Adds dao_rules.py: ScheduleRulesDao (create, get, partial update, delete_if_unreferenced with check+delete in one transaction under the connection lock) and TaskDefinitionsDao (create with active-child and rule validation, get, list_by_child, list_active, field-scoped update, set_active, set_assignee with same validation). No delete path for definitions per guardrail. Typed dataclass returns; SQL confined to DAO modules (extended leak guards). 37 new tests incl. delete-vs-create race safety test; suite 389 passed.
Adds dao_rules.py: ScheduleRulesDao (create, get, partial update, delete_if_unreferenced with check+delete in one transaction under the connection lock) and TaskDefinitionsDao (create with active-child and rule validation, get, list_by_child, list_active, field-scoped update, set_active, set_assignee with same validation). No delete path for definitions per guardrail. Typed dataclass returns; SQL confined to DAO modules (extended leak guards). 37 new tests incl. delete-vs-create race safety test; suite 389 passed.
- create/set_assignee validate child+rule inside the same serialized
transaction as the INSERT/UPDATE (time-of-check/time-of-use race
closed; inactive child or deleted rule at assignment time raises
ValueError, never a raw FK error)
- update() methods take an _UNSET sentinel: omitted = leave alone,
explicit None = write SQL NULL (reopen ended rules, clear metadata)
- rule create/update validate strict YYYY-MM-DD date shape (lexical
CHECK cannot prove calendar validity)
- delete/create race test now forces both orderings via a validation
hook; SQL-leak guard no longer exempts dao_children.py
The pause point is now the actual TOCTOU window (validation passed,
INSERT pending): the create-first ordering asserts deleted is False -
the serialized transaction must keep the queued delete from removing
the rule between the create's check and its insert. Tautological or
True assertion removed.
orchestrator-agent
merged commit c27ed24020 into feature/8940567d-7b50-41ef-a510-8b234fe7290e-sqlite-data-layer2026-09-14 07:48:02 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds dao_rules.py: ScheduleRulesDao (create, get, partial update, delete_if_unreferenced with check+delete in one transaction under the connection lock) and TaskDefinitionsDao (create with active-child and rule validation, get, list_by_child, list_active, field-scoped update, set_active, set_assignee with same validation). No delete path for definitions per guardrail. Typed dataclass returns; SQL confined to DAO modules (extended leak guards). 37 new tests incl. delete-vs-create race safety test; suite 389 passed.