171 lines
4.6 KiB
Markdown
171 lines
4.6 KiB
Markdown
|
# ASL/FEDERATION-REPLAY/1 -- Cross-Node Deterministic Replay
|
||
|
|
|
||
|
|
Status: Draft
|
||
|
|
Owner: Architecture
|
||
|
|
Version: 0.1.0
|
||
|
|
SoT: No
|
||
|
|
Last Updated: 2025-01-17
|
||
|
|
Tags: [federation, replay, determinism, tgk, pel]
|
||
|
|
|
||
|
|
**Document ID:** `ASL/FEDERATION-REPLAY/1`
|
||
|
|
**Layer:** L2 -- Federation replay semantics (no transport)
|
||
|
|
|
||
|
|
**Depends on (normative):**
|
||
|
|
|
||
|
|
* `ASL/FEDERATION/1`
|
||
|
|
* `ASL/LOG/1`
|
||
|
|
* `ASL/1-CORE-INDEX`
|
||
|
|
* `TGK/1`
|
||
|
|
|
||
|
|
**Informative references:**
|
||
|
|
|
||
|
|
* `ASL/SYSTEM/1` -- unified system view
|
||
|
|
* `ENC-ASL-CORE-INDEX` -- domain metadata
|
||
|
|
* `ASL/DAP/1` -- admission gating
|
||
|
|
* `ASL/POLICY-HASH/1` -- policy compatibility
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 0. Conventions
|
||
|
|
|
||
|
|
The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHOULD**, and **MAY** are to be interpreted as in RFC 2119.
|
||
|
|
|
||
|
|
ASL/FEDERATION-REPLAY/1 defines **deterministic replay rules** for federated propagation. It does not define network protocols or encodings.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 1. Purpose
|
||
|
|
|
||
|
|
This document defines how artifacts, PERs, and TGK edges are propagated and replayed across federation nodes while preserving deterministic reconstruction.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 2. Core Inputs
|
||
|
|
|
||
|
|
* **ArtifactKey**: canonical identifier for artifacts and PERs
|
||
|
|
* **SnapshotID**: snapshot boundary for replay
|
||
|
|
* **logseq**: append-only ordering within a domain
|
||
|
|
* **Canonical Edge Key**: TGK edge identity
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 3. Replay Record Requirements
|
||
|
|
|
||
|
|
Each propagated record MUST be replayable without external context. Records MUST carry:
|
||
|
|
|
||
|
|
* `domain_id` (source domain)
|
||
|
|
* `record_type` (artifact, PER, TGK edge, tombstone)
|
||
|
|
* `logseq` (source-domain ordering)
|
||
|
|
* `snapshot_id` and `log_prefix` bounds for which the record is visible
|
||
|
|
* Canonical identity (ArtifactKey or Canonical Edge Key)
|
||
|
|
* Visibility metadata (internal/published, cross-domain source when applicable)
|
||
|
|
|
||
|
|
Records MAY include optional integrity fields (hashes, signatures), but replay MUST
|
||
|
|
remain deterministic without them.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 4. Propagation Rules
|
||
|
|
|
||
|
|
### 4.1 Artifacts and PERs
|
||
|
|
|
||
|
|
* Artifacts and PERs are propagated with their `ArtifactKey` and `logseq`.
|
||
|
|
* Only artifacts visible under a published snapshot MAY be propagated.
|
||
|
|
* Duplicate ArtifactKeys MUST be de-duplicated by identity.
|
||
|
|
* Imported entries MUST preserve origin metadata (domain identity and visibility).
|
||
|
|
|
||
|
|
### 4.2 TGK Edges
|
||
|
|
|
||
|
|
* TGK edges are propagated with their canonical edge identity and `logseq`.
|
||
|
|
* Edge propagation MUST preserve the same snapshot/log visibility constraints as artifacts.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 5. Deterministic Replay Ordering
|
||
|
|
|
||
|
|
Replay order MUST be deterministic across nodes:
|
||
|
|
|
||
|
|
1. Sort by `logseq` ascending
|
||
|
|
2. Tie-break by canonical identity (ArtifactKey or Canonical Edge Key)
|
||
|
|
|
||
|
|
This ordering MUST be applied identically by all receivers.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 6. Snapshot Bounds
|
||
|
|
|
||
|
|
* Replay MUST be bounded by `{SnapshotID, LogPrefix}`.
|
||
|
|
* Records with `logseq` greater than the replay prefix MUST be ignored.
|
||
|
|
* Replay MUST use the source domain's `{SnapshotID, LogPrefix}` as the bound for imported state.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 7. Federation View Construction
|
||
|
|
|
||
|
|
Receivers construct a federation view by combining:
|
||
|
|
|
||
|
|
1. Local domain state at `{SnapshotID, LogPrefix}`.
|
||
|
|
2. Admitted foreign published state bounded by the source domain's `{SnapshotID, LogPrefix}`.
|
||
|
|
|
||
|
|
Admission and policy compatibility MUST be enforced before any foreign state is admitted.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 8. Tombstones and Shadowing
|
||
|
|
|
||
|
|
* Tombstones MUST be replayed in log order and apply only within their source domain.
|
||
|
|
* A tombstone from domain A MUST NOT shadow artifacts from domain B.
|
||
|
|
* Shadowing is resolved per-domain using ASL/LOG/1 order and ASL/1-CORE-INDEX semantics.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 9. Conflict Handling
|
||
|
|
|
||
|
|
1. **ArtifactKey collision**
|
||
|
|
|
||
|
|
* If bytes match existing artifact: discard duplicate.
|
||
|
|
* If bytes differ: reject and flag conflict.
|
||
|
|
|
||
|
|
2. **TGK edge conflicts**
|
||
|
|
|
||
|
|
* Multiple edges with the same canonical identity are resolved by log order and tombstone rules.
|
||
|
|
|
||
|
|
3. **PER conflicts**
|
||
|
|
|
||
|
|
* PERs with identical inputs and program identity but divergent outputs MUST be rejected.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 10. Replay State and Idempotency
|
||
|
|
|
||
|
|
Replay MUST be idempotent:
|
||
|
|
|
||
|
|
* Re-applying the same record set MUST NOT change the resulting state.
|
||
|
|
* Receivers SHOULD track `{domain_id, logseq}` high-water marks per peer.
|
||
|
|
* Checkpointing MUST be aligned to `{SnapshotID, LogPrefix}` boundaries.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 11. Provenance and Audit
|
||
|
|
|
||
|
|
Receivers SHOULD maintain:
|
||
|
|
|
||
|
|
* Last applied `logseq` per peer
|
||
|
|
* Snapshot provenance tables for applied records
|
||
|
|
|
||
|
|
This supports deterministic audit and replay verification.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 12. Non-Goals
|
||
|
|
|
||
|
|
* Transport protocol selection
|
||
|
|
* Streaming formats
|
||
|
|
* Compression or batching
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## 13. Summary
|
||
|
|
|
||
|
|
ASL/FEDERATION-REPLAY/1 defines a deterministic replay ordering and conflict rules to ensure federation is reproducible across nodes and snapshots.
|