ARDR: reconcile end-to-end idempotency and duplicate suppression #183

New issue

Open

opened 2026-09-02 17:26:15 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-02 17:26:15 +00:00

Owner

Research transaction

Issue-backed ARDR transaction for lost-rob0t/starintel-server#47 — end-to-end idempotency and duplicate suppression across HTTP, Rabbit, persistence, targets, and leases.

Canonical Org artifacts

roam/research/star-server/STAR-RESEARCH-053-end-to-end-idempotency-duplicate-suppression.org
roam/design/star-server/STAR-SERVER-052-end-to-end-idempotency-duplicate-suppression.org

Lifecycle:

research: READY_FOR_DESIGN
design: DESIGN_READY_FOR_OPERATOR_REVIEW

Approval state:

research conclusion: PENDING
architecture/design: PENDING
implementation: PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL
publication: PENDING until the exact-main publication workflow succeeds

Current-source reconciliation

Audited starintel-server head: 8fb297d146e7332fae7e38170b5b49d49530ac53.

Current source already has target-specific principal-scoped idempotency identity/fingerprint semantics plus a separate target-dispatch fingerprint, while lease work has stronger request/digest replay and fencing semantics. This cycle therefore does not propose a blank-slate global dedupe cache. It defines one application-level transport-neutral idempotency state machine that composes with those existing identities.

Key decision

A scoped logical operation identity binds atomically to one deterministic semantic request fingerprint. One claimant gets first execute-authority; duplicates may replay known success/failure, remain in-progress, require reconciliation after ambiguous outcomes, or conflict when the same key is reused with changed semantics. Outcome-unknown is never retried as fresh logical work merely because a process restarts or a timeout occurs.

Rabbit delivery tags, HTTP request/correlation IDs, scheduled occurrence attempts, outbox events, and lease fencing generations retain separate identities/authorities. Replay does not bypass current authorization. Generic idempotency must not revive stale lease/fence authority.

Implementation boundary

Existing starintel-server#47 was updated as the bounded implementation handoff with RED-first slices, dependencies, and acceptance criteria.

Implementation authorization remains PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL. Do not expose this work to executable RAGE until explicit operator approval is recorded in the canonical workflow.

## Research transaction Issue-backed ARDR transaction for `lost-rob0t/starintel-server#47` — end-to-end idempotency and duplicate suppression across HTTP, Rabbit, persistence, targets, and leases. ## Canonical Org artifacts - `roam/research/star-server/STAR-RESEARCH-053-end-to-end-idempotency-duplicate-suppression.org` - `roam/design/star-server/STAR-SERVER-052-end-to-end-idempotency-duplicate-suppression.org` Lifecycle: - research: `READY_FOR_DESIGN` - design: `DESIGN_READY_FOR_OPERATOR_REVIEW` Approval state: - research conclusion: **PENDING** - architecture/design: **PENDING** - implementation: **PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL** - publication: **PENDING** until the exact-main publication workflow succeeds ## Current-source reconciliation Audited `starintel-server` head: `8fb297d146e7332fae7e38170b5b49d49530ac53`. Current source already has target-specific principal-scoped idempotency identity/fingerprint semantics plus a separate target-dispatch fingerprint, while lease work has stronger request/digest replay and fencing semantics. This cycle therefore does not propose a blank-slate global dedupe cache. It defines one application-level transport-neutral idempotency state machine that composes with those existing identities. ## Key decision A scoped logical operation identity binds atomically to one deterministic semantic request fingerprint. One claimant gets first `execute-authority`; duplicates may replay known success/failure, remain in-progress, require reconciliation after ambiguous outcomes, or conflict when the same key is reused with changed semantics. Outcome-unknown is never retried as fresh logical work merely because a process restarts or a timeout occurs. Rabbit delivery tags, HTTP request/correlation IDs, scheduled occurrence attempts, outbox events, and lease fencing generations retain separate identities/authorities. Replay does not bypass current authorization. Generic idempotency must not revive stale lease/fence authority. ## Implementation boundary Existing `starintel-server#47` was updated as the bounded implementation handoff with RED-first slices, dependencies, and acceptance criteria. **Implementation authorization remains `PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL`.** Do not expose this work to executable RAGE until explicit operator approval is recorded in the canonical workflow.