Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ARCHITECTURE.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ boundaries above remain the target modular MSA architecture.
| `tepp_simulation` | known-truth temporal/event data generation |
| `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics |
| `tepp_api` | versioned DTO, schema, and export contracts |
| `copy_identity` | a template copy is not the source document and not a state transition |
| `intake_authorization` | untrusted intake fails closed without a grant; bounds are not authorization |
| `summarizes_edge` | a summary is not a state transition and not the source document |
| `outcome_order` | input-process-outcome edges cannot move backward in event time |
Expand Down
2 changes: 2 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang

### Added

- `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovered copy kinds match known truth at a higher computed rate than collapsing every copy to the source (ADR 0003).
- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Unrelated CHANGELOG entry for persistence_postgres migration 0007

The CHANGELOG diff adds two entries: the copy_identity gate (expected) and a persistence_postgres retention/deletion/legal-hold (migration 0007) entry at CHANGELOG.md. The latter is unrelated to this PR's stated scope (copy-versus-source identity) and the author description explicitly disclaims allocating migrations. retention_sql.rs does exist in the tree, so this may be a pre-existing/merge-carried entry rather than newly introduced work, but its appearance in this PR's diff is worth confirming to avoid over-claiming capabilities not delivered by this change.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

- `provider_receipt` disclosure receipt: records provider field codes and
purpose-bound receipt metadata without persisting source text or source
identity (ADR 0009).
Expand Down
4 changes: 4 additions & 0 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ members = [
"crates/tepp_simulation",
"crates/validation_core",
"crates/tepp_api",
"crates/copy_identity",
"crates/provider_receipt",
"crates/intake_authorization",
"crates/summarizes_edge",
Expand Down Expand Up @@ -53,6 +54,7 @@ default-members = [
"crates/tepp_simulation",
"crates/validation_core",
"crates/tepp_api",
"crates/copy_identity",
"crates/provider_receipt",
"crates/intake_authorization",
"crates/summarizes_edge",
Expand Down
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ crates/corpus_split
crates/tepp_simulation
crates/validation_core
crates/tepp_api
crates/copy_identity
crates/provider_receipt
crates/intake_authorization
crates/summarizes_edge
Expand Down
17 changes: 17 additions & 0 deletions crates/copy_identity/Cargo.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
[package]
name = "copy_identity"
description = "A template copy is not the source document and not a state transition."
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
authors.workspace = true
repository.workspace = true
homepage.workspace = true
readme.workspace = true
keywords.workspace = true
categories.workspace = true
publish = false

[lints]
workspace = true
53 changes: 53 additions & 0 deletions crates/copy_identity/src/error.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
//! Fail-closed copy-identity errors.

use std::fmt;

/// A fail-closed copy-identity error.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub enum CopyIdentityError {
/// A template copy was treated as the source document identity.
CopyIsNotSourceIdentity,
/// A template copy was treated as a state transition.
CopyIsNotTransition,
/// A recovery slice was empty or length-mismatched.
InvalidCopyPayload,
}

impl fmt::Display for CopyIdentityError {
fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
let message = match self {
Self::CopyIsNotSourceIdentity => "a template copy is not the source document identity",
Self::CopyIsNotTransition => "a template copy is not a state transition",
Self::InvalidCopyPayload => "invalid copy-identity payload",
};
formatter.write_str(message)
}
}

impl std::error::Error for CopyIdentityError {}

#[cfg(test)]
mod tests {
use super::CopyIdentityError;

#[test]
fn error_messages_are_stable() {
for (error, message) in [
(
CopyIdentityError::CopyIsNotSourceIdentity,
"a template copy is not the source document identity",
),
(
CopyIdentityError::CopyIsNotTransition,
"a template copy is not a state transition",
),
(
CopyIdentityError::InvalidCopyPayload,
"invalid copy-identity payload",
),
] {
assert_eq!(error.to_string(), message);
}
}
}
127 changes: 127 additions & 0 deletions crates/copy_identity/src/kind.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,127 @@
//! Template-copy identity versus the copied source document.

use crate::CopyIdentityError;

/// Closed vocabulary of copy-related document identities.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum CopyKind {
/// A template or pasted copy of an earlier source.
TemplateCopy,
/// The earlier source document being copied.
SourceDocument,
}

impl CopyKind {
/// Return the stable wire kind name.
#[must_use]
pub const fn wire_name(self) -> &'static str {
match self {
Self::TemplateCopy => "template_copy_of",
Self::SourceDocument => "source_document",
}
}

/// Parse a stable wire kind name.
///
/// # Errors
///
/// Returns [`CopyIdentityError::InvalidCopyPayload`] for unrecognized names.
pub fn from_wire_name(name: &str) -> Result<Self, CopyIdentityError> {
match name {
"template_copy_of" => Ok(Self::TemplateCopy),
"source_document" => Ok(Self::SourceDocument),
_ => Err(CopyIdentityError::InvalidCopyPayload),
}
}
}

/// Refuse to treat a template copy as the source document identity.
///
/// # Errors
///
/// Returns [`CopyIdentityError::CopyIsNotSourceIdentity`] when `kind` is
/// [`CopyKind::TemplateCopy`].
pub fn refuse_copy_as_source_identity(kind: CopyKind) -> Result<(), CopyIdentityError> {
match kind {
CopyKind::TemplateCopy => Err(CopyIdentityError::CopyIsNotSourceIdentity),
CopyKind::SourceDocument => Ok(()),
}
}

/// Refuse to treat a template copy as a forward state transition.
///
/// # Errors
///
/// Returns [`CopyIdentityError::CopyIsNotTransition`] when `kind` is
/// [`CopyKind::TemplateCopy`].
pub fn refuse_copy_as_transition(kind: CopyKind) -> Result<(), CopyIdentityError> {
match kind {
CopyKind::TemplateCopy => Err(CopyIdentityError::CopyIsNotTransition),
CopyKind::SourceDocument => Ok(()),
}
}

/// Fraction of recovered copy kinds that match known truth.
///
/// # Errors
///
/// Returns [`CopyIdentityError::InvalidCopyPayload`] when either slice is empty
/// or the lengths differ.
pub fn identity_recovery_rate(
truth: &[CopyKind],
decided: &[CopyKind],
) -> Result<f64, CopyIdentityError> {
if truth.is_empty() || truth.len() != decided.len() {
return Err(CopyIdentityError::InvalidCopyPayload);
}
let mut matches = 0_u32;
for (truth_kind, decided_kind) in truth.iter().zip(decided) {
if truth_kind == decided_kind {
matches += 1;
}
}
Ok(f64::from(matches) / truth.len() as f64)
}

#[cfg(test)]
mod tests {
use super::{
CopyKind, identity_recovery_rate, refuse_copy_as_source_identity, refuse_copy_as_transition,
};
use crate::CopyIdentityError;

#[test]
fn local_branches_cover_kinds_payloads_and_wire_names() {
assert_eq!(
refuse_copy_as_source_identity(CopyKind::TemplateCopy),
Err(CopyIdentityError::CopyIsNotSourceIdentity)
);
assert_eq!(
refuse_copy_as_transition(CopyKind::TemplateCopy),
Err(CopyIdentityError::CopyIsNotTransition)
);
refuse_copy_as_source_identity(CopyKind::SourceDocument).expect("source");
refuse_copy_as_transition(CopyKind::SourceDocument).expect("source");
for kind in [CopyKind::TemplateCopy, CopyKind::SourceDocument] {
assert_eq!(
CopyKind::from_wire_name(kind.wire_name()).expect("round-trip"),
kind
);
}
assert_eq!(
CopyKind::from_wire_name("summarizes"),
Err(CopyIdentityError::InvalidCopyPayload)
);
let matched = identity_recovery_rate(&[CopyKind::TemplateCopy], &[CopyKind::TemplateCopy])
.expect("rate");
assert!((matched - 1.0).abs() < f64::EPSILON);
assert_eq!(
identity_recovery_rate(&[], &[]),
Err(CopyIdentityError::InvalidCopyPayload)
);
assert_eq!(
identity_recovery_rate(&[CopyKind::TemplateCopy], &[]),
Err(CopyIdentityError::InvalidCopyPayload)
);
}
}
22 changes: 22 additions & 0 deletions crates/copy_identity/src/lib.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
#![forbid(unsafe_code)]
#![deny(missing_docs)]
#![allow(clippy::cast_precision_loss)]
//! A template copy is not the source document and not a state transition.
//!
//! Copy variants keep a distinct identity for relation-aware splits. They
//! never become input-process-outcome edges and never reuse the source
//! identity (ADR 0003).

mod error;
mod kind;

/// Fail-closed copy-identity errors.
pub use error::CopyIdentityError;
/// Closed vocabulary of copy-related document identities.
pub use kind::CopyKind;
/// Fraction of recovered copy kinds that match known truth.
pub use kind::identity_recovery_rate;
/// Refuse to treat a template copy as the source document identity.
pub use kind::refuse_copy_as_source_identity;
/// Refuse to treat a template copy as a forward state transition.
pub use kind::refuse_copy_as_transition;
67 changes: 67 additions & 0 deletions crates/copy_identity/tests/copy_identity_contract.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
//! A template copy is not the source document and not a state transition.

use copy_identity::{
CopyIdentityError, CopyKind, identity_recovery_rate, refuse_copy_as_source_identity,
refuse_copy_as_transition,
};

#[test]
fn a_copy_cannot_become_the_source_identity_or_a_transition() {
assert_eq!(
refuse_copy_as_source_identity(CopyKind::TemplateCopy),
Err(CopyIdentityError::CopyIsNotSourceIdentity)
);
assert_eq!(
refuse_copy_as_transition(CopyKind::TemplateCopy),
Err(CopyIdentityError::CopyIsNotTransition)
);
refuse_copy_as_source_identity(CopyKind::SourceDocument).expect("source");
refuse_copy_as_transition(CopyKind::SourceDocument).expect("source");
}

#[test]
fn recovered_kinds_match_known_truth_better_than_a_source_collapse() {
let truth = [
CopyKind::TemplateCopy,
CopyKind::SourceDocument,
CopyKind::TemplateCopy,
];
let recovered = truth;
let collapsed = [
CopyKind::SourceDocument,
CopyKind::SourceDocument,
CopyKind::SourceDocument,
];
let recovered_rate = identity_recovery_rate(&truth, &recovered).expect("recovered");
let collapsed_rate = identity_recovery_rate(&truth, &collapsed).expect("collapsed");
let expected = {
let mut matches = 0_u32;
for (truth_kind, decided_kind) in truth.iter().zip(recovered.iter()) {
if truth_kind == decided_kind {
matches += 1;
}
}
f64::from(matches) / f64::from(u32::try_from(truth.len()).expect("len"))
};
assert!((recovered_rate - expected).abs() < f64::EPSILON);
assert!(recovered_rate > collapsed_rate);
}

#[test]
fn empty_or_mismatched_kind_payloads_fail_closed() {
assert_eq!(
identity_recovery_rate(&[], &[]),
Err(CopyIdentityError::InvalidCopyPayload)
);
assert_eq!(
identity_recovery_rate(&[CopyKind::TemplateCopy], &[]),
Err(CopyIdentityError::InvalidCopyPayload)
);
assert_eq!(
identity_recovery_rate(
&[CopyKind::TemplateCopy, CopyKind::SourceDocument],
&[CopyKind::TemplateCopy]
),
Err(CopyIdentityError::InvalidCopyPayload)
);
}
7 changes: 7 additions & 0 deletions crates/copy_identity/tests/crate_contract.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
//! Integration contract for the `copy_identity` package identity.

#[test]
fn package_identity_is_stable() {
let observed = std::hint::black_box(env!("CARGO_PKG_NAME"));
assert_eq!(observed, "copy_identity");
}
2 changes: 1 addition & 1 deletion docs/TRACEABILITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ The full APA 7th standards/literature register remains `docs/research/standards-
| Rust workspace/quality foundation | ADR 0007 | workspace/CI/repository contract | implemented-main |
| six distinct clocks and uncertain intervals | PRD; ADR 0002 | PR #8 `temporal_core` on protected main; `system_clock` system-vs-other-clock identity on the active PR | active-PR |
| Allen relation algebra/bounded closure | ADR 0002; temporal research | PR #9 `temporal_core` path-consistency on protected main | implemented-main |
| forward-only transition subgraph | PRD; ADR 0002/0003 | `relation_graph` on protected main; `summarizes_edge` summary-versus-source identity on the active PR | partial |
| forward-only transition subgraph | PRD; ADR 0002/0003 | `relation_graph` on protected main; `copy_identity` copy-versus-source identity on the active PR | partial |
| event ontology/evidence mentions | PRD; ADR 0003 | `event_core` mention/instance separation on protected main; `persistence_postgres` mention SQL implemented-main refuses mention-as-instance; event-instance SQL (#39 implemented-main) refuses inverted windows; full intelligence stack remaining | partial |
| time-varying cross-classified multiple membership | PRD; ADR 0003 | `membership_core` network on protected main; `inferred_status` inferred-versus-observed identity on the active PR; multilevel estimators remaining | partial |
| leakage-safe availability/cutoff snapshots | PRD; ADR 0002/0013 | `corpus_split` on protected main | implemented-main |
Expand Down
1 change: 1 addition & 0 deletions docs/adr/0003-relational-event-multiple-membership.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# ADR 0003 — Relational event ontology and time-varying multiple membership

**Decision status:** Accepted
**Implementation maturity:** partial — membership network and event mention/instance separation implemented-main; copy-versus-source identity in `copy_identity` on the active PR; typed relation graph with forward-only transitions active-PR; multilevel estimators and persistence remain accepted-target
**Implementation maturity:** partial — membership network and event mention/instance separation implemented-main; summary-versus-source identity in `summarizes_edge` on the active PR; typed relation graph with forward-only transitions active-PR; multilevel estimators and persistence remain accepted-target
**Implementation maturity:** partial — membership network and event mention/instance separation implemented-main; typed relation graph with forward-only transitions implemented-main; IPO event-time order in `outcome_order` on the active PR; multilevel estimators and persistence remain accepted-target
**Implementation maturity:** partial — membership network and event mention/instance separation implemented-main; retrospective-reporting identity in `retrospective_edge` on the active PR; typed relation graph with forward-only transitions active-PR; multilevel estimators and persistence remain accepted-target
Expand Down
1 change: 1 addition & 0 deletions docs/adr/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ Read [`ADR_POLICY.md`](ADR_POLICY.md) first. **Decision status and implementatio
| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | partial | Typed clocks/intervals are implemented-main via `temporal_core`; retrospective-reporting identity is `retrospective_edge` on the active PR. Later graph/split enforcement remains target work. |
| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); retrospective-reporting identity is `retrospective_edge` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. |
| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Unmerged PR #8 is the canonical Task 3 replacement implementing typed clocks/intervals against the current protected-main lineage; conflicted PR #5 is superseded lineage. Later graph/split enforcement remains target work. |
| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); copy-versus-source identity is `copy_identity` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. |
| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); summary-versus-source identity is `summarizes_edge` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. |
| [0003](0003-relational-event-multiple-membership.md) | Relational event ontology and time-varying cross-classified multiple membership | Accepted | partial | Weighted time-varying membership network/roles are implemented-main (PR #12); inferred-versus-observed identity is `inferred_status` on the active PR; full multilevel estimators and persistence remain accepted-target. ADR 0016 owns event-intelligence tasks. |
| [0002](0002-six-clock-temporal-semantics.md) | Six-clock temporal semantics and fail-closed historical leakage prevention | Accepted | active-PR | Evidential-vs-transition gate in `support_edge` on the active PR; remaining graph/split enforcement stays accepted-target. |
Expand Down
Loading
Loading