Decide how degraded identity affects projection confidence #15
Assignees
xavierk (Xavier Karma)
Clear assignees
xavierk (Xavier Karma)
No Assignees
xavierk
xavierk
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: xavierk/Fenris#15
Reference in New Issue
Block a user
Parent map: Chart Fenris's persistent TUI monitoring redesign
Question
When the controller identity key is blank or degraded (e.g., ephemeral virtual controllers reporting model "Linux" with a random serial), should projection confidence degrade a category — weakening the identity/counter-discontinuity evidence behind ADR 0002's categorical states — or stay confidence-neutral with the degraded marker shown as a contributing fact?
Slot-fill pointer from Define cross-cutting acceptance criteria: the accepted criteria at docs/spec/acceptance-criteria.md reserve SLOT-A for this decision. Fill the slot in the same commit as your resolution (same practice as ADR amendments).
Resolution
Settled in one grilling round; all five recommendations accepted as proposed.
Predicate — blank key only. Degraded means the blank-key rule fired: every rung of the identity ladder produced nothing, so
identity_key = "". The kernel-composite andmodel|serialrungs embed the same serial+model information, so flagging one and not the other would be incoherent, and a virtual controller with a stable configured NQN is properly identified — swap detection works as well as with a vendor NQN. Ephemeral markers (model "Linux", non-pcie transport) stay segment metadata, never confidence facts.Confidence effect — cap at Limited. Expressed as an additional Supported conjunct ("the current controller segment's identity key is not degraded"): a blank key cannot detect a replacement, so Supported would overclaim. The projection still has a baseline, a rate, and days of evidence, so it renders at Limited with the contributing fact "controller identity unavailable — replacement detection relies on write-counter continuity only", shown in every state. The cap combines idempotently with the 48-hour staleness drop (both land at Limited). Rejected: confidence-neutral (Supported would overclaim swap-detectability it does not have) and Unavailable (hiding the number contradicts ADR 0002 §6's render-with-facts philosophy).
Change semantics — no special casing. Any visible change of the recorded key — including to or from blank — is a controller-identity change and quarantines exactly as ADR 0002 §9 already says; equal blank keys continue the segment, segmented by DUW monotonicity alone. A degraded→healthy transition also quarantines, so the projection window only ever spans segments sharing one key: "current segment degraded" and "any segment in the window degraded" coincide, and no cross-segment propagation rule is needed.
Amends ADR 0002 (Supported conjunct, degraded-identity rule, §9 extension, contract fact); fills SLOT-A as PR-15/PR-16 and adds ID-4 in the accepted criteria; adds the Degraded identity glossary term to CONTEXT.md — all in commit 580fab2.