Repository navigation
fix(purchase): route AutoPurchase steps to approval when RequireDifferentApprover is on #1771
Description
Split from the #348 tracker (A05-003). Confirmed on main 0015bea.
enforceFourEyesPolicy (internal/purchase/approvals.go:232) says it's the single choke point for RequireDifferentApprover, but only ApproveAndExecute calls it (approvals.go:424). The scheduler's auto path skips it entirely: the cron sweep and SQS (executableByScheduler, internal/purchase/manager.go:887-915, then claimAndExecuteWithin and executeAndFinalize). So with dual control on, an armed AutoPurchase plan still buys with no second person.
Decision (fleet coordinator, recorded on #348, comment 6657724378; the owner can override): with RequireDifferentApprover on, an AutoPurchase plan must not auto-execute. Its due step goes to the approval queue, the same pending/notified state and approval email a non-auto plan gets. It must not be refused silently. Document this at the gate.
Test: a real-path test runs the flag on, with an armed plan and a due step, through the scheduler entry point. The row ends awaiting approval, the purchaser is never called, and an approval by a different user then runs it. With the flag off, the auto path is unchanged. A mutation that skips the new check must fail it.
Activity
cristim commentedon Nov 5, 2026
Claimed by claude-qa-ui-3: queued right after #348 F6 (in progress). Next step: read the scheduler auto path and the approval routing, then write a plan with a plan review before any code.
cristim commentedon Nov 5, 2026
Recorded decision (fleet coordinator, 2026-11-05; the owner can override):
enforceFourEyesPolicydenies every approver. Such a step waits in the queue, then expires about 7 days after its date; a human then recreates the plan. This will be documented in the PR and theRequireDifferentApproverdoc comment.cristim commentedon Nov 5, 2026
Claimed by claude-qa-ui-3: PR #1793 is open (head 658a922) and waiting for 2 cold reviews.
test(api): update #1761's automatic combined-plan test for 4-eyes rou…
fix(purchase): route AutoPurchase steps to approval when 4-eyes is on (…