Repository navigation
refactor(delivery): S2 — retire delivery/identity.py; the rule moved, it did not lapse - #160
Merged
Merged
Conversation
… it did not lapse Closes #150; closes register C-64 and C-25. Epic #148. S1 deleted identity.py's only caller. ADR-012's "Delivery Invariants" row listed forecast identity as authoritative, so this could not be allowed to happen as a silent side effect — C-64 existed to force the decision. Decision: retire it. The rule is enforced, in a stronger form, at wire/source_selection.py:73-81 — TargetLease.load() checks EVERY shard header's declared provenance.ensemble against the launched ensemble. Identity now comes from the artifact's own declared content rather than one store document's metadata field, and is checked per shard rather than once per run. Covered by test_wire_source_selection.py::test_wrong_declared_ensemble_refuses_at_load. Why retire rather than keep: an invariant module nothing calls is documentation shaped like code, and delivery/ is exactly the package the coming clones will copy wholesale — an unenforced rule there would be inherited as if it were live. C-25 closes too, and the distinction matters: its recorded mitigation WAS this function, so on paper it loses its guard. In fact its hazard — "newest category=forecast upload wins regardless of producer" — is now structurally impossible, because the contract path selects by run manifest, a commit marker with hash-verified contents. Recency-based selection is not an operation the code can perform. Closed as superseded by mechanism, not as mitigated. ADR-012 gains a dated amendment recording all of the above, and its Delivery Invariants row now points at it rather than naming a rule whose module is gone. The e2e suite's S3 section is re-homed rather than deleted: a comment now names where the invariant lives and which test covers it, so the next reader of that file finds the guarantee instead of a gap. ruff clean; 295 passed, 41 xfailed, 5 known local pyarrow byte-parity failures (CI authoritative). No file under wire/ or fixtures/ touched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #150 · Epic #148 · Register C-64 and C-25 closed
Why this needed a story rather than a line in S1
S1 deleted
identity.py's only caller. But ADR-012 lists forecast identity among the authoritative Delivery Invariants, so letting the module vanish as a side effect would have left the ontology describing deleted code — anddelivery/is precisely the package views-crafdapi and views-productionapi will copy wholesale. An unenforced rule sitting there would be inherited as if it were live.C-64 existed to force the decision. This is the decision.
The decision: retire it — the rule is enforced from better evidence
assert_forecast_identitywire/source_selection.py:73-81, inTargetLease.load()name/loametadataprovenance.ensembleCovered by
test_wire_source_selection.py::test_wrong_declared_ensemble_refuses_at_load.C-25 closes too — and the distinction is the point
C-25's hazard: "newest
category=forecastupload wins regardless of producer." Its recorded mitigation was this exact function, so on paper the entry loses its guard when the function goes.It doesn't. The hazard is now structurally impossible: since #149 the contract path is the only path, and it selects by run manifest — a commit marker whose contents are hash-verified. Recency-based selection is not an operation the code can perform any more.
Closed as superseded by mechanism, not as mitigated. That wording is deliberate: a future reader must not conclude a guard is standing watch when what actually happened is that the door was removed.
Also in this PR
tests/test_identity.pydeleted with the module.Verification
ruffclean · 295 passed, 41 xfailed · the 5 failures are the known local pyarrow byte-parity tests; CI authoritative · no file underwire/orfixtures/touched — contract surface untouched by construction.Register: 71 concerns, 32 open (was 34), 39 resolved. Integrity guard green.
🤖 Generated with Claude Code