Commit a denied terminal outcome after final egress refusal

[Brad-Edwards]

A final flow-sink denial commits a denied audit but leaves the operation SUCCEEDED. Durable status and the caller-visible refusal disagree.

Acceptance criteria

• Commit the terminal operation outcome and denial audit atomically after the final release decision, using existing operation semantics.
• Ensure status, history, idempotent readback, and effect consumers agree on the denied release. Preserve evidence of earlier work without reporting the prohibited release as successful.
• Verify no payload is released and the same denied outcome survives repeated retrieval and store reopening.

References: Diagnosis, Final egress.

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 1358-denied-terminal-outcome, 2026-09-24T01:14:29.407Z.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1358). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #1358). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Plan for #1358

All three acceptance criteria are Path B (regression on shipped egress behavior). The final SEM-233 decision will classify the prepared operation before its existing atomic participant-transition commit.

1. Extend implementations/python/tests/test_issue_1003_final_sink_flow_enforcement.py with failing egress regressions. For every non-permit class, assert the caller receives no view, the persisted status is FAILED with the sink-denial and canonical terminal diagnostics, the denied audit is tied to that operation, earlier crossing decision history remains, no delivery/observation fact appears, and the stored result payload is absent. Add same-key retrieval and local-store reopen checks. Exercise the incumbent-claim readback path so a denied incumbent cannot release a candidate payload. Cover the existing effect owner outcome mapping from a failed operation. Keep opacity coverage targeted to its existing invariant.
2. In implementations/python/packages/raes_runtime/participant_crossing_egress.py, reuse flow_sink_denied_record() at the final refusal and keep commit_prepared_crossing() as the sole claim and atomic commit path. Preserve the immutable accepted receipt, earlier API-423 crossing history, expected heads, bounded flow audit details, and value-free PermissionError. Check an incumbent's terminal status before reading its result payload at both replay points.
3. Keep the preflight decision note docs/decisions/issue-1358-denied-egress-outcome-preflight.md and update the participant-control explanation only if the implementation exposes a documentation gap. Map each criterion to code and tests, then run explicit affected pytest cases and narrow lint/format checks. Set RAES_REQUIREMENT_UID=ISSUE-1358 for local gate commands on this issue branch. The mandatory pre-publish hook, review, hosted CI, and SonarCloud gates follow in the workflow.

Security: retain identity/audience authorization, API-423 history validation, exact-cut SEM-233 validation, strict store codecs, bounded audit fields, and redacted error envelopes. Maintainability: build on the existing denial-record and commit helpers; no new operation state, store, or serializer. Extensibility: final classification stays at the prepared-crossing sink boundary and applies to each governed view without view- or backend-specific branches. Whole-repo surfaces: runtime retrieval, operation lifecycle, store/idempotency, effect-outcome mapping, public participant-control guidance, and repository policy; no schema or configuration changes.

[Brad-Edwards]

gc_codex_review — sanitized deferred publication for issue #1358, cycle 1 of 1
Reviewed revision: c7a6a2e0ad25e3fc7b3466b8f8f21e91ccf1f22c2f259302ccf9776cd948c9c6

Architectural read

The final sink refusal now classifies the prepared crossing as FAILED before the existing atomic commit. Earlier crossing history and the admission receipt remain intact. Both replay paths require a successful status before payload release. Targeted regressions cover denial classes, readback, reopening, and commit failure; review found no actionable defects.

Verdict: ship

Findings

• (none)

[Brad-Edwards]

gc_codex_review pre-push cycle 1 of 1 complete for issue #1358 on branch '1358-denied-terminal-outcome'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.

[Brad-Edwards]

Review decision record — codex cycle 1 (issue #1358)

Reviewer: codex
Cycle: 1
Verdict: ship

Architectural read:

The final sink refusal now classifies the prepared crossing as FAILED before the existing atomic commit. Earlier crossing history and the admission receipt remain intact. Both replay paths require a successful status before payload release. Targeted regressions cover denial classes, readback, reopening, and commit failure; review found no actionable defects.

Blocking findings: 0 (clean run)

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at b00aba06389ab75ffac3b3bdbd026a0dbecac487
• Outcome: already_current
• Published feature head: c54060dd591f4c09dda49be7a5b04fde83efe02e
• Synchronized tree: 3148464823a9e1afb5bafe8ef3e56f75a029764e