Documentation
¶
Overview ¶
Package replay re-derives decisions from the canonical event log on a throwaway kernel (event-sourcing purity, S8): replay reads the log only, never advances a live cursor or writes a live store, and its determinism is established by FIELD-MASKING the dynamic decision fields (DecisionID/AppliedAt) before any diff (D1) — production decisions keep their real uuid/time. replay imports rule (one-way, D11).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Replay ¶
Replay re-derives the decisions by reconciling the *.proposed events of the log over a FRESH :memory: kernel. It is a pure function of the events (no live store), reproducing the live decisions up to the masked dynamic fields. The candidate ruleset is retained for signature symmetry with Shadow — pure replay needs no policy because the logged proposals are authoritative (event-sourcing).
func Shadow ¶
func Shadow(events []contract.Event, subs map[contract.ActorID]contract.Subscription, live, candidate rule.RuleSet) rule.ShadowReport
PROOF-ONLY: S7/S8 shadow-promotion spec proof; no production caller yet — see .insight Shadow asks the governance question "would promoting this candidate rule set change behavior?" by RE-RUNNING both policies' rules over the OBSERVED events of the log and diffing their rule results (S8). This is the faithful model: a rule handles OBSERVED events and EMITS proposals/denies/jobs — so the candidate's behavior change lives in observed->decision, NOT in re-reconciling the already-minted *.proposed events (the prior model never ran the candidate's rules at all, so every real rule change passed Clean).
View TIMING matches the server, which evaluates rules at DISPATCH time — BEFORE that tick's reconcile. Shadow walks the log in IngestSeq order on a throwaway kernel: a logged *.proposed event is applied (reconciled) to evolve canonical state; an OBSERVED event is evaluated against the state BUILT FROM THE PROPOSALS THAT PRECEDE IT in the log — i.e. the dispatch-time state, not the final state (evaluating against final state yields a false-clean for any version-sensitive rule that diverges at @1 but agrees at @2). Only the logged proposals mutate the kernel; the rule evaluations are read-only (S8).
The comparison covers verdict + proposal (type+payload) + job + trusted origin actor + the decision REASONS + the rule DIAGNOSTICS. Reasons are NOT advisory: the server writes them verbatim into durable *.diagnostic events for deny/warn (the auditable S7 trail), so a Reasons-only reword (e.g. blanking a security deny reason) IS a behavior change. Diagnostics likewise are durable: a candidate that errors or returns a borrowed-emit proposal reduces to Verdict allow but emits one. It reports diffs, never pass/fail (the operator gates promotion on Clean).
Types ¶
This section is empty.
Source Files