mirror of
https://github.com/block/buzz.git
synced 2026-10-27 12:40:30 +00:00
bba75a71eb
## Why Owner deletion admission stops at `submitted`. Manual inventory and approval still stand between owner intent and the existing deletion executor, preventing self-serve deletion. ## What The existing `buzz-admin deletions drain` process prepares and automatically approves operator-attested owner requests. Operator-origin requests retain manual approval. ## How The drain prioritizes approved work, then claims one owner submission with the existing generation lease. It freezes inventory and records digest-bound `owner_automatic` approval in one transaction before entering the unchanged executor. Before approval, the transaction rechecks archived state and current ownership. It locks the deletion advisory fence, community, owner memberships, and request in that order. A regression test pins privileged abort during a live preparation lease. What got simpler: one drain still owns preparation and execution. There is no second worker, queue, lifecycle, or retry authority. The rebased branch contains only this feature and its review fixes. ## Risk Automatic approval permits irreversible deletion without a human grace period. Operator attestation is not a cryptographic owner signature. Provenance, locked authority checks, generation fences, and digest-bound approval constrain the operation. This remains work in progress. Broad test failures and incomplete mobile checks are disclosed below; publication is not a merge-ready verdict. ## Testing Published head: `e059ae9056b447ca3b5d0c2893da86550ef16f5c`. All seven commit trees match tested source `5605f27eaece1e809f746cc1839b55c7ceef8d80`; only attribution metadata changed. Source-SHA results below are not new-head execution receipts. At source commit `5605f27eaece1e809f746cc1839b55c7ceef8d80`, isolated PostgreSQL tests showed stale archive and ownership fixtures fail closed after the fix. Before the fix both reached automatic approval. Removing abort's generation increment or stage transition made the new live-lease regression fail; restored production passed. `just test` failed in two ACP native-git fixtures and one agent body-timeout test. The failing source files match the pinned base, but there is no exact-base execution comparison proving those failures unrelated. `just test-unit` also failed in the ACP fixtures, leaving 18 tests unrun. `just ci` stopped in Flutter tooling package resolution; separately run non-mobile lanes do not constitute a full `just ci` pass. No live tenant deletion or human testing was performed. A dedicated populated `0052` → `0053` approval-backfill fixture remains a coverage gap. Final-head hosted CI and security review are required. ## Bigger picture Rebased directly onto main `12670bd0f037c66a682272bb81c46c3f254fad74`; prerequisite #7818/#7827 are already merged. Main owns `0052_channel_artifacts`, so this feature's automatic-approval migration is now `0053`. Client/KGoose and quota work are separate PRs and are not part of this diff. Generated with Codex --------- Signed-off-by: Codex <noreply@openai.com> Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
23 lines
1020 B
SQL
23 lines
1020 B
SQL
-- Owner-origin deletion requests may be prepared automatically by the
|
|
-- privileged one-shot deletion drain. Manual approvals retain operator
|
|
-- provenance and the existing exact inventory-digest foreign key.
|
|
SET LOCAL lock_timeout = '5s';
|
|
|
|
ALTER TABLE community_deletion_approvals
|
|
ADD COLUMN approval_origin TEXT NOT NULL DEFAULT 'operator'
|
|
CHECK (approval_origin IN ('operator', 'owner_automatic'));
|
|
|
|
ALTER TABLE community_deletion_requests
|
|
DROP CONSTRAINT community_deletion_requests_retry_stage_check,
|
|
ADD CONSTRAINT community_deletion_requests_retry_stage_check
|
|
CHECK (retry_stage IS NULL OR retry_stage IN (
|
|
'submitted', 'approved', 'fenced', 'drained', 'bindings_removed',
|
|
'postgres_purged', 'cache_purged', 'logically_verified'
|
|
));
|
|
|
|
CREATE INDEX community_deletion_requests_owner_preparable
|
|
ON community_deletion_requests (next_attempt_at, created_at)
|
|
WHERE request_origin = 'owner'
|
|
AND stage = 'submitted'
|
|
AND blocked_at IS NULL;
|