coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0031-T03: durable decision outbox and the FLEX-DEC-2026-018 release rule
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m27s
Details

Browse source 
internal/emission commits one audit-core-shaped event per decision with
fsync before release (one sync per batch), random event ids with the
decision id as correlation_id, torn-tail and failed-commit truncation, and
per-class committed/released_uncommitted counts at GET /v1/emission.
The engine releases restrictions whose record failed to commit and
withholds allow/audit_only (503). api.DecisionEffects() is pinned by a
source-parsing test and cadence.yaml must classify exactly it.

T03 split under the task budget: heartbeat+drain is T05, reconciliation,
profile check and PVC are T06. Nothing deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 307130@bnt-lap001
Assistant-Session: 270c79f7-0823-4b0d-990d-aad5af9935ce
This commit is contained in:
tegwick 2026-09-23 20:20:58 +02:00
parent 7f0e2e37f9
commit cd14a34e33
9 changed files with 842 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

8
decisions/decisions.md
View file

@ -2070,5 +2070,13 @@ not one per resource.
again, so a restart during an outbox outage loses them. This is the same
residual as the stated bound, not a new one.
**Batch residual (added 2026-09-23, `FLEX-WP-0031-T03`).** A batch has one
HTTP status. If a batch holds a permissive decision whose record did not
commit, the whole batch is withheld (503), and its restrictions are withheld
with it. This is the one place the rule above yields. It is accepted because no
live consumer calls `/v1/batch_check`: user-engine's `batch_check` loops over
`/v1/check`. It must be revisited before any consumer adopts the batch
endpoint.
**Bound.** Unchanged from `cadence.yaml`: none of this detects a compromised
flex-auth suppressing a record together with its own count.