An automated review of #1189 flagged that review task grants are not invalidated when their template retires. activate_task_templates in crates/registry-casework/src/task_grants.rs sweeps live casework_task_grants whose template is no longer active and invalidates them transactionally, but has no equivalent sweep for casework_review_task_grants. Review grants are only invalidated lazily, by active_review_task when the template lookup fails at use time.
Failure scenario: an operator removes a review task template and reintroduces the same immutable version within a live grant's 15-minute expiry window. While the template is absent the deployment refuses assertions, but after reintroduction the exact-template lookup succeeds again, invalidated_at was never set, and the pre-existing grant can mint assertions without a new human approval.
Suggested fix:
- Invalidate live
casework_review_task_grants in the same transaction as the ordinary grant sweep, with an equivalent invalidation reason.
- Add a Postgres test that retires and reintroduces the same template version and asserts the earlier review grant is refused.
Filed from the review of #1189; not merge-blocking under the current no-adopter policy.
An automated review of #1189 flagged that review task grants are not invalidated when their template retires.
activate_task_templatesincrates/registry-casework/src/task_grants.rssweeps livecasework_task_grantswhose template is no longer active and invalidates them transactionally, but has no equivalent sweep forcasework_review_task_grants. Review grants are only invalidated lazily, byactive_review_taskwhen the template lookup fails at use time.Failure scenario: an operator removes a review task template and reintroduces the same immutable version within a live grant's 15-minute expiry window. While the template is absent the deployment refuses assertions, but after reintroduction the exact-template lookup succeeds again,
invalidated_atwas never set, and the pre-existing grant can mint assertions without a new human approval.Suggested fix:
casework_review_task_grantsin the same transaction as the ordinary grant sweep, with an equivalent invalidation reason.Filed from the review of #1189; not merge-blocking under the current no-adopter policy.