NTP hands you a number and the world treats it as exact. PLUMB replaces it with the interval the real instant must lie in, tightens it with Marzullo across servers, and detects the lying server with proof.
Cada leitura carimbada por um intervalo de tempo certificado.
open in new tab ↗MiFID II / RTS 25 requires proving the clock ≤ 100 µs from UTC; IEC 61850 asks for 1 µs. PLUMB attests each instant against the ruler: PROVED_INSIDE, PROVED_OUTSIDE or UNDECIDABLE — and it's honest when the measurement isn't precise enough to claim.
Measured on a real Mac: the clock drifted at 135.9 ppm; chrony cured it ~13×, yet PLUMB proves it stays non-conformant — because the measurement path (Wi-Fi, ±12 ms) is the floor, not the clock.
A library that returns the instant as Stamp{T, δ} with an honest sawtooth, orders events with proof (BEFORE/AFTER/UNDECIDABLE) and does Spanner-style commit-wait — without an atomic clock.
chrony is the actor: it claims ~30 µs over one path, assuming the server is truth. PLUMB is the auditor: it proves ±12 ms with 5 independent sources, no trust. Separating the two is the feature.