fix: return errors for blocked durable queries

2026-05-23 02:53:10 +00:00
parent 892a0276bd
commit 6d474d10d7
3 changed files with 256 additions and 4 deletions
@@ -66,6 +66,17 @@ and a runtime blocker such as `runtime_durable_adapter_auth_blocked`,
 `runtime_durable_adapter_migration_blocked`. Fixture data and env presence are
 never promoted to `runtime.liveRuntimeEvidence`.

+When the Postgres durable adapter is selected or requested, JSON-RPC
+`audit.event.query` and `evidence.record.query` must also honor that durability
+gate. If auth, schema, migration, durability-query, or table read-query evidence
+is blocked, the method returns a JSON-RPC error with redacted blocker data such
+as `adapter: "postgres"`, `durableRequested: true`,
+`liveRuntimeEvidence: false`, `secretMaterialRead: false`, and the classified
+blocker. It must not
+return `events: []`, `records: []`, or `count: 0` on a blocked durable read.
+Empty successful result sets are valid only after the durable adapter has
+completed the read and the matching durable table rows are actually absent.
+
 If `HWLAB_CLOUD_DB_URL` and `HWLAB_CLOUD_DB_SSL_MODE` are absent, health
 reports `db.status: "blocked"`.
 If both env vars are present, cloud-api attempts a short read-only TCP