1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
//! # Cross-Log Correlation Law
//!
//! Typed shapes for correlating events across multiple event logs.
//!
//! ## What this module IS
//!
//! - Structure-only typed shapes for cross-log correlation keys, witnesses,
//! merged log envelopes, and schema labels.
//! - A zero-cost [`crate::correlation::CorrelationWitness`] tag that names the authority under
//! which a cross-log correlation has been applied.
//! - A [`crate::correlation::CorrelatedLog`] envelope that distinguishes a merged log (produced
//! by correlating two source logs) from either source at the type level.
//!
//! ## What this module is NOT
//!
//! - **Not** a correlation engine. No event matching, no join execution, no
//! attribute lookup. Those concerns graduate to `wasm4pm`.
//! - **Not** a replacement for [`crate::evidence::Evidence`]. Cross-log
//! correlation is orthogonal to the `Raw → Admitted` lifecycle.
//!
//! ## Graduation
//!
//! When you need to actually correlate events across logs — matching by case
//! ID, object reference, timestamp proximity, or attribute equality — graduate
//! to `wasm4pm`. The correlation witness and schema travel with the evidence
//! into the engine.
use PhantomData;
/// A correlation key linking events across logs.
///
/// `SCHEMA` is a compile-time `&'static str` naming the correlation schema
/// (e.g. `"by-case"`, `"by-object"`, `"by-timestamp"`). Two
/// `CorrelationKey<"by-case">` shapes are the same type; a
/// `CorrelationKey<"by-case">` and a `CorrelationKey<"by-object">` are
/// different types. This prevents silent schema substitution.
///
/// This is structure only. See [`crate::correlation`]. Graduate to `wasm4pm`
/// when correlation key derivation must execute.
/// Witness that cross-log correlation has been applied under the given schema.
///
/// `SCHEMA` is a compile-time `&'static str` naming the correlation schema.
/// This is a zero-sized marker. Presence of this witness as a type parameter
/// means the evidence has passed through a cross-log correlation step. It does
/// not run the correlation — it names the authority. Graduate to `wasm4pm` to
/// execute.
///
/// This is structure only. See [`crate::correlation`]. Graduate to `wasm4pm`
/// when cross-log correlation must execute.
;
/// A merged log shape from correlating two source logs.
///
/// `A` and `B` are the source log types; `SCHEMA` is the correlation schema
/// applied to produce this merged shape. This is a zero-cost structure-only
/// envelope — no events are stored at this layer.
///
/// A `CorrelatedLog<XesLog, OcelLog, "by-case">` is a different type from
/// `CorrelatedLog<XesLog, OcelLog, "by-object">`, preventing silent schema
/// substitution at the type level.
///
/// This is structure only. See [`crate::correlation`]. Graduate to `wasm4pm`
/// when the merged log contents must be computed or consumed.
/// The correlation schema type — defines how events are matched across logs.
///
/// This is a runtime-representable label for the four canonical correlation
/// strategies. It complements the compile-time `SCHEMA` const-generic parameter
/// on [`crate::correlation::CorrelationKey`], [`crate::correlation::CorrelationWitness`], and [`crate::correlation::CorrelatedLog`].
///
/// ## Variants
///
/// - [`ByCase`](crate::correlation::CorrelationSchema::ByCase) — events are matched by case
/// identifier equality (standard single-case merge).
/// - [`ByObject`](crate::correlation::CorrelationSchema::ByObject) — events are matched by shared
/// object reference (cross-object path correlation).
/// - [`ByTimestamp`](crate::correlation::CorrelationSchema::ByTimestamp) — events are matched by
/// temporal proximity (sliding window / trace-free correlation).
/// - [`ByAttribute`](crate::correlation::CorrelationSchema::ByAttribute) — events are matched by
/// equality of a named attribute value.