Consent, policy, identity and tenancy

Consent state machine with a transition map, computing the effective state from a record and the current time through lookup-time expiry and auto-resume. Terminal states exist, and expiry is not persisted.

What it does

transition map; lookup-time expiry/auto-resume

Inputs

record, now

Outputs

effective state

State

n/a (derived)

Safeguards

terminal states; expiry not persisted

Grants or upserts consent with a terminal-state guard, READ COMMITTED isolation, a record_hash and an audit row. It stores in PG consent_records and consent_audit_log, with RLS, a 409 terminal block, MFA step-up and MANAGE_CONSENT.

What it does

upsert with terminal guard, READ COMMITTED, record_hash, audit row

Inputs

actor_id, action, tenant, scope, lawful basis…

Outputs

record; cache tombstone; signed publish

Depends on

pg pool, cache, publisher

State

PG consent_records, consent_audit_log

Safeguards

RLS, terminal-state block (409), MFA step-up, MANAGE_CONSENT

Revokes consent using FOR UPDATE, a transition check and an audit row, producing a REVOKED row, a tombstone and a pub/sub message. A CAS cache tombstone protects it, and a failed publish raises a CRITICAL alert.

What it does

FOR UPDATE, transition check, audit

Inputs

id, tenant, revoked_by

Outputs

REVOKED row; tombstone; pub/sub

Depends on

pg, cache, publisher

State

PG

Safeguards

CAS cache tombstone; CRITICAL alert on publish failure

Suspends or resumes consent with state checks. Suspend publishes to other instances, while resume invalidates locally; it takes an id and an until value and updates the row.

What it does

state checks; suspend publishes, resume local invalidate

Inputs

id, until

Outputs

row update

Depends on

as above

State

PG

Safeguards

same

Hot-path consent verify that runs a sync gate, then cache, PG, state, scope and provenance checks, adding an async audit row. It fails closed on every error.

What it does

sync gate → cache → PG → state → scope → provenance

Inputs

actor_id, action, tenant, required_scope

Outputs

+ async audit row

Depends on

cache, store, subscriber

State

cache (Redis), PG

Safeguards

fail-closed on every error

Signed compare-and-set cache of consent results with MAC-sealed entries, Lua CAS, a TTL clamp and master-only reads. Entries are stored under Redis keys qodiqa:consent:*, protected by MAC, tombstones and key binding.

What it does

MAC-sealed entries, Lua CAS, TTL clamp, master-only reads

Inputs

key parts, result, version

Outputs

Redis keys qodiqa:consent:*

Depends on

Redis

State

Redis

Safeguards

MAC, tombstones, key-bound

Signs and parses revocation events using HMAC v2 with a 30 s age limit. Verification checks the signature, age and version.

What it does

HMAC v2, 30 s age limit

Inputs

event

Outputs

signed event

Safeguards

signature, age, version

Publishes revocation events through a single-attempt Redis PUBLISH, returning a boolean. A failure is made visible at CRITICAL level rather than hidden.

What it does

single-attempt Redis PUBLISH

Inputs

opts

Outputs

boolean

Depends on

managed Redis

Safeguards

fail-visible (CRITICAL)

Revocation subscriber and sync gate that verifies messages, dedups with a window of 10k and invalidates cache by target or actor. It outputs a readiness flag, and the verifier denies when started but not ready.

What it does

verify, dedup 10k, targeted/actor invalidation

Inputs

channel messages

Outputs

cache invalidation; readiness flag

Depends on

managed Redis

Safeguards

verifier denies when started & not ready

Handles GDPR rectify, anonymize, erase and pseudonymize by scrubbing, tombstoning and rehashing records in PG. It updates rows and writes a CONSENT_ERASED audit row, limited to allow-listed fields, with audit retained.

What it does

scrub, tombstone, rehash

Inputs

id/actor, pseudonym

Outputs

rows updated; CONSENT_ERASED audit

Depends on

pg

State

PG

Safeguards

allow-listed fields; audit retained

Computes an audit checksum (sha256 of 4 fields) and runs an integrity scan with a definer-function scan, returning mismatches. The checksum covers only consent_id, event, actor and detail; it depends on migration 053.

What it does

sha256 of 4 fields; definer-function scan

Inputs

rows

Outputs

mismatches

Depends on

migration 053

State

PG

Safeguards

checksum covers only consent_id/event/actor/detail

Caveat checksum covers only consent_id/event/actor/detail

Management API for consent that validates schema, checks special categories and records operator attribution. It returns 201, a 4xx or 409, and needs MANAGE_CONSENT, MFA, a registered tenant and DD-021 attribution.

What it does

schema, special-category check, operator attribution

Inputs

HTTP

Outputs

201/4xx/409

Depends on

registry

State

PG

Safeguards

MANAGE_CONSENT + MFA, tenant must be registered, DD-021 attribution

Loads and validates the policy JSON document by schema and limits, per-type validate and preprocess, mandatory REQUIRE_CONSENT, and priority sort. It returns a frozen policy array and rejects poison keys, with size and count caps and a required POLICY_FILE in production.

What it does

schema, limits, per-type validate/preprocess, REQUIRE_CONSENT mandatory, sort by priority

Inputs

JSON doc

Outputs

frozen policy array

Depends on

evaluators

State

file/control plane

Safeguards

poison keys, size/count caps, production POLICY_FILE required

Engine decision loop: validates the context, evaluates policies first-fail-wins and batches RATE_LIMIT. It returns a frozen decision with hashes and is fail-closed on every error path.

What it does

validate ctx, first-fail-wins, RATE_LIMIT batching

Inputs

raw context, policies, store

Outputs

frozen decision with, hashes

Depends on

evaluators

Safeguards

fail-closed for every error path

Validates the evaluation context for type, length and range, poison keys and attribute sanitising, returning a frozen context. It protects against prototype pollution and enforces length bounds.

What it does

type/length/range, poison keys, attribute sanitising

Inputs

raw context

Outputs

frozen context

Depends on

abac/attributes

Safeguards

prototype-pollution and length bounds

Evaluation wrapper that builds the context, calls the engine, hashes the live policy set and logs an audit entry on block. It returns EXECUTE, BLOCK or ENFORCEMENT_ERROR, normalises IPv4-mapped addresses, and the hash is informational only.

What it does

builds ctx, calls engine, hashes live set, audit logs on block

Inputs

request facts

Outputs

EXECUTE /BLOCK/ ENFORCEMENT_ERROR

Depends on

engine, logger

Safeguards

IPv4-mapped normalisation; informational only

Caveat informational only

REQUIRE_CONSENT evaluator that builds the actor from the context and verifies consent, returning pass or a reason with provenance. It binds the caller (NONREP-1) and is forced true.

What it does

actor = ‖; verify

Inputs

ctx, config

Outputs

pass/reason + provenance

Depends on

consent registry

Safeguards

NONREP-1 caller binding; forced true

BLOCK_IP rule using an exact set, IPv4 CIDR math and an IPv6 BlockList. It returns pass, IP_BLOCKED or IP_MISSING and supports IPv6 CIDR.

What it does

exact set, IPv4 CIDR math, IPv6 BlockList

Inputs

ip

Outputs

pass/ IP_BLOCKED / IP_MISSING

Depends on

net

Safeguards

IPv6 CIDR support

TIME_WINDOW rule over UTC day and minute windows. It takes a timestamp and returns pass or OUTSIDE_TIME_WINDOW, validating that start comes before end.

What it does

UTC day/minute windows

Inputs

timestamp

Outputs

pass/ OUTSIDE_TIME_WINDOW

Safeguards

start<end validation

RATE_LIMIT rule with an atomic check-and-increment, plus a batch form with short-circuit. It returns pass, RATE_LIMIT_EXCEEDED or RATE_LIMIT_KEY_MISSING, uses the Redis Lua store (ratelimit:v1) and fails closed on store error.

What it does

atomic check-and-increment; batch with short-circuit

Inputs

/ip, store

Outputs

pass/ RATE_LIMIT_EXCEEDED / RATE_LIMIT_KEY_MISSING

Depends on

policy store (Redis Lua)

State

Redis ratelimit:v1

Safeguards

fail-closed on store error

Counter store on Redis or in memory, using Lua CHECK_AND_INCR, CHARGE_BY, ADJUST and batch scripts, with a cluster fallback. It takes key, window and max, and the scripts are atomic.

What it does

Lua CHECK_AND_INCR / CHARGE_BY / ADJUST / batch; cluster fallback

Inputs

key, window, max

Depends on

managed Redis

State

Redis

Safeguards

atomic scripts

ABAC rule evaluating a condition tree with 17 ops over a 22-attribute catalogue, returning pass or ABAC_<LABEL>, also for tool rules. Depth and nodes are bounded, attributes typed, and unprepared rules never pass silently.

What it does

condition tree, 17 ops, 22-attribute catalogue

Inputs

context, attributes

Outputs

pass/ ABAC_<LABEL>; for tool rules

Depends on

net

Safeguards

bounded depth/nodes, typed attributes, no silent pass if unprepared

Covers DLP, CONTENT_RULE, BUDGET, ROUTING and DATA_RETENTION rule types: they validate and preprocess config, while evaluate is a no-op pass. The output is policy-set carriers; it checks config and uses safe regex.

DATA_RESIDENCY rule that looks up a provider's region and compares it with the allowed set. It passes or gives 3 deny reasons, and an unknown provider is denied.

What it does

provider→region lookup vs allowed set

Inputs

action (provider)

Outputs

pass / 3 deny reasons

Safeguards

unknown provider denies

Safe regex engine built on a Thompson NFA with bounded matching. It takes a pattern, avoids backtracking and applies size caps.

What it does

Thompson NFA, bounded

Inputs

pattern

Safeguards

no backtracking, size caps

Opt-in decision cache using LRU for BLOCK_IP, TIME_WINDOW and ABAC only, held in memory. The key includes the rule hash and context, and a set-hash change invalidates it.

What it does

LRU for BLOCK_IP/TIME_WINDOW/ABAC only

Inputs

policy, ctx

Outputs

cached pass/reason

State

memory

Safeguards

key includes rule hash+ctx; set-hash invalidation

Caveat opt-in

Hashes policies and rules with a domain-separated hash of stable JSON, stripping _ fields. It returns hex and compares in constant time.

What it does

domain-separated hash of stable JSON, _ -fields stripped

Inputs

policies/rule

Outputs

hex

Safeguards

constant-time compare

Global policy store kept in a control-plane collection with versions and rollback, returning the enforced set from CRUD operations. It depends on the loader and fails closed when invalid or stale.

What it does

control-plane collection, versions, rollback

Inputs

CRUD ops

Outputs

enforced set

Depends on

loader

State

control-plane PG / memory

Safeguards

fail-closed when invalid/stale

Maker-checker workflow using a state machine, independence rules, a payload hash and transaction events, in PG policy_change_requests and approval_events. Author, reviewer, approver and publisher must differ, and lineage is checked.

What it does

state machine, independence rules, payload hash, tx events

Inputs

change requests, actors

Outputs

PUBLISHED policy changes

Depends on

PG, policy store, rbac store

State

PG policy_change_requests, approval_events

Safeguards

author≠reviewer≠approver≠publisher, lineage check

Emergency activation applies a policy change immediately and adds retro-approval and expiry revert. It takes an incident, justification and ttl and creates an emergency row; TTL is at most 168 h and the retro approver must differ from the activator.

What it does

immediate apply; retro-approval; expiry revert

Inputs

incident, justification, ttl

Outputs

policy changed; emergency row

Depends on

PG

State

PG

Safeguards

TTL ≤168 h, retro approver≠activator

Rollback governance requiring independent approval of a rollback request before publish. The approver, requester and publisher must be different people, with state in PG.

What it does

independent approval

Inputs

request

Outputs

rollback publish

Depends on

PG, store

State

PG

Safeguards

approver≠requester≠publisher

Reconciles PG against the live store, keeps hash-chained events and a provenance ledger, and produces an evidence package. The hash chain protects it, but provenance is fire-and-forget.

What it does

reconcile PG vs live store; hash-chained events; provenance ledger

Inputs

state

Outputs

evidence package

Depends on

PG

State

PG

Safeguards

hash chain; provenance fire-and-forget

Caveat provenance fire-and-forget

Visual policy builder offering graph, tree, deps, stats, risk and export views. It takes a policy document and returns SVG, PNG or JSON using pure functions.

What it does

graph/tree/deps/stats/risk/export

Inputs

policy doc

Outputs

SVG/PNG/JSON

Safeguards

pure functions

Tenant registry with control-plane CRUD and a status gate. It takes options as input and returns a result, and tenant statuses fail closed.

What it does

control-plane CRUD, status gate

Inputs

opts

Outputs

result

State

control plane

Safeguards

fail-closed statuses

Tenant policy registry with a floor: it clamps to the floor, appends it, sorts and preprocesses, producing effective policies from a tenant set. A tenant cannot disable or loosen the floor; state is hydrated in memory.

What it does

clamp to floor, append floor, sort, preprocess

Inputs

tenant set

Outputs

effective policies

Depends on

policy store, evaluators

State

memory (hydrated)

Safeguards

cannot disable/loosen floor

Persists tenant config with RLS upserts, boot load and periodic refresh, filling registries from rows in PG (migration 051). It uses a definer full-read and skips malformed rows.

What it does

RLS upsert; boot load; periodic refresh

Inputs

rows

Outputs

registries populated

Depends on

PG (migration 051)

State

PG

Safeguards

definer full-read, skip malformed

Tenant semantic overlay that validates and clamps config in a tighten-only way, held in memory or PG. It depends on semantic policy defaults and uses a strict schema.

What it does

tighten-only validate/clamp

Inputs

config

Outputs

overlay

Depends on

semantic policy defaults

State

memory/PG

Safeguards

strict schema

Org registry with CRUD, tenant assignment and quotas, held in the control plane. It takes org data and returns status verdicts, and stale or unsynced status leads to deny.

What it does

CRUD, tenant assignment, quotas

Inputs

org data

Outputs

status verdicts

Depends on

status subscriber

State

control plane

Safeguards

stale/unsynced ⇒ deny

Propagates org status using a Redis hash, signed pub/sub, a 5 s sweep and monotonic stamps, updating local status. The data lives in qodiqa:org:status, signed and sealed, and fails closed.

What it does

Redis hash + signed pub/sub + 5 s sweep + monotonic stamps

Inputs

status changes

Outputs

local status updates

Depends on

managed Redis

State

Redis hash qodiqa:org:status

Safeguards

signed/sealed, fail-closed

Replicated versioned store: PG snapshot, pull and signed notify, with 5 s staleness refusal and versioned writes with invariants. It uses PG control_plane_records, Redis notify and MAC notifications, and returns CONTROL_PLANE_STALE refusals.

What it does

pg snapshot + pull + signed notify; 5 s staleness refusal; versioned writes + invariants

Inputs

records

Outputs

CONTROL_PLANE_STALE refusals

Depends on

PG control_plane_records, Redis notify

State

PG / memory(dev)

Safeguards

staleness bound, version conflicts, MAC notifications

Caveat memory(dev)

Signing identities as scoped machine identities, with sk_ keys stored hashed and an OIDC-linked type. It handles create, update, issue and revoke and returns an identity record, scoped by tenant, env and provider.

What it does

scoped machine identities, sk_ keys hashed, OIDC-linked type

Inputs

create/update/issue/revoke

Outputs

identity record

State

control plane

Safeguards

tenant+env+provider scope, hash lookup, expiry

Defines the single signing permission SIGN_ARTIFACT and the environment from QODIQA_ENVIRONMENT or NODE_ENV. It takes permissions and env and returns booleans or the env, scoping by environment.

What it does

single permission SIGN_ARTIFACT; QODIQA_ENVIRONMENT /NODE_ENV

Inputs

permissions, env

Outputs

booleans/env

Safeguards

environment scoping

Key status timeline as a forward-only control-plane record with merge, giving key status across replicas. Revocation becomes visible within 5 s.

What it does

forward-only control-plane record, merge

Inputs

key status transitions

Outputs

cross-replica key status

State

control plane

Safeguards

revocation visible ≤5 s

Extension point that lazily requires enterprise/identity, returning the module or null. Without the module only API keys work, and a config needing the module fails boot.

What it does

lazy require of enterprise/identity

Outputs

module or null

Depends on

enterprise/identity

Safeguards

absent module ⇒ API keys only; config without module fails boot

Optional OIDC bearer authentication that verifies sig, iss, aud and exp with an alg allow-list, a JWKS cache and an SSRF-safe fetch. It reads QODIQA_OIDC_CONFIG_PATH, refuses HS* and none, and requires a link.

What it does

verify sig/iss/aud/exp, alg allow-list, JWKS cache, SSRF-safe fetch

Inputs

JWT

Outputs

identity/operator resolution

Depends on

QODIQA_OIDC_CONFIG_PATH, node crypto

State

JWKS cache memory

Safeguards

no HS*/none, key/alg match, duplicate-member refusal, link required

Caveat OPTIONAL

Optional SAML SSO with preflight, library validation and a replay claim, turning a SAMLResponse into an operator session token. It uses @node-saml/node-saml, accepts SHA-2 only, rejects DOCTYPE, and uses signed relay state and one-time assertions.

What it does

preflight + library validation + replay claim → session

Inputs

SAMLResponse

Outputs

operator session token

Depends on

@node-saml/node-saml

State

Redis idreplay:v1: or memory

Safeguards

SHA-2 only, no DOCTYPE, signed relay state, one-time assertion

Caveat OPTIONAL

Optional LDAP/AD sign-in using a service bind, search, user bind, group admit and session mint, via ldapts. It returns an operator session token, with TLS≥1.2, no empty bind, filter escaping and a per-process lockout of 5 per 15 min.

What it does

service bind, search, user bind, group admit, session mint

Inputs

username/password

Outputs

operator session token

Depends on

ldapts

State

in-memory lockout

Safeguards

TLS≥1.2, no empty bind, filter escape, per-process 5/15 min lockout

Caveat OPTIONAL

Operator session tokens verified by MAC with a per-request recheck of the user and link. They are stateless, last at most 8 h, and are revoked immediately when the user is disabled or unlinked.

What it does

MAC verify, per-request user/link recheck

Inputs

token

Depends on

rbac store

State

stateless

Safeguards

MAC, ≤8 h, immediate revocation by user disable/unlink

Replay store for assertions using SET NX PX or a memory map. It takes a key and ttl and returns a boolean; a store failure refuses login, with a 2 s timeout.

What it does

SET NX PX or memory map

Inputs

key, ttl

Outputs

boolean

Depends on

Redis

State

Redis/memory

Safeguards

store failure refuses login; 2 s timeout

Portal MFA assurance that checks the amr, acr and auth_time claims against env, returning a boolean. It fails closed if the enterprise oidc module is absent.

What it does

amr/acr/auth_time check

Inputs

claims, env

Outputs

boolean

Depends on

enterprise oidc

Safeguards

fail-closed if module absent

Static frozen role and permission matrix of 6 roles and 66 permissions, held in code. It takes a role and permission and returns a boolean; unknown means deny.

What it does

static frozen map, 6 roles / 66 permissions

Inputs

role, permission

Outputs

boolean

State

code

Safeguards

unknown ⇒ deny

Custom roles in a custom: namespace, defined as a subset of fixed permissions and stored in the control plane. It returns role permissions, cannot add permissions, and has an enabled flag.

What it does

custom: namespace, subset of fixed permissions

Inputs

role defs

Outputs

role permissions

State

control plane

Safeguards

cannot add permissions, enabled flag

Operator user store and API keys with create, update and delete, a last-admin invariant, ok_ keys hashed with SHA-256, rotation grace and external identity links. It uses a last-admin lock, a hash index and constant-time compare.

What it does

create/update/delete, last-admin invariant, ok_ keys SHA-256, rotation grace, external identity link

Inputs

user/key ops

Outputs

user records

State

control plane

Safeguards

last-admin lock, hash index, constant-time compare

Permission middleware that checks the role and, on deny, writes an audit log and a metric and returns 403. It uses the rbac modules and fails closed.

What it does

role check, audit log + metric on deny

Inputs

req

Outputs

403

Depends on

rbac modules

Safeguards

fail-closed

TOTP MFA with step-up per RFC 6238 and recovery codes, locking after 5 failures. It takes an OTP header and returns allow or deny, using an AES-GCM secret, a replay guard and a 15 min lock, with the KEK.

What it does

RFC 6238, recovery codes, lock after 5

Inputs

OTP header

Outputs

allow/deny

Depends on

KEK

State

control plane (encrypted secret)

Safeguards

AES-GCM secret, replay guard, lock 15 min

Ops auth middleware that tries lockout, federation, API key, then shared token in order. It takes credentials and returns the methods, using constant-time compare, lockout and expiry headers, backed by the rbac store.

What it does

lockout → federation → API key → shared token

Inputs

credentials

Outputs

methods

Depends on

rbac store, federation

Safeguards

constant-time, lockout, expiry headers

Brute-force lockout using Redis Lua counters per IP and credential hash with backoff, returning lock verdicts and metrics. Storage down means locked (fail-closed), with a default of 5 fails per 15 min, under authlock:v1.

What it does

Redis Lua counters per IP and credential hash, backoff

Inputs

req, credential

Outputs

lock verdicts/metrics

Depends on

managed Redis

State

Redis authlock:v1

Safeguards

storage-down ⇒ locked (fail-closed); 5 fails/15 min default

Registers nonces with a Lua SET NX PX, an uptime restart barrier and anomaly windows, returning REPLAY, UNPROVABLE, BURST or ALLOWED. It stores under qodiqa:req:v2, fails closed and uses an AOF persistence gate (STRICT_REPLAY_PROTECTION).

What it does

Lua SET NX PX + uptime restart barrier + anomaly windows

Inputs

expiry, tenant

Outputs

REPLAY/UNPROVABLE/BURST/ALLOWED

Depends on

Redis

State

Redis qodiqa:req:v2

Safeguards

fail-closed; AOF persistence gate (STRICT_REPLAY_PROTECTION)

Redis persistence guard that runs AOF and fsync diagnostics with a periodic recheck. It reads the live Redis CONFIG, returns safe or unsafe with warnings, and refuses to start when strict.

What it does

AOF/fsync diagnostics; periodic recheck

Inputs

live Redis CONFIG

Outputs

safe/unsafe + warnings

Depends on

Redis

Safeguards

refuses start when strict

Validates the key by charset and length and computes a domain-separated sha256 fingerprint. It takes the header and request facts and returns the key and fingerprint, binding across requests.

What it does

charset/length; domain-separated sha256

Inputs

header, request facts

Outputs

key/fingerprint

Safeguards

cross-request binding

Reserve, complete and release store on Redis NX, XX and DEL with a bounded wait, giving 5 outcomes: proceed, replay, conflict, in_progress, unavailable. Keys are tenant-scoped under qodiqa:idem:v1, and it fails closed.

What it does

Redis NX/XX/DEL, bounded wait, 5 outcomes

Inputs

key, fingerprint

Outputs

proceed/replay/conflict/in_progress/unavailable

Depends on

Redis

State

Redis qodiqa:idem:v1

Safeguards

tenant-scoped key; fail-closed

Sliding-window and burst limiter with a Lua two-bucket weighting, a burst bucket and a policy chain, returning 429 with headers. It fails closed or degrades per surface and uses rl:v2.

What it does

Lua two-bucket weighting + burst bucket; policy chain

Inputs

surface, identity

Outputs

429 + headers

Depends on

Redis

State

Redis rl:v2

Safeguards

fail-closed/degrade per surface

Surface config covering 34 surfaces with tenant, user, key and endpoint overlays, read from env into a policy chain. Schema validation is fatal on error, using zod.

What it does

34 surfaces + tenant/user/key/endpoint overlays

Inputs

env

Outputs

policy chain

Depends on

zod

State

memory

Safeguards

schema validation fatal on error

Degraded fallback that uses a per-process MemoryStorage for degrade surfaces, raising a CRITICAL event and an AlertEngine alert. It takes a Redis outage and outputs a degraded flag and metric, making degradation visible.

What it does

per-process MemoryStorage for degrade surfaces, CRITICAL event, AlertEngine alert

Inputs

Redis outage

Outputs

degraded flag/metric

Depends on

alerting

State

memory

Safeguards

visible degradation

Detectors: 24 of them, with validation such as Luhn and CNP, PESEL and BSN checks. They scan text and return findings, with confidence scoring.

What it does

24 detectors with validation (Luhn, CNP/PESEL/BSN checks)

Inputs

text

Outputs

findings

Safeguards

confidence scoring

Scan and transform engine that normalises invisible and confusable characters, merges findings and redacts, masks or blocks text, blocking on truncation. It returns transformed text and hashes, with stable HMAC tokens and a scan limit of 1 MiB.

What it does

normalise (invisible/confusable), merge, redact/mask/block, truncation block

Inputs

text, action

Outputs

transformed text + hashes

Depends on

detectors

Safeguards

stable HMAC tokens, ≤1 MiB scan, fail-block on truncation

Classifies text by level and marking signals and derives exfiltration signals. It takes text and findings and returns classification and signals, using URL, encoded blob and bulk heuristics.

What it does

level + marking signals; exfil signals

Inputs

text, findings

Outputs

classification, signals

Depends on

engine

Safeguards

URL/encoded blob/bulk heuristics

Provides light, standard and strict rule-set profiles plus an evaluation scorer. It takes a profile name or corpus and returns rules or metrics, and depends on the engine.

What it does

light/standard/strict rule sets; scorer

Inputs

profile name / corpus

Outputs

rules / metrics

Depends on

engine

Endpoint store in PG with CRUD and an AES-256-GCM secret under RLS, returning endpoint rows and the secret once. The secret never appears in projections.

What it does

PG CRUD, AES-256-GCM secret

Inputs

endpoint data

Outputs

endpoint rows, secret once

Depends on

pg

State

PG (RLS)

Safeguards

secret never in projections

Dispatches events by fan-out under tenant RLS, enqueueing an operation per endpoint on the recovery queue. It takes an event and payload and returns queued operations, asynchronously and without blocking.

What it does

fan-out under tenant RLS, enqueue per endpoint

Inputs

event, payload

Outputs

queued operations

State

recovery queue

Safeguards

async, non-blocking

Delivers signed payloads by HTTP POST with an HMAC signature and SSRF, DNS-rebind, TLS and redirect controls. It is HTTPS-only, rechecks rebinding, supports allow and deny lists, and uses a circuit breaker.

What it does

SSRF/DNS-rebind/TLS/redirect controls, HMAC signature

Inputs

endpoint, payload

Outputs

HTTP POST result

Depends on

https, circuit breaker

Safeguards

HTTPS-only, rebinding recheck, allow/deny lists

Retry policy and circuit breaker that classify errors as transient or permanent, using capped jittered backoff and a per-host breaker. It takes status and attempt, returns a retry decision and retries only idempotent calls.

What it does

transient/permanent classification, capped jittered backoff, per- host breaker

Inputs

status, attempt

Outputs

retry decision

Depends on

config

State

memory (breaker)

Safeguards

idempotent-only retries

Aggregates tenant usage by validating a range up to 400 d and summing token usage per UTC day with BigInt. It returns totals and a series, with a tenant id regex and exact numerics.

What it does

validate range ≤400 d, BigInt reduce of token usage per UTC day

Inputs

range

Outputs

totals/series

Depends on

audit-log backends

State

audit store

Safeguards

tenant id regex; exact numerics

Managed HA client factory for single, sentinel or cluster Redis, with TLS or auth, deadlines and reconnect. It reads env and returns a client wrapper, with credential redaction, TLS verify and a command deadline; it uses redis ^5.12.1.

What it does

single/sentinel/cluster factory, TLS/auth, deadlines, reconnect

Inputs

env

Outputs

client wrapper

Depends on

redis ^5.12.1

Safeguards

credential redaction, TLS verify, command deadline

Health registry that aggregates state from the registered purposes. It serves the /health/redis data and depends on the managed client to report on each Redis purpose.

What it does

aggregate state

Inputs

purposes

Outputs

/health/redis data

Depends on

managed client

Command deadline and watchdog that rejects slow commands. It reads REDIS_COMMAND_DEADLINE_MS and raises REDIS_COMMAND_DEADLINE_EXCEEDED, so a silent partition fails closed.

What it does

reject slow commands, watchdog

Inputs

REDIS_COMMAND_DEADLINE_MS

Outputs

REDIS_COMMAND_DEADLINE_EXCEEDED

Depends on

managed client

Safeguards

silent partition ⇒ fail-closed