pub const RECEIPT_JSON_KEY: &str = "receipt.json";Expand description
Canonical data key on a receipt-carrying ConfigMap for the JSON
wire form of a ReceiptEnvelope — the substrate’s PRIMARY payload
key. Peer to RECEIPT_YAML_KEY on the same wire-form axis;
RECEIPT_CM_KEYS fixes the primary-first ordering the reader-side
lookup gate binds to.
Load-bearing at four shipped production sites — two on the writer
axis (tatara-closed-loop-probe’s per-run receipt-CM emit inserts
BOTH keys so operators can kubectl get cm -o yaml and read the
receipt without re-parsing the embedded JSON) and two on the reader
axis (tatara-reconciler::boundary::verify_receipt_cm‘s data-map
lookup gate reads the primary FIRST, then falls back to the YAML
twin). Pre-lift each side restated the two &'static str literals
verbatim — the writer inserted "receipt.json" + "receipt.yaml"
as inline String allocations, the reader chained
.and_then(|d| d.get("receipt.json")).or_else(|| … "receipt.yaml"))
as inline lookup literals — with NO shared owner binding the two
keys’ spelling OR the primary-first ordering that the reader-side
gate encodes as a load-bearing invariant. A rename at ONE writer
key or ONE reader key silently desynchronizes the twin (a probe
writing "receipt.jsonl" while the reader still gates on
"receipt.json" → the postcondition MALFORMED-reads a ConfigMap
that carries a valid receipt at a drifted key); a swap of the
primary/fallback ordering at the reader silently promotes YAML
over the operator-canonical JSON form.
Post-lift the two keys live at ONE substrate-owned pair of
constants; RECEIPT_CM_KEYS pins the primary-first ordering the
reader-side lookup gate iterates through
(extract_receipt_payload_json composes the gate); every writer
insert AND every reader lookup routes through ONE substrate owner,
so a future rename (e.g. "receipt.jsonl" on a NDJSON schema
variant, "receipt.cbor" on a binary-form variant) OR a
primary/fallback swap lands at ONE substrate site and every writer
and reader picks up the change mechanically — the two-side drift
trap becomes unrepresentable at the type / value binding.
The reader’s primary-first ordering is the substrate’s convention:
the JSON form is the machine-canonical wire (the closed-loop probe
emits serde_json::to_string(envelope) as the source-of-truth
payload), the YAML twin is the operator-facing readable projection
(serde_yaml::to_string(envelope)) — both round-trip through the
SAME ReceiptEnvelope::parse_either parser, so the primary/fallback
ordering is a payload-format preference, not a semantic distinction.
A future third wire form (CBOR, MessagePack, sigstore-signed JSON)
extends RECEIPT_CM_KEYS in the primary-first order the readers
prefer, and rustc’s […; N] arity constant on the type binds the
extension in lockstep with every consumer.
Sibling substrate-owned wire-form const on the same receipt axis:
RECEIPT_CM_SUFFIX pins the ConfigMap-name suffix every
default-derivation site composes; RECEIPT_VERSION pins the
wire-format version string every parser gates on; the three
consts together define the substrate’s receipt-CM wire contract at
ONE surface.
Theory anchor: THEORY.md §VI.1 — generation over composition; the
two payload-key literals recurred at FOUR production sites past
the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold and are lifted
to ONE substrate-owned pair of constants + ONE reader-side
lookup-gate composer here. THEORY.md §V.1 — knowable platform;
the (primary, fallback) ordering that the reader-side gate encodes
becomes a NAMED PRIMITIVE (RECEIPT_CM_KEYS) rather than an
implicit hand-coded chain reader consumers had to grok from a
.and_then(...).or_else(...) pattern.