Connectors and Trust Boundaries

Boundary definition

A connector translates between the trajectory and an external source of records, identity, live facts, or effects. Its role determines which failures are retryable and whether the trajectory may continue, narrow, reauthorize, reconcile, or stop.

First response

Record connector role, operation, target, schema version, source and record version, observation time, authority reference, attempt count, latency, typed error, retry budget, idempotency reference, and reconciliation state. Do not retry an action until its prior outcome is known or safely deduplicated.

Symptom catalog

acl_sync_drift: Indexed authorization data is stale

Signal. Recently changed group, tenant, classification, or deletion state disagrees between source and index.

Confirm. Compare source record version and observation time with the indexed authorization attributes.

Correct. Reconcile changed and deleted records, bound maximum staleness, and stop using stale policy inputs when the bound is exceeded.

identity_claim_expired: Identity context expired before use

Signal. A previously valid session or delegated call begins failing at one receiver.

Confirm. Validate issuer, audience, validity, revocation, principal, actor, and clock assumptions.

Correct. Reauthorize through the identity boundary and reevaluate policy. Never extend validity by copying old claims into state.

connector_schema_drift: Transport succeeds after meaning changes

Signal. Fields are missing, renamed, retyped, or semantically changed while transport still succeeds.

Confirm. Validate a recorded response against the expected schema and semantic fixtures.

Correct. Reject or quarantine mismatched payloads, version the adapter, and replay from the source after compatibility is restored.

unsafe_connector_fallback: A required source fails open

Signal. An unavailable required source produces a fluent answer, widened query, or cached response with no partial-status label.

Confirm. Disable the connector and compare the output with the declared completion condition.

Correct. Mark sources required or optional by task. Narrow optional failures explicitly; stop when required evidence is unavailable.

rate_limit_retry_amplification: Throttling creates more traffic

Signal. Throttling increases total request volume, concurrent branches, or tail latency.

Confirm. Join attempts by trajectory and connector target. Inspect Retry-After, backoff, concurrency, and remaining budget.

Correct. Coordinate retry and concurrency budgets across branches, add jitter, and stop when the remaining trajectory budget cannot accommodate another attempt.

ambiguous_write_replay: An unknown effect is repeated

Signal. Duplicate effects appear after timeouts or reconnects.

Confirm. Locate all attempts for the same operation and idempotency key. Determine whether the first request committed.

Correct. Reconcile the original operation, reuse the same key only with the same payload, and reject key reuse with different arguments.

connector_provenance_missing: An assertion has no attributable source

Signal. A classification, identity claim, or live fact cannot be tied to its source and observation time.

Confirm. Follow the assertion from response through transformation, storage, and decision event.

Correct. Persist source id, record and schema version, observed time, transformation version, and decision reference beside the governed derivative.

Diagnostic questions

1. Is this connector supplying indexed data, verified identity, a live read, or an effect?
2. Which source, schema, provenance, and freshness assertions must hold before its payload is usable?
3. Is the source required for the completion condition, or can the result be explicitly narrowed?
4. Are retries bounded by time, attempts, and fan-out?
5. Can an ambiguous write be reconciled through the original operation or idempotency key?

Exit criteria

• Each connector has one declared role and a role-specific contract.
• Policy-relevant assertions carry provenance and bounded freshness.
• Required-source failures stop; optional failures narrow visibly.
• Retries are budgeted, and ambiguous effects reconcile before replay.