Kafka: close a window before you sign it.
A topic is an open-ended log, not one finite artifact. Makoto evidence needs a bounded subject: exact topic, partitions, offset ranges, timestamps, serialization context, and the bytes or deterministic manifest covered by that window.
Implementation boundary. Makoto does not ship a producer interceptor, record header, Schema Registry predicate mapping, or Kafka UI integration.
The attachment point
| Source window | An authorized finalizer closes declared partition and offset ranges, computes or resolves the exact window artifact, and creates an origin statement. |
|---|---|
| Stream transform | After an output window commits, append a transformation statement binding exact input window and predecessor digests. |
| Schema Registry | Carry schema IDs and serialization details as context or profile references. A schema ID does not become a Makoto predicate automatically. |
| Cross-team topic | Sign a handoff that commits to exact windows, heads, profiles, recipient, and final artifact representation. |
Control flow
topic: sensor.raw
partitions: 0..7
offsets: [120000, 128000)
window-end: 2026-09-16T16:05:00Z
# The finalizer writes an immutable window manifest, then uses:
uv run makoto attest origin --help
uv run makoto attest transform --helpThe design must specify record encoding, ordering, tombstones, late arrivals, compacted topics, and how the receiver reconstructs or obtains the exact bytes. Signing only offsets leaves content identity underspecified.
What the evidence can say
It can bind one closed stream window to authorized claims and predecessors. It cannot prove device firmware, infer trust from a producer ID, or turn ongoing CDC into a complete history without an explicit finalization boundary.
Define one window both sides can reproduce.
Contribute a deterministic fixture with partition offsets, exact serialization, late-arrival behavior, and a changed-record denial.