Jake
592b894790
Captures the 12 items from docs/code-review-2026-04-22.md that must land before v0.1 ships. One markdown file per issue with: severity, path:line, problem description, acceptance criteria, fix scope, and dependency graph. Split by severity: - 3 CRITICAL: live-session race, migration atomicity, transcript- profile FK - 9 MAJOR: monolith refactor, channel-fatality, capture worker join, runtime capabilities, macOS App Nap, decoder error prop, LLM prompt preflight, keystore thread-safety, hotkey device filter README.md indexes them with a fix-order dependency graph and a fish-shell script for bulk-converting to GitHub issues once `gh` CLI is installed and authed. Deferred step by user decision — markdown tracker is authoritative until then.
27 lines
1.7 KiB
Markdown
27 lines
1.7 KiB
Markdown
# RB-03 CRITICAL: transcript provenance can reference deleted profiles
|
|
|
|
**Severity:** CRITICAL
|
|
**Path:** `crates/storage/src/migrations.rs:208-216`, `crates/storage/src/database.rs:61-89`, `:697-708`
|
|
**Source:** [2026-04-22 code review](../code-review-2026-04-22.md#c4--transcript-provenance-can-reference-deleted-profiles)
|
|
**Labels:** release-blocker, critical, data-integrity, storage
|
|
|
|
## Problem
|
|
|
|
v8 migration adds `transcripts.profile_id` but without a `FOREIGN KEY` constraint. `insert_transcript` accepts any `profile_id` string without validation. `delete_profile` doesn't guard against existing transcript references. The combined result: persisted transcripts can keep orphaned profile IDs indefinitely, breaking provenance integrity.
|
|
|
|
## Acceptance
|
|
|
|
- A v9 migration adds `FOREIGN KEY (profile_id) REFERENCES profiles(id) ON DELETE RESTRICT` (or `ON DELETE SET NULL` if soft-orphaning is preferred — decide during the fix).
|
|
- The migration reconciles existing orphans: either backfill with `DEFAULT_PROFILE_ID`, or null them, per the chosen FK semantic.
|
|
- `insert_transcript` passes the FK check — no behaviour change on the happy path.
|
|
- `delete_profile` returns a meaningful error when transcripts reference the profile being deleted (or cascades to null, matching the FK semantic).
|
|
- Regression tests: (a) delete_profile with transcript references behaves per the chosen semantic; (b) insert_transcript with a non-existent profile_id errors; (c) existing orphans are reconciled on first migration to v9.
|
|
|
|
## Fix scope
|
|
|
|
Large. FK constraint design decision + migration + reconciliation + `database.rs` updates + tests.
|
|
|
|
## Dependencies
|
|
|
|
- **Blocked by:** RB-02 (migrations atomicity — the v9 migration must be transactional).
|