mirror of
https://github.com/block/buzz.git
synced 2026-10-30 14:01:37 +00:00
6202549cf1
Review of node C found four places where the delivery lease boundary
was not actually fenced under realistic races. All four are on the
authority-decision path, so a stale or foreign caller could obtain or be
credited with authority it does not hold.
- finish_workflow_agent_delivery reconciled uncertain completion by
reading the current terminal state on (community, id) only. When a
lease expired, the reaper bumped the generation, and a newer holder
claimed and finished, the original holder's later finish correctly
missed the fenced UPDATE but then read the newer holder's terminal
and returned AlreadyTerminal -- laundering the newer holder's outcome
back to the stale caller. The reconciliation read is now fenced by
the caller's generation (finish never bumps it, so a genuine
idempotent retry still matches); a terminal at a different generation
is LeaseLost.
- renew and finish gated only on status='claimed' AND lease_generation,
never on lease_until. Between the deadline and the reaper winning, an
expired holder could renew (resurrect authority) or finish (settle
work performed outside its lease). Both mutations now also require
lease_until >= NOW(): a lease no longer depends on the janitor
running first to become invalid.
- claim_workflow_agent_delivery scoped the row lookup by the request
(community, target) arguments and bound every field of the expected
binding except the binding's own community and target. A foreign
expected binding could therefore authorize a row selected under a
different request scope. claim now rejects an expected binding whose
community or target disagrees with the request scope before any SQL.
- WorkflowDeliveryLease is a target-scoped capability (target_pubkey is
"the managed-agent recipient that holds the lease"), but renew, the
finish UPDATE, and the terminal reconciliation SELECT bound only
(community, id, generation) -- the target fence evaporated after
claim. A lease reconstituted with a foreign target but the right
delivery id and generation could renew, settle, or be credited a
terminal via AlreadyTerminal. All three now bind the lease's
target_pubkey, so wrong-target authority is unrepresentable at C's
owner boundary rather than a convention D/F must re-enforce.
Adds fresh-Postgres invariant tests for the exact stale-holder-vs-newer-
holder finish interleaving (same and conflicting outcomes), expired
renew/finish before reaping, community-only / target-only expected-
binding scope mismatch, and a wrong-target lease that fails closed on
renew, finish, and terminal retry while the real target succeeds. Still
dormant: no producer, runtime, API, or ACP reachability.
Co-authored-by: Mongo <89eda16aff8223982a0d928ccc850c50a22abc23babd9f890dc8d6d5431876fb@buzz.block.builderlab.xyz>
Signed-off-by: Logan Johnson <loganj@squareup.com>