Abstract endpoint-specific mutation rejections

docs/protocol/RemoraApiMutation.cfg

@@ -12,7 +12,7 @@ CONSTANTS
     NoRecord = NoRecord
     NoObservation = NoObservation
     Accepted = Accepted
-    PreconditionFailed = PreconditionFailed
+    Rejected = Rejected
     FirstObservation = FirstObservation
     ReplayObservation = ReplayObservation
     ConflictObservation = ConflictObservation

docs/protocol/RemoraApiMutation.tla

@@ -7,7 +7,7 @@ EXTENDS Naturals, FiniteSets
 CONSTANTS
     OperationScopes, EligibilityClaims, OperationIds, MutationKinds,
     Fingerprints, NoEligibility, NoRecord, NoObservation,
-    Accepted, PreconditionFailed,
+    Accepted, Rejected,
     FirstObservation, ReplayObservation, ConflictObservation
 
 ASSUME
@@ -26,8 +26,10 @@ Requests ==
      kind        : MutationKinds,
      fingerprint : Fingerprints]
 
+\* Rejected abstracts endpoint-specific idempotency_conflict and
+\* precondition_failed responses exercised by the executable contract.
 Responses ==
-    [status : {Accepted, PreconditionFailed},
+    [status : {Accepted, Rejected},
      revision : 0..Cardinality(Identities)]
 
 Records == [request : Requests, response : Responses]
@@ -60,7 +62,7 @@ FirstRequest(request) ==
         accepted == Eligible(request)
         nextRevision == IF accepted THEN revision + 1 ELSE revision
         response ==
-            [status |-> IF accepted THEN Accepted ELSE PreconditionFailed,
+            [status |-> IF accepted THEN Accepted ELSE Rejected,
              revision |-> nextRevision]
         record == [request |-> request, response |-> response]
     IN /\ records[identity] = NoRecord
@@ -89,7 +91,7 @@ ConflictRequest(request) ==
     LET identity == Identity(request)
         record == records[identity]
         response ==
-            [status |-> PreconditionFailed, revision |-> revision]
+            [status |-> Rejected, revision |-> revision]
     IN /\ record # NoRecord
        /\ record.request # request
        /\ observation' =
@@ -144,7 +146,7 @@ ObservationConsistent ==
                       /\ record.response = observation.response
                   [] observation.disposition = ConflictObservation ->
                       /\ record.request # observation.request
-                      /\ observation.response.status = PreconditionFailed
+                      /\ observation.response.status = Rejected
 
 RecordsAppendOnlyAction ==
     \A identity \in Identities :

docs/spec/api/README.md

@@ -31,7 +31,9 @@ fresh operation is evaluated against current eligibility.
 
 [`RemoraApiMutation`](../../protocol/RemoraApiMutation.tla) models this durable
 operation ledger around an abstract successful `JobProtocol` effect. It does
-not redefine job phases or attempt-authority transitions.
+not redefine job phases or attempt-authority transitions. Its `Rejected`
+response abstracts the endpoint-specific `idempotency_conflict` and
+`precondition_failed` codes enforced by the executable contract.
 
 ## Authorization and errors