Spool

Outside services

The services the project declares it sends data to, each with its reason.

No outside services are declared.

Scope and limits

One owner identity per installation with multiple isolated projects and project-scoped ingest and read grants.

What it will not do

• Automatic hosted provisioning during local setup; actual owner-account deployment and mail sender acceptance require explicit owner action.
• Sentry feature parity or a completed-migration claim; organization import has been exercised with synthetic fixtures only, and owner-export qualification is pending.
• External paging, automatic retention, or guarantees of complete capture coverage.
• Unbounded event payloads, remote artifact URL fetching, or execution of telemetry-provided instructions.

Declared limits

Status

Product bounds are implemented locally; representative capacity and large-instance economics are unmeasured.

New Event Admissions Per Minute Per Project

120

Retained Occurrences Per Project

10,000

Ingest Request Bytes

32,768

Frames Per Event

30

Breadcrumbs Per Event

20

Flat Source Maps Per Project

20

Source Map Bytes

262,144

Groups Per Query

100

Events Per Evidence Packet

10

Legacy Restore Request Bytes

16,777,216

Legacy Restore Rows Per Table

10,000

Portability Archive Line Bytes

25,165,824

Portability Archive Part Bytes

16,777,216

Portability Archive Rows Per Part

1,000

Restore Semantics

Native v1/v2 and Base portability JSONL restore into an empty domain database, preserve private maps and browser origins, and exclude owner/authentication state and credential grants. All formats validate domain integrity and per-project capacities. JSONL has per-line and per-part bounds, not a 16 MiB total archive or 10,000-row per-table limit.

Requirements

All 12 clauses of Spool’s CONTRACT.md. They say what the project must do; the handover and verification records say what is built and tested.

ERR 10 clauses

1. ERR-001
   Bounded admission Native version-1 JavaScript, Python and Go exception envelopes require active exact-project ingest credentials, registered release/build identity and bounded fields. Invalid, oversized, volume-limited and conflicting retries have explicit outcomes. Each project admits at most 120 outcomes a minute (minute_budget) and retains at most 10,000 events (retained_event_budget); over-limit intake returns 429 with Retry-After and a counted outcome. GOV-003 carries the target that replaces both limits with its named volume reasons and published sustained rate. Artifact URLs in envelopes are never fetched. Supported Sentry SDK exception events need the same registered release/build; SDK-009 carries admitting them with no release or an unregistered one. The broader SDK target is SDK-001. Acceptance evidence: Send valid, invalid, oversize, foreign-project and conflicting-retry envelopes through public ingest; inspect the outcome and unchanged rows for refusals. Exceed the per-minute and retained-event limits and confirm the explicit 429, Retry-After and counted reason, with no partial rows.
2. ERR-002
   Atomic acceptance Accepted means a sanitized occurrence, its group aggregate and its local new/regression alert commit atomically. Retry identity is project plus event ID and SHA-256 of canonical original accepted JSON before scrubbing: identical retry never increments, changed raw content conflicts even if its sanitized result matches. Raw bytes are not retained. Group algorithm version and basis remain inspectable. Acceptance evidence: Ingest an event twice, then change its raw secret under the same ID; inspect one occurrence and aggregate increment, one local alert and an explicit conflict without partial rows.
3. ERR-003
   Scrub before storage Apply the native allowlist, bounded text, query/fragment removal and sensitive-text scrubbing before persistence. Native envelopes contain no headers, cookies, request bodies or personal user identity; the user interface that unmodified Sentry SDKs send is governed by SDK-008's project identity policy instead. An optional random installation identifier supports bounded exposure measurement; it is never a name or address. Telemetry, source and notes are untrusted data and cannot authorize execution. The event fields SDK-010 keeps from unmodified Sentry SDKs (frame local variables, SDK-sent source context lines, exception values, tags, contexts, request, extra and thread stacks) pass through these scrubbers and SDK-003's server-side rules before storage, and default secret names are masked inside frame variables. Default protection persists when SDK-003 and CTX-002 introduce opt-in context; those captures require their own field policies and previews. Redaction does not promise removal of arbitrary semantic personal data. Acceptance evidence: Ingest privacy canaries and inspect stored events, issue views, packets, archives and delivery content; common secrets are removed while ordinary diagnostic content survives.
4. ERR-004
   Separated authority Every private API/document checks the current owner session or its exact ingest, deploy or read-only project grant itself. Cookie writes enforce same origin. Revocation and identity fencing take effect on the next request; confidential maps are never public. Ingest cannot read, deploy can only register releases/upload artifacts, and read-only agent grants cannot mutate. TEAM-001 extends this model to collaborative membership without broadening existing credentials. Acceptance evidence: Call each private transport anonymously and with wrong-scope, foreign-project, revoked and fenced grants; denied writes change no state, and direct map URLs reveal no private bytes.
5. ERR-005
   Source map identity Private flat Source Map V3 lookup matches project, release, build, debug ID and SHA-256 before presenting original coordinates. Missing, invalid or mismatched maps retain generated frames and a reason. Late uploads never rewrite immutable admission snapshots; current lookup is labelled separately. Lines are one-based, columns zero-based. A project stores at most 20 flat maps of 256 KiB; indexed (sections) maps are refused with a reason and sourceRoot is not applied. SRC-004 carries indexed maps, sourceRoot, published capacity and opt-in source fetching. Spool never fetches a remote URL. Acceptance evidence: Capture a minified second-origin exception before and after uploading the matching map; compare original coordinates, immutable admission diagnostics, mismatch refusal and confidential source exclusion from packets. Upload an indexed (sections) map and a 21st map in the same project and confirm each is refused with its reason.
6. ERR-006
   Audited triage and regression Revision-checked open, acknowledged, resolved and suppressed changes are audited. An issue resolved in its current release reopens as a regression on a recurrence in a later release; delayed older-release events cannot invent one. For registered releases the order is the registered sequence, never guessed semver; releases auto-created from Sentry SDK events are ordered by the project's stated rule in SDK-009. TEAM-003 adds resolve in the next or a named release, TEAM-004 resolution from a commit's release, and SDK-009 plain Resolve, which regresses on the next accepted event in any release. Recognized JavaScript bundle hash suffixes do not split grouping; native anchors and reported frames stay immutable. Corrections retain exact occurrence provenance and reversible fenced apply/undo. Acceptance evidence: Resolve a captured issue, admit its fingerprint in a newer and then older release, and inspect regression identity. Preview/apply/undo split and merge through owner HTTP/UI, reject stale revisions and inspect original membership.
7. ERR-007
   Sanitized evidence packet A compatible v1 packet exposes issue/lifecycle/grouping, retained release sequence and per-event release/build/environment, generated/original coordinates, immutable diagnostics beside current lookup, links and coded coverage gaps. UTF-8 JSON is bounded to 256 KiB and ten events, removing oldest events first and naming included/available counts even if none fit. It excludes source snippets, sourcesContent and artifact bytes. It carries the latest computed repair observation and newest three owner-recorded repairs, with omitted history named. CLI and stdio MCP keep exact-project read authority and untrusted/no-execution labels; they cause no model egress. Acceptance evidence: Read the same packet through HTTP, CLI and official MCP transport at size/retention/import/loss boundaries; compare projections and verify no secrets, source bytes, writes or cross-project reads.
8. ERR-008
   Loss counters and repair observation Expose windowed accepted/rejected/budget outcomes and unknown pre-transport loss. Only the owner records revision-checked repair links, scrubbed notes, checks, approval/merge/deploy facts and an exercised-flow record. Links are HTTPS origin/path text and never fetched. Manual repair writes send no notifications or external work. Compute recur/reasoned inconclusive/no-recurrence-after-exercise from stored release sequence, maps, events, exercise and loss; list older-release events separately. Missing exercise, capture, map, exposure or retention yields inconclusive. Never label a quiet feed fixed. AI-004 adds rate-based live proof. Status: done Acceptance evidence: Record a repair through owner HTTP, deny every project-grant write, then exercise deployed/no-events, healthy exercise, older-release event, loss and recurrence cases; inspect packet verdicts and absence of side effects from manual records.
9. ERR-009
   Archive, restore and retention Versioned private archives carry stored source bytes, checksums, migration identity, triage, maps, repairs/checks, operator corrections, reproduction/fix/exposure history and erasure journal. Base owns staging, JSONL integrity, empty-target guards and atomic inactive restore; HTTP/CLI and legacy v1/v2 decoding share semantic validation. Run tokens, step leases, owner sessions, project grants, alert destination records/credentials and dispatch queues never travel; retained alert rules restore disabled and delivery history is historical. Older archives restore newly introduced collections empty under versioned rules. An archive holds at most 10,000 events and 20 artifacts per project and refuses more with Archive event budget or Archive artifact budget; GOV-003 carries streaming archives of any retained volume. Manual cutoff retention removes private derived content, keeps repair snapshots with coverage gaps and exposes the deduplication horizon. Imported history creates no active grant, dispatch or current repair proof. Acceptance evidence: Export a populated installation via browser and rer, restore into an independent empty destination, compare retained records and inspect inert work. Refuse tampered, conflicting and nonempty-target imports before mutation; retain repair gaps after cutoff.
10. ERR-010
    Release gates A release must exercise real capture, symbolication, privacy, permissions, persistence and independent restore through the shipped app. Fresh setup has no demo rows. Private flows are accessible and responsive with explicit empty, failure and unavailable states. Source presence, local providers or a green build cannot substitute for hosted, mobile, integration or real-account acceptance. UX-001 and each connector clause specify the expanded product gates. Acceptance evidence: Run the named implemented journeys on the emitted Worker, inspect 1440/390 end states, then qualify each supported runtime/device and configured real provider with a buyer-controlled account.

OPS 1 clause

1. OPS-001
   Base commands and native admission The public rer command contract uses declared Node/pnpm pins and one setup manifest for terminal/browser. Setup claims or preserves the owner and private settings, stops its temporary app and leaves empty product data; rer dev uses real assets/HMR and private local identity. Local dev grants never authorize deployed entry. Reset is confirmed/contained and preserves source, exports and deployment receipts. Export/import share Base integrity and inactive empty-target restore. Deployment dry-run makes no provider request. Managed signed first-owner admission precedes auth dispatch; editor config independently checks the owner and has short expiry/exact-origin CSP. Acceptance evidence: Use public rer install/setup/dev/export/import/reset and deployment dry-run in a fresh checkout and independent destination; preserve existing setup, reject unsafe answer paths and reused managed claims, and deny anonymous/project-grant editor access.

BASE-DATA 1 clause

1. BASE-DATA-003
   Project and installation-owner erasure The owner has count-only preview, typed confirmation bound to the exact current plan, resumable destructive steps and a completion receipt with per-table counts/times and no personal values. Project-root cascade, anonymized permanent audit, portability tombstones, source-import custody withdrawal, stale-write fences are preserved, and project erasure completes within five minutes for a project at today's 10,000-event admission limit. GOV-003 carries erasure within 15 minutes for 150,000 retained events. Owner self-erasure first transfers authority to a verified successor; it refuses unsupported/ambiguous attribution rather than damaging other people's data. All current declared tables and outbox copies participate; new capture stores must extend this declaration before release. Acceptance evidence: Run public setup/dev/HTTP/export/import erasure journeys with canaries in every declared store, count-only preview/receipt, wrong-scope/origin/stale denials, a 10,000-event project erased within 300 seconds, successor handoff, resumed partial erasure and same/fresh-destination old-archive fences.

View as agent

Everything on this page is in these files, copied unmodified from the release. An agent evaluating Spool can read them instead of the page.

seed.json

The manifest: capabilities, outside services, extension points, limits, operating cost and deployment needs.

CONTRACT.md

The requirements on this page, in source form.

AGENTS.md

Instructions for the coding agent that maintains an installation.

LICENSE

RELEASE.json

README.md

Source setup, available commands and implementation status.

OPERATIONS.md

How the project is set up, operated and deployed.

ACCEPTANCE.md

What the publisher accepts as a finished release.

Every project, with its availability, is in /agents/catalogue.json; the agents page describes the machine-readable files.