Fence governed connector acquisitions

2026-08-03 05:43:54 +02:00
parent 26f8898d11
commit dfa717b9ba
9 changed files with 1042 additions and 19 deletions
@@ -138,6 +138,26 @@ Every connector that writes to an external system needs a reconciliation story:
 - explicit requested, approved, dispatched, possibly-executed, confirmed, and
  reconciled/corrected effect states

+## Durable recovery operations
+
+Connectors declares two recovery classes. A read-only acquisition into an
+immutable snapshot is `atomic`: the source revision or conditional cursor,
+redacted dry-run decision, canonical request digest, and distributed
+tenant/provider lease are durable before the fetch. The acquired domain rows
+and terminal Core recovery checkpoint commit in one PostgreSQL transaction. A
+caller-supplied `Idempotency-Key` replays that committed result without a second
+provider request. A failed or stale transaction has no remote mutation and may
+be repeated only as a new deliberate acquisition.
+
+An external create, update, publish, or delete is `forward_recovery`. It must
+start through the connector mutation recovery contract with a stable
+idempotency key, SHA-256 request digest, source revision/cursor, and dry-run
+evidence. Definitive rejection is terminal. A timeout or lost acknowledgement
+after dispatch is `outcome_unknown` and blocks replay until the owning connector
+verifies provider state. The contract and conformance tests exist; no current
+connector advertises a production external mutation, so write/delete adoption
+remains explicitly planned rather than implied.
+
 ## Provider Declaration

 An executable connector type should publish machine-readable metadata for: