[cursor]

Problem

POST /v1/advise/gate registered with InFlightRegistry so admin disable, token rotate, server drain, and POST /v1/requests/:id/cancel can abort the provider call. After run_advisor_gate returned, the handler lumped sticky/hard cancel and tenant revoke into one HTTP 401 {"error":"missing or invalid bearer token"}.

Orchestrate already splits those (docs/concepts/authentication.md): tenant disable/rotate stay 401 so clients cannot enumerate revoked tenants; caller cancel is the cancelled taxonomy. On advise/gate, a drain or explicit cancel looked like a bad bearer, so an external loop could drop a still-valid token.

Fix

advisor_gate_http_abort maps post-call state:

• tenant not alive → 401 missing or invalid bearer token (revoke wins when both are true)
• cancelled while the tenant is still alive → 409 request cancelled
• otherwise return the gate verdict

Docs list the new 409. Public API: callers that treated every advise-gate failure as auth should handle 409 as cancel; 401 meaning is unchanged.

Tests

unit_advisor_gate — alive/success, revoke, cancel, and revoke+cancel (401 wins). Suite 20/20 locally (+ ASan). arbiter compiles.

Independently mergeable against main (0456350). merge-tree vs #321–#346: src/api_server.cpp auto-merges; only CHANGELOG [Unreleased] sibling-conflicts after the first of those merges.

  

---

Note

Low Risk
Narrow HTTP semantics change on a beta endpoint; 401 auth meaning is unchanged, but clients that treated all non-200 advise-gate responses as invalid tokens should treat 409 as cancel/retry.

Overview
POST /v1/advise/gate no longer treats server drain or POST /v1/requests/:id/cancel as auth failure. After run_advisor_gate completes, post-call abort handling uses advisor_gate_http_abort: disabled/revoked tenant still gets 401 "missing or invalid bearer token" (revoke wins when cancel and revoke both apply); cancel while the tenant is still valid returns 409 "request cancelled".

Docs and changelog document the new 409. Unit tests cover success, revoke, cancel, and revoke+cancel precedence.

^{Reviewed by Cursor Bugbot for commit 85e1118. Bugbot is set up for automated code reviews on this repo. Configure here.}