Skip to main content

Operation lifecycle

The following sequence summarizes a guarded write executed by gate.execute().

1. Request envelope​

The HTTP adapter maps the method, path, input, headers, and cookies into a RequestEnvelope. The kernel creates a request ID when one is not supplied and resolves the locale to tr or en.

2. Method, origin, and CSRF​

  • The HTTP method is narrowed to the supported set.
  • Unsafe methods require an exact match against the allowed origin set.
  • A session-bound CSRF token is required unless the action sets csrf: "disabled".
  • Production configuration rejects non-HTTPS, loopback, unspecified, and IPv4-mapped loopback addresses at startup.

3. Session and policy​

The session token is hashed before the store lookup. An expired or revoked session adds clearSessionCookie to result metadata. Fastify, Express, and Hono adapters translate that metadata into a clearing cookie.

Maintenance state, user/guild/IP blocks, and the owner set are evaluated in the same request context. Owner identity does not bypass the action security chain.

4. Input, resource, and authorization​

parse narrows raw input into the application type. resource creates the resource identity used by later audit and lock steps. authorize checks Discord access and application policy at the final write boundary.

5. Rate limit and idempotency​

The rate-limit store increments counters atomically. The PostgreSQL adapter serializes updates for the same bucket with a transaction-scoped advisory lock.

For an idempotent action, the kernel creates a reservation ID. renew, complete, and fail apply only to the matching reservation owner. An old worker cannot complete or remove a newer record after its reservation expires.

6. Optimistic revision and lease​

optimistic.expected is compared with the current revision. A mismatch stops the request with revision_conflict before the domain write.

When concurrency is configured, the kernel acquires a distributed lease. If the store supports leases, a fencing token is added to the context and the lease is renewed while work continues. The durable write layer should reject stale fencing tokens.

7. Deadline, retry, and circuit breaker​

timeoutMs is more than a cancellation request. In 1.1.0, the response ends at the configured boundary and produces DeadlineExceededError. If the underlying promise settles later, its outcome is exposed through settlement.

reliability.maximumLateSettlementMs bounds how long reservation and lease ownership may be held for that late result. When the physical operation must stop early, I/O inside execute must honor context.signal.

Retries run only for configured retryable failures and within the same idempotency and lease boundary. An open circuit breaker prevents the domain call from starting.

8. Transaction and savepoint​

The transaction order is:

  1. transaction.hooks.before
  2. execute
  3. transaction.hooks.beforeCommit
  4. Required audit or outbox records
  5. Database COMMIT
  6. afterCommit callbacks

Nested PostgreSQL work opens a SAVEPOINT. A successful inner scope forwards callbacks to the parent; an error rolls back only to that savepoint. The nested scope cannot change isolation or read-only mode.

9. Commit finality​

After a successful commit, the domain result is final. When cache invalidation, realtime publishing, or an observer callback fails:

  • the database is not rolled back
  • the domain write is not repeated
  • the issue is added to postCommitIssues or telemetry
  • the idempotent result is stored for replay

Fail-closed audit can be enabled only when the action uses audit, idempotency, and a required transaction. The audit write must enlist in that same transaction.

10. Response metadata​

Both successful and failed results may include:

  • requestId
  • resolved locale
  • rate-limit state
  • replacement session and CSRF tokens
  • a cookie-clearing instruction
  • post-commit issues

Do not drop this metadata in the adapter or application logging layer.

Last updated on