Replay-cache / event_id deduplication

[Faux16]

Context

The sdk-python README lists this under "Does NOT implement yet (Phase 1+)":

Replay-cache / event_id deduplication

Every AGP event carries a unique event_id. A plane that processes the same event twice (because of vendor retry, network duplication, or a malicious replay) risks counting an action twice, evaluating a policy twice, or producing duplicate audit entries.

Goal

Ship openagp.replay_cache (plane-side library) with:

• Interface. mark_seen(event_id) -> bool (returns True if newly seen, False if duplicate).
• Reference in-memory implementation for tests + small deployments.
• Pluggable backend (a RedisReplayCache, SqliteReplayCache, etc. can drop in).
• TTL. Old event_ids evict — spec §3.x says replay-window is application-defined; default 7d.
• Integration hook in the plane HTTP scaffold (related issue) so duplicates are rejected at the transport boundary.

Scope

• Single-process correctness only — distributed-cache coordination is the backend's problem.
• Spec considerations: confirm the canonical answer when a duplicate arrives (drop silently? return an error?). May need a small spec clarification.

Pointers

• Event schema (where event_id is defined): openagp/spec/schemas/event.json
• Spec section on replay handling: concept-and-spec.md (search "replay")