cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [data-integrity] autonomy_guardrail_service.py load_from_metadata non-atomic — guardrails updated before audit trail, partial state on validation error #7504

New issue

Closed

opened 2026-04-10 20:52:10 +00:00 by HAL9000 · 3 comments

HAL9000 commented

2026-04-10 20:52:10 +00:00

Owner

Bug Report: Data Integrity — `AutonomyGuardrailService.load_from_metadata` Not Atomic

Severity Assessment

Impact: On validation error, guardrails dict updated while audit trail remains stale — inconsistent state between the two
Likelihood: Low-Medium — triggered by malformed metadata in the session store
Priority: High

Location

File: src/cleveragents/application/services/autonomy_guardrail_service.py
Function: AutonomyGuardrailService.load_from_metadata
Lines: ~344–367
Category: data-integrity

Description

The method updates _guardrails[plan_id] and _audit_trails[plan_id] in two separate steps inside a single lock. If the first write succeeds (guardrails updated) but the second raises ValidationError (malformed audit trail data), the lock is released with _guardrails updated but _audit_trails still stale. The two dicts are now inconsistent.

Evidence

with self._lock:
    if _GUARDRAILS_KEY in metadata:
        self._guardrails[plan_id] = AutonomyGuardrails.model_validate(raw_guardrails)
        # ↑ written to _guardrails — cannot be rolled back

    if _AUDIT_TRAIL_KEY in metadata:
        self._audit_trails[plan_id] = GuardrailAuditTrail.model_validate(raw_trail)
        # ↑ ValidationError here leaves _guardrails updated but _audit_trails stale

Expected Behavior

Both _guardrails and _audit_trails should be updated atomically — either both succeed or neither is applied.

Actual Behavior

A validation error on the audit trail leaves the guardrails updated but the audit trail stale, creating an inconsistency.

Suggested Fix

Validate both models before writing either:

with self._lock:
    # Validate first, then write
    new_guardrails = AutonomyGuardrails.model_validate(raw_guardrails) if _GUARDRAILS_KEY in metadata else None
    new_trail = GuardrailAuditTrail.model_validate(raw_trail) if _AUDIT_TRAIL_KEY in metadata else None
    # Both validated — now write atomically
    if new_guardrails is not None:
        self._guardrails[plan_id] = new_guardrails
    if new_trail is not None:
        self._audit_trails[plan_id] = new_trail

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_, and @tdd_expected_fail to prove the bug exists before fixing it.

Automated by CleverAgents Bot
Supervisor: Bug Detection Pool | Agent: bug-hunt-pool-supervisor

## Bug Report: Data Integrity — `AutonomyGuardrailService.load_from_metadata` Not Atomic ### Severity Assessment - **Impact**: On validation error, guardrails dict updated while audit trail remains stale — inconsistent state between the two - **Likelihood**: Low-Medium — triggered by malformed metadata in the session store - **Priority**: High ### Location - **File**: `src/cleveragents/application/services/autonomy_guardrail_service.py` - **Function**: `AutonomyGuardrailService.load_from_metadata` - **Lines**: ~344–367 - **Category**: data-integrity ### Description The method updates `_guardrails[plan_id]` and `_audit_trails[plan_id]` in two separate steps inside a single lock. If the first write succeeds (guardrails updated) but the second raises `ValidationError` (malformed audit trail data), the lock is released with `_guardrails` updated but `_audit_trails` still stale. The two dicts are now inconsistent. ### Evidence ```python with self._lock: if _GUARDRAILS_KEY in metadata: self._guardrails[plan_id] = AutonomyGuardrails.model_validate(raw_guardrails) # ↑ written to _guardrails — cannot be rolled back if _AUDIT_TRAIL_KEY in metadata: self._audit_trails[plan_id] = GuardrailAuditTrail.model_validate(raw_trail) # ↑ ValidationError here leaves _guardrails updated but _audit_trails stale ``` ### Expected Behavior Both `_guardrails` and `_audit_trails` should be updated atomically — either both succeed or neither is applied. ### Actual Behavior A validation error on the audit trail leaves the guardrails updated but the audit trail stale, creating an inconsistency. ### Suggested Fix Validate both models before writing either: ```python with self._lock: # Validate first, then write new_guardrails = AutonomyGuardrails.model_validate(raw_guardrails) if _GUARDRAILS_KEY in metadata else None new_trail = GuardrailAuditTrail.model_validate(raw_trail) if _AUDIT_TRAIL_KEY in metadata else None # Both validated — now write atomically if new_guardrails is not None: self._guardrails[plan_id] = new_guardrails if new_trail is not None: self._audit_trails[plan_id] = new_trail ``` ### Category data-integrity ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. The test will use tags: @tdd_issue, @tdd_issue_<this-issue-number>, and @tdd_expected_fail to prove the bug exists before fixing it. --- **Automated by CleverAgents Bot** Supervisor: Bug Detection Pool | Agent: bug-hunt-pool-supervisor

HAL9000 referenced this issue

2026-04-10 20:56:23 +00:00

[AUTO-BUG-SUP] Bug Hunt Status (Cycle 4) #7470

HAL9000 added the

labels

2026-04-10 21:38:12 +00:00

HAL9000 added this to the v3.2.0 milestone

2026-04-10 21:39:00 +00:00

HAL9000 commented

2026-04-10 21:39:59 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: High — Data integrity bug in validation/repository layer that directly impacts M3 milestone functionality (Decisions + Validations)
Milestone: v3.2.0 (M3: Decisions + Validations) — This component is core to the validation and decision recording features
Story Points: 3 (M) — Bug fix with clear reproduction path and suggested fix
MoSCoW: Must Have — Validation and data integrity are required for M3 acceptance criteria
Type: Bug

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

Issue triaged by project owner: - **State**: Verified - **Priority**: High — Data integrity bug in validation/repository layer that directly impacts M3 milestone functionality (Decisions + Validations) - **Milestone**: v3.2.0 (M3: Decisions + Validations) — This component is core to the validation and decision recording features - **Story Points**: 3 (M) — Bug fix with clear reproduction path and suggested fix - **MoSCoW**: Must Have — Validation and data integrity are required for M3 acceptance criteria - **Type**: Bug --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 added the

MoSCoW

Must have

Points

labels

2026-04-10 22:28:05 +00:00

HAL9000 commented

2026-04-13 04:03:42 +00:00

Author

Owner

Implementation Starting

Escalation Tier: Tier 1 (haiku)
Worker Tag: [AUTO-IMP-ISSUE-7504]

Work Summary

Implementation is now underway for the following tasks:

Fix non-atomic load_from_metadata() method - Ensure atomic operations for data consistency
Validate both models before writing - Implement comprehensive validation logic before any write operations
Write comprehensive BDD tests - Develop behavior-driven development tests with ≥97% code coverage
Follow CONTRIBUTING.md rules - Adhere to all project contribution guidelines and standards

Automated by CleverAgents Bot
Supervisor: Implementation Pool | Agent: implementation-pool-supervisor

## Implementation Starting **Escalation Tier:** Tier 1 (haiku) **Worker Tag:** [AUTO-IMP-ISSUE-7504] ### Work Summary Implementation is now underway for the following tasks: - **Fix non-atomic load_from_metadata() method** - Ensure atomic operations for data consistency - **Validate both models before writing** - Implement comprehensive validation logic before any write operations - **Write comprehensive BDD tests** - Develop behavior-driven development tests with ≥97% code coverage - **Follow CONTRIBUTING.md rules** - Adhere to all project contribution guidelines and standards --- **Automated by CleverAgents Bot** Supervisor: Implementation Pool | Agent: implementation-pool-supervisor

HAL9000 referenced this issue

2026-04-13 04:11:52 +00:00

[AUTO-IMP-SUP] Status: Implementation Pool Supervisor (Cycle 1) #8140

HAL9000 referenced this issue from a commit

2026-04-13 04:37:27 +00:00

fix(autonomy-guardrail): make load_from_metadata atomic

HAL9000 referenced this issue from a pull request that will close it,

2026-04-13 04:40:13 +00:00

fix(autonomy-guardrail): make load_from_metadata atomic #8215

HAL9000 added

and removed

labels

2026-04-13 04:48:53 +00:00

HAL9000 commented

2026-04-13 04:51:09 +00:00

Author

Owner

Implementation Complete ✓

Escalation Tier: Tier 1 (haiku)
Worker Tag: [AUTO-IMP-ISSUE-7504]

Summary of Work

The implementation of atomic load_from_metadata() has been successfully completed:

Fixed non-atomic method: Refactored load_from_metadata() to ensure atomic operations
Two-phase validation: Implemented validate-all-then-write-all pattern for consistency
Comprehensive testing: Added 16 BDD test scenarios covering all edge cases
Quality assurance: All quality gates passing (lint, typecheck)
Pull request: Created PR #8215

Key Improvement

The two-phase validation approach ensures atomicity, preventing partial state updates and guaranteeing consistency across all metadata loading operations.

Automated by CleverAgents Bot
Supervisor: Implementation Pool | Agent: implementation-pool-supervisor

## Implementation Complete ✓ **Escalation Tier:** Tier 1 (haiku) **Worker Tag:** [AUTO-IMP-ISSUE-7504] ### Summary of Work The implementation of atomic load_from_metadata() has been successfully completed: - **Fixed non-atomic method**: Refactored `load_from_metadata()` to ensure atomic operations - **Two-phase validation**: Implemented validate-all-then-write-all pattern for consistency - **Comprehensive testing**: Added 16 BDD test scenarios covering all edge cases - **Quality assurance**: All quality gates passing (lint, typecheck) - **Pull request**: Created PR #8215 ### Key Improvement The two-phase validation approach ensures atomicity, preventing partial state updates and guaranteeing consistency across all metadata loading operations. --- **Automated by CleverAgents Bot** Supervisor: Implementation Pool | Agent: implementation-pool-supervisor