20-EFT.WP.Metrology.TimeBase v1.0 | Appendix B — Contract Library & Strategy Cards (C50 Full Set)

Home ／ Docs-Technical WhitePaper ／ 20-EFT.WP.Metrology.TimeBase v1.0

Appendix B — Contract Library & Strategy Cards (C50 Full Set)

One-line objective: Provide executable C50-* contracts and strategy card templates for time-base metrology & synchronization, so that offset / skew / jitter, the Allan family, dual-form arrival time, and distributed synchronization are measurable, alertable, and rollbackable in production.

I. Purpose & Scope

• Covered
  Single-host time bases, link timestamping, sync servos (NTP/PTP/SyncE), arrival time & paths, buffering & resampling, distributed graph sync, audit & dashboards.
• Outputs
  Contract lists contracts.time.*, evaluation report report.contracts, and strategy execution trace audit_log.
• Evaluation baseline
  All statistics are computed on tau_mono and published on ts; any arrival-related gauge must record both T_arr forms and delta_form.

II. Evaluation Semantics & Rule Grammar

1. Rule primitives
   • metric ⊲⊳ threshold within Δt using agg, where agg ∈ {mean, p95, p99, max} and ⊲⊳ ∈ {≤, ≥, ∈}.
   • Composition: AND / OR / k-of-n, with graded severities sev ∈ {warn, major, critical}.
2. Statistical windows
   Δt = [t0, t1] rolling or tumbling windows; sequential scenarios may attach an alpha_spending budget.
3. Uncertainty disclosure
   If a rule depends on an estimator x_hat, publish U = k * u_c with coverage confidence or posterior quantiles.
4. Units & dimensions
   Every rule must declare unit(metric) and dim(metric) and pass check_dim(metric - threshold).

III. Base Contract Cluster C50-1x (Time Bases & Timestamps)

1. C50-11 Monotonic Base
   • Rule: non_decreasing(tau_mono); any violation → data rejected.
   • Action: tag segment m=1, quarantine the batch.
2. C50-12 ts Publication Slope
   Rule: d ts / d tau_mono ∈ [1 - tol_skew_pub, 1 + tol_skew_pub] within Δt using max; default tol_skew_pub = 5 ppm.
3. C50-13 Timestamp Chain Budget
   • Rule: latency_chain.p99 ≤ budget_chain.p99 and per-segment phy/mac/stack/app stay under plan.
   • Cross-ref: Ch. 4 and I50-41/42.
4. C50-14 Units & Dimensions
   Rule: check_dim(all) = pass before publication.

IV. Sync & Servo Contracts C50-2x (NTP/PTP/SyncE)

1. C50-21 PTP Lock Stability
   • Rule: offset.p95 ≤ tol_offset_p95 AND J.p99 ≤ tol_J_p99 within Δt; defaults tol_offset_p95 = 200 ns, tol_J_p99 = 1 μs (profile dependent).
   • Depends on I50-51/55/56.
2. C50-22 BMCA Uniqueness
   • Rule: count(role == GM) = 1 within Δt; if >1 → critical.
   • Action: run failover_policy and append audit_log.
3. C50-23 NTP Frequency Compliance
   Rule: |skew|.mean ≤ tol_skew_ntp within Δt and slew_rate ≤ max_slew; defaults tol_skew_ntp = 100 ppm, max_slew = 50 ns/s.
4. C50-24 Holdover Budget
   Rule: holdover_time ≤ holdover_budget ∧ offset.p95 ≤ tol_offset_holdover; breach → degrade, rate-limit, or switch to secondary ref.
5. C50-25 Leap Smear Consistency
   Rule: within the leap window |Δts_step| = 0 ∧ smear_profile == policy; breach → major and configuration rollback.

V. Allan Family & Noise Contracts C50-3x

• C50-31 ADEV Envelope
  Rule: adev(τ) ≤ A_spec(τ) + margin for τ ∈ TauSet; default TauSet = {1 s, 10 s, 100 s, 1 ks}, margin = 20%; see Ch. 7 and I50-73.
• C50-32 MDEV/TDEV Bounds
  Rule: mdev(τ) ≤ M_spec(τ), TDEV(τ) ≤ T_spec(τ); typical T_spec(1 s) = 100 ns, profile-specific curve.
• C50-33 Phase-Noise Area
  Rule: ∫_{f1}^{f2} S_phi(f) df ≤ tol_phase_area (for jitter budget/SER scenarios).

VI. Arrival-Time & Path Contracts C50-4x

• C50-41 Dual-Form Consistency
  Rule:
  delta_form = | ( 1 / c_ref ) * ( ∫ n_eff d ell ) - ( ∫ ( n_eff / c_ref ) d ell ) | ≤ tol_Tarr；default tol_Tarr = 100 ps (scenario adjustable); depends on Ch. 9 and I50-91/92.
• C50-42 Path Monotonicity & Length
  Rule: non_decreasing(ell) and L_gamma = ( ∫_gamma 1 d ell ) ≥ 0; violation → reject & write TraceID.
• C50-43 Publication Mapping Consistency
  Rule: T_arr discrepancy between tau_mono and ts mapping ≤ tol_map; default tol_map = 10 ps.

VII. Buffering, Resampling & Conversion Contracts C50-5x

• C50-51 Buffer Under/Overflow Protection
  Rule: drop_rate ≤ tol_drop ∧ latency_buffer.p99 ≤ tol_buf_p99; typical tol_drop = 1e-6, tol_buf_p99 = 5 ms.
• C50-52 Resampling Distortion
  Rule: ENBW_error ≤ tol_enbw ∧ alias_power ≤ tol_alias; depends on I50-82.
• C50-53 Time-Base Conversion Reversibility
  Rule: || F^{-1}(F(ds)) - ds || ≤ tol_roundtrip (for high-fidelity network borders).

VIII. Distributed & Failover Contracts C50-6x

• C50-61 Reference Tree Consistency
  Rule: graph_sync.plan.valid = true ∧ cycles = 0; depends on Ch. 10 and I50-101.
• C50-62 Failure-Domain Isolation
  Rule: blast_radius ≤ tol_radius under single-fault injection; actions: quarantine(zone) and traffic_shift.
• C50-63 Failover Time
  Rule: t_failover ≤ tol_failover ∧ offset.p99 ≤ tol_offset_failover during switch; typical 2 s and 1 μs.

IX. Audit, SLO & Compliance Templates C50-7x

• C50-71 SLO Burn Rate
  Rule: burn_rate_W = bad_time_W / ( (1 - SLO_target) * W ) ≤ tol_burn; tiers warn ≤ 2, major ≤ 6, critical > 6.
• C50-72 Signature & Traceability
  Rule: signature_valid = true ∧ hash_sha256(manifest) == recorded_hash; breach → reject release.
• C50-73 Metrology Closure
  Rule: all published gauges carry the unit/dim/U triplet; missing values are flagged m ∈ {0,1} with rate ≤ tol_missing.

X. Strategy Card Template (Instantiable)

1. Template fields: name, scope, triggers, metrics, thresholds, window Δt, actions, fallbacks, rollback, owner, TraceID.
2. Execution flow
   • Detect: evaluate relevant C50-* rules.
   • Decide: route by severity warn/major/critical.
   • Act: throttle, reparent_to_GM, enter_holdover, enable_smear, quarantine, degrade_service.
   • Audit: append audit_log and signature.
   • Rollback: auto-revert when conditions meet or require human approval.
3. Example A — PTP Lock Loss Recovery
   • Trigger: C50-21 breaches major+ for 3 consecutive windows.
   • Action: enter holdover, run failover_policy, degrade sync; start I50-55 servo_kalman for robust filtering.
4. Example B — Dual-Form Arrival Breach
   • Trigger: C50-41 violation.
   • Action: pause T_arr publication, roll back to the previous mapping, trigger path recalibration, replay windows post-recovery and supplement audit.
5. Example C — Reference-Tree Rebuild
   • Trigger: C50-61 or C50-62 violation.
   • Action: minimal-disturbance re-rooting; limit switch frequency ≤ 1 / T_min_switch; enable traffic_shift on edge zones.

XI. Contract Packs & Tiers

1. Tiers
   • Gold: enable C50-21/22/24/31/32/41/61/63/71/72 with tight thresholds.
   • Silver: core rules enabled, thresholds relaxed ×1.5.
   • Bronze: essentials + audit-only, thresholds relaxed ×2.
2. Composition
   Within a tier, apply k-of-n tolerance (default k = n - 1); cross-tier downgrades are forbidden for releases.

XII. Integration & Persistence Keys

1. Manifest mapping
   • manifest.time.contracts = { id, rule, window, result, severity, action, ts, signature }.
   • Panel fields map to TS.sli.* and align with report.slo.
2. Cross-references
   Ch. 5 (servos), Ch. 7 (Allan metrics), Ch. 9 (arrival paths), Ch. 14 (SLO dashboards).

Summary