AIKIDO-2026-10393

TL;DR

The Check reducers (union, intersection, exclusion) in internal/graph/check.go did not check for an already-cancelled parent context before creating goroutines and enqueueing work. When the request context was cancelled before a reducer ran, the reducers could still spawn nested handlers, leading to a race: the Check API could non-deterministically return "Request Cancelled" (or an error) instead of the correct allow/deny. The observed impact is that authorized users may be wrongly denied or receive an error when they should have been allowed; the race does not cause the engine to allow an unauthorized user. The fix adds an early ctx.Err() != nil guard at the entry of each reducer, mirroring the existing guard in ResolveCheck, so cancelled contexts short-circuit before goroutine creation.