feat: declare governed external provider state

2026-08-01 17:48:23 +02:00
parent ccdf12162a
commit 66a6df4f05
5 changed files with 761 additions and 0 deletions
@@ -81,6 +81,22 @@ retirement before queued work is changed; a later retry tolerates a provider
 secret already removed by an earlier attempt whose database transaction rolled
 back. Provider errors and audit details never contain credential values or
 secret references.
+
+### Runtime provider state
+
+Calendar registers tenant-aware runtime state for
+`calendar.caldav_sync`. Each active CalDAV source is projected by a stable
+`calendar:sync-source:<id>` reference with its effective source-authority mode,
+enabled state, health, freshness, unresolved-conflict state, recovery readiness,
+last successful synchronization, and bounded outbox counts. Collection URLs,
+usernames, credential references, remote resource paths, and error text are not
+included.
+
+Docs uses the projection to explain configured availability, Ops aggregates it
+for operator inspection, and configuration-package preflight can require one
+exact source binding. A source with dead or conflicting desired-state work
+requires recovery attention; a never-synchronized source remains unknown rather
+than being reported healthy.
 The current singular ownership model permits one active sync source per
 calendar; multi-source fan-in will require per-event source routing. Celery beat
 triggers recovery every minute, while root-transaction after-commit dispatch