From 8f7422166fcb9afdf41661afbc25539110839afc Mon Sep 17 00:00:00 2001 From: nickyleach <331803+nickyleach@users.noreply.github.com> Date: Thu, 10 Sep 2026 15:10:41 +0000 Subject: [PATCH] docs(server): correct the reviewer-projection claim in the recovery comment The comment said no code reads responsibleUserId on a queued row. A run-ledger projection does read it with no status filter, so a queued recovery run can show a null responsible user in that display. The projection makes no authorization decision, so the null value is still safe to keep. Co-authored-by: Paperclip --- server/src/modules/wake-queue/adapters/postgres.ts | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/server/src/modules/wake-queue/adapters/postgres.ts b/server/src/modules/wake-queue/adapters/postgres.ts index 61f1d5a33a..fe729816fa 100644 --- a/server/src/modules/wake-queue/adapters/postgres.ts +++ b/server/src/modules/wake-queue/adapters/postgres.ts @@ -456,10 +456,16 @@ function buildTransaction(tx: Db, deps: WakeQueuePostgresAdapterDeps): WakeQueue // This insert does not set responsibleUserId. claimQueuedRun resolves the // responsible user and writes it in the same update that moves the run // from "queued" to "running", and initializeRunIdentity then overwrites - // it again from the run identity chain. No code reads responsibleUserId - // on a queued row. Resolving the responsible user here, like the other - // recovery writers do, would add a throw inside this release transaction - // — on the one path whose job is to un-stick a stalled review. + // it again from the run identity chain. The row therefore holds a null + // responsible user only while the run is queued. One reader can observe + // that null: runsForIssue projects the column with no status filter, so + // the issue run ledger can show a queued recovery run with no responsible + // user. That projection displays attribution and makes no authorization + // decision. Every authorization and audit read keys on a running or an + // authenticated run instead. Resolving the responsible user here, like + // the other recovery writers do, would add a throw inside this release + // transaction — on the one path whose job is to un-stick a stalled + // review. const queuedRun = await tx .insert(heartbeatRuns) .values({