PREWAVE-BE-107 — Persist Analytics Consent and Enforce Withdrawals Across Instances #808

Problem context

AnalyticsConsentService stores grant, withdrawal, policy version, and do-not-track state only in a process-local Map. Consent therefore resets after restart and differs between API replicas. This can cause optional analytics to be collected after a user has withdrawn consent or before a new policy version has been accepted.

Technical scope

Persist consent records with subject ID, policy version, status, grant/withdraw timestamps, do-not-track state, and subject-rotation/deletion history as required by the privacy policy. Ensure every analytics collection path checks the durable current record and policy version. Make withdrawal and wallet/subject rotation atomic and immediately visible across instances. Operational Prometheus telemetry must remain separate from optional user analytics consent.

Required tests

• Grant, renew, withdraw, do-not-track, rotate, and delete survive restart.
• Withdrawal and subject rotation propagate across replicas before further optional analytics collection.
• New policy version invalidates stale consent until renewed.
• Concurrent grant/withdraw requests have deterministic outcomes.
• Deletion and retention behavior is verified without leaking subject identifiers.

Security and architecture constraints

• Durable state must be consistent across restarts and replicas where the feature is user-, privacy-, security-, or operations-critical.
• Fail closed when persistence, authorization, policy version, or source provenance cannot be verified.
• Keep protocol authority in canonical contracts and finalized event projections.
• Protect contact details, consent records, subject identifiers, capabilities, and audit metadata.
• Do not create new protocol mutation authority in API services.

Acceptance criteria

• The process-local-only behavior is replaced by a durable/shared implementation where required.
• Ownership, role, and privacy boundaries are enforced.
• Concurrency, restart, retention, and failure behavior are covered by automated tests.
• Documentation describes the persistence and operational model.
• Exact-head required CI passes and independent review is recorded.

Dependencies

• Existing analytics consent policy/version definitions remain authoritative.

Non-goals

Disabling operational metrics or changing the analytics policy itself.

Complexity and points

• Medium — 150 points

Candidate only. Activation remains maintainer-controlled; do not apply Stellar Wave as part of implementation.