You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A data architect can provide immutable relational source evidence and receive a reviewable governed semantic-model proposal that explains what was observed, which exact source coordinates support each candidate, how it was validated, and what a released client may safely consume.
DDD boundary
Source Observation owns bounded source-access contracts, registry authorization capability binding, immutable observed facts, evidence coordinates and extractor receipts; it does not own source-system business truth or semantic inference. Semantic Discovery owns candidates, never authoritative source truth. LLM proposal work, if used, routes only through a released contextual-orchestrator contract and remains proposed/inferred. Model Alignment and Model Validation own matching/refinement and deterministic validation. Governance & Publication owns steward decisions and immutable semantic releases. External source/provider DTOs and credentials remain behind adapter ACLs.
Current Source Observation lane — 2026-09-06
Client parent #5 is fcf36c8a99f015b963c9f812787df127ac2e2f9e; Source Observation PR #6 is exact e3c415600300b6c2d5b852c457ea6ab2e5222e08, Draft/open. Predecessor evidence does not transfer to this exact head.
The retained contract now includes owner-computed deterministic source-content identity, bounded authorization metadata, exact source-key + immutable connection-policy binding resolution, explicit exact-schema and complete resource-envelope policy, one non-resetting monotonic operation budget across local authorization and adapter execution, awaitable provider-independent Send execution, stale-binding rejection, snapshot-side exact-schema containment, and binding-preserving immutable receipt provenance. DSNs, credentials, provider runtime objects, foreign domain truth and wall-clock timestamps remain outside the port.
Single-use authorization repair
Review 5124482059 identified that predecessor db209b9b11039ed77cbae246f65b3a83d7589d23 still treated AuthorizedObservationRequest as replayable: it implemented Clone and SourceObservationPort::observe borrowed it. One successful registry authorization could therefore start multiple observations and multiply one operation's admitted row, byte, concurrency, deadline and source-access budget.
2a03a56a5982f9d56e880689a139597aea3ef47d committed the compile-contract specification first: the port consumes the authorization by value and cancellation/success controls obtain independent authorizations. 340ded102f18c1c4abebbcf0590e5941b61f6cba is the minimum production repair: AuthorizedObservationRequest is non-Clone and SourceObservationPort::observe consumes it. Successor fixtures preserve authorization zero-side-effect, cancellation, stale-binding, remaining-budget and resource-envelope behavior on that single-use seam.
Architecture, TRD, Security, Test Strategy, Operability, CHANGELOG and docs/product-technical-gap-baseline.md are aligned. Proposed ADR 0006 refines Proposed ADR 0004 with the single-use operation-capability decision. docs/doctoring/source-observation-authorization-replay-governance.md traces the finding and repair to OWASP API4:2023 and MITRE CWE-770 resource-governance guidance while explicitly distinguishing that general guidance from the Rust ownership mechanism chosen here.
Verification state
Do not treat the current head as GREEN until fresh exact-head evidence proves it. The current tool environment has no Rust toolchain, so the compile-contract specification was not observed with cargo here. Required evidence remains Rust 1.98 tests, strict fmt/Clippy, warnings-denied rustdoc, release build, owned 100% coverage and applicable security/dependency workflows on one unchanged exact head. ADR 0004 and ADR 0006 remain Proposed. No predecessor Product/coverage/rustdoc evidence transfers.
Implement the concrete read-only PostgreSQL adapter behind conceptweave-source-port with a maintained patched Rust PostgreSQL driver, adapter-local least-privilege credential resolution for the exact key+binding, one fresh authorization per attempted observation/retry, one explicit REPEATABLE READ READ ONLY catalog transaction, exact-schema pg_catalog evidence, and one remaining operation budget across connect/transaction/statement/cancellation work.
Enforce cancellation plus row/byte/concurrency limits, stale-binding rejection before I/O, complete-or-fail snapshot construction and source-disappearance handling.
Freeze and replay an anonymized GRC-shaped conformance fixture without copying governance-risk-compliance source or querying its application tables through hidden coupling.
After observation conformance is GREEN, continue discovery/proposal/alignment/validation/governance/release work from verified source receipts rather than relational structure alone.
Acceptance
Same immutable observed metadata produces the same owner-computed source-content identity regardless of input table order or provenance-only coordinates; materially different observed metadata cannot reuse that identity; every candidate binds to exact source identity/digest/location evidence; a raw request or merely well-formed key cannot reach the canonical adapter seam; unknown/unauthorized source, schema, resource or stale binding fails before source/snapshot side effects; one authorization can cross the canonical observation execution seam only once; retry re-authorizes against current policy; authorization, connection and catalog work share one operation deadline; access remains read-only, least-privilege, cancellation-aware and credential-free at domain boundaries; partial/ambiguous capture is never promoted to immutable success; raw LLM SQL is never executed against source systems; publication and Client consumption use governed immutable releases only.
Buyer outcome
A data architect can provide immutable relational source evidence and receive a reviewable governed semantic-model proposal that explains what was observed, which exact source coordinates support each candidate, how it was validated, and what a released client may safely consume.
DDD boundary
Source Observation owns bounded source-access contracts, registry authorization capability binding, immutable observed facts, evidence coordinates and extractor receipts; it does not own source-system business truth or semantic inference. Semantic Discovery owns candidates, never authoritative source truth. LLM proposal work, if used, routes only through a released
contextual-orchestratorcontract and remains proposed/inferred. Model Alignment and Model Validation own matching/refinement and deterministic validation. Governance & Publication owns steward decisions and immutable semantic releases. External source/provider DTOs and credentials remain behind adapter ACLs.Current Source Observation lane — 2026-09-06
Client parent #5 is
fcf36c8a99f015b963c9f812787df127ac2e2f9e; Source Observation PR #6 is exacte3c415600300b6c2d5b852c457ea6ab2e5222e08, Draft/open. Predecessor evidence does not transfer to this exact head.The retained contract now includes owner-computed deterministic source-content identity, bounded authorization metadata, exact source-key + immutable connection-policy binding resolution, explicit exact-schema and complete resource-envelope policy, one non-resetting monotonic operation budget across local authorization and adapter execution, awaitable provider-independent
Sendexecution, stale-binding rejection, snapshot-side exact-schema containment, and binding-preserving immutable receipt provenance. DSNs, credentials, provider runtime objects, foreign domain truth and wall-clock timestamps remain outside the port.Single-use authorization repair
Review
5124482059identified that predecessordb209b9b11039ed77cbae246f65b3a83d7589d23still treatedAuthorizedObservationRequestas replayable: it implementedCloneandSourceObservationPort::observeborrowed it. One successful registry authorization could therefore start multiple observations and multiply one operation's admitted row, byte, concurrency, deadline and source-access budget.2a03a56a5982f9d56e880689a139597aea3ef47dcommitted the compile-contract specification first: the port consumes the authorization by value and cancellation/success controls obtain independent authorizations.340ded102f18c1c4abebbcf0590e5941b61f6cbais the minimum production repair:AuthorizedObservationRequestis non-CloneandSourceObservationPort::observeconsumes it. Successor fixtures preserve authorization zero-side-effect, cancellation, stale-binding, remaining-budget and resource-envelope behavior on that single-use seam.Architecture, TRD, Security, Test Strategy, Operability, CHANGELOG and
docs/product-technical-gap-baseline.mdare aligned. Proposed ADR 0006 refines Proposed ADR 0004 with the single-use operation-capability decision.docs/doctoring/source-observation-authorization-replay-governance.mdtraces the finding and repair to OWASP API4:2023 and MITRE CWE-770 resource-governance guidance while explicitly distinguishing that general guidance from the Rust ownership mechanism chosen here.Verification state
Do not treat the current head as GREEN until fresh exact-head evidence proves it. The current tool environment has no Rust toolchain, so the compile-contract specification was not observed with
cargohere. Required evidence remains Rust 1.98 tests, strict fmt/Clippy, warnings-denied rustdoc, release build, owned 100% coverage and applicable security/dependency workflows on one unchanged exact head. ADR 0004 and ADR 0006 remain Proposed. No predecessor Product/coverage/rustdoc evidence transfers.Active P0
conceptweave-source-portwith a maintained patched Rust PostgreSQL driver, adapter-local least-privilege credential resolution for the exact key+binding, one fresh authorization per attempted observation/retry, one explicitREPEATABLE READ READ ONLYcatalog transaction, exact-schemapg_catalogevidence, and one remaining operation budget across connect/transaction/statement/cancellation work.governance-risk-compliancesource or querying its application tables through hidden coupling.Acceptance
Same immutable observed metadata produces the same owner-computed source-content identity regardless of input table order or provenance-only coordinates; materially different observed metadata cannot reuse that identity; every candidate binds to exact source identity/digest/location evidence; a raw request or merely well-formed key cannot reach the canonical adapter seam; unknown/unauthorized source, schema, resource or stale binding fails before source/snapshot side effects; one authorization can cross the canonical observation execution seam only once; retry re-authorizes against current policy; authorization, connection and catalog work share one operation deadline; access remains read-only, least-privilege, cancellation-aware and credential-free at domain boundaries; partial/ambiguous capture is never promoted to immutable success; raw LLM SQL is never executed against source systems; publication and Client consumption use governed immutable releases only.
Refs #6, Issue #4,
ContextualWisdomLab/governance-risk-compliance#63.