stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Recover Human Gate decisions after interrupted mobile responses #1446

New Issue
Closed
opened 2026-08-26 21:49:32 +00:00 by timmy · 0 comments
timmy commented 2026-08-26 21:49:32 +00:00
Owner
Copy Link

Problem

Human Gate decision idempotency keys live only in memory. If the server commits a Release/Hold but the mobile response is lost or the app restarts, the operator cannot replay the same operation to recover the authoritative receipt. A new key can produce a stale-revision conflict and leave the decision outcome ambiguous.

Vertical slice

Persist one account-, gate-, revision-, decision-, and payload-bound pending operation before POST. On the next matching review after reload, expose a clear outcome-unknown recovery state and replay the exact operation/key on explicit operator verification. Clear it only after a confirmed receipt or an authoritative conflict dismissal; never cross account boundaries.

Acceptance tests

  • A failed/lost response followed by controller recreation reuses the identical idempotency key and payload and recovers the receipt.
  • A request that never reached the server executes once when verified after reload.
  • Recovery is scoped to immutable account identity, gate ID, and revision.
  • Concurrent recovery taps remain single-flight.
  • Confirmed success clears both review progress and pending operation; uncertain transport failure retains them.
  • The mobile recovery control is accessible, touch-sized, and does not auto-submit a decision.
  • Focused tests, full suite, and packaged mobile browser journey pass.

No existing issue or recent commit covers cross-reload in-flight Human Gate decision recovery. Related #1435 resumes evidence review before a decision; #1441/#1444 cover durable history after a known decision.

## Problem Human Gate decision idempotency keys live only in memory. If the server commits a Release/Hold but the mobile response is lost or the app restarts, the operator cannot replay the same operation to recover the authoritative receipt. A new key can produce a stale-revision conflict and leave the decision outcome ambiguous. ## Vertical slice Persist one account-, gate-, revision-, decision-, and payload-bound pending operation before POST. On the next matching review after reload, expose a clear outcome-unknown recovery state and replay the exact operation/key on explicit operator verification. Clear it only after a confirmed receipt or an authoritative conflict dismissal; never cross account boundaries. ## Acceptance tests - A failed/lost response followed by controller recreation reuses the identical idempotency key and payload and recovers the receipt. - A request that never reached the server executes once when verified after reload. - Recovery is scoped to immutable account identity, gate ID, and revision. - Concurrent recovery taps remain single-flight. - Confirmed success clears both review progress and pending operation; uncertain transport failure retains them. - The mobile recovery control is accessible, touch-sized, and does not auto-submit a decision. - Focused tests, full suite, and packaged mobile browser journey pass. No existing issue or recent commit covers cross-reload in-flight Human Gate decision recovery. Related #1435 resumes evidence review before a decision; #1441/#1444 cover durable history after a known decision.
timmy self-assigned this 2026-08-26 21:49:32 +00:00
timmy closed this issue 2026-08-26 23:05:33 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1446
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?