assertion, not completion of the whole criterion. The local suite uses disposable keys, fake clocks and loopback HTTP/TLS; it does not prove independent UTC accuracy, production admission or native consumer correctness.

Test names below are in tests/test_*.py; the added protocol, transport, attribution and interval sweeps have dedicated files. Parameterized cases count as tests, not additional acceptance criteria. The release smoke script is separate from pytest and runs against an installed wheel.

ID	Existing local evidence	Uncovered or native obligation; existing owner record
C01	test_interval_contains_send_with_asymmetric_delay changes time.time and exercises the injected timer	No complete ±5-minute/zone/wall-step platform matrix; native Windows is unsupported by LinuxTimer. Supported Linux/WSL evidence: 0002-T03, 0004-T02
C02	test_interval_encloses_true_receipt_across_asymmetry_and_drift sweeps 324 combinations of outbound/inbound delay, processing, authority error, verification delay and timer drift; delayed exchange refusal	A finite deterministic sweep under explicit error assumptions is not measured network or oscillator evidence: 0002-T03, 0004-T02
C03	test_signed_wrong_binding_refuses, test_bad_signature, signed invalid version/number samples, unadmitted and malformed headers, modified uncertainty, signer rotation; wheel smoke refuses wrong key	Finite adversarial cases do not exhaust possible inputs; accepted signing/trust profile: 0002-T02
C04	test_replay_refused, delayed-exchange refusal, test_restart_preserves_floor, test_new_client_cannot_reset_expired_trust	Exact replay across process restart and every nonce-timeout interleaving are not separately tested; native lifecycle evidence: 0004-T02
C05	test_authority_refuses_unusable_health, test_restart_changes_epoch, test_step_at_final_timestamp_latches_refusal, test_health_expires_during_sample_preparation, test_health_model_refusals, collector replacement test	Disposable host upstream outage/reboot/recovery and accepted error model: 0005-T02/T05, RAIL-HO-WP-0013
C06	test_lifecycle_during_exchange_refuses[suspend/domain/backward]; boot-bound admission; 45 elapsed-time cases spanning drift bounds and timer disagreement	Fake timer disruption does not establish real VM suspend/reboot detection or oscillator bounds: 0002-T03, 0004-T02
C07	test_validity_uses_entire_interval checks entirely valid, not-before overlap and exact expiry	Native signed-artifact semantics and protected-side-effect recheck remain consumer-owned: 0002-T04, 0004-T03
C08	Expired-session, delayed-sample and lifecycle refusals; health expiry during preparation	No general offline holdover offered; native loss/age/uncertainty policy evidence: 0004-T02
C09	Real TLS positive control and expired/not-yet-valid/wrong-host/untrusted certificate refusals; all five redirect statuses refused without following; wrong signer and changed/revoked trust refusal	Disposable CA tests do not prove production bootstrap or trust distribution. Transport trust acceptance: 0002-T02, 0005-T03
C10	No approval/CAS concurrency fixture in this repository	Clock interval checks do not establish atomic consume or check-to-use safety. Consumer native proof: 0002-T04, 0004-T03
C11	test_recording_evidence_preserves_original_event verifies additive recording-time labels and preservation when merged; disabled, unavailable and expired-clock paths are tested	No historical occurrence translation or calibration-domain proof is implemented here. Audit/consumer contract and native evidence: 0002-T04, 0004-T03
C12	No occurrence-ordering test; application clock returns intervals	Overlap/order handling belongs to the consuming event system; audit acceptance: 0002-T04, 0004-T03
C13	Signed numeric overflow, units/types, malformed headers/envelopes and nonfinite exponent refusal; strict JSON, HTTP framing, malformed health/policy/helper tests	Coverage is not exhaustive numeric/schema fuzzing. Profile acceptance remains 0002-T02/T03
C14	test_rotation_requires_fresh_client_and_matching_signer, changed-trust refusal, expired admission and persisted rollback tests	Local file replacement is not distributed revocation; custody visibility deadlines and compromise recovery: 0002-T02, 0005-T03/T05
C15	test_connection_limit_and_capacity_recovery, HTTP liveness/readiness separation, unexpected status/media/encoding refusals, framing and delayed-exchange tests	Eight held connections and recovery are not sustained-load/SLO proof. Host measurements and alerts: 0004-T02, 0005-T06
C16	tools/wheel_smoke.py checks installed CLI and signed authority/client HTTP exchange, wrong-key and unhealthy refusal	This is reference integration only. Named native consumer identity/tenant/expiry/CAS migration: 0004-T03

Release and dependency evidence

tools/verify_release.py separately checks byte equality of two builds from separate source roots with different file mtimes, packaged/spec schema equality, wheel installation into a fresh runtime environment, CLI startup and a signed loopback exchange. Build tools are hash-pinned in tools/build-requirements.txt; runtime dependencies are installed from a hash-bearing export of uv.lock. The SBOM lists installed runtime distributions and versions, not all platform libraries, transitive native-library internals, licenses or vulnerability findings.

See release verification for the exact receipt and reproduction procedure. No test or artifact publication makes the proposed contract adopted. The 0003 closeout is limited to the reference implementation; its original task prose is broader than the evidence in several rows above. Those unproven native claims remain in existing 0002/0004/0005 records.

Local gap follow-up

The expanded suite passes 167 tests and 4 subtests. The two arithmetic sweep tests additionally exercise 324 signed-exchange scenarios and 45 elapsed-time scenarios internally; these are not separate pytest counts. The true-time oracle uses independent simulated transit/processing/verification time and authority error, with ±500ppm simulated timer drift inside the declared 1000ppm allowance. This validates containment under that model, not a universal platform drift bound.

The nonfinite exponent regression exposed a parser gap: Python JSON parsing can turn 1e999 into infinity without invoking the literal-constant callback. The parser now rejects nonfinite floats at every nesting level while retaining finite JSON numbers. All certificates and keys in the transport tests are disposable; TLS verification remains enabled and each refusal checks its certificate reason.