Config-Track Federation
Audience: Developers distributing configuration changes across nodes with evidence. Status (2026-11-08): Twenty-seven cards — twenty-six done, one deferred.
Blueprint sources
- Change-track federation and seeding design note and its backlog.
- Configuration backlog status lines.
Facts
- The protocol is hierarchical distribution with no acronym in the sources.
- All track traffic uses the canonical envelope only, outbox-first publish, and idempotency on subject-plus-event and cell-plus-digest-plus-track. Legacy bare payloads without the envelope are refused.
- The system of record is claims only — offer, receipt, finalise, waiver, rollback — plus projections recomputed from receipt claims. No bespoke track tables.
1. Track, cell, proof, rollout — in plain terms
Track is one of test, production, or a custom bucket. Test is a test value overlay with the test marker and upstream approval after optional shadow replay; production is live values and requires a test finalise for the same package digest, or a dual-control waiver claim, default deny. Custom is a profile-declared bucket that cannot widen the ceiling or add denied audiences.
Cell is one downstream node addressed by cell identity, with a frozen audience snapshot (cells plus weights) captured at offer time. Finalise and rollup use that snapshot denominator, never live membership.
Proof is the upward ladder: offer received, then admitted or verify failed, then verify passed or failed, then apply progress heartbeat (lease-fenced), then terminal applied, rejected, or degraded, then post-apply health attestation. Receipts carry a signature plus a hop proof, and parents recompute rollups rather than trusting child-supplied counts.
Rollout flows: authoring-cell vote and separation, then change set, then offer down, then downstream admit, verify, apply, then progress and applied, rejected, or degraded up, then parent rollup and finalise, then optional production offer. Confederation peers do not inherit hierarchy owner-push.
2. Card table — ID | desire | status
| ID | Desire | Status |
|---|---|---|
| FCT-01 | Distribution tracks, track envelopes, closed event registry, schema directory, subjects value, track profile. | DONE |
| FCT-02 | Soft drill desk: offer, admit, verify, apply, upward reports, parent rollup, finalise, production refuse or allow, progress lease. | DONE |
| FCT-03 | Effect interface with applies, finalise, rollups, and a compliance board. | DONE |
| FCT-04 | Event-bus topology for offer, report, flush, dead-letter, and command; outbox-first publish; idempotency; dead-letter reasons. | DONE |
| FCT-05 | Apply with compare-and-swap recompute, pin, ceiling, residency, gap, track-scoped write, two-phase mixed. | DONE |
| FCT-06 | Optional governance promotion to a test offer when tracks include test. | DONE |
| FCT-07 | Seeder library extract with universal parent pin and approved-digest refusal. | DONE |
| FCT-08 | Federated seeding of data and mixed; receipt verification; probation witness-only. | DONE |
| FCT-09 | Bootstrap soft baseline digest; child test-first. | DONE |
| FCT-10 | Multi-cell soft matrix with weighted approval; confederation ignores hierarchy push. | DONE |
| FCT-11 | Shadow replay before vote; missing bytes skips explicitly, never invents a pass. | DONE |
| FCT-12 | Live production apply behind live and policy gates, with runbook. | DONE |
| FCT-13 | Threat feed and quarantine short-circuit the admit. | DONE |
| FCT-14 | Customer signature required when the track profile demands it. | DONE |
| FCT-15 | Console and interface listing of receipts plus finalise, tenant-scoped. | DONE |
| FCT-16 | Observability and audit attributes: revision, package, track, cell, change set, audience snapshot. | DONE |
| FCT-17 | Waiver claim for production without test — default deny. | DONE |
| FCT-18 | Trusted timestamp on finalise. | DEFERRED |
| FCT-19 | Audience snapshot at offer: freeze cells plus weights; finalise uses the snapshot denominator only. | DONE |
| FCT-20 | Upward reporting ladder on the live path: progress heartbeat with lease fencing, terminal states, production health. | DONE |
| FCT-21 | Signed receipt chain with hop proofs and parent countersignatures; unregistered cells get no credit. | DONE |
| FCT-22 | Meter-clock profiles plus breach flagging, silent cells, optional degraded finalise under dual control. | DONE |
| FCT-23 | Cohort reoffer: only the noncompliant or silent subset via the pin-pull path. | DONE |
| FCT-24 | Rollback as a new change set with dual control; no silent undo. | DONE |
| FCT-25 | Counsel-ready failure-mode note: partial audience, degraded finalise, rollback liability. | DONE |
| FCT-26 | Pipeline depth and cycle handling with shared dead-letter builders. | DONE |
| FCT-27 | Canary honeypot offer to a small audience before wide test finalise. | DONE |
3. Soft cell semantics and rollout evidence
The soft desk implements the full ladder for drills only; live event-bus and system-of-record paths refuse when live mode is on, and soft desks never invent live success. Live-apply permission is separate from bus liveness: the live apply path requires live opt-in plus query and outbox adapters, plus track exactly production, plus a policy-root signature, plus a test finalise for the same digest.
| Evidence | Where it lands | Gate visible |
|---|---|---|
| Offer plus audience snapshot | Offer claim plus offer subject per track | Tracks and snapshot cards |
| Upward admit, verify, apply, reject, degrade | Report subjects by kind | Drill desk and live ladder |
| Parent rollup recomputed, never child-trusted | Rollup plus compliance board interface | Drill desk and signed chain |
| Signed receipts with signature plus hop proof | Receipt claims | Signed chain; unregistered cells get no credit |
| Live production commit | Terminal receipts with signatures plus hop proofs | Live gate table |
| Drift report, report-only | Zero-drift on empty input | Evidence only, no invented merge |
| Rollback as a new change set under dual control | Rollback command plus claim | Rollback card |
| Canary pre-finalise signal | Small-audience gate | Canary card |
Shadow replay simulates the pipeline without committing state; missing retained bytes skip explicitly. A canary degrade or reject is a poison signal and wide finalise refuses unless degraded-finalise dual control is set.
4. Governance gates
| Gate | Condition | Effect when failing |
|---|---|---|
| Soft invent-refusal | Live mode on | Soft refuses; never invents live success. |
| Apply live opt-in | Live apply opt-in plus query and outbox adapters present | Refuses without inventing. |
| Live production apply | All gates: live opt-in, adapters, track exactly production, policy-root signature, test-finalised same digest | Refuses without inventing live success. |
| Waiver default deny | Production commit without a waiver | Refuses; waiver identity recorded when granted. |
| Audience snapshot | Late joiners after the snapshot | Excluded from the denominator. |
| Lease fencing | Lease expiry on a progress heartbeat | Expiry never counts as applied. |
| Threat quarantine | Quarantined source at admit | Rejected. |
| Unsigned production | Customer signature required by the track profile but absent | Unsigned production refuses. |
| Depth and cycle | Pipeline depth above the ceiling, or a cycle | Dead-lettered, never applied. |
Open items / gaps
- The trusted-timestamp card remains deferred; no trusted timestamp is set.
- Drill packs, the anonymous intake carrier, the ultrasonic software kit, and the liability note remain outstanding in the configuration backlog.
- Drift handling is report-only with an honest zero on empty input.