Do real API specifications publish a snapshot and completeness bit?
3 of 560 strict list operations publish a snapshot in the response envelope, 2 of them also echoing the narrowing request; the threshold of 2 was met, against the plan's expected negative.
Prediction failedWhere does it stop?Working note
- Designed for
- Built to test how often real API specifications publish a source-set snapshot in list responses, and whether that would make the guard's closed-world rule a protection.
What was tested
A census of strict enumerations in public API specifications looked for a source-set snapshot in list responses; positive cases were re-read by hand in one cloud provider’s specification. The plan expected a negative and set a threshold of 2 operations.
What we observed
3 of 560 strict enumerations publish a snapshot in the response envelope, and 2 of them also echo the narrowing request through a last-evaluated-time field. The threshold was met; the expected negative failed. An earlier agent-taken census found a snapshot declared by 2 of 1,335 reading operations, both false, and ETag or Last-Modified on 0 of 1,051 GET operations.
What this means for Heimdall
This asks how far real services supply what the guard’s closed-world rule needs. A few list operations publish a snapshot, so completeness is checkable from the source there; most do not. By argument, not measurement, checkable is not hostile-agent-proof: an agent can obtain both bits lawfully. The census measures the rule’s reach, not how it decides where the bits exist. Its result bears on set completeness, which the layer defers.
Limits
The positive result rests on one provider; the specifications and the census instrument are not listed; earlier numbers were agent-taken.
What remains open
List the specifications and instrument, then repeat across providers.