Failure, reconciliation and migration

Distributed privacy operations use at-least-once delivery. Correctness comes from idempotent destination commands, immutable instruction versions and reconciliation—not an assumption that a single API call succeeds.

Delivery contract

1. command and outbox event commit together;
2. worker assigns delivery ID, aggregate sequence and expiry;
3. connector verifies signature, tenant, capability, sequence/replay and policy;
4. destination performs idempotently using external operation ID;
5. connector returns status, source version, count/digest and evidence reference;
6. control plane records outcome and advances only the destination task;
7. retries use exponential backoff/jitter; exhausted work enters dead letter and human queue.

Never retry an ambiguous non-idempotent destructive operation blindly. Query destination state or require manual verification.

Reconciliation states

State	Meaning	Next action
queued	durable, not delivered	normal dispatch
delivered	agent accepted	wait bounded result
acknowledged	destination proved operation	close destination
retrying	transient classified failure	scheduled retry
ambiguous	timeout after possible action	query/manual verification
failed	permanent or retry exhausted	owner escalation
exception	source-linked lawful/technical exception	reviewer and expiry
dead_letter	no automated path remains	manual remediation

Parent state is complete only when every required destination is acknowledged or an approved exception explicitly permits closure.

Offline and clock skew

Agents maintain an encrypted append-only spool with monotonic local sequence. Instructions expire and cannot execute if legal/configuration version is outside allowed range. Results include source occurred time, agent received/executed time and control-plane recorded time. Excess clock skew quarantines time-sensitive proof and alerts; it does not rewrite timestamps.

Error taxonomy

AUTH, AUTHZ, RATE_LIMIT, TRANSIENT_NETWORK, SOURCE_UNAVAILABLE, SCHEMA_CHANGED, NOT_FOUND, MULTIPLE_MATCH, VERSION_CONFLICT, POLICY_BLOCK, VALIDATION, PARTIAL_SOURCE, AMBIGUOUS_RESULT, PERMANENT_UNSUPPORTED. Only classified transient errors retry automatically.

Migration from spreadsheets/custom portals

1. inventory files, fields, owners, definitions and duplicates;

2. freeze an export and compute manifest/checksum;

3. map stable external IDs and controlled enums;

4. dry-run validation with per-row errors;

5. import configurations before cases/receipts

   ;

6. preserve original timestamp/source and mark proof confidence;

7. reconcile sample counts/hashes and obtain maker-checker approval;

8. run legacy and new system in read/dual-write comparison only for bounded period;

9. cut over intake, retain read-only archive under source-linked rule;

10. delete obsolete extracts and evidence completion.

Do not transform a spreadsheet “Y” into a legally valid consent receipt if notice, purpose, actor and proof are missing. Import it as legacy_assertion with confidence and remediation.

Connector upgrade

Capability/schema changes are versioned. Agent downloads a signed package, verifies SBOM/signature, runs compatibility and test transaction, then activates. Rollback preserves queued instruction compatibility. A connector cannot silently add fields to its PII budget.

Acceptance tests

• Given a timeout after a delete call, then the task becomes ambiguous, not automatically retried.
• Given duplicate event delivery, then one destination action and multiple delivery audit entries exist.
• Given a stale offline result after a newer correction, then optimistic version prevents overwrite.
• Given a legacy consent row lacks notice proof, then import labels it assertion, not receipt.