tegwick 13c2b82281 feat: restate the backup case in ITC-CAP terms; add evidence basis; publish consumption-mode signal

Three things.

1. CANON RESTATEMENT (info-tech-canon's ask after accepting our demand)
data/capability/platform-audit-storage.json restates the backup case against
ITC-CAP 0.2.0: requirement with profile, targets and the failure-domain
constraint that decided the procurement; two provisions (data.object and
data.backup); all four data.backup evidence hooks satisfied and measured; and
consumption in native units — GB, hours, tokens — with unknown never zero.

tools/capability.py reads their capabilities.yaml directly rather than copying
it, so drift in either repo fails here. The requirement asks D5, the provision
is D4, and the review reports below_requirement rather than inflating maturity.

2. EVIDENCE BASIS (tools/basis.py, docs/evidence-basis.md)
Every value declares how it was obtained on an ordered scale: invoiced,
measured, quoted, derived, projected, estimated, assumed, unknown. A derived
value resolves to the weakest basis among its inputs, so precise arithmetic
cannot launder weak assumptions.

First application is a finding about our own biggest decision: the Scaleway vs
Hetzner comparison, EUR 29.14/month stated to the cent, grades "indicative" —
1 of 4 load-bearing values evidenced, weakest "assumed". The direction is
robust; the magnitude is a model output. The cheapest fix is recording real
operator hours, not better arithmetic.

3. CONSUMPTION-MODE SIGNAL (railiance-platform RAILIANCE-WP-0017)
settlement.py gains a consumption-mode command projecting statements into the
signal they consume; make consumption-mode PERIOD=YYYY-MM publishes
data/consumption-mode/current.json. Currently an empty list: no live charges for
2026-09, so no entity is restricted. Publishing the empty list makes that an
assertion rather than an absence, which their contract distinguishes. The
validator fails if the published signal is stale.

185 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-15 18:42:06 +02:00

4.6 KiB

Raw Blame History

Backup case restated in ITC-CAP terms — 2026-08-15

Result

info-tech-canon accepted demand/CapabilityProvisionEconomics.md in full and shipped canon 0.3.0 / ITC-CAP 0.2.0. They asked resource-control to restate the backup case against the new shape, and said they would treat that restatement as the real-provision proof for their §10 promotion requirement 3 rather than inventing a worked example.

Delivered:

data/capability/platform-audit-storage.json — the restatement
tools/capability.py, make capability — validation against the live catalog
tools/basis.py, docs/evidence-basis.md — the evidence-basis vocabulary
44 tests across tests/test_capability.py and tests/test_basis.py

tools/capability.py reads info-tech-canon/infospace/models/capability/capabilities.yaml directly rather than copying it. Every capability id, profile, quality dimension, maturity level, resource class, native unit, and constraint predicate we use is checked against what the canon actually declares, so drift in either repository fails here.

What the restatement says

The requirement is now expressible. The constraint that decided the procurement — the backup must not sit in the failure domain of the host it protects — was prose in an acceptance-requirements section. It is now:

constraints:
  - dimension: geographical_separation
    predicate: not_in
    of: [{kind: host, id: railiance01}, {kind: provider, id: host-europe}]

Two provisions, not one. resource:platform:audit-storage provides data.object; the CNPG/Barman configuration provides data.backup and depends on it. This is the layering our resource records already had and could not name.

The requirement is not met, and the record says so. The requirement asks for data.backup at D5. The provision is D4. Thresholds are declared, but the evidence behind them is one backup, one full restore, one PITR, and about four hours of operation; wal_archive_gap_minutes is declared and not yet emitted. Reliability is claimed, not substantiated. The review reports status: below_requirement rather than inflating the maturity to match.

All four data.backup evidence hooks are satisfied — successful_backup, successful_restore_test, measured_rpo, measured_rto — each measured, each pointing at the T05 evidence file. The data.object provision is honestly incomplete: it satisfies neither object_integrity_tests nor availability_metrics.

Consumption is in native units. Storage in GB, human effort in hours, tokens for intelligence, and P for the purchased service — with unknown recorded as unknown and never as zero. Two rows the old model could not have carried:

H on the data.backup provision is unknown, because real operator time was spent on procurement, credential custody, and two restore drills and no time record was kept. A time record starts in 2026-09.
I is unknown on both provisions. We do not meter tokens against a provision yet.

The evidence-basis addition

Beyond what the canon asked for, every value in the restatement declares how it was obtained, on an ordered scale from invoiced through measured, quoted, derived, projected, estimated, assumed, to unknown. A derived value resolves to the weakest basis among its inputs.

The rule earns its place immediately. The provider comparison that produced the decision — Scaleway over Hetzner by €29.14/month, stated to the cent — grades:


by basis	`quoted` 1, `projected` 1, `assumed` 2
weakest	`assumed`
evidenced ratio	0.25
grade	`indicative`

One of four load-bearing values is evidenced. The two labour figures — the ones that actually inverted the ranking — are derived from an assumed hour count and an assumed rate, so they resolve to assumed.

This does not overturn the decision. The direction is robust under any plausible rate, and the remaining alternative was five times dearer. It does say that the magnitude is a model output rather than a measurement, and it identifies the cheapest way to strengthen it: record real operator hours, not better arithmetic.

Note that this is a finding about our own most consequential decision, produced by a mechanism that did not exist yesterday. It is the intended effect.

Boundary held

No canon artifact was copied into this repository, and nothing was written into info-tech-canon for this restatement. The capability catalog stays theirs; the provisioned facts stay ours; the join is by capability id, which is exactly the durable interface CAP-R5 describes and the reason the canon was not split.

4.6 KiB Raw Blame History