ADR 0004: Auth outbox and streams-only runtime

Status

Accepted. Relay ownership moved to ADR 0006. The outbox table and streams-only consume path remain in force.

Context

Phase 2 still let publishers talk to Redis directly. A commit could succeed and a publish could fail, and each service was growing its own relay.

Decision

1. Auth writes integration events to auth.event_outbox in the business transaction.
2. A relay publishes those rows to Redis Streams. The relay process is now outbox-relay-service, not an in-auth scheduler.
3. Downstream uses stream listeners and consumer groups only.
4. SHARED_EVENTS_TRANSPORT=STREAMS.

The outbox row carries event_id, route, type, aggregate, JSON envelope, pending or published or failed, retry metadata, and timestamps.

Consequences

A committed user create cannot lose user-registered because Redis was down. Operators watch outbox lag instead of "did the publisher thread run". Pub/Sub is not the main path.

Rollback

Do not drop the outbox table. Pause the relay, fix the consumer, then replay pending or dead-letter rows. Idempotency is event_id.