Skip to content

symfonic.services.privacy.values

values

The values the erasure ports exchange. Transport-neutral, by CON-P-3.

Nothing here mentions a request, a response, or a framework object: an integration in another repository implements SubjectDataStore against these types without ever importing platform, which is the whole reason row 20 is runtime-service-owned.

ErasureGeneration dataclass 

ErasureGeneration(scope_key: str, generation: int = 0, tombstoned: bool = False, tombstoned_at: float | None = None, reason: str = '')

EFX-ER-2 — what a writer observes before it commits.

The pair is read together and, at publication, advanced together: PRIV-4 makes the tombstone and the generation bump ONE linearizable transition, so there is no interval in which an observer can see a new generation without the tombstone that came with it.

ErasureReceipt dataclass 

ErasureReceipt(participant_id: str, erased: int, generation: int, confirmed_absent: bool, detail: Mapping[str, Any] = dict())

What one store did, and whether absence was then verified.

erased is reporting (PRIV-6). confirmed_absent is the proof, and it is a separate field because a store that returns a confident count and still holds rows is precisely the failure SEC-PRIV-3 exists to catch.

ExportFragment dataclass 

ExportFragment(participant_id: str, records: tuple[Mapping[str, Any], ...] = (), exportable: bool = True, note: str = '')

One store's contribution to a subject export (SEC-PRIV-2).

FenceDenial dataclass 

FenceDenial(scope_key: str, reason: DenialReason, expected_generation: int, observed_generation: int)

One refused write, kept so the audit seam has something to emit.

ParticipantDescriptor dataclass 

ParticipantDescriptor(participant_id: str, holds: str, durable: bool = True, replica_of: str | None = None, backup_retention_days: int | None = None, exportable: bool = True)

PRIV-1/PRIV-7 — what a store declares about the subject data it holds.

replica_of and backup_retention_days exist so PRIV-7 is checkable rather than aspirational: a read replica names its primary, and a backup set names the horizon the tombstone must outlive for a restore to re-apply the erasure before the data is served again.

WriteOutcome dataclass 

WriteOutcome(committed: bool, generation: int, denial_reason: DenialReason | None = None, result: Any = None)

The result of the atomic dual-condition commit (EFX-ER-3).

committed is the whole contract. A caller that wants to know why it failed reads denial_reason; a caller that retries on subject_tombstoned is performing resurrection and EFX-ER-4 forbids it.