[cristim]

Refs #532. Slice 1 of 4 (plan: #532 (comment)).

What changed

• ApproveAndExecute returns the row (like RunPlannedPurchaseNow), so handlers can tell a lost claim from a failure after the claim.
• New Manager.DirectExecute: same funnel, stamps executed_at/executed_by_user_id/pre_approval_skip_reason only once the CAS is won. The handler no longer saves them before the claim.
• runNowError is now executeFailureError(executionID, action, final, err), shared by run-now, session approve and direct execute.
• openapi.yaml: 502 added to approve (session mode) and execute (direct mode); approve 409 text no longer lists execution failure.

Mapping (same as run-now)

error	status
four-eyes denial	403 (was 409 on approve and direct execute)
lost claim, row gone (no row returned)	409
other error before the claim	500 (was 409)
audit loss after the claim	500
any other failure after the claim, including partially_completed	502 with execution_id and the row's status (was 409)

Decisions for the owner

• A partially_completed run answers 502 (follows run-now), not 200. Slice 2 adds the revocation token and email for it.
• Out of scope: sec(purchase): constraint checks read recs before the CAS; execution buys from the post-CAS row (TOCTOU) #415 (post-CAS constraint re-check), token-mode ApproveExecution (slice 3), the approved-row claim race (slice 4).

Proof

Before: handler_purchases.go:851 and :3179 returned 409 for every error, and :3158 stamped ExecutedAt before the claim. The new tests fail when executeFailureError is mutated to answer 409 for the post-claim case (verified), and the DirectExecute stamp test fails when the skip reason is removed (verified). The existing 4-eyes direct-execute tests (real manager) were asserting the old 409 and now assert 403 and that no save carries ExecutedAt.

• go test -race -short ./..., go vet ./..., go vet -tags integration ./internal/...: pass. OpenAPI tests pass. errcheck -blank, shadow, unparam, gocritic, misspell: nothing new in changed lines.
• Not run locally: testcontainers tests (Docker hangs on this host); CI covers them.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 15 billable files and costs up to $3.75.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 6 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 69 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 6db14457-75cc-4546-856e-7911d1e9e1ff

📥 Commits

Reviewing files that changed from the base of the PR and between e96f5ae and 5780b34.

📒 Files selected for processing (15)

• internal/api/executed_notification_flow_test.go
• internal/api/execution_scope_test.go
• internal/api/handler_purchases.go
• internal/api/handler_purchases_test.go
• internal/api/middleware_test.go
• internal/api/mocks_test.go
• internal/api/openapi.yaml
• internal/api/purchase_pricing_test.go
• internal/api/session_denial_final_test.go
• internal/api/types.go
• internal/purchase/approvals.go
• internal/purchase/approvals_test.go
• internal/purchase/armed_redrive_test.go
• internal/server/interfaces.go
• internal/testutil/mocks.go

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}