Struct RateLimitedAuditSink 

pub struct RateLimitedAuditSink { /* private fields */ }

Wraps any AuditSink with any RateLimiter.

On every AuditSink::record_failure call:

1. Compute event.rate_limit_key() (Phase 9 design call (e): compound client_id_hint ‖ kid_hint).
2. Consult the limiter: if admitted, forward to inner sink.
3. If denied, increment dropped_total and silently drop the event.

The verify hot path NEVER blocks on rate-limit denial — the dropped event simply never reaches the inner sink.

Ops observation pattern (per refinement #1 audit): hold an Arc<RateLimitedAuditSink> outside the verifier wiring, then coerce a clone to Arc<dyn AuditSink> for the verifier:

use std::sync::Arc;
use pas_external::{
    AuditSink, MemoryRateLimiter, RateLimitedAuditSink, RateLimiter,
};
let limited = Arc::new(RateLimitedAuditSink::new(
    real_sink,
    Arc::new(MemoryRateLimiter::default()),
));
let dropped_handle = Arc::clone(&limited);
let verifier = verifier.with_audit(limited as Arc<dyn AuditSink>);
// Later, in a health probe:
let _ = dropped_handle.dropped_total();

Implementations

impl RateLimitedAuditSink

pub fn new( inner: Arc<dyn AuditSink>, limiter: Arc<dyn RateLimiter>, ) -> RateLimitedAuditSink

Compose an inner sink with a limiter.

pub fn dropped_total(&self) -> u64

Total events dropped due to rate-limit denial since construction.

Useful for ops dashboards / health probes that want to detect “we’re suppressing audit signal because of upstream pressure.” Relaxed ordering — the counter is monotonic and readers don’t need cross-thread happens-before guarantees against audit emissions.

Trait Implementations

impl AuditSink for RateLimitedAuditSink

fn record_failure<'life0, 'async_trait>( &'life0 self, event: AuditEvent, ) -> Pin<Box<dyn Future<Output = ()> + Send + 'async_trait>>

where 'life0: 'async_trait, RateLimitedAuditSink: 'async_trait,

impl Debug for RateLimitedAuditSink

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.