railiance-clock/docs/acceptance-coverage.md

Acceptance coverage — 2026-09-28

This maps the current repository tests to the obligations in acceptance v0.1. A listed test is evidence for its specific assertion, not completion of the whole criterion. The local suite uses disposable keys, fake clocks and loopback HTTP; it does not prove independent UTC accuracy, production admission or native consumer correctness.

Test names below are in tests/test_clock.py, tests/test_authority.py, and tests/test_health.py unless otherwise noted. Parameterized cases count as tests, not additional acceptance criteria. The release smoke script is separate from pytest and runs against an installed wheel.

ID	Existing local evidence	Uncovered or native obligation; existing owner record
C01	test_interval_contains_send_with_asymmetric_delay changes time.time and exercises the injected timer	No complete ±5-minute/zone/wall-step platform matrix; native Windows is unsupported by LinuxTimer. Supported Linux/WSL evidence: 0002-T03, 0004-T02
C02	test_interval_contains_send_with_asymmetric_delay; test_lifecycle_during_exchange_refuses[delay]	One deterministic asymmetric-delay case, not property-based interval coverage or measured network guarantees: 0002-T03, 0004-T02
C03	test_signed_wrong_binding_refuses, test_bad_signature, test_rotation_requires_fresh_client_and_matching_signer; wheel smoke refuses wrong key	No exhaustive version/header/modified-uncertainty matrix; accepted signing/trust profile: 0002-T02
C04	test_replay_refused, delayed-exchange refusal, test_restart_preserves_floor, test_new_client_cannot_reset_expired_trust	Exact replay across process restart and every nonce-timeout interleaving are not separately tested; native lifecycle evidence: 0004-T02
C05	test_authority_refuses_unusable_health, test_restart_changes_epoch, test_step_at_final_timestamp_latches_refusal, test_health_expires_during_sample_preparation, test_health_model_refusals, collector replacement test	Disposable host upstream outage/reboot/recovery and accepted error model: 0005-T02/T05, RAIL-HO-WP-0013
C06	test_lifecycle_during_exchange_refuses[suspend/domain/backward]; boot-bound admission behavior	Fake timer disruption does not establish real VM suspend/reboot detection or oscillator bounds: 0002-T03, 0004-T02
C07	test_validity_uses_entire_interval checks entirely valid, not-before overlap and exact expiry	Native signed-artifact semantics and protected-side-effect recheck remain consumer-owned: 0002-T04, 0004-T03
C08	Expired-session, delayed-sample and lifecycle refusals; health expiry during preparation	No general offline holdover offered; native loss/age/uncertainty policy evidence: 0004-T02
C09	Wrong signer and changed/revoked trust refusal; wheel smoke requires explicit disposable loopback admission	No real invalid-date TLS bootstrap or redirect-server integration test in this suite. Transport trust acceptance: 0002-T02, 0005-T03
C10	No approval/CAS concurrency fixture in this repository	Clock interval checks do not establish atomic consume or check-to-use safety. Consumer native proof: 0002-T04, 0004-T03
C11	attribution.py emits recording-time evidence; no direct attribution test	No historical occurrence translation or calibration-domain proof is implemented here. Audit/consumer contract and native evidence: 0002-T04, 0004-T03
C12	No occurrence-ordering test; application clock returns intervals	Overlap/order handling belongs to the consuming event system; audit acceptance: 0002-T04, 0004-T03
C13	test_strict_json, test_http_framing_refused, test_malformed_health_is_stable_http_refusal, test_bad_policy_refuses, test_helper_failures_are_sanitized	Coverage is not exhaustive numeric/schema fuzzing. Profile acceptance remains 0002-T02/T03
C14	test_rotation_requires_fresh_client_and_matching_signer, changed-trust refusal, expired admission and persisted rollback tests	Local file replacement is not distributed revocation; custody visibility deadlines and compromise recovery: 0002-T02, 0005-T03/T05
C15	test_connection_limit_and_capacity_recovery, HTTP liveness/readiness separation, framing and delayed-exchange tests	Eight held connections and recovery are not sustained-load/SLO proof. Host measurements and alerts: 0004-T02, 0005-T06
C16	tools/wheel_smoke.py checks installed CLI and signed authority/client HTTP exchange, wrong-key and unhealthy refusal	This is reference integration only. Named native consumer identity/tenant/expiry/CAS migration: 0004-T03

Release and dependency evidence

tools/verify_release.py separately checks byte equality of two builds from separate source roots with different file mtimes, packaged/spec schema equality, wheel installation into a fresh runtime environment, CLI startup and a signed loopback exchange. Build tools are hash-pinned in tools/build-requirements.txt; runtime dependencies are installed from a hash-bearing export of uv.lock. The SBOM lists installed runtime distributions and versions, not all platform libraries, transitive native-library internals, licenses or vulnerability findings.

See release verification for the exact receipt and reproduction procedure. No test or artifact publication makes the proposed contract adopted. The 0003 closeout is limited to the reference implementation; its original task prose is broader than the evidence in several rows above. Those unproven native claims remain in existing 0002/0004/0005 records.