Files
Aura/docs/design/contracts/c11-sources-record-replay.md
T
claude 8688a60ded docs(ledger): split the design ledger into an INDEX map, per-contract live files, and history sidecars
The single-file ledger had grown to 2968 lines / ~42k tokens, mixing
current design law with accreted history: 59 cycle-stamped realization
blocks, 18 [HISTORY] passages, 22 supersession markers, and the C10 /
C22 / C24 reframe sagas layered several supersessions deep. A
code-grounding audit (31 agents, adversarially verified) confirmed 11
defects stated as current truth: stale crate homes from the C28 #288
roster split (cost nodes, PositionManagement, PositionEvent, Session),
the renamed InputSpec->PortSpec, the pre-#241 project model in C16 and
the open-threads section, a stale HarnessKind retirement deferral in
C24, and three C28-internal inconsistencies.

New shape, per the ailang precedent:

- INDEX.md stays the sole addressable entry point: foundation, external
  components, a C-id-keyed contract map (one line per contract), and
  only the genuinely open architectural threads.
- contracts/cNN-<slug>.md carries each contract's current truth only:
  Guarantee / Forbids / Why with ratified refinements integrated, plus
  a code-anchored Current state. All confirmed defects are fixed here;
  crate anchors were re-verified against the tree.
- contracts/cNN-<slug>.history.md (18 sidecars) and INDEX.history.md
  preserve every superseded block verbatim, stamps and issue refs
  intact, under a frozen-record banner. Nothing was deleted: superseded
  design intent remains an addressable working-tree artifact, off the
  per-cycle audit walk.
- Ledger discipline is now stated in INDEX.md: live files are edited in
  place at cycle close, superseded text moves verbatim to the sidecar,
  and a supersession marker in a live file is itself an audit finding.

Every contract file was verified against its old text by an independent
zero-loss pass (statement-by-statement) plus a code-accuracy spot check;
C-ids and contract titles are unchanged, so existing C-id citations in
code, tests, and issues resolve as before.
2026-07-21 16:40:36 +02:00

40 lines
2.2 KiB
Markdown

# C11 — Generalized sources; record-then-replay determinism boundary
**Guarantee.** A source is anything that produces timestamped scalar streams —
market data (the data-server) and non-financial sources (e.g. a news-agent node
emitting a bias) are treated identically. Anything nondeterministic, external,
or slow (LLM/news/web) is materialized into a recorded, timestamped stream
*before* it enters the engine; a backtest replays the recording, live computes
fresh in real time and records it for future backtests. A bias enters as a value
held until the next event (firing policy A, C6).
**Forbids.** Any live external call *inside* a backtest replay.
**Why.** It is the only model compatible with reproducible backtests (C1) — LLM
calls are nondeterministic and far too slow per-cycle. External LLM (IONOS) calls
happen only at the recording/live-source edge, with explicit per-session consent,
never inside a sim (the IONOS consent rule lives in `~/.claude/CLAUDE.md`).
## Current state
The producer seam that makes "a source is anything" concrete is the object-safe
`Source` trait (`crates/aura-engine/src/harness.rs`), driven by the single k-way
ingestion merge (C3); the seam itself is detailed in C12. The realized side is the
market-data replay path: `DataServer` (the external `data-server` git-dependency
crate, re-exported through `crates/aura-ingest`)
parses an archived M1 window and streaming `M1FieldSource` producers
(`crates/aura-ingest/src/lib.rs`) replay it deterministically into the merge. The
recording *direction* — a live source materialized into a timestamped stream for
later replay — and generalized non-price recorded sources (a news-agent bias) are
design law that rides the same `Source` seam (the #71 source seam) but has not yet
landed. The held-until-next-event semantics of a sparse recorded source are the
firing-policy-A / sample-and-hold mechanism already realized under C5/C6. At the
opposite edge the live broker is an I/O adapter at the recording/deploy boundary,
never part of the strategy (C13; domain invariant 7).
## See also
- [C1](c01-determinism.md)
- [C3](c03-single-merge.md)
- [C6](c06-firing-policy.md)
- [C12](c12-atomic-sim-unit.md)
- [C13](c13-hot-reload-frozen-deploy.md)