Persist exact workflow revisions additively - #6960
Conversation
🔐 Codex Security Review
|
ca2c16c to
e191591
Compare
|
🤖 I’m Larry. The mixed-version rollout blocker is fixed at A column-targeted database trigger now clears Rebased onto main Exact-head Blox evidence: workstation Downloaded evidence: Not merge-cleared: restored draft status; fresh Royals review and GitHub CI are pending. The previous approval/green state does not establish this candidate’s clearance. The PR body’s anticipated automatic historical migration is not a delivery commitment: historical matching cannot establish provenance across the predecessor’s separate materialization/event commits. Legacy rows remain NULL until new signed ingest. |
|
🤖 I’m Larry. Fixed the Royals CI-gate finding at |
|
@buzz-security-review 53b92fc |
53b92fc to
8368014
Compare
|
🤖 I’m Larry. Rebased onto main The conflict came from #6987's runtime/store extraction. I kept its crate-root facade unchanged, applied the revision/transaction arguments to the relocated Exact-head Blox evidence on Correction to my previous status comment: Codex's stale-review notice is advisory, not one of main's required checks. Both manually authorized attempts timed out without a verdict; that is neither a security finding nor a mandatory merge blocker. The actual required |
Signed-off-by: Logan Johnson <loganj@squareup.com> Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Clear bindings at the database materialization boundary, even on equal-value legacy updates. Rebind inside atomic signed ingest while holding the row lock. Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com> Signed-off-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz>
Co-authored-by: Larry <8cf5a83f590ec0955b11647d1c88f796a98e088c30a492c58e0e46c3026ae7a4@buzz.block.builderlab.xyz> Signed-off-by: Logan Johnson <loganj@squareup.com>
8368014 to
bb7de1e
Compare
|
🤖 I’m Larry. Main advanced again while the previous candidate completed CI. Replacement head Main's push-message migration owns 0040; the unchanged workflow revision SQL is now 0041. Migration inventory assertions preserve both. No workflow behavior changed, and main's CI/Cargo.lock/schema changes remain intact. Exact-head Blox validation on workstation 2169747 passed: fresh migrations 0001–0041 in order; fresh pgschema bootstrap plus reconciliation; fmt; all-target DB/workflow/relay clippy; full package tests DB 114+2, workflow 169, relay 994+13; all 11 workflow PostgreSQL tests on both fresh databases; archive-selector 11/11. Evidence: |
|
🤖 I’m Larry. Ready for human review at Final-head GitHub checks are complete: 30 successful, 10 skipped, none pending or failing. CI run 33212873048 includes the permanent workflow PostgreSQL archive gate. The initial Desktop Smoke E2E (3) failure passed on an unchanged-head retry; both results are retained, without claiming a diagnosed cause. The exact-head Blox matrix and migration evidence are recorded above. PR copy now reflects migration 0041, mixed-version invalidation, nullable legacy provenance, and the retired historical-backfill proposal. No unresolved review threads remain; completed Royals behavior reviews and inspected integration deltas stand. No further engineering fix round is indicated. The PR remains draft and conflict-free. Human GitHub approval is still required; no merge or auto-merge was requested. The separate advisory Codex review has no current verdict and is not satisfied by the ordinary Security check. |
🤖 I’m Larry. This is the additive foundation for recording the exact signed workflow definition revision selected when a run begins.
Summary
Details
Workflow definitions are materialized into database rows today, but those rows do not retain the exact signed event that produced them. This change adds nullable, 32-byte revision IDs to definitions and runs so subsequent manual-trigger and agent-wake features can verify the owner-signed instructions selected for a run.
Signed-event persistence and workflow materialization commit in one transaction. A database trigger clears the workflow binding on every materialization update—including equal-value writes from older pods. New ingest rebinds within the same transaction while retaining the row lock, so readers cannot observe an intermediate binding. Operational status/enabled changes preserve it; existing runs retain their selected revision even when a later legacy write clears the workflow's binding.
Compatibility and scope
The permanent PostgreSQL CI gate covers legacy-write invalidation, atomic rebinding/visibility, row-lock exclusion, rollback, and retention of already-created run revisions.
Originating Buzz workstream:
buzz://message?channel=11ae68c1-38e7-4591-958e-e4da94d758f0&id=ee768d6e6f981d9450e2afc727a632d99d9480bbbe4399995332c5dd19e12c4c