Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- The Futex free tier shall meter decision creation against a TokenGate quota.
- When a freepass tenant is provisioned, Futex shall assign it the free-tier TokenGate plan.
- When a decision is created by a freepass tenant, Futex shall consume one unit of the metered resource before the decision is persisted.
- If the freepass tenant has exhausted its quota, then Futex shall refuse the decision with HTTP 429 naming the quota and its reset time.
- The Futex decision-creation path shall use the caller's idempotency key when consuming, so a retried request is not charged twice.
- Where a tenant is not a freepass tenant, Futex shall not call TokenGate on the decision path.
- If TokenGate answers that the quota is exceeded or that its backend refused, then Futex shall treat the decision as refused.
- If TokenGate cannot be reached at all, then Futex shall allow the decision and record an audit event identifying the unmetered call.

CONTEXT: Futex has NO usage metering of any kind. Freepass is a free tier in name only - keys are rate-limited per minute (300 API / 60 web) but have no cap on total usage, ever. Rate limits are also hand-rolled Redis counters (app/security/ratelimit.py:49, app/freepass/guards.py:212) against the standing house rule. This ticket covers the freepass quota; the rate-limiter migration is deliberately NOT in scope.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #103