Skip to content

symfonic.services.shadow.native_privacy

native_privacy

Explicit native privacy participation for the governed recording store.

A host registers its own store with the same SubjectDataStoreRegistry passed to PrivacyService. The legacy process-global registry is never consulted here. The recording store is tenant-keyed. Only tenant-root erasure is supported; a child scope is refused before any rows are touched. Native registration keeps this synchronous writer synthetic-only until an atomic write fence exists.

RecordingStoreSubjectDataStore 

RecordingStoreSubjectDataStore(store: RecordingStore)

Row-20 participant for one explicitly selected recording store.

Source code in src/symfonic/services/shadow/native_privacy.py 
36
37
def __init__(self, store: RecordingStore) -> None:
    self.store = store

preflight_erase async 

preflight_erase(scope: SubjectScope) -> None

Reject unsupported scope before the service audits or tombstones it.

Source code in src/symfonic/services/shadow/native_privacy.py 
54
55
56
async def preflight_erase(self, scope: SubjectScope) -> None:
    """Reject unsupported scope before the service audits or tombstones it."""
    self._require_tenant_root(scope)

register_recording_store 

register_recording_store(store: RecordingStore, *, into: SubjectDataStoreRegistry) -> RecordingStoreSubjectDataStore

Wire this store into the registry the native PrivacyService will use.

Source code in src/symfonic/services/shadow/native_privacy.py 
81
82
83
84
85
86
87
88
def register_recording_store(
    store: RecordingStore, *, into: SubjectDataStoreRegistry
) -> RecordingStoreSubjectDataStore:
    """Wire this store into the registry the native PrivacyService will use."""
    store.mark_native_privacy_only()
    participant = RecordingStoreSubjectDataStore(store)
    into.register(participant)
    return participant

verify_native_deletion_wiring async 

verify_native_deletion_wiring(store: RecordingStore, *, registry: SubjectDataStoreRegistry, fence: ErasureFence, probe_tenant: str = 'deletion-wiring-probe', seed: int = 1) -> DeletionWiringAttestation

Refuse native production attestation until synchronous writes can fence.

Source code in src/symfonic/services/shadow/native_privacy.py 
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
async def verify_native_deletion_wiring(
    store: RecordingStore,
    *,
    registry: SubjectDataStoreRegistry,
    fence: ErasureFence,
    probe_tenant: str = "deletion-wiring-probe",
    seed: int = 1,
) -> DeletionWiringAttestation:
    """Refuse native production attestation until synchronous writes can fence."""
    registry.require(store.participant_id)
    raise RecordingStoreError(
        "synchronous recording put is unfenced by the native erasure fence; "
        "production deletion wiring cannot be attested"
    )