REL-WF-002 — Fail closed while workflow state is unknown
| Field | Value |
|---|---|
| Status | Open; source-verified |
| Architecture state | Deployed state gating; OpenFGA capability gating is future |
| Severity | High |
| Affected surface | Workflow detail initial load, dependency failures, runtime actions, and read-only tabs |
| Components | sparqd/oqullus, sparqd/bff-api, sparqd/workflow-backend |
| Associated issue | Not opened |
Where the problem appears
Load a detail route slowly or fail its managed workflow and Airflow detail requests, then inspect controls and rendered data.
Concrete observed case
Known syncing and failed values disable runtime actions, but missing or unknown status is treated like Ready. Airflow detail failure can also replace data with a dummy workflow object, allowing read-only views to render non-authoritative fallback state.
Expected condition
Unknown, loading, missing, failed, and Ready are distinct. In current single-project mode, runtime mutations remain disabled until canonical workflow identity, status, and the legacy access decision are known. After OpenFGA rollout, the operation-specific capability becomes an additional required state. Read failures show unavailable or stale state, never dummy production data.
Cause and evidence
- The status gate enables actions when status is empty or unrecognized.
- Managed and Airflow detail requests resolve independently.
- Airflow detail failure assigns a dummy detail object.
Why it matters
A user can act against incomplete or stale identity and mistake fabricated fallback fields for runtime state.
Existing controls and workarounds
Wait for an explicit Ready pill and refresh after any detail error. Do not trust runtime tabs populated during a dependency failure.
Alternatives considered
- Recommended: explicit loading/error state machine that fails closed.
- Skeleton read-only view using last-known data labelled with revision and timestamp.
- Permit actions optimistically — rejected because identity, access policy, and synchronization readiness are prerequisites.
Component involvement
- sparqd/oqullus owns the page state machine and action gate.
sparqd/workflow-backendreturns canonical status now; its permission fields become authoritative only after OpenFGA activation.- sparqd/bff-api supplies structured missing, denied, and dependency errors.
Reproduction and verification
Follow WF-S002.
Resolution conditions
Close when only explicit Ready plus the active access contract enables each action and no failure path renders dummy workflow or runtime data. Add capability gating to this condition when OpenFGA is rolled out.
Validation and blockers
Oqullus, workflow-backend, BFF, security, and UX owners must validate.