Open table of contents
Conclusion
Applying model results to implementation requires a separate correspondence review.
Context
Model events do not necessarily map one-to-one to API calls. Error handling, key storage, retries and concurrency can change correspondence.
Design and verification scope
Assess the following responsibilities and boundaries when designing and verifying a configuration.
- Protocol events
- State
- Key lifecycle
- Implementation mapping
- Assumptions
Decision rationale
Use the relationship between Protocol events and Assumptions to compare the responsibilities of the selected approach and alternatives. Separate retained constraints from what the new boundary can change.
Trade-offs
Compare the implementation, maintenance and review work introduced by State with the control it provides. Include failure paths, operator effort and conditions in which the approach should not be adopted.
Limitations
Map lemmas and model events to code and out-of-model behavior. Model proofs are not whole-implementation proofs.
Related case context
These cases provide attributed design context. They do not establish that the proposed experiments or configurations were delivered in those engagements.