cadrumo.application.config_reset_models module

Record contracts for durable reset journals.

These models define local journal shapes and invariants only. They do not implement reset orchestration, discovery, transition enforcement, resume, or completion semantics.

class ConfigResetOperationStatus(*values)

Bases: StrEnum

Closed vocabulary of operation-status labels, without transition rules.

INCOMPLETE

PAUSED

COMPLETE

class ConfigResetPauseReason(*values)

Bases: StrEnum

Closed vocabulary of reasons that require an explicit resume.

RETENTION_UNRESOLVED

TARGET_STATE_CHANGED

POINTER_CHANGED

class ConfigResetTargetPhase(*values)

Bases: StrEnum

Closed vocabulary of target-phase labels, without transition rules.

SNAPSHOTTED

RETENTION_APPROVED

AUTH_CLEARING

AUTH_CLEARED

POINTER_RECONCILING

POINTER_RECONCILED

DELETING

DELETED

class ConfigResetPointerSnapshot(**data)

Bases: BaseModel

Reset-journal witness over the canonical pointer record.

Parameters:

data (Any)

record: BucketPointer

class ConfigResetRetentionDecision(**data)

Bases: BaseModel

Journaled correlations supporting a retention decision.

The record enforces internal count, flag, and reason correlations only; it is not proof of external policy approval.

Parameters:

data (Any)

assessed_at: datetime

blocks_erase: bool

retained_record_count: NonNegativeInt

latest_safe_erase_date: datetime | None

override_approved: bool

override_reason: str | None

class ConfigResetAuthClearanceMode(*values)

Bases: StrEnum

Closed vocabulary of how one target’s auth custody was actually ended.

UNLOCKED_REVOCATION

CAPSULE_DESTRUCTION

class ConfigResetAuthClearance(**data)

Bases: BaseModel

What the auth phase removed for one target, and what it could not reach.

The phase name says auth was cleared; this record says HOW, because the two modes end custody by different means and leave different residue.

UNLOCKED_REVOCATION means a custody session for the target was already open, so the full revocation ran: the encrypted rows inside the capsule and the certificate-source secrets held outside it were both removed, and removed_out_of_bucket_secret_records counts the latter.

CAPSULE_DESTRUCTION means the target was locked. Its in-capsule auth rows end with the capsule, and the acquisition locks – plaintext files outside it, which the deletion does not reap – were cleared explicitly. Its certificate-source secrets could be neither enumerated nor removed, because both the record naming them and the lookup digest addressing them need the profile’s key, so removed_out_of_bucket_secret_records is None: an unknown, never a zero. Their ciphertext outlives the erase and is unreadable, the wrapping of its key having been destroyed with the capsule.

Parameters:

data (Any)

mode: ConfigResetAuthClearanceMode

cleared_at: datetime

cleared_lock_provider_ids: tuple[str, ...]

removed_out_of_bucket_secret_records: int | None

class ConfigResetDeletionMarker(**data)

Bases: BaseModel

Ownership-witness shape intended for pre-delete persistence.

This model does not implement the orchestration that writes the marker.

Parameters:

data (Any)

operation_id: Hex64Str

bucket_id: BucketId

fingerprint: ContentDigest

marked_at: datetime

class ConfigResetTarget(**data)

Bases: BaseModel

Explicit bucket target recorded in a reset journal.

The model represents a supplied target and does not perform discovery.

Parameters:

data (Any)

bucket_id: BucketId

label: str | None

setup_state_at_snapshot: ProfileSetupState | None

exists_at_snapshot: bool

fingerprint: BucketDeletionFingerprint | None

phase: ConfigResetTargetPhase

retention: ConfigResetRetentionDecision | None

auth_clearance: ConfigResetAuthClearance | None

deletion_marker: ConfigResetDeletionMarker | None

completed_at: datetime | None

class ConfigResetSummary(**data)

Bases: BaseModel

Reconciled-count shape for a completed operation record.

The model defines the record shape but is not itself reset orchestration.

Parameters:

data (Any)

target_count: NonNegativeInt

deleted_count: NonNegativeInt

already_absent_count: NonNegativeInt

retention_override_count: NonNegativeInt

completed_at: datetime

class ConfigResetOperation(**data)

Bases: BaseModel

Credential-free reset-journal document with local invariants.

Targets are unique and sorted. The model accepts only the current schema version and validates its own record structure. It does not enforce state transitions.

Parameters:

data (Any)

schema_version: Literal[2]

operation_id: Hex64Str

status: ConfigResetOperationStatus

started_at: datetime

updated_at: datetime

pointer_snapshot: ConfigResetPointerSnapshot

targets: tuple[ConfigResetTarget, ...]

pause_reason: ConfigResetPauseReason | None

paused_target_ids: tuple[BucketId, ...]

summary: ConfigResetSummary | None

new_config_reset_operation_id()

Generate a cryptographically random 256-bit operation identifier.

Return type:

str

Returns:

A lowercase hexadecimal identifier.