Retry and permission teaching examples
Synthetic, local examples. These are not servers or production security implementations. Download this entire folder, then open a terminal in it. Requires Python 3 with the standard-library sqlite3 module; no packages, credentials or network.
Run
python3 -B demo.py retries
python3 -B -m unittest -v test_retries
python3 -B demo.py permissions
python3 -B -m unittest -v test_permissions
Both test commands should exit 0. Denials and conflicts are expected outcomes asserted by passing tests, not commands that should fail. Each demo starts fresh synthetic state.
Retry example
Read the article, retries.py and test_retries.py.
The demo commits an edit, then raises a synthetic timeout. Exact replay returns the original receipt without another mutation. Changing the payload under the same ID is refused; a new ID with a stale version is also refused. The tests cover rollback if the receipt fails to save, stale-edit handling, input validation and the distinction between an old receipt and a later record state.
Limits: one actor, workspace and operation, in-memory database, no network or cross-process concurrency test, no external side effects, no receipt-expiry policy. SQLite transactions demonstrate atomic edit/receipt storage within this process; this does not prove another database or distributed service behaves identically. Request-ID validation is a string-format check, not a claim about UUID randomness. A real caller should generate appropriately unique IDs using its platform's supported facility.
Permission example
Read the article, permissions.py and test_permissions.py.
The registry holds a reader and writer for alpha, and a reader for beta. It allows the intended reads/writes and rejects writes by readers, wrong-workspace operations, unknown connections and unknown operations. Tests check unchanged state after denials and ensure editing a returned identity does not edit the registry.
Limits: fixture connection names are not credentials, authentication is assumed, and the process operator can choose another fixture or alter the registry. This is an authorization teaching model, not a sandbox or secure deployment. There is no model, OAuth exchange, HTTP layer, expiry, revocation, logging service or prompt-injection defense under test.
Do not run a negative test against a production record hoping that it will be denied. Use synthetic data in an environment you own, with explicitly authorized test connections.