Fence governed connector acquisitions

src/govoplan_connectors/backend/manifest.py

@@ -88,6 +88,11 @@ ARCHITECTURE = ModuleArchitectureDeclaration(
             reference="tests/test_sanctions_sources.py",
             summary="Exercises source acquisition health, checksums, retries, and immutable evidence.",
         ),
+        ModuleMaturityEvidence(
+            kind="recovery",
+            reference="tests/test_recovery.py",
+            summary="Proves atomic snapshot commits, idempotent replay, distributed fences, tamper rejection, and unknown external-effect handling.",
+        ),
         ModuleMaturityEvidence(
             kind="documentation",
             reference="docs/CONNECTOR_SOURCE_LIFECYCLE.md",
@@ -149,8 +154,13 @@ EXTERNAL_PROVIDERS = (
             freshness="Snapshot acquisition time and source timestamp are exposed.",
             health="Import validation and source-read failures are explicit.",
             max_read_items=1000,
+            idempotency="Feed imports accept a caller request key and replay the same committed immutable source without refetching.",
+            retry="Read-only acquisition may be retried only as a new deliberate request after a failed atomic operation.",
+            outcome_unknown="Provider reads do not mutate remote state; an uncertain database commit is resolved by the atomic recovery transaction.",
+            outcome_unknown_supported=False,
             evidence="Rows, schema, fingerprint, source metadata, and acquisition provenance remain linked.",
             correction="Import a replacement snapshot; retain the prior snapshot as evidence.",
+            rollback="Snapshot rows and the terminal recovery checkpoint commit or roll back together.",
             reconciliation="Compare source and snapshot fingerprints before selecting a new current state.",
             outage="Existing snapshots remain available and visibly stale; no live-source claim is made.",
             classifications=("internal", "confidential", "restricted"),
@@ -187,12 +197,18 @@ EXTERNAL_PROVIDERS = (
         ),
         behavior=ProviderBehaviorDeclaration(
             revision_tokens="Provider source version, ETag, Last-Modified, and SHA-256 digest are retained when available.",
-            concurrency="Refreshes use conditional source requests and create immutable snapshots.",
+            concurrency="Refreshes use conditional source requests, a distributed per-tenant/provider fence, and immutable snapshots.",
             freshness="Latest successful acquisition, source timestamp, and stale health are reported.",
             health="Transport, parsing, source-change, and malformed-source states are explicit.",
             max_read_items=5000,
+            idempotency="A caller request key identifies one acquisition run and replays its committed result without contacting the source again.",
+            retry="Bounded HTTP retries are safe because acquisition is read-only; failed runs require a new deliberate request key.",
+            timeout_seconds=30,
+            outcome_unknown="The external operation is read-only; snapshot rows and recovery evidence commit atomically.",
+            outcome_unknown_supported=False,
             evidence="Raw source bytes, checksum, acquisition run, parser result, and normalized entry count are linked.",
             correction="A corrected source creates a new immutable snapshot and acquisition run.",
+            rollback="A failed database transaction leaves no snapshot and the stale atomic fence resolves as failed.",
             reconciliation="Compare source version and digest, then preserve both prior and corrected evidence.",
             outage="The latest accepted snapshot stays usable with stale/unavailable source health.",
             classifications=("public", "internal"),
@@ -494,7 +510,11 @@ manifest = ModuleManifest(
                 "the official United Nations Security Council consolidated "
                 "XML source. Each fetch records conditional transport "
                 "evidence, bounded retries, health state, source metadata, "
-                "raw evidence, and a SHA-256 checksum. Risk Compliance owns "
+                "raw evidence, and a SHA-256 checksum. Refreshes acquire a "
+                "distributed recovery fence before provider I/O; the immutable "
+                "snapshot and terminal recovery checkpoint then commit in one "
+                "transaction. A repeated request key returns the same result. "
+                "Risk Compliance owns "
                 "normalization, matching, legal review, and dispositions."
             ),
             layer="available",