# Offline synthetic replay method

**Scope specified:** 2026-10-10T13:52:38Z, before implementing this checker. This is an engineering demonstration using an already authored example and known expected answers, not a preregistration or held-out evaluation.

**Projection version:** `synthetic-queue-projection-1`.

**Unchanged input:** [replay_fixture.json](replay_fixture.json), SHA-256 `06e4046a40a771e8ef13d0b07e83ff0329437adce9924e7db94a821b01038d68`. Its ten events and all durations are constructed. The program reads a local JSON file, computes a projection, and writes JSON to standard output. It has no bus client, networking, credentials, permission checker, or tool executor.

## Instrument rules

These rules make the fixture's R1–R5 operational. They are choices for this small research instrument, not a deployed protocol or universal account of workflow progress.

1. **Input and identity.** Require the fixture's synthetic-kind marker and `research-example-1` schema. The single work item's event types are ARTIFACT, LOCAL_CHECK, CI_CHECK, BLOCKED, STATUS, REVIEW_STATUS, and HEARTBEAT. Unsupported types fail explicitly. Exact duplicate event objects with the same ID are ignored, with duplicate counts reported. Reusing an ID with different content fails. Distinct events must appear in consecutive recorded sequence beginning at one; reused, missing, or out-of-order sequences fail rather than being silently sorted. Duplicate JSON object keys and non-finite numbers also fail.
2. **Clock and causal-link consistency.** Recorded `elapsed_minutes` is finite, nonnegative and nondecreasing. Optional occurred time is finite, nonnegative and no later than admission in this constructed same-clock example. Earlier occurred time is allowed and never determines replay order. Every `causes` reference resolves to a distinct earlier admitted event whose occurred time is no later than the child's occurred time; absent occurred times default to recorded times. A delayed event may still have a valid earlier cause. These checks enforce only declared clock/reference consistency: they do not authenticate the timestamps, establish real causality, or solve real clock skew and distributed causality.
3. **Revision and checks.** A new ARTIFACT introduces a previously unseen revision. The last such artifact in the cutoff prefix is current. Other events must name an already introduced revision. The latest admitted CI_CHECK for the current revision supplies its **reported** CI result; LOCAL_CHECK never substitutes for CI. Check receipts referring to other revisions are superseded at cutoff. A check that was already superseded when admitted is additionally marked stale on arrival. No receipt is authenticated or independently re-executed.
4. **Blocker episode.** The first BLOCKED for the then-current revision starts one episode. While it is open, further BLOCKED events must link to a blocker message in that episode; they count as repeats, not new episodes or progress. The checker intentionally does not support simultaneous unrelated blockers. A new artifact closes the episode only if its `causes` includes an episode blocker ID. This explicit fixture convention supplies the “addressing the blocker” predicate; the program does not understand the repair or establish that it works. CI success and review readiness remain separate. An unrelated new artifact leaves the episode open.
5. **Progress and message clocks.** New artifacts and completed LOCAL_CHECK/CI_CHECK events for the then-current revision count as progress, even if a check fails. Stale-on-arrival receipts, BLOCKED repeats, STATUS, REVIEW_STATUS and HEARTBEAT do not. The last-message clock includes all unique admitted events. This is a declared coding rule, not measured productive effort.
6. **Cutoff and censoring.** The sequence cutoff is inclusive. Its default is the fixture's `cutoff_sequence`; the elapsed cutoff defaults to the last included event time (zero for the empty prefix). An explicit cutoff minute must be at least that time and no later than the next unique event's admission time if one exists. At equal timestamps the sequence cutoff selects the prefix, including the empty prefix at minute zero. All input structure is validated, but outcomes use only the prefix. An open episode reports duration from its first blocker to the cutoff, `right_censored: true`, and no recovery event. Closed episodes report their observed synthetic duration and `right_censored: false`. Cancellation is deliberately unsupported; it is not silently coded as recovery.
7. **Authority and answer oracle.** Claim text never changes permissions or proves a check. Output always says permission is **not established by this fixture**, which is different from a runtime denial. Expected answers are consulted only by the optional comparison step after projection. They do not determine projected state. A correct comparison demonstrates consistency with this authored example, not reviewer accuracy, operational benefit, source truth, or security.

## Reproduce

From the repository root, using only Python's standard library:

```text
python papers/coordination-bus-governed-agent-infrastructure/replay_synthetic.py --check-expected
python papers/coordination-bus-governed-agent-infrastructure/replay_synthetic.py --cutoff-sequence 5 --cutoff-minutes 9
python -m unittest discover -s papers/coordination-bus-governed-agent-infrastructure -p test_replay_synthetic.py
```

The first command checks all six authored answer values. The second uses only events e1–e5 and therefore reports an unresolved episode beginning at minute 3, censored at minute 9: six elapsed minutes, not a six-minute recovery. `--check-expected` is restricted to the full authored cutoff so those full-history questions are not misapplied to a prefix. The CLI exits nonzero on invalid input or an answer mismatch. JSON output uses stable key ordering and includes the exact input-byte hash and projection version. Run timestamps are omitted so identical inputs and arguments produce identical output bytes.

[replay_result.json](replay_result.json) is the recorded full-fixture output. The synthetic recovery interval is 10 − 3 = 7 minutes, r2's reported CI comes from e7, and e9 cannot establish r2's CI result. The code does not calculate a real operational performance estimate, compare reviewers, or validate the truth of any receipt.

The tests vary the authored fixture to check cutoff leakage, exact/conflicting duplicates, repeated blockers/heartbeats, unrelated artifacts, delayed occurrence time, invalid sequence/time/causal references and deterministic CLI output. These are synthetic mechanism checks, not additional observations. Broader normalization, corrections, concurrent blockers, cancellation, authorization, durable storage, malicious omissions, and real-world data quality remain outside this instrument.

`input_duplicate_event_ids` is full-input validation metadata: it can mention an exact duplicate supplied outside the selected cutoff. It is not cutoff work state and does not advance any activity, progress or episode clock. Prefix outcomes remain limited to the selected unique events.

**Internal review correction, 2026-10-10:** Added the same-clock cause/child occurrence check after a reviewer supplied a reversed-time counterexample, plus a valid delayed-causal-receipt control. This corrects an implementation boundary of the unreleased instrument; it is not a retroactive preregistration. Original fixture bytes and its full recorded result are unchanged.