You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit fcf318e
Browse filesBrowse the repository at this point in the historyBrowse files
Limit the no-generation rule to app-generation refusals, scope surface proof
to captures that need it, keep integrated checks for unproven absence, and
scope the rationale to multi-source owners.
Copy file name to clipboardExpand all lines: docs/adr/0038-snapshot-capture-source-routing.md
+7-6Lines changed: 7 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,22 +47,23 @@ A source never routes to another source.
47
47
| Runner session | The source stays disabled until the runner has a new session id. |
48
48
49
49
An unknown refusal code has app-generation scope.
50
-
Without a verified generation, the refusal disables the source for the current capture only and creates no circuit.
50
+
Without a verified app generation, an app-generation refusal disables the source for the current capture only and creates no app-generation circuit.
51
51
The refusal fixture is the one table of codes and scopes.
52
52
The router handles cancellation before it classifies a refusal.
53
53
54
-
**Surface proof.** Prove surface absence for each capture. Never cache it.
55
-
An unproven state is not a clear state: an app-only read must prove absence or refuse.
54
+
**Surface proof.** When a capture needs surface-absence proof, prove absence for that capture. Never cache it.
55
+
An unproven state is not a clear state.
56
+
When surface absence is unproven, an app-only source must refuse an occluded or unverified read through integrated checks.
56
57
An occluded read selects a source that can read the surface.
57
58
A source that declares no proof asserts no absence.
58
59
Acquisition metadata, such as an Android system-only tree, is not a proof.
59
60
A future app-only source needs window-ownership evidence that is tied to its read.
60
61
61
62
## Rationale
62
63
63
-
-One rule makes fallback, refusals, and warnings the same on every platform. A new provider declares its sources and does not copy policy.
64
+
-The router gives multi-source owners one rule for fallback, refusals, and warnings. A new provider declares its sources and does not copy policy.
64
65
- The router applies only where a choice exists. A planner that never chooses adds migration cost and no value.
65
-
- An unknown refusal fails closed, so a failed source cannot stay eligible.
66
+
- An unknown refusal fails closed for the verified app generation, or for the current capture when the generation is unverified.
66
67
- A surface can appear between captures. A cached absence would publish an occluded read as app content.
67
68
68
69
## Rejected alternatives
@@ -76,4 +77,4 @@ A future app-only source needs window-ownership evidence that is tied to its rea
76
77
77
78
- Provenance types move from kernel to contracts, and both iOS sources bind to the router.
78
79
- Readers, decoding, discovery, process checks, native budgets, geometry, and lifecycle stay platform-specific.
79
-
- Open gaps: the router and the producer registry do not exist yet. The runner-session scope arrives with[#4256](https://github.com/callstack/agent-device/pull/4256). ADR 0004 must shrink below about 15 KB.
80
+
- Open gaps: the router and the producer registry do not exist yet. The runner-session scope is pending[#4256](https://github.com/callstack/agent-device/pull/4256).
0 commit comments