Responsibility boundaries

GuildGate implements shared security and reliability mechanisms; it does not take over product-domain decisions.

GuildGate boundary

• Session token hashing, expiry, rotation, and revocation
• Exact-origin and session-bound CSRF verification
• Action lifecycle, deadlines, idempotency, and concurrency controls
• Store, transaction, lock, realtime, and telemetry contracts
• Stable user error codes with hidden server error details
• Production startup guards

Application responsibility

Resource access, user/bot permission mapping, domain validation, schemas, migrations, retention, backups, Discord request budgets, proxy/TLS, and incident response remain in the application.

JavaScript cannot forcibly stop an arbitrary promise. GuildGate returns at the deadline and supplies an AbortSignal, but the physical operation may finish later. A durable write that can outlive a lease should reject stale workers through fencing tokens.

The transactional outbox provides at-least-once delivery. Consumers that apply external side effects must deduplicate by event ID.