broker: remove dead IdempotencyStore (post-issue-#72)

crates/agentkeys-broker-server/src/boot.rs

@@ -29,9 +29,7 @@ use crate::jwt::SessionKeypair;
 use crate::oidc::OidcKeypair;
 use crate::plugins::audit::{AuditAnchor, AuditPolicy};
 use crate::plugins::PluginRegistry;
-use crate::storage::{
-    AuthNonceStore, GrantStore, IdempotencyStore, IdentityLinkStore, WalletStore,
-};
+use crate::storage::{AuthNonceStore, GrantStore, IdentityLinkStore, WalletStore};
 
 /// Outcome of the synchronous Tier-1 boot phase.
 pub struct BootArtifacts {
@@ -43,7 +41,6 @@ pub struct BootArtifacts {
     pub nonce_store: Arc<AuthNonceStore>,
     pub grant_store: Arc<GrantStore>,
     pub identity_link_store: Arc<IdentityLinkStore>,
-    pub idempotency_store: Arc<IdempotencyStore>,
     /// Concrete EmailLink plugin handle (Phase A.1, US-018). Populated
     /// when `email_link` is in `BROKER_AUTH_METHODS` AND the
     /// `auth-email-link` feature is compiled in. The registry's auth
@@ -186,16 +183,6 @@ pub fn run_tier1(config: &BrokerConfig) -> anyhow::Result<BootArtifacts> {
             )
         })?,
     );
-    let idempotency_store = Arc::new(IdempotencyStore::open(&idempotency_path(config)).map_err(
-        |e| {
-            boot_fail(
-                env::BROKER_AUDIT_DB_PATH,
-                &config.audit_db_path.display().to_string(),
-                format!("IdempotencyStore: {}", e),
-                "idempotency-db",
-            )
-        },
-    )?);
 
     // 5. Validate + parse plugin selection env vars. Every name in each
     //    list must resolve at compile time (i.e. the corresponding
@@ -238,7 +225,6 @@ pub fn run_tier1(config: &BrokerConfig) -> anyhow::Result<BootArtifacts> {
         nonce_store,
         grant_store,
         identity_link_store,
-        idempotency_store,
         #[cfg(feature = "auth-email-link")]
         email_link: built.email_link,
         #[cfg(feature = "auth-oauth2")]
@@ -314,14 +300,6 @@ fn identity_links_path(config: &BrokerConfig) -> std::path::PathBuf {
         .unwrap_or_else(|| std::path::PathBuf::from("identity_links.sqlite"))
 }
 
-fn idempotency_path(config: &BrokerConfig) -> std::path::PathBuf {
-    config
-        .audit_db_path
-        .parent()
-        .map(|p| p.join("idempotency.sqlite"))
-        .unwrap_or_else(|| std::path::PathBuf::from("idempotency.sqlite"))
-}
-
 #[cfg(feature = "audit-sqlite")]
 fn open_sqlite_anchor(config: &BrokerConfig) -> Result<Arc<dyn AuditAnchor>, anyhow::Error> {
     use crate::plugins::audit::sqlite::SqliteAnchor;

crates/agentkeys-broker-server/src/main.rs

@@ -177,7 +177,6 @@ async fn main() -> anyhow::Result<()> {
         nonce_store: boot_artifacts.nonce_store,
         grant_store: boot_artifacts.grant_store,
         identity_link_store: boot_artifacts.identity_link_store,
-        idempotency_store: boot_artifacts.idempotency_store,
         metrics: Arc::new(agentkeys_broker_server::metrics::Metrics::new()),
         tier2: Arc::clone(&tier2),
         #[cfg(feature = "auth-email-link")]

crates/agentkeys-broker-server/src/metrics.rs

@@ -22,8 +22,6 @@ pub struct Metrics {
     pub auth_failed_unauthorized: AtomicU64,
     pub auth_failed_rate_limited: AtomicU64,
     pub auth_failed_other: AtomicU64,
-    pub idempotency_hits: AtomicU64,
-    pub idempotency_conflicts: AtomicU64,
 }
 
 impl Metrics {
@@ -74,16 +72,6 @@ impl Metrics {
                 &self.auth_failed_other,
                 "Auth attempts that failed with any other 4xx/5xx.",
             ),
-            (
-                "agentkeys_broker_idempotency_hits_total",
-                &self.idempotency_hits,
-                "Idempotency-Key replays served from cache.",
-            ),
-            (
-                "agentkeys_broker_idempotency_conflicts_total",
-                &self.idempotency_conflicts,
-                "Idempotency-Key requests with mismatched body hash (422).",
-            ),
         ];
         for (name, counter, help) in pairs {
             use std::fmt::Write as _;
@@ -123,8 +111,8 @@ mod tests {
         let s = m.render_prometheus();
         let help_count = s.matches("# HELP").count();
         let type_count = s.matches("# TYPE").count();
-        assert_eq!(help_count, 10);
-        assert_eq!(type_count, 10);
+        assert_eq!(help_count, 8);
+        assert_eq!(type_count, 8);
     }
 
     #[test]

crates/agentkeys-broker-server/src/state.rs

@@ -7,9 +7,7 @@ use crate::metrics::Metrics;
 use crate::oidc::OidcKeypair;
 use crate::plugins::audit::AuditPolicy;
 use crate::plugins::PluginRegistry;
-use crate::storage::{
-    AuthNonceStore, GrantStore, IdempotencyStore, IdentityLinkStore, WalletStore,
-};
+use crate::storage::{AuthNonceStore, GrantStore, IdentityLinkStore, WalletStore};
 use crate::sts::StsClient;
 
 /// Tier-2 reachability state shared with the /readyz handler.
@@ -50,11 +48,6 @@ pub struct AppState {
     /// OmniAccount. Recovery flow consults this to find which master
     /// should sign the recovery grant.
     pub identity_link_store: Arc<IdentityLinkStore>,
-    /// Idempotency-Key dedup (Phase D-rest, US-037). Originally consumed
-    /// by mint_v2; after PR #96 (issue #72) the only consumer is gone,
-    /// so this field is currently unread by any live handler. Slated for
-    /// removal — see follow-up task "Remove dead IdempotencyStore code".
-    pub idempotency_store: Arc<IdempotencyStore>,
     /// Atomic counters surfaced via /metrics (Phase D-rest, US-036).
     pub metrics: Arc<Metrics>,
     pub tier2: Arc<Tier2State>,

crates/agentkeys-broker-server/src/storage/mod.rs

@@ -15,7 +15,6 @@ pub mod email_rate_limits;
 #[cfg(feature = "auth-email-link")]
 pub mod email_tokens;
 pub mod grants;
-pub mod idempotency;
 pub mod identity_links;
 #[cfg(feature = "auth-oauth2")]
 pub mod oauth_pending;
@@ -29,7 +28,6 @@ pub use email_rate_limits::{EmailRateLimitStore, RateLimitOutcome};
 #[cfg(feature = "auth-email-link")]
 pub use email_tokens::{EmailConsumeOutcome, EmailRequestStatus, EmailTokenStore};
 pub use grants::{Grant, GrantConsumeOutcome, GrantStore};
-pub use idempotency::{IdempotencyOutcome, IdempotencyStore};
 pub use identity_links::{IdentityLink, IdentityLinkStore};
 #[cfg(feature = "auth-oauth2")]
 pub use oauth_pending::{OAuth2PendingConsume, OAuth2PendingStatus, OAuth2PendingStore};