| Safe Haskell | None |
|---|---|
| Language | GHC2021 |
Conformance.Cli.Controls
Description
The ordinary CLI's story and the open-datum application's boundary, judged from receipts.
Alice's story runs through the ordinary commands and is checked against the receipts they print. Hand-built updates and an early release reach the application's own script. An ordinary insert, update or terminate the key's current entry rules out is refused at booking before signing, naming the key and the client policy: a second insertion of a key that is Active, an insertion of a key that is already Terminal, and an update or a terminate of a key that is unknown or already Terminal.
And the registry refuses at its fold a booking the permissive builders
certify for a key it already holds: a second insertion of a key that is
Active, and an insertion of a key that is already Terminal. Neither can
take effect: the registry refuses to fold them because the key exists
(the model's duplicate_refused_by_registry and
resurrection_refused_by_registry). Each refusal is paired with an
accepting control that differs only in the key: a key the registry has
never held, booked and folded the same way. Readbacks taken before and
after every refusal show that nothing moved.
Every result here is computed from receipts. A story is interpreted twice: once against a node, where each action leaves one receipt, and once over those receipts, where each check is recomputed. A missing, misplaced or altered receipt changes the verdict; nothing is typed in.
Synopsis
- data Command
- applicationExecutable :: String
- registryExecutable :: String
- commandExecutable :: Command -> String
- commandPrefix :: Command -> [String]
- commandInvocation :: Command -> String
- provocationCommand :: Provocation -> Command
- storyCommands :: Story () -> [Command]
- storyExecutables :: Story () -> [String]
- introductionExecutablePhrase :: Story () -> String
- registryPrefix :: String -> [String]
- registryInvocation :: String -> String
- commandName :: Command -> String
- data Crafted
- = HonestUpdate
- | UpdateByStranger
- | UpdateOtherController
- | UpdateDepositTampered
- | UpdateEscaped
- | UpdateTokenLeft
- | UpdateShortDeposit
- | UpdateWithoutDatum
- | UpdateAddedAsset
- | EarlyWithdrawal
- | BookingByStranger
- | BookingOtherDestination
- | BookingShortDeposit
- | BookingNoDatum
- | EnvelopeOtherStateName
- | EnvelopeOtherStatePolicy
- | EnvelopeOtherRegistry
- | TerminateBooking
- | TerminateBookingByStranger
- | ReleaseInOtherFold
- | UpdateWithoutScript
- | FoldPaysShort
- | FoldPaysInFull
- | FoldTwoReleasesShort
- | FoldTwoReleasesOneFloor
- | FoldTwoReleasesInFull
- | FoldMixedShort
- | FoldMixedInFull
- craftedName :: Crafted -> String
- craftedPhrase :: Crafted -> String
- newtype Target = Target String
- data Requirement
- = CommandSucceeded
- | Accepted
- | RefusedByState
- | Unchanged
- | PartialPending
- | BookingRefused
- | RefusedByApplication
- | HoldingUnchanged
- | SameRegistry
- | Delivered
- | PayloadReplaced
- | Released
- | Observed
- | RegistryUnchanged
- | Established
- | ReachedActive
- | ReachedTerminal
- | RejectedBeforeScripts
- | RefusedBeforeSubmitting
- | CreateUnderfunded
- | TokenOnlyReading
- | FoldConsumed
- | NoLeafPrinted
- | StoppedAfterAcceptance
- | ReconciledOrRefused
- | ResolvedFromChain
- | IncompleteCreateRead
- | LateCreateRefused
- | BoundedAfterNodeLoss
- | Reclaimed
- | ExposureBounded
- | IndexerAgrees
- data Indexer
- = Koios
- | Blockfrost
- indexerName :: Indexer -> String
- data IndexerRead = IndexerRead {
- irProvider :: Text
- irPolicy :: Text
- irAssetName :: Text
- irHolders :: Maybe [(Text, Integer)]
- irHolderAddresses :: Maybe Int
- irAnswerDatum :: Maybe Text
- irAnswerTip :: Maybe Integer
- irIndexerOutput :: Text
- irIndexerDatumCbor :: Text
- irIndexerDatumHashRecorded :: Text
- irIndexerDatumHashComputed :: Maybe Text
- irIndexerTipSlot :: Maybe Integer
- irMaxLagSlots :: Maybe Integer
- irNodeOutput :: Text
- irNodeDatumCbor :: Text
- irNodeDatumHash :: Text
- irNodeChainPoint :: Text
- irStated :: Stated
- irMalformed :: [Text]
- data Stated = Stated {
- stHolds :: Bool
- stSameOutput :: Bool
- stSameDatumBytes :: Bool
- stSameDatumHash :: Bool
- stWithinLag :: Bool
- stLagSlots :: Maybe Integer
- data Account = Account {
- acFee :: Integer
- acCollateralInputs :: [Text]
- acCollateralTotal :: Maybe Integer
- acCollateralReturn :: Maybe Integer
- acSpends :: [Text]
- data CliI res where
- Run :: Command -> Target -> String -> CliI Receipt
- RunByToken :: Target -> Target -> Command -> String -> CliI Receipt
- Book :: Target -> String -> CliI Receipt
- FoldUnevaluated :: Target -> String -> CliI Receipt
- Observe :: Target -> String -> CliI Receipt
- Craft :: Crafted -> Target -> String -> CliI Receipt
- Provoke :: Provocation -> Target -> String -> CliI Receipt
- Reclaim :: Target -> String -> Receipt -> Receipt -> CliI Receipt
- ReadIndexer :: Indexer -> Target -> String -> Receipt -> CliI Receipt
- Require :: Requirement -> [Receipt] -> CliI ()
- Retire :: String -> CliI ()
- type Story = Story CliI
- data DuplicateRefused
- data ResurrectionRefused
- duplicateRefused :: Theorem DuplicateRefused
- resurrectionRefused :: Theorem ResurrectionRefused
- data UpdateInversion
- updateInversion :: Theorem UpdateInversion
- data ClientPolicy
- earlyRefusalPolicy :: Theorem ClientPolicy
- clientPolicyBindings :: [Binding]
- terminateBurnsActiveHolding :: Theorem ClientObligation
- statementBindings :: [Binding]
- resolveStatement :: Value -> Binding -> Either String ()
- obligationBindings :: [Binding]
- resolveObligation :: (Text -> Text) -> Text -> Binding -> Either String ()
- cliSpecification :: String
- duplicateStory :: Story ()
- resurrectionStory :: Story ()
- earlyRefusalStory :: Story ()
- lifecycleStory :: Story ()
- boundaryStory :: Story ()
- controlsStory :: Story ()
- processStory :: Story ()
- permanentStory :: String -> Story ()
- forbiddenInPermanent :: [Text]
- actionsOf :: Story () -> [Text]
- data Receipt = Receipt {
- rcStep :: Int
- rcAction :: Text
- rcTarget :: Text
- rcKey :: Text
- rcOutcome :: Text
- rcTxId :: Maybe Text
- rcPendingRequest :: Maybe Text
- rcEvaluation :: Maybe Text
- rcStateValidator :: Maybe Text
- rcApplication :: Maybe Text
- rcRefusingScripts :: [Text]
- rcPhaseWords :: [Text]
- rcRejectionFile :: Maybe Text
- rcRejectionSha256 :: Maybe Text
- rcBodyFile :: Maybe Text
- rcBodySha256 :: Maybe Text
- rcSubmissions :: [Submission]
- rcResolved :: [Resolved]
- rcJournal :: Maybe JournalSpan
- rcProcess :: Maybe ProcessEvidence
- rcAdmission :: Maybe [Text]
- rcReason :: Maybe Text
- rcObservation :: Maybe Observation
- rcAllowance :: Maybe Integer
- rcAccount :: Maybe Account
- rcReadbackFile :: Maybe Text
- rcReadbackSha256 :: Maybe Text
- rcIndexer :: Maybe IndexerRead
- rcMaxLag :: Maybe Integer
- rcEvidence :: [Text]
- rcCommand :: Maybe Value
- rcWithheldReads :: Maybe Int
- data Observation = Observation {
- obRoot :: Text
- obHolding :: Maybe Text
- obHoldingLovelace :: Maybe Integer
- obPending :: [Text]
- obPendingLovelace :: Integer
- obWalletLovelace :: Integer
- obLeaf :: Maybe Text
- data Submission = Submission {
- suStep :: Text
- suTxId :: Text
- suBodyFile :: Text
- suBodySha256 :: Text
- data Resolved = Resolved {}
- data JournalSpan = JournalSpan {}
- data ProcessEvidence = ProcessEvidence {
- peJournal :: Text
- peJournalBefore :: Int
- peJournalAfter :: Int
- peLastEvent :: Text
- peSubmitted :: [Text]
- peExit :: Int
- peWaited :: Maybe Int
- peFilesBefore :: [(Text, Text)]
- peFilesAfter :: [(Text, Text)]
- peSeedProbe :: Maybe Text
- data Provocation
- provocationName :: Provocation -> String
- emptyReceipt :: Int -> Text -> Text -> Text -> Receipt
- rejectionEvidence :: String -> ([Text], [Text])
- decodeIndexerRead :: Value -> Maybe IndexerRead
- attribution :: Text -> Receipt -> Either RefusalMismatch ()
- data ClauseStatus
- data ClauseResult = ClauseResult {
- crStatement :: String
- crTitle :: String
- crStatus :: ClauseStatus
- check :: Requirement -> [Receipt] -> [String]
- judge :: [Receipt] -> Story () -> [ClauseResult]
- held :: [ClauseResult] -> Bool
- outline :: Story () -> [(String, String)]
- renderControls :: [ClauseResult] -> Story () -> String
- validateControls :: Story () -> Either String ()
Actions
The ordinary commands, as a person runs them. An update names which of the story's payloads it writes. A fold folds the registry's pending request: the request names its key and edge, so the command takes no key, payload, deposit or fold flag of its own.
Instances
| Show Command Source # | |
Defined in Conformance.Cli.Controls | |
| Eq Command Source # | |
Defined in Conformance.Cli.Controls | |
applicationExecutable :: String Source #
The executable that runs the application's own verbs (#528).
registryExecutable :: String Source #
The executable that keeps the registry's own verbs (#528).
commandExecutable :: Command -> String Source #
The executable that runs one ordinary command: the application's verbs all run through `open-datum` (#528).
commandPrefix :: Command -> [String] Source #
The executable and verb one ordinary command runs as, from the one source the backend builds its arguments from and the rendering names.
commandInvocation :: Command -> String Source #
The same invocation as rendered in the description language.
provocationCommand :: Provocation -> Command Source #
The ordinary command a provocation runs, from the same command its phrase names (#528).
storyCommands :: Story () -> [Command] Source #
The ordinary commands a story runs, in order, as the steps name them (#528).
storyExecutables :: Story () -> [String] Source #
The distinct executables a story's steps run, in first-seen order, from the same source that names each step (#528).
introductionExecutablePhrase :: Story () -> String Source #
The introduction's executable phrase, derived from the steps the story actually has (#528).
registryPrefix :: String -> [String] Source #
The executable and verb one registry command runs as.
registryInvocation :: String -> String Source #
The same registry invocation as rendered.
commandName :: Command -> String Source #
A transaction built by hand against a key's live holding at the application, and submitted without local evaluation so the node judges it. Each shape but the first is one of the Aiken suite's refused updates, or a release outside any fold.
Constructors
| HonestUpdate | The controller's update: same control, value and address |
| UpdateByStranger | The same update, requiring another signer instead of the controller |
| UpdateOtherController | The continuation names another controller |
| UpdateDepositTampered | The continuation's protected deposit is changed |
| UpdateEscaped | The continuation, token and all, leaves for the controller's own address |
| UpdateTokenLeft | The continuation stays but the key's token leaves it |
| UpdateShortDeposit | The continuation holds one lovelace less than the protected deposit |
| UpdateWithoutDatum | The continuation carries no datum |
| UpdateAddedAsset | The continuation also carries an asset of another policy |
| EarlyWithdrawal | The holding is spent with |
| BookingByStranger | An insertion booked with the controller's envelope, paid and signed by another wallet |
| BookingOtherDestination | An insertion booking whose request names another destination |
| BookingShortDeposit | An insertion booking whose request deposit is one lovelace short of the protected one |
| BookingNoDatum | An insertion booking whose destination names no datum |
| EnvelopeOtherStateName | An insertion booking whose envelope names the state policy under another token name |
| EnvelopeOtherStatePolicy | An insertion booking whose envelope names the token name under another policy |
| EnvelopeOtherRegistry | An insertion booking whose envelope names another registry's state asset |
| TerminateBooking | The controller's own booking of the key's termination |
| TerminateBookingByStranger | A termination booking by another wallet |
| ReleaseInOtherFold | A fold of another key's insertion that also spends the holding with |
| UpdateWithoutScript | The controller's update, submitted without the application's script |
| FoldPaysShort | The terminating fold, folded by another wallet, paying the controller one lovelace short |
| FoldPaysInFull | The same terminating fold, folded by another wallet, paying the controller in full |
| FoldTwoReleasesShort | One fold of two terminations for one controller, paying it one lovelace short of the sum |
| FoldTwoReleasesOneFloor | The same fold, paying it one released deposit where the sum of two is owed |
| FoldTwoReleasesInFull | The same fold, paying it the sum in full |
| FoldMixedShort | One fold of an insertion and a termination for one controller, paying it one lovelace short |
| FoldMixedInFull | The same fold, paying it in full |
Instances
| Bounded Crafted Source # | |
Defined in Conformance.Cli.Controls | |
| Enum Crafted Source # | |
Defined in Conformance.Cli.Controls Methods succ :: Crafted -> Crafted Source # pred :: Crafted -> Crafted Source # toEnum :: Int -> Crafted Source # fromEnum :: Crafted -> Int Source # enumFrom :: Crafted -> [Crafted] Source # enumFromThen :: Crafted -> Crafted -> [Crafted] Source # enumFromTo :: Crafted -> Crafted -> [Crafted] Source # enumFromThenTo :: Crafted -> Crafted -> Crafted -> [Crafted] Source # | |
| Show Crafted Source # | |
Defined in Conformance.Cli.Controls | |
| Eq Crafted Source # | |
Defined in Conformance.Cli.Controls | |
craftedName :: Crafted -> String Source #
craftedPhrase :: Crafted -> String Source #
A crafted transaction, in the description language.
A registry the story works in: its own directory and its own boot.
Constructors
| Target String |
Instances
| Show Target Source # | |
Defined in Conformance.Cli.Controls | |
| Eq Target Source # | |
Defined in Conformance.Cli.Controls | |
data Requirement Source #
What a check requires of the receipts it is given.
Constructors
| CommandSucceeded | One command receipt whose outcome is |
| Accepted | One booking or fold the node accepted and the chain confirmed |
| RefusedByState | One fold submitted without local evaluation, which the node refused, naming the registry's own state validator as the script that failed |
| Unchanged | Two readbacks, before and after, that agree on the registry's root, the key's holding, the pending requests and the wallet |
| PartialPending | A command receipt whose outcome is |
| BookingRefused | An ordinary command refused at booking before signing, with a
readback of its key: the command's outcome is |
| RefusedByApplication | One hand-built transaction submitted without local evaluation, which the node refused, naming the applied open-datum script as the script that failed |
| HoldingUnchanged | Two readbacks that agree on the registry's root, the key's holding and the wallet |
| SameRegistry | The create and insert receipts: the inserted envelope names the created registry's state asset and active policy |
| Delivered | The insert and inspect receipts: the key reads Active, its one holding is the output the insert delivered, carrying the inserted envelope inline and at least its protected deposit |
| PayloadReplaced | Inspect, update, inspect: the root does not move, the holding is the update's output, the payload is the update's and the control and deposit are unchanged |
| Released | Inspect, terminate, inspect: the key reads Terminal with no holding, and the terminate released the protected deposit it held |
| Observed | One readback the node answered |
| RegistryUnchanged | Two readbacks that agree on the registry's root, its pending requests and the wallet |
| Established | Command receipts that all succeeded, in one registry: the premise a telling builds on |
| ReachedActive | Command receipts that all succeeded, then a fresh reading of the exact key: an @ that authenticated it Active against the chain's root, or a readback whose public replay agrees with that root |
| ReachedTerminal | The same, reading the key Terminal |
| RejectedBeforeScripts | One hand-built transaction the node rejected before any script ran, although its rejection names the applied open-datum script: the control that such a rejection is not counted as the script's refusal |
| RefusedBeforeSubmitting | A provoked command refused before submitting: its outcome is the class its condition names, and the registry's journal did not move |
| CreateUnderfunded | The create receipt of a wallet that cannot fund every publication: refused before anything was submitted, with the publication funding named, its directory untouched and its seed still unspent |
| TokenOnlyReading | An inspect by the registry's own actor and one by a second actor starting from an empty directory with only the state token: both succeeded and read the same registry |
| FoldConsumed | A booking, an ordinary token-only fold of that booking and an inspect after it: the booking was accepted, the fold succeeded on the booking's own request, and the key reads Active under the fold's envelope and root |
| NoLeafPrinted | A provoked |
| StoppedAfterAcceptance | A killed command: the journal's last line when it stopped is the node's acceptance of the step it was killed at, and that submission's body was kept |
| ReconciledOrRefused | The killed |
| ResolvedFromChain | The killed |
| IncompleteCreateRead | The killed |
| LateCreateRefused | The late |
| BoundedAfterNodeLoss | The |
| Reclaimed | The retraction of a pending request: the insertion's receipt names it, the readbacks before and after agree that exactly that request left, the retained body spends exactly that request, the registry's root did not move, and the wallet gained the bond it released less the fee the retraction paid |
| ExposureBounded | A node-judged transaction of a take on an existing registry: the operator set an explicit collateral allowance, and the body states a total collateral within it and a return of the rest of its funding output |
| IndexerAgrees | The fresh inspect of an Active key and one public indexer's read of that key's token: the indexer found exactly one output holding exactly one of the token, under the policy and asset name the inspect names, and its output reference, datum bytes, datum hash and chain position are the node's, within the lag |
Instances
| Bounded Requirement Source # | |
Defined in Conformance.Cli.Controls | |
| Enum Requirement Source # | |
Defined in Conformance.Cli.Controls Methods succ :: Requirement -> Requirement Source # pred :: Requirement -> Requirement Source # toEnum :: Int -> Requirement Source # fromEnum :: Requirement -> Int Source # enumFrom :: Requirement -> [Requirement] Source # enumFromThen :: Requirement -> Requirement -> [Requirement] Source # enumFromTo :: Requirement -> Requirement -> [Requirement] Source # enumFromThenTo :: Requirement -> Requirement -> Requirement -> [Requirement] Source # | |
| Show Requirement Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> Requirement -> ShowS Source # show :: Requirement -> String Source # showList :: [Requirement] -> ShowS Source # | |
| Eq Requirement Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: Requirement -> Requirement -> Bool Source # (/=) :: Requirement -> Requirement -> Bool Source # | |
A public indexer the take asks about its Active key.
Constructors
| Koios | |
| Blockfrost |
Instances
| Bounded Indexer Source # | |
Defined in Conformance.Cli.Controls | |
| Enum Indexer Source # | |
Defined in Conformance.Cli.Controls Methods succ :: Indexer -> Indexer Source # pred :: Indexer -> Indexer Source # toEnum :: Int -> Indexer Source # fromEnum :: Indexer -> Int Source # enumFrom :: Indexer -> [Indexer] Source # enumFromThen :: Indexer -> Indexer -> [Indexer] Source # enumFromTo :: Indexer -> Indexer -> [Indexer] Source # enumFromThenTo :: Indexer -> Indexer -> Indexer -> [Indexer] Source # | |
| Show Indexer Source # | |
Defined in Conformance.Cli.Controls | |
| Eq Indexer Source # | |
Defined in Conformance.Cli.Controls | |
indexerName :: Indexer -> String Source #
data IndexerRead Source #
What an indexer's readback record keeps, as read from the record's retained bytes by admission and never from the receipt's own words: the policy and asset name it was asked about, the provider's own answers counted into the outputs that hold the token, the output, datum bytes and tip it reports, what the node read, the maximum lag it was run under, and the summary it states. The verdict recomputes every comparison from these facts; the stated summary is only checked against them.
Constructors
| IndexerRead | |
Fields
| |
Instances
| Show IndexerRead Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> IndexerRead -> ShowS Source # show :: IndexerRead -> String Source # showList :: [IndexerRead] -> ShowS Source # | |
| Eq IndexerRead Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: IndexerRead -> IndexerRead -> Bool Source # (/=) :: IndexerRead -> IndexerRead -> Bool Source # | |
The summary a readback record states about itself.
Constructors
| Stated | |
Fields
| |
Instances
| Show Stated Source # | |
Defined in Conformance.Cli.Controls | |
| Eq Stated Source # | |
Defined in Conformance.Cli.Controls | |
A readback of one registry, for one key.
What a submitted transaction states about its fee and collateral, read from the body the receipt retained and never from the receipt's own words: only admission sets it.
Constructors
| Account | |
Fields
| |
One step of the story. Every action but Require leaves exactly one
receipt; Require is computed from receipts and leaves none.
Constructors
| Run :: Command -> Target -> String -> CliI Receipt | Run one ordinary command against a registry, for a key |
| RunByToken :: Target -> Target -> Command -> String -> CliI Receipt | Run one ordinary command from this actor's directory against the registry another target created, naming it only by its state token: the actor's directory starts empty and receives the token, nothing else of the registry |
| Book :: Target -> String -> CliI Receipt | Book an insertion of the key through the application, as the ordinary insert does, and stop before its fold |
| FoldUnevaluated :: Target -> String -> CliI Receipt | Fold that booking, submitted without evaluating its scripts locally, so the node judges it |
| Observe :: Target -> String -> CliI Receipt | Read the registry's root, the key's holding, the pending requests and the wallet back from the node |
| Craft :: Crafted -> Target -> String -> CliI Receipt | Submit a hand-built transaction against the key's live holding |
| Provoke :: Provocation -> Target -> String -> CliI Receipt | Run an ordinary command under a condition of its process |
| Reclaim :: Target -> String -> Receipt -> Receipt -> CliI Receipt | Retract the request a refused insertion left pending, as its owner, in the request's own retract window, and read the registry back: the bond returns, the fee is paid. It carries the command receipt that names the request and the readback that saw it pending: the request is that one, in the state that readback saw, or nothing is retracted |
| ReadIndexer :: Indexer -> Target -> String -> Receipt -> CliI Receipt | Ask one public indexer, read-only, for the Active key's token, from the policy and asset name the fresh inspect names, and compare what it finds with that inspect. It writes nothing; an indexer that is missing, unreachable, stale or in disagreement ends the take before its next write |
| Require :: Requirement -> [Receipt] -> CliI () | |
| Retire :: String -> CliI () | The enclosing clause's promise is retired, for this reason. The clause keeps its words as history and is judged retired, never from a receipt; it leaves no receipt |
Statements
data DuplicateRefused Source #
OpenDatumApplication.Statements.duplicate_refused_by_registry
data ResurrectionRefused Source #
OpenDatumApplication.Statements.resurrection_refused_by_registry
data UpdateInversion Source #
Statement markers for the early booking refusals.
data ClientPolicy Source #
The client's own booking policy: an update the key's current entry
rules out is refused before anything is signed, naming the key and the
client policy. It claims no Lean theorem and no row of the CLI's
specification (issue #486: kept labelled as client policy unless the
model is amended); only the accepted payload update below is told under
update_inversion, which states exactly that accepted step.
clientPolicyBindings :: [Binding] Source #
The client-policy tellings the controls bind, claiming no theorem.
terminateBurnsActiveHolding :: Theorem ClientObligation Source #
Active becomes Terminal using its actual holding; a terminate the key's entry rules out is refused before anything is signed.
statementBindings :: [Binding] Source #
Every statement the stories bind.
resolveStatement :: Value -> Binding -> Either String () Source #
Whether the application's statement ledger (ledgers.json) carries
the bound statement under the bound digest, proved.
obligationBindings :: [Binding] Source #
The client obligations the controls bind.
resolveObligation :: (Text -> Text) -> Text -> Binding -> Either String () Source #
Whether the CLI's specification carries the bound row exactly once, its line hashing (by the given SHA-256) to the bound digest.
cliSpecification :: String Source #
The specification whose rows the client obligations are.
The stories
duplicateStory :: Story () Source #
A second insertion of an Active key.
resurrectionStory :: Story () Source #
An insertion of a key already Terminal.
earlyRefusalStory :: Story () Source #
Bob's update and terminate refused before signing, beside Alice's same
verbs accepted on a live key. One registry holds a key Active, one key
Terminal, and one key it never held: Bob, from an empty directory naming the
registry only by its state token, has an update or a terminate of the unknown
or the Terminal key refused at booking, naming the key and the client policy,
before anything is signed; Alice's same verbs on the Active key are accepted,
the update replacing the payload with the root unmoved and the terminate
releasing the deposit. The refusals are the client's own policy with no Lean
theorem claimed; only the accepted payload update is told under
update_inversion, which states exactly that accepted step.
lifecycleStory :: Story () Source #
Alice's story through the ordinary commands, judged against the receipts the commands print: create, insert, inspect, two updates with unrelated payloads, terminate, inspect.
boundaryStory :: Story () Source #
The application's own boundary, reached by hand-built transactions the node judges: the controller's update beside an update required of another wallet, the Aiken suite's custody tampers realisable on a ledger, and a release outside any fold beside the ordinary terminate.
controlsStory :: Story () Source #
processStory :: Story () Source #
The client's obligations under conditions of its process, each told under the row of the CLI's specification it bears on: a changed selector, withheld public history and an absent node; a terminate and a create killed once the node accepted them; and, last because it stops the node, a concurrent writer, a racing create and an update that loses its node.
permanentStory :: String -> Story () Source #
One take on a registry that already exists, through a node someone else runs: the four refusals the demonstration shows, each beside its accepting control, on one fresh key.
The key is inserted by the ordinary command, which is also the accepting control of the two insertion refusals; a second insertion of the Active key is refused before signing, naming the key already registered, with nothing submitted and nothing to retract; the update another wallet's signature stands for is refused, beside the controller's own ordinary update; a release outside any fold is refused, beside the ordinary terminate that releases the same holding inside one; an insertion of the now Terminal key is refused before signing, naming the key already retired, likewise with nothing to retract.
No registry is created and no node is started, stopped or reset: the story
contains none of those actions, which forbiddenInPermanent names.
forbiddenInPermanent :: [Text] Source #
What a take on an existing registry never does: create one, or provoke a command by stopping a process or a node. Quantified over every command and every provocation this module defines, so a provocation added later is forbidden until a ruling admits it.
actionsOf :: Story () -> [Text] Source #
The actions a story runs, by the name their receipts carry, in order.
Receipts
What one action left. The step number, action, target and key say which action it answers; a receipt answering another is not accepted.
Constructors
| Receipt | |
Fields
| |
Instances
| FromJSON Receipt Source # | |
Defined in Conformance.Cli.Controls | |
| ToJSON Receipt Source # | |
| Show Receipt Source # | |
Defined in Conformance.Cli.Controls | |
| Eq Receipt Source # | |
Defined in Conformance.Cli.Controls | |
data Observation Source #
Constructors
| Observation | |
Fields
| |
Instances
| FromJSON Observation Source # | |
Defined in Conformance.Cli.Controls Methods parseJSON :: Value -> Parser Observation parseJSONList :: Value -> Parser [Observation] omittedField :: Maybe Observation | |
| ToJSON Observation Source # | |
Defined in Conformance.Cli.Controls Methods toJSON :: Observation -> Value toEncoding :: Observation -> Encoding toJSONList :: [Observation] -> Value toEncodingList :: [Observation] -> Encoding omitField :: Observation -> Bool | |
| Show Observation Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> Observation -> ShowS Source # show :: Observation -> String Source # showList :: [Observation] -> ShowS Source # | |
| Eq Observation Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: Observation -> Observation -> Bool Source # (/=) :: Observation -> Observation -> Bool Source # | |
data Submission Source #
One submission an ordinary command journalled, and the body it kept.
Constructors
| Submission | |
Fields
| |
Instances
| FromJSON Submission Source # | |
Defined in Conformance.Cli.Controls Methods parseJSON :: Value -> Parser Submission parseJSONList :: Value -> Parser [Submission] omittedField :: Maybe Submission | |
| ToJSON Submission Source # | |
Defined in Conformance.Cli.Controls Methods toJSON :: Submission -> Value toEncoding :: Submission -> Encoding toJSONList :: [Submission] -> Value toEncodingList :: [Submission] -> Encoding omitField :: Submission -> Bool | |
| Show Submission Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> Submission -> ShowS Source # show :: Submission -> String Source # showList :: [Submission] -> ShowS Source # | |
| Eq Submission Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: Submission -> Submission -> Bool Source # (/=) :: Submission -> Submission -> Bool Source # | |
A live output an ordinary command's journal read back without submitting it: the transaction that published it, and the step that read it.
Instances
| FromJSON Resolved Source # | |
Defined in Conformance.Cli.Controls | |
| ToJSON Resolved Source # | |
| Show Resolved Source # | |
Defined in Conformance.Cli.Controls | |
| Eq Resolved Source # | |
Defined in Conformance.Cli.Controls | |
data JournalSpan Source #
The lines an ordinary command's registry journal gained while it ran: the journal, relative to the run's directory, the line counts before and after, and the SHA-256 of those lines as they stand in the file. Admission re-derives from them what the command submitted and what it only read back.
Constructors
| JournalSpan | |
Instances
| FromJSON JournalSpan Source # | |
Defined in Conformance.Cli.Controls Methods parseJSON :: Value -> Parser JournalSpan parseJSONList :: Value -> Parser [JournalSpan] omittedField :: Maybe JournalSpan | |
| ToJSON JournalSpan Source # | |
Defined in Conformance.Cli.Controls Methods toJSON :: JournalSpan -> Value toEncoding :: JournalSpan -> Encoding toJSONList :: [JournalSpan] -> Value toEncodingList :: [JournalSpan] -> Encoding omitField :: JournalSpan -> Bool | |
| Show JournalSpan Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> JournalSpan -> ShowS Source # show :: JournalSpan -> String Source # showList :: [JournalSpan] -> ShowS Source # | |
| Eq JournalSpan Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: JournalSpan -> JournalSpan -> Bool Source # (/=) :: JournalSpan -> JournalSpan -> Bool Source # | |
data ProcessEvidence Source #
What a provoked command's process left, as the backend recorded it. Admission reads each part back from the run's files — the registry's journal, the saved files, the printed receipts — and a recorded part that differs from them is a problem, never a fact.
Constructors
| ProcessEvidence | |
Fields
| |
Instances
| FromJSON ProcessEvidence Source # | |
Defined in Conformance.Cli.Controls Methods parseJSON :: Value -> Parser ProcessEvidence parseJSONList :: Value -> Parser [ProcessEvidence] omittedField :: Maybe ProcessEvidence | |
| ToJSON ProcessEvidence Source # | |
Defined in Conformance.Cli.Controls Methods toJSON :: ProcessEvidence -> Value toEncoding :: ProcessEvidence -> Encoding toJSONList :: [ProcessEvidence] -> Value toEncodingList :: [ProcessEvidence] -> Encoding omitField :: ProcessEvidence -> Bool | |
| Show ProcessEvidence Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> ProcessEvidence -> ShowS Source # show :: ProcessEvidence -> String Source # showList :: [ProcessEvidence] -> ShowS Source # | |
| Eq ProcessEvidence Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: ProcessEvidence -> ProcessEvidence -> Bool Source # (/=) :: ProcessEvidence -> ProcessEvidence -> Bool Source # | |
data Provocation Source #
An ordinary command run under a condition of its process, not of the ledger: another process, a changed or missing file, an absent node, or a kill. What the command does then is the client's obligation under the CLI's own specification; no model statement covers it.
Constructors
| WhileLocked |
|
| WithoutHistory |
|
| WithoutNode |
|
| TerminateKilled |
|
| UpdateAfterKill |
|
| CreateKilled |
|
| CreateAgain |
|
| LateCreate |
|
| UnderfundedCreate |
|
| NodeLost |
|
Instances
| Bounded Provocation Source # | |
Defined in Conformance.Cli.Controls | |
| Enum Provocation Source # | |
Defined in Conformance.Cli.Controls Methods succ :: Provocation -> Provocation Source # pred :: Provocation -> Provocation Source # toEnum :: Int -> Provocation Source # fromEnum :: Provocation -> Int Source # enumFrom :: Provocation -> [Provocation] Source # enumFromThen :: Provocation -> Provocation -> [Provocation] Source # enumFromTo :: Provocation -> Provocation -> [Provocation] Source # enumFromThenTo :: Provocation -> Provocation -> Provocation -> [Provocation] Source # | |
| Show Provocation Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> Provocation -> ShowS Source # show :: Provocation -> String Source # showList :: [Provocation] -> ShowS Source # | |
| Eq Provocation Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: Provocation -> Provocation -> Bool Source # (/=) :: Provocation -> Provocation -> Bool Source # | |
provocationName :: Provocation -> String Source #
emptyReceipt :: Int -> Text -> Text -> Text -> Receipt Source #
Reading a node's rejection
rejectionEvidence :: String -> ([Text], [Text]) Source #
The node's words for a script that executed and failed, and the hashes of the scripts that failed, as they occur in its rejection text.
decodeIndexerRead :: Value -> Maybe IndexerRead Source #
The record the readback script writes, in the fields the verdict reads.
attribution :: Text -> Receipt -> Either RefusalMismatch () Source #
The node's rejection, rebuilt from exactly what the receipt carries of
it — its words for a script that executed and failed, and the hashes of
the scripts that failed — and judged by the suite's own refusal discipline
(matchRefusal): a phase-2 failure among whose failed scripts the
expected one is.
Verdicts and rendering, from receipts
data ClauseStatus Source #
Constructors
| Held | |
| NotHeld [String] | |
| Uncovered String | |
| Retired String | The promise is retired, for this reason; no receipt judges it |
Instances
| Show ClauseStatus Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> ClauseStatus -> ShowS Source # show :: ClauseStatus -> String Source # showList :: [ClauseStatus] -> ShowS Source # | |
| Eq ClauseStatus Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: ClauseStatus -> ClauseStatus -> Bool Source # (/=) :: ClauseStatus -> ClauseStatus -> Bool Source # | |
data ClauseResult Source #
Constructors
| ClauseResult | |
Fields
| |
Instances
| Show ClauseResult Source # | |
Defined in Conformance.Cli.Controls Methods showsPrec :: Int -> ClauseResult -> ShowS Source # show :: ClauseResult -> String Source # showList :: [ClauseResult] -> ShowS Source # | |
| Eq ClauseResult Source # | |
Defined in Conformance.Cli.Controls Methods (==) :: ClauseResult -> ClauseResult -> Bool Source # (/=) :: ClauseResult -> ClauseResult -> Bool Source # | |
check :: Requirement -> [Receipt] -> [String] Source #
The requirement's failures on these receipts; none means it holds.
judge :: [Receipt] -> Story () -> [ClauseResult] Source #
Interpret the story over receipts. A receipt answers the action at its step exactly when it names that action, target and key; the first missing or misplaced receipt leaves every later clause uncovered, naming why, but a clause whose promise is retired, which reads retired from its description. Requirements inside a clause's body fail the clause; its check decides it.
held :: [ClauseResult] -> Bool Source #
Every clause's verdict holds, or its promise is retired.
outline :: Story () -> [(String, String)] Source #
Every clause the story states, in order, with its statement: the rows a verdict must account for, whether or not a receipt reached them. The story is walked with placeholder receipts; it never branches on one.
renderControls :: [ClauseResult] -> Story () -> String Source #
The section a reader sees: each statement, what was done, the verdict of each clause as the receipts give it, and the approved matrix of cases with each one's coverage computed from those verdicts. Uncovered clauses and cases are listed, with the reason, beside the rest.
validateControls :: Story () -> Either String () Source #
Refuse a story before it runs: every statement it binds must be one of
statementBindings and told once, every clause title distinct within its
statement, and every refusal paired with an accepting clause in the same
telling.