BobSong-dev opened a new issue, #7956: URL: https://github.com/apache/shenyu/issues/7956
## Background P1-12 in the mentor-approved OSPP plan; parent #7949. MCP quotas and LLM budgets need the same explainable shadow/enforce decision semantics, rather than incompatible local switches. ## Existing capabilities and reuse Reuse trusted request context, P1-05 bounded metrics and P1-06 audit records. Reuse existing Redis/limiter primitives in the later execution integrations. #7933 is HTTP shadow traffic replay/comparison and is unrelated to this non-executing policy evaluation mode. ## Implementation scope - Define a versioned decision contract with policy/configuration version, mode, allow/would-deny/deny result, bounded reason codes, correlation and effective time. - Shadow mode must not reject otherwise permitted requests or debit real quotas. Use an isolated bounded shadow ledger/counters for continuous evaluation, while recording actual observed usage normally. - Enforce mode acts at the real admission/settlement points in P1-13/P1-14. Define mode transitions, in-flight reservations, expiry and comparison semantics without moving or double-debiting state between ledgers. - Authentication, authorization and fundamental resource protection always remain enforced independently of policy shadow mode. ## Non-goals Duplicating audit/metrics implementations, bypassing security in shadow mode, traffic mirroring, or claiming a contract-only implementation completes P1-13/P1-14 integration. ## Acceptance criteria - [ ] A common decision schema/reason vocabulary is consumed by metrics and audit; bounded labels exclude tenant/trace IDs as unbounded dimensions. - [ ] Shadow evaluation preserves normal routing and production quota state, yet evaluates repeated calls against evolving isolated state. - [ ] Mode changes and in-flight work have deterministic, documented semantics without double accounting or lost reservations. - [ ] Security/resource rejections remain effective in both modes. - [ ] Executable contract tests are supplied for both MCP quota and LLM budget consumers; real execution integrations are tracked by their respective issues. ## Tests Contract and state-transition tests, concurrent shadow/enforce isolation, configuration updates and stale policy versions; audit/metric correlation tests; failure/expiry/cancellation cases and tests proving authentication/authorization/resource limits cannot be bypassed. ## Dependencies P0-03, P1-05 and P1-06. Define this contract before P1-13/P1-14; those tasks must ship actual shadow/enforce integration with their first release. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
