# Public API
```rust
use std::{path::Path, sync::Arc};
pub use kcode_k1_canonical_chain::{SubmitError, TxId};
pub use kcode_k1_transaction::{GENESIS_PARENT, REGISTER_AT_TIP, SubsystemId};
pub type TestSigner = Box<dyn FnOnce(&[u8]) -> Result<[u8; 64], String> + Send + 'static>;
pub type TestQueuePropagation = Box<dyn FnOnce(&[u8]) -> Result<(), String> + Send + 'static>;
pub trait TestSubsystem: Send + Sync + 'static {
fn submit_txn(&self, id: TxId, payload: &[u8]) -> Result<(), String>;
fn reorg(&self) -> Result<(), String>;
}
pub trait OrderingCandidate: Send + Sync + 'static {
fn register_subsystem(&self, subsystem: SubsystemId, after: Option<TxId>, handler: Arc<dyn TestSubsystem>) -> Result<(), String>;
fn submit_txn(&self, transaction: &[u8]) -> Result<(), SubmitError>;
fn submit_local_txn(&self, timestamp: u64, creator: [u8; 32], subsystem: SubsystemId, payload: &[u8], signer: TestSigner, queue_propagation: TestQueuePropagation) -> Result<(TxId, Vec<u8>), String>;
fn contains(&self, id: TxId) -> bool;
fn tip(&self) -> Option<TxId>;
fn between_txids(&self, older: TxId, newer: TxId) -> Result<Vec<TxId>, String>;
fn get_txn(&self, id: TxId) -> Result<Option<Vec<u8>>, String>;
}
pub trait OrderingHarness: Send + Sync {
fn open(&self, root: &Path) -> Result<Arc<dyn OrderingCandidate>, String>;
}
pub fn verify_registration_sentinels(harness: &dyn OrderingHarness) -> Result<(), String>;
pub fn verify_queue_before_callback(harness: &dyn OrderingHarness) -> Result<(), String>;
pub fn verify_independent_subsystem_lanes(harness: &dyn OrderingHarness) -> Result<(), String>;
pub fn verify_signing_commit_exclusion(harness: &dyn OrderingHarness) -> Result<(), String>;
pub fn verify_unrelated_callback_reentry(harness: &dyn OrderingHarness) -> Result<(), String>;
```
# Adapter contract
This is a development and test conformance package. An `OrderingHarness` opens the supplied candidate directly at the requested private root; adapters forward candidate behavior rather than emulate ordering, delivery, persistence, errors, or synchronization. Each open returns one independently usable candidate instance.
`OrderingCandidate` mirrors the operations exercised by the scenarios. `submit_local_txn` invokes each boxed signer and queue closure exactly once and returns the committed `TxId` with the complete signed transaction bytes. The returned ID equals the ID derived from those bytes. For `register_subsystem`, `None` and `Some(GENESIS_PARENT)` both replay matching canonical transactions from genesis, `Some(REGISTER_AT_TIP)` atomically activates at the current canonical tip without historical delivery, and any other cursor is the last successfully integrated transaction with replay starting strictly after it. A consumer adapter may bridge `TestSubsystem` to its public callback trait but adds no scheduling, retry, locking, persistence, or panic handling.
`contains` reports canonical membership. `tip` reports the canonical tip. `between_txids` returns canonical transaction IDs strictly after `older` and strictly before `newer`, in canonical order. `get_txn` returns the complete stored bytes for a canonical ID.
Postcommit queue, subsystem, and panic failures contain the literal text `was committed`, `TxId`, and that ID's `Debug` representation. Peer callback failures use `SubmitError::Other`. These exact strings distinguish an already committed outcome from a retryable precommit failure without another public error type.
Each verifier owns its root, threads, callbacks, gates, assertions, and cleanup. Verifier calls share no package-wide lock and may run concurrently; only an atomic root-name counter is shared. Candidate serialization is exercised only at the relevant commit or subsystem lane, and deliberately blocked work must not stall unrelated operations identified by each scenario. Gates are released during unwind, bounded receive failures include diagnostics, and temporary roots are retained when a scenario panics.
Cross-thread progress waits fail after two seconds, and known-blocked checks observe a 50-millisecond quiet interval. These are test-hang boundaries, not candidate latency promises. Direct in-process candidate calls cannot be forcibly cancelled, so a candidate that never returns from one may hang its verifier.
A verifier returns `Ok(())` only after all assertions pass. Assertion failures, escaped panics, bounded-wait failures, worker panics, and candidate errors become a descriptive `Err`. Intentionally injected queue failures and panics must be caught and reported by the candidate according to this contract.
# Verifiers
## `verify_registration_sentinels`
Verifies that `Some(GENESIS_PARENT)` replays matching canonical history, `Some(REGISTER_AT_TIP)` delivers no prior transaction and exactly one later matching transaction, and tip registration on an empty chain delivers its first later matching transaction. It also verifies that a successful local-submission receipt contains the exact ID derived from its returned bytes and that the ID is the canonical tip.
## `verify_queue_before_callback`
Submits local transactions with a failing queue closure and a panicking queue closure. Each matching callback observes that its queue closure already completed. Both transactions remain committed and integrated, with committed `TxId` errors. The registration then successfully integrates a third local transaction.
## `verify_independent_subsystem_lanes`
Blocks the first callback for subsystem A and commits a second A transaction concurrently. The second A queue closure completes, but its callback and caller wait behind the first ticket. Canonical queries and a complete local submission for B finish while A remains blocked. After release, A callbacks appear in commit order and B has its independent payload.
## `verify_signing_commit_exclusion`
Blocks a local signer before its transaction can commit. A second local writer and a canonical tip query start while signing is blocked. Neither may finish before the signer is released. Both writers and the query finish after signing and commit complete.
## `verify_unrelated_callback_reentry`
Registers an A callback that synchronously submits a local transaction to B. The outer A submission finishes without deadlock or caller-managed coordination. The nested B transaction is committed and delivered before the outer callback returns, with its exact payload verified at B.