Rate Limit + Abuse Controls

Build rate-limit middleware with tenant policies, response metadata, and an audit trail.

Requirements

1. 01Enforce an explicit limit and window policy independently for each tenant and policy key.
2. 02Make allowance decisions atomic under concurrent requests and define the exact window-boundary rule.
3. 03Return limit, remaining, reset, and retry-after metadata with stable units and rejected responses.
4. 04Record an audit decision without storing raw secrets or allowing audit failure to bypass enforcement.
5. 05Recover capacity at the documented reset boundary without leaking usage between tenants.

Constraints

• • Submit one compact engineering spec, not implementation code.
• • The generated artifact must use the declared HTTP service adapter.
• • Scoring rewards observable behavior and prompt efficiency, not runtime.