Docs / Specification

contract assurance · 80-formal.md · 81-engineering.md · 82-consumer.md · 83-gate.md · guide · card

Consumer compatibility

consumer

Artifact compatibility: source-independent execution, required capabilities, scenario evidence, storage profiles and release distribution.

• suitetestcontextful-conformance --binary <path> --output <report> executes its versioned scenarios through the supplied artifact’s public CLI and HTTP surfaces outside a source checkout.
  Why

  A-assurance#consumer-compatibility-binds
• credential-isolationtestEvery artifact invocation receives an empty inherited environment, an isolated home and scratch directory, a fixed executable search path and explicitly supplied synthetic fixture credentials.
  Why

  because compatibility evidence requires no provider account or inherited credential
• requirementstestEvery required scenario executes its declared capabilities; a missing capability or unsupported storage profile records unsupported, names its requirement and refuses consumer activation.
  Why

  A-assurance#consumer-compatibility-binds
• verdicttestA compatibility verdict passes only when every required scenario reports executed success; a parse, an unsupported requirement or a skipped required scenario supplies no execution pass.
  Why

  P7
• verdict-exittestcontextful-conformance exits 1 after writing a failing verdict and 2 without a report; release packaging records a failed suite-exit scenario for any other exit, or for exit 1 over a passing report.
  Why

  because the suite’s own failing verdict is evidence, not a crashed process
• scenariostestThe suite exercises pagination and checkpoints, applied scheduling and dependencies, graceful restart, hard-crash replay, empty and replacement captures, public identifiers, credential masking, typed export acknowledgement, receiver visibility and a delegated item fenced by a newer owner.
• mutation-controlstestPlanted cursor skips, duplicate public identities, repeated in-window scheduling and acknowledgement before receiver commit each fail their owning scenario.
  Why

  because a scenario that accepts its motivating defect proves no compatibility
• reporttestEvidence records the suite revision and version, supplied binary SHA-256 digest, reported version, feature profile, storage profile and every scenario outcome, requirement and diagnostic.
• command-diagnostictestA failed or timed-out artifact command’s diagnostic, a scenario step’s included, names its verb and the first error identifier its stderr carries; no other stderr text enters the report.
  Why

  because a provider failure must name its cause while stderr may carry binding credentials
• provenancetestUnknown source correspondence remains null; a reported version or successful scenario never supplies a source commit.
  Why

  because source correspondence requires evidence beyond behavior and a version string
• artifact-stabilitytestThe suite verifies the supplied artifact’s digest before and after execution; changed bytes refuse a compatibility verdict.
• release-distributiontestEach release archive carries the matching-target suite and compatibility report whatever its verdict; release metadata names the report, binary digest and verdict, preserving failed and skipped outcomes.
  Why

  because a profile lacking a scenario’s capability never passes, and refusing its cell withholds the evidence stating so
• release-notestestcontextful-ci formula writes release-notes.md stating every cell’s local and cloudflare-d1 verdict, and fails on a cell carrying none; the operator publishes it as the GitHub release body.
  Why

  because a failing verdict ships, so the release page states it beside the archives
• foreign-targettestA release target unavailable to its packaging host records explicit skipped scenarios with a target diagnostic; its report supplies no execution pass.
  Why

  because a cross compilation cannot demonstrate the produced artifact’s behavior
• storage-profiletestThe local profile uses isolated filesystem state; postgres uses synthetic PostgreSQL and signed S3 services. An unavailable fixture records its named requirement through requirementsassurance.consumer.requirementsEvery required scenario executes its declared capabilities; a missing capability or unsupported storage profile records unsupported, names its requirement and refuses consumer activation..
• d1-profiletestA cloudflare-d1 verdict runs the supplied contextful-full artifact against D1 and R2 bindings, replaces its local disk, and records every required outcome independently of the local and PostgreSQL profiles.
  Why

  A-assurance#consumer-compatibility-binds
• d1-admissiontestA cloudflare-d1 suite holds a lease row in the bound D1 from before its first reset until it ends, lapsing 120 s after its last renewal; a suite meeting a live lease refuses each required scenario with ConformanceAlreadyRunning.
  Why

  because a process check inside one container misses a suite another container runs against the same database
• d1-releasetestRelease evidence binds a cloudflare-d1 report to the artifact digest, source revision, suite revision and storage profile; a required failure, unsupported case, skip or unverified binding supplies no compatibility verdict.
  Why

  A-assurance#consumer-compatibility-binds
• d1-absenttestA native contextful-full release cell without CONTEXTFUL_CONFORMANCE_D1_ENDPOINT runs no cloudflare-d1 pass; its report records binding origin absent and every required scenario skipped with ConformanceBindingAbsent.
  Why

  because a release container holds no D1 binding, and the deployment run against D1 and R2 supplies that verdict

Scenarios

• assurance.consumer.requirementsassurance.consumer.requirementsEvery required scenario executes its declared capabilities; a missing capability or unsupported storage profile records unsupported, names its requirement and refuses consumer activation.: WHEN a read-only artifact receives a required replay scenario, THEN evidence names the missing run capability and the suite exits unsuccessfully.
• assurance.consumer.verdict-exitassurance.consumer.verdict-exitcontextful-conformance exits 1 after writing a failing verdict and 2 without a report; release packaging records a failed suite-exit scenario for any other exit, or for exit 1 over a passing report.: WHEN the suite exits 1 over a report whose required scenarios are unsupported, THEN the release report holds those scenarios and no suite-exit failure.
• assurance.consumer.command-diagnosticassurance.consumer.command-diagnosticA failed or timed-out artifact command's diagnostic, a scenario step's included, names its verb and the first error identifier its stderr carries; no other stderr text enters the report.: WHEN a command fails with a credential in its stderr, THEN the diagnostic names the verb and error identifier, and the report omits the credential.
• assurance.consumer.mutation-controlsassurance.consumer.mutation-controlsPlanted cursor skips, duplicate public identities, repeated in-window scheduling and acknowledgement before receiver commit each fail their owning scenario.: WHEN a native source advances past an unserved page, THEN the pagination scenario fails.
• assurance.consumer.scenariosassurance.consumer.scenariosThe suite exercises pagination and checkpoints, applied scheduling and dependencies, graceful restart, hard-crash replay, empty and replacement captures, public identifiers, credential masking, typed export acknowledgement, receiver visibility and a delegated item fenced by a newer owner.: WHEN a newer job version takes an entity’s lease while a delegated call is in flight, THEN the earlier item lands nothing, and its job’s next fire lands the recorded answer without a second request.
• assurance.consumer.d1-profileassurance.consumer.d1-profileA cloudflare-d1 verdict runs the supplied contextful-full artifact against D1 and R2 bindings, replaces its local disk, and records every required outcome independently of the local and PostgreSQL profiles.: WHEN a newer job version fires while a delegated call holds its D1 guard, THEN that fire refuses, and its next fire after the callback returns lands.