Repository navigation
Interim hard-reject of accept_data_loss=true rollbacks #104
Description
Question
Ship the interim fail-closed fix for audit finding #2 (critical): reject every Request::Rollback with accept_data_loss = true at the top of crates/agenticd/src/rollback/mod.rs::execute, before any side effects, with a typed error. This is exactly ADR-0014 Decision 4's no-key-configured semantics, shipped ahead of the full gate — the full ADR-0014 implementation ticket supersedes it.
Scope:
- Gate check first in the handler, before object-store or Postgres work (evidence:
crates/agenticd/src/rollback/mod.rs:54,crates/agenticd/src/migrate.rs:106). - Regression test:
accept_data_loss=truerequest is rejected with the typed error and causes no side effects. - Verify (don't assume) that the broken-prompt demo path never exercises destructive rollback — ADR-0014 Decision 4 asserts it doesn't.
Resolution records: PR link, test names, demo-path verification result.
Activity
tonibergholm commentedon Jul 9, 2026
Resolution
Shipped as PR #114 (pending Toni's review/merge per the map's PR gate).
What landed: the ADR-0014 Decision 4 fail-closed branch as the entire interim gate — every
accept_data_loss=truerollback is rejected at the top ofrollback::execute, before any side effects, dry-run included. TypedApprovalError::KeyNotConfigured, wire-classified as non-retryableValidationwith codeapproval_key_not_configured(a typed downcast arm inwire_error.rs, not a string-sniff; the code is shared with the full gate so alert rules survive the upgrade). Rejections emit the ADR's Decision 5 audit warn line (decision = "rejected_no_key_configured") so probing is operator-visible.Tests:
rollback_rejects_accept_data_loss_before_side_effects(in-memory end-to-end: typed rejection; schema, memory rows, branch tip untouched; dry-run doesn't bypass) andapproval_key_not_configured_classifies_as_non_retryable_validation(wire classification). Full workspace tests, clippy-D warnings, and fmt green.Demo-path verification (was an assumption to check): confirmed —
run-demo.shinvokes plainagentic rollback baseline --yes, never--accept-data-loss, so no legitimate demo path is blocked. Matches ADR-0014 Decision 4's rationale.Facts later tickets depend on: the full gate (#111, now unblocked) turns the unconditional reject into the no-key branch of token verification;
migrate::load_stepsbypass mechanics are untouched and still covered by the ignored AC3c Postgres test.Reject accept_data_loss rollbacks until the ADR-0014 approval gate sh…