Governance
The one place an operator reaches the schema governance loop: read what the last checks found, run a check, and let a quarantined proposition back into use.
Everything the loop produces was previously reachable only from a debugger. The stores keep drift reports and version stamps, the runner performs a check, and the sweep holds and releases propositions — and none of them had a caller a person could invoke. This class is that caller, and both shipped front ends (GovernanceController over HTTP, GovernanceTools for an agent) run through it, so the two can never answer differently.
Reading is bounded, and scope is named at the call site
A drift log grows once per check forever, so every read takes a limit and refuses one outside MIN_REPORT_LIMIT with a GovernanceRequestException naming the bound. latestReports answers for whole-graph checks and reportsInContext for one context's, which is the same split DriftReportStore makes; a caller asking for one never silently gets the other.
Running a check changes nothing
runCheck calls DriftCheckRunner, which reads, compares and writes a report, and moves no proposition on any path. So every run is an evaluation, and DriftCheckDto carries the whole comparison a sweep would act on: both drift sets, the declared diff, and the two merged into DriftCheckDto.sweepImpact. Performing the sweep stays a separate, deliberate call a host makes on DriftSweepCapable.
Releasing is scoped before it writes
releaseProposition takes a context and checks the proposition belongs to it before the release happens, so a caller holding one context's id can never lift a hold in another. The release itself goes through DriftSweepCapable.releaseFromQuarantine, which restores the status the proposition carried before quarantine and clears its quarantine metadata in one write.
There is no operation here that releases a whole drift report's worth of propositions. Nothing in the model ties a quarantined proposition back to the report whose application quarantined it: a com.embabel.dice.metamodel.DriftReport has no identity of its own beyond its natural key, and the reason the sweep writes onto a proposition names the two schemas and nothing about the check. Guessing the set from the reason text would release propositions a different check had held.
Parameters
What the application declares. Its schema name scopes every read, so an operator always reads the log belonging to the declaration in force.
Where stamps live. Consulted to say whether the current declaration has ever been recorded, and for the reconciled baseline when the store tracks one.
The durable drift log.
Performs a check.
The store-side quarantine operations. Only DriftSweepCapable.releaseFromQuarantine is used here; nothing in this class sweeps.
Read to confirm a proposition's context before a release touches it.
Constructors
Functions
What the application declares right now, with whether governance has recorded it and which declaration the last completed sweep reconciled against.
The most recent whole-graph drift checks for the declared schema, newest first.
Let one quarantined proposition back into use.
The most recent drift checks scoped to contextId, newest first. Whole-graph checks and other contexts' are left out.
Run a drift check and hand back everything it found.