Schedules: how the internals are drafted.

This is the part Gherkin-era codebases never test: the freshness judgment itself. Because it is a pure function of timestamps and terms, it gets ordinary case law — no clock mocking, no cache server in the test.

# schedules/caching.py — the ruling. Pure: facts in, admissibility out.
class Admissibility(Enum):
    FRESH = "fresh"          # serve it
    STALE_IN_GRACE = "grace" # serve it, refetch in background
    EXPIRED = "expired"      # must refetch before serving


def admissibility(fetched_at: datetime, now: datetime,
                  terms: CacheTerms) -> Admissibility:
    age = now - fetched_at
    if age <= terms.ttl:
        return Admissibility.FRESH
    if age <= terms.ttl + terms.grace:
        return Admissibility.STALE_IN_GRACE
    return Admissibility.EXPIRED


# case_law/test_schedule_c_caching.py
def test_a_rate_older_than_its_ttl_but_in_grace_is_served_while_refetching():
    fetched = datetime(2026, 8, 6, 12, 0)
    now = datetime(2026, 8, 6, 12, 16)   # 16 min: past TTL, inside grace
    assert admissibility(fetched, now, EXCHANGE_RATE) is Admissibility.STALE_IN_GRACE

Written once for the whole program. It reads the terms and consults the ruling — it holds no TTLs, no keys, no policy. Swapping Redis for memcache touches this file and no schedule.

# machinery/cache.py — generic performer. One per program, rule-free.
def cached(terms: CacheTerms):
    """Wrap a fact-gatherer so Schedule C governs its evidence."""
    def wrap(gather):
        def gather_with_terms(**kw):
            key = terms.key.format(**kw)
            hit = store.read(key)                       # impure read
            match hit and admissibility(hit.fetched_at, clock.now(), terms):
                case Admissibility.FRESH:
                    return hit.value
                case Admissibility.STALE_IN_GRACE:
                    tasks.enqueue(refetch, gather, key, kw)  # Schedule D!
                    return hit.value
                case _:
                    return store.fill(key, gather(**kw), clock.now())
        return gather_with_terms
    return wrap


# usage, at the fact-gathering layer — the clause never knows:
@cached(EXCHANGE_RATE)
def fetch_exchange_rate(base: str, quote: str) -> Rate: ...

The retry decision is where async bugs live, and it is almost never tested — because it is usually buried in framework config. Here it is a pure ruling with case law. The names of the outcomes are Definitions, so the performer cannot improvise.

# schedules/delivery.py — the ruling. Pure: history in, next step out.
@dataclass(frozen=True)
class Retry:      at: datetime
@dataclass(frozen=True)
class Escalate:   reason: str
@dataclass(frozen=True)
class GiveUp:     pass


def after_failed_attempt(attempt_no: int, first_tried: datetime,
                         now: datetime, terms: DeliveryTerms
                         ) -> Retry | Escalate | GiveUp:
    if now - first_tried >= terms.escalate_after:
        return Escalate(reason="delivery deadline breached")
    if attempt_no >= terms.attempts_owed:
        return Escalate(reason="attempts exhausted")
    return Retry(at=now + terms.backoff_base * 2 ** (attempt_no - 1))


# case_law/test_schedule_d_delivery.py
def test_a_breached_deadline_escalates_even_with_attempts_remaining():
    first = datetime(2026, 8, 6, 12, 0)
    now = datetime(2026, 8, 6, 13, 1)     # 61 min, attempt 2 of 5
    ruling = after_failed_attempt(2, first, now, REFUND_OUTCOME_NOTICE)
    assert isinstance(ruling, Escalate)

The dispatcher is the program's only contact with the broker. It consults the ruling after every failure; it decides nothing itself. The performer from Exhibit B defers with one call, citing the schedule by name.

# machinery/tasks.py — generic performer over any broker.
def defer(fn, args: tuple, terms: DeliveryTerms) -> None:
    broker.enqueue(terms.queue, job_of(fn, args, terms))

def on_job_failure(job) -> None:
    match after_failed_attempt(job.attempt_no, job.first_tried,
                               clock.now(), job.terms):
        case Retry(at=at):        broker.reschedule(job, at)
        case Escalate(reason=r):  pager.page(job, r); broker.park(job)
        case GiveUp():            broker.park(job)


# the refund performer (Exhibit B, step 3) now defers the notice:
def perform_refund_decision(order_id, decision) -> Receipt:
    ...
    defer(notifications.send_refund_outcome,
          (order_id, decision), terms=REFUND_OUTCOME_NOTICE)
    ...

Frontend validation rules are named, pure, and separately testable — exactly like backend clauses. A rule returns a grievance or nothing. Case law runs in vitest with no DOM, no render, no user-event simulation.

// schedules/rules.ts — named rulings. Pure: value in, grievance out.
export function requestedOnMayNotBeInTheFuture(
  value: string, today: string
): Grievance | null {
  return value > today
    ? { field: "requestedOn", says: "The request date cannot be in the future." }
    : null;
}


// case_law/refundRequestForm.test.ts
test("a customer may not date a refund request in the future", () => {
  const grievance = requestedOnMayNotBeInTheFuture("2026-08-07", "2026-08-06");
  expect(grievance?.says).toMatch(/cannot be in the future/);
});

test("the form tenders exactly what Clause 4's endpoint is owed", () => {
  const body = refundRequestForm.actions[0].call.payload({
    requestedOn: "2026-08-05", reason: "damaged_on_arrival" });
  expect(body).toEqual({ requested_on: "2026-08-05",
                         damaged_on_arrival: true });
});

One renderer for every form in the product. It walks the terms, runs the rules, disables submit while grievances stand, and performs the declared call. Adding a field to the refund form is a diff in Schedule F-1 only — no component edits, no new tests for the renderer.

// machinery/ContractForm.tsx — generic performer. Knows no form.
export function ContractForm<V>({ terms }: { terms: FormTerms<V> }) {
  const [values, setValues] = useState<V>(initialValues(terms));
  const grievances = terms.fields.flatMap(f =>
    f.rules.map(rule => rule(values[f.name], today())).filter(Boolean));

  return (
    <form onSubmit={e => { e.preventDefault(); tender(terms, values); }}>
      {terms.fields.map(f => <Field key={f.name} field={f}
                                    value={values[f.name]}
                                    onChange={v => setValues(s => ({ ...s, [f.name]: v }))}
                                    grievances={grievances} />)}
      {terms.actions.map(a => <Action key={a.label} action={a}
                                      disabled={a.kind === "submit" && grievances.length > 0} />)}
    </form>
  );
}

// tender() performs the declared call — gather, consult, perform,
// browser edition. It never builds a payload by hand.
async function tender<V>(terms: FormTerms<V>, values: V) {
  const submit = terms.actions.find(a => a.kind === "submit")!;
  await api.call(submit.call.method, submit.call.endpoint,
                 submit.call.payload(values));
}

Drift is the dispute. Three pure rulings keep the parties honest: the record must cover its Definition, the live schema must match the record, and every record must respect Article III. Schema-scanning is impure fact-gathering in conftest; the rulings stay pure.

# schedules/records.py — the rulings.
def uncovered_fields(terms: RecordTerms) -> list[str]:
    """Every field of the Definition must map to a column."""
    return [f.name for f in fields(terms.definition)
            if f.name not in terms.columns]

def undeclared_drift(live: TableSchema, terms: RecordTerms) -> list[str]:
    """The database may hold nothing the schedule does not declare."""
    declared = set(terms.columns.values())
    return [col for col in live.columns if col not in declared]

# case_law/test_schedule_m_records.py
def test_every_field_of_order_has_a_declared_column():
    assert uncovered_fields(ORDER_RECORD) == []

def test_the_live_orders_table_holds_nothing_undeclared():
    live = scan_schema("orders")          # gathered fact (impure, conftest)
    assert undeclared_drift(live, ORDER_RECORD) == []

A migration is never a standalone SQL file: it is the amendment that reconciles the stored form with an amended Definition, and the diff must show all three together — Definition, record terms, migration. CI rejects any one without the other two.

# One amendment, three parts, one commit:

# 1. The Definition amended (the contract changes first)
@dataclass(frozen=True)
class Order:
    ...
    damaged_on_arrival: bool
    gift_wrapped: bool = False          # ← new term

# 2. Schedule M amended (the stored form follows)
ORDER_RECORD = RecordTerms(..., columns={...,
    "gift_wrapped": "gift_wrapped"})

# 3. The migration performs the amendment — it decides nothing
# migrations/0012_orders_gift_wrapped.sql
ALTER TABLE orders ADD COLUMN gift_wrapped boolean
    NOT NULL DEFAULT false;

# and the case law that motivated it, in the same commit:
def test_gift_wrapped_orders_refund_without_the_restocking_fee(): ...

Articles are enforced, not aspirational. The ruling is pure — an import graph is just data — so the architecture check is ordinary case law run in CI. Tools like import-linter already speak this shape; here the terms stay in your Articles and the tool is mere machinery.

# articles/rulings.py — pure: an import graph in, violations out.
def layering_violations(imports: ImportGraph,
                        terms: LayeringTerms) -> list[Violation]:
    rank = {layer: i for i, layer in enumerate(terms.order)}
    return [Violation(edge) for edge in imports
            if rank[edge.importer_layer] < rank[edge.imported_layer]]


# case_law/test_article_i_layering.py — architecture case law, in CI.
def test_no_clause_may_cite_a_performer():
    graph = scan_imports("src/")          # gathered fact (impure, in conftest)
    assert layering_violations(graph, ARTICLE_I) == []


def test_deployables_share_no_database():
    bindings = scan_db_bindings("src/")
    assert ownership_violations(bindings, ARTICLE_III) == []

An ADR under CaC is not a wiki page — it is the amendment record of an Article, in the repo, adjacent to the terms it amends. The diff that changes the Article must carry its recital; CI blocks an Article edit without one.

# articles/amendments/0007_payments_becomes_async.md
Amendment 7 — to Article II (boundaries)

Recital (why): synchronous capture blocked checkout for the
p99 of processor latency; the parties accept eventual receipt
in exchange for a bounded checkout time.

Operative change: storefront → payments crossing amended
"http" → "queue", under Schedule D terms CAPTURE_PAYMENT
(attempts_owed=5, escalate_after=15min).

Case law affected:
  - test_checkout_completes_without_awaiting_capture  (new)
  - test_capture_breach_pages_the_merchant            (new)
  - test_checkout_returns_the_captured_receipt        (overruled)