Repository navigation
Command queue: honour caller cancellation until a step starts, then wait for it #88
Closed as not planned
Description
Problem
Queue.DoCommitted treats a step as committed once it is queued, not once it starts. A caller cancelled while its step waits behind another still has that step run. For ProjectOps.RotateToken, an HTTP client that disconnects while queued gets its old token revoked, and the new token goes to a dead connection. Under Do the step was skipped.
Fix
Add a queue mode that returns ctx.Err() and skips the step if the caller cancels before the step starts, and waits for it once it has started. Use it for the ops that return a secret.
Accepted for now during #85: a lost rotation is loud and recoverable, because the operator rotates again.
Activity
barelyworkingcode commentedon Sep 26, 2026
Folded in from the #87 review: the same class covers a secret minted for a client that has gone away. With
runCommitted,CredentialOps.MintandLoginOps.MintBootstrap, likeProjectOps.RotateToken, still commit when the door's context is cancelled because the client disconnected. The plaintext then comes back to a handler that has no one to deliver it to. The cancel-until-started mode helps only while the step is still waiting in the queue. Once it has started, the door needs to notice the dead connection and revoke what it minted, or accept the loss. The loss is loud: the operator mints again.barelyworkingcode commentedon Sep 26, 2026
Parked by the owner on 2026-09-26: the stability pass is refocused on reproduced bugs only. It stays open for a later pass.
barelyworkingcode commentedon Sep 26, 2026
Closing as won't fix. The owner previously accepted this as a trade-off, and it touches token minting. Reopen if you disagree.