Attest what is routed, waiting out the provider's own convergence, and fail
closed when it does not converge.
Every promote path needs this same wait for the same reason: a hostname-to-
script mapping is eventually consistent, so the first read after a promote
can legitimately still answer with the release that promote just replaced.
Attesting once would make that ordinary lag look like drift. The wait lives
here, once, rather than in each caller, so no promote path can be written
without it.
It is a wait, not a retry loop around a broken provider: an unconverged read
— a stale routed release, a route mapping that has not landed yet, a routed
artifact whose digest binding is not visible — is retried inside the budget,
and anything else propagates immediately. When the budget runs out the last
observation is raised as ActiveRouteAttestationError, never swallowed and
never accepted as a match.
A route that already matches costs exactly one attestation; the backoff only
ever pays for a route that has not settled.
Attest what is routed, waiting out the provider's own convergence, and fail closed when it does not converge.
Every promote path needs this same wait for the same reason: a hostname-to- script mapping is eventually consistent, so the first read after a promote can legitimately still answer with the release that promote just replaced. Attesting once would make that ordinary lag look like drift. The wait lives here, once, rather than in each caller, so no promote path can be written without it.
It is a wait, not a retry loop around a broken provider: an unconverged read — a stale routed release, a route mapping that has not landed yet, a routed artifact whose digest binding is not visible — is retried inside the budget, and anything else propagates immediately. When the budget runs out the last observation is raised as
ActiveRouteAttestationError, never swallowed and never accepted as a match.A route that already matches costs exactly one attestation; the backoff only ever pays for a route that has not settled.