fix(breg): bind occurrence creation evidence to record type

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

crates/CLIENTS.md

@@ -74,9 +74,12 @@ or unify distinct authority contracts. Shared HTTP/token primitives live in
   Recorded time comes only from the creation revision of that record, which
   `occurrence_creation_revision` reads as exactly revision 1 and reports as
   absent only for a 403 or 404 answer, which means the caller cannot see that
-  revision; every other status is returned as an error. Evidence that does not match the
-  record's exact type, identifier, and revision is listed as ignored, never
-  merged. Instants are emitted with an uppercase `T` and `Z` and the offset the
+  revision; every other status is returned as an error. Its compact
+  `{recordType, recordId, revision, createdAt}` form retains the response's
+  record type so a same-UUID revision of another type cannot supply recorded
+  time. Evidence that does not match the record's exact type, identifier, and
+  revision is listed as ignored, never merged. Instants are emitted with an
+  uppercase `T` and `Z` and the offset the
   registry served (it serves stored timestamps in UTC with `+00:00`); dates stay
   dates. The Rust projection is the single implementation:
   the Node and Python exports (`occurrenceView`, `occurrence_view`, and the

crates/registry-breg-client-node/__test__/occurrence-view.test.js

@@ -118,7 +118,8 @@ test('the metadata accessor and the creation-revision read follow the declared c
 
     const text = await client.occurrenceCreationRevision('incorporations', recordId);
     assert.deepEqual(JSON.parse(text), {
-      recordId, revision: '1', createdAt: '2026-10-26T08:15:30.123456Z',
+      recordType: 'incorporation', recordId, revision: '1',
+      createdAt: '2026-10-26T08:15:30.123456Z',
     });
     assert.ok(requests.some((url) => url.includes(`/incorporations/${recordId}/revisions/1`)));
     assert.equal(await client.occurrenceCreationRevision('incorporations', hiddenId), null);
@@ -127,6 +128,13 @@ test('the metadata accessor and the creation-revision read follow the declared c
       JSON.parse(occurrenceView(JSON.stringify(input))).recordedAt,
       { status: 'available', type: 'instant', value: '2026-10-26T08:15:30.123456Z' },
     );
+    input.creationRevision.recordType = 'ownership-transfer';
+    assert.throws(() => occurrenceView(JSON.stringify(input)), (error) => {
+      assert.equal(error.kind, 'occurrence');
+      assert.equal(error.code, 'wrong-record-evidence');
+      assert.doesNotMatch(error.message, /ownership-transfer/);
+      return true;
+    });
   } finally {
     await new Promise((resolve) => server.close(resolve));
   }

crates/registry-breg-client-node/client.d.ts

@@ -896,8 +896,9 @@ export declare class BaseRegistryClient {
   openapi(accessProfile?: string | null): Promise<RawOutcome>
   registryMetadata(accessProfile?: string | null): Promise<RawOutcome>
   /**
-   * The first revision of a record as `{recordId, revision, createdAt}` JSON
-   * text, or null when the caller may not read it (403 or 404).
+   * The first revision of a record as
+   * `{recordType, recordId, revision, createdAt}` JSON text, or null when the
+   * caller may not read it (403 or 404).
    */
   occurrenceCreationRevision(entityRoute: string, recordIdentifier: string, accessProfile?: string | null): Promise<string | null>
   statisticsLive(dataset: string, from?: string | null, to?: string | null, accessProfile?: string | null, format?: StatisticsFormat | null): Promise<RawOutcome>

crates/registry-breg-client-node/index.d.ts

@@ -29,8 +29,9 @@ export declare class BaseRegistryClient {
   /** Retrieve one exact retained revision as validated inert record JSON. */
   getRecordRevision(entityRoute: string, recordIdentifier: string, revision: number, options?: any | undefined | null): Promise<RawOutcome>
   /**
-   * Read the first revision of one record as the compact creation-revision
-   * JSON, or null when the caller may not read it.
+   * Read the first revision of one record as the compact
+   * `{recordType, recordId, revision, createdAt}` JSON, or null when the
+   * caller may not read it.
    */
   occurrenceCreationRevision(entityRoute: string, recordIdentifier: string, accessProfile?: string | undefined | null): Promise<string | null>
   getRecord(entityRoute: string, recordIdentifier: string, options?: any | undefined | null): Promise<CompleteOutcome>

crates/registry-breg-client-node/src/lib.rs

@@ -2924,8 +2924,9 @@ impl BaseRegistryClient {
             .map_err(client_error)
     }
 
-    /// Read the first revision of one record as the compact creation-revision
-    /// JSON, or null when the caller may not read it.
+    /// Read the first revision of one record as the compact
+    /// `{recordType, recordId, revision, createdAt}` JSON, or null when the
+    /// caller may not read it.
     #[napi]
     pub async fn occurrence_creation_revision(
         &self,

crates/registry-breg-client-py/python/registry_breg_client/__init__.pyi

@@ -337,8 +337,8 @@ class BaseRegistryClient:
         *,
         access_profile: str | None = None,
     ) -> dict[str, str] | None:
-        """The first revision of a record as `recordId`, `revision` and `createdAt`,
-        or None when the caller may not read it (403 or 404)."""
+        """The first revision of a record as `recordType`, `recordId`, `revision`
+        and `createdAt`, or None when the caller may not read it (403 or 404)."""
         ...
     def statistics_live(
         self, dataset: str, *, from_period: str | None = None,

crates/registry-breg-client-py/src/lib.rs

@@ -1820,8 +1820,9 @@ impl BaseRegistryClient {
         raw_value(py, &value.value, &value.metadata)
     }
 
-    /// The first revision of one record as `{recordId, revision, createdAt}`,
-    /// or `None` when the caller may not read it.
+    /// The first revision of one record as
+    /// `{recordType, recordId, revision, createdAt}`, or `None` when the caller
+    /// may not read it.
     #[pyo3(signature = (entity_route, record_identifier, *, access_profile=None))]
     fn occurrence_creation_revision<'py>(
         &self,

crates/registry-breg-client-py/tests/python/test_occurrence_view.py

@@ -147,7 +147,12 @@ def log_message(self, *_args: object) -> None:
             revision = client.occurrence_creation_revision("incorporations", RECORD_ID)
             self.assertEqual(
                 revision,
-                {"recordId": RECORD_ID, "revision": "1", "createdAt": CREATED_AT},
+                {
+                    "recordType": "incorporation",
+                    "recordId": RECORD_ID,
+                    "revision": "1",
+                    "createdAt": CREATED_AT,
+                },
             )
             self.assertIsNone(
                 client.occurrence_creation_revision("incorporations", HIDDEN_ID)
@@ -158,6 +163,12 @@ def log_message(self, *_args: object) -> None:
                 occurrence_view(arguments)["recordedAt"],
                 {"status": "available", "type": "instant", "value": CREATED_AT},
             )
+            arguments["creationRevision"]["recordType"] = "ownership-transfer"
+            with self.assertRaises(BaseRegistryClientError) as caught:
+                occurrence_view(arguments)
+            self.assertEqual(caught.exception.kind, "occurrence")
+            self.assertEqual(caught.exception.code, "wrong-record-evidence")
+            self.assertNotIn("ownership-transfer", str(caught.exception))
         finally:
             server.shutdown()
             thread.join()

crates/registry-breg-client/src/client.rs

@@ -767,6 +767,8 @@ impl BaseRegistryClient {
     /// read that revision (a 403 or 404 problem answer); the absence is never
     /// replaced by another timestamp. Every other failure is returned, and a
     /// revision 1 document that is not the record's creation is a body failure.
+    /// The retained evidence binds the response's record type, record identifier,
+    /// revision and creation time.
     pub async fn occurrence_creation_revision(
         &self,
         entity_route: &str,

crates/registry-breg-client/src/occurrence.rs

@@ -512,6 +512,7 @@ fn time_value(time: &TimeDescriptor) -> Value {
 /// states when the registry first recorded it.
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct BRegCreationRevision {
+    record_type: String,
     record_id: String,
     created_at: String,
 }
@@ -520,6 +521,12 @@ impl BRegCreationRevision {
     /// Read a Registry Record revision envelope (`{"data": {...}, "meta": {...}}`)
     /// and keep only the creation evidence for `record_id`.
     pub fn from_document(record_id: &str, document: &Value) -> Result<Self, BRegOccurrenceError> {
+        let record_type = document
+            .get("meta")
+            .and_then(Value::as_object)
+            .and_then(|meta| meta.get("entityTypeIdentifier"))
+            .and_then(Value::as_str)
+            .ok_or_else(|| wrong_evidence("the revision has no record type"))?;
         let data = document
             .get("data")
             .and_then(Value::as_object)
@@ -545,19 +552,21 @@ impl BRegCreationRevision {
             .get("createdAt")
             .and_then(Value::as_str)
             .ok_or_else(|| wrong_evidence("the revision has no creation time"))?;
-        Self::new(record_id, created_at)
+        Self::new(record_type, record_id, created_at)
     }
 
-    /// Read the compact `{"recordId", "revision", "createdAt"}` form that
-    /// `Serialize` writes.
+    /// Read the compact `{"recordType", "recordId", "revision", "createdAt"}`
+    /// form that `Serialize` writes.
     pub fn from_value(value: &Value) -> Result<Self, BRegOccurrenceError> {
         let object = value
             .as_object()
             .ok_or_else(|| wrong_evidence("the creation revision is not an object"))?;
-        if object
-            .keys()
-            .any(|key| !matches!(key.as_str(), "recordId" | "revision" | "createdAt"))
-        {
+        if object.keys().any(|key| {
+            !matches!(
+                key.as_str(),
+                "recordType" | "recordId" | "revision" | "createdAt"
+            )
+        }) {
             return Err(wrong_evidence(
                 "the creation revision has an unknown member",
             ));
@@ -569,21 +578,35 @@ impl BRegCreationRevision {
                 .ok_or_else(|| wrong_evidence(format!("the creation revision has no {name}")))
         };
         require_creation_revision(member("revision")?)?;
-        Self::new(member("recordId")?, member("createdAt")?)
+        Self::new(
+            member("recordType")?,
+            member("recordId")?,
+            member("createdAt")?,
+        )
     }
 
-    fn new(record_id: &str, created_at: &str) -> Result<Self, BRegOccurrenceError> {
+    fn new(
+        record_type: &str,
+        record_id: &str,
+        created_at: &str,
+    ) -> Result<Self, BRegOccurrenceError> {
         if OffsetDateTime::parse(created_at, &Rfc3339).is_err() {
             return Err(wrong_evidence(
                 "the creation time is not an RFC 3339 timestamp",
             ));
         }
         Ok(Self {
+            record_type: record_type.to_owned(),
             record_id: record_id.to_owned(),
             created_at: created_at.to_owned(),
         })
     }
 
+    #[must_use]
+    pub fn record_type_identifier(&self) -> &str {
+        &self.record_type
+    }
+
     #[must_use]
     pub fn record_identifier(&self) -> &str {
         &self.record_id
@@ -620,6 +643,7 @@ fn require_creation_revision(revision: &str) -> Result<(), BRegOccurrenceError>
 impl Serialize for BRegCreationRevision {
     fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
         serde_json::json!({
+            "recordType": self.record_type,
             "recordId": self.record_id,
             "revision": CREATION_REVISION,
             "createdAt": self.created_at,
@@ -961,7 +985,10 @@ fn build_view(
         ));
     }
     let recorded_at = match creation_revision {
-        Some(creation) if creation.record_id != record.record_id => {
+        Some(creation)
+            if creation.record_type != record.record_type
+                || creation.record_id != record.record_id =>
+        {
             return Err(wrong_evidence(
                 "the creation revision belongs to another record",
             ));