Reject GitHub PR effects after cancellation

src/runtime/postgres.ts

@@ -1129,6 +1129,7 @@ export class PostgresRuntimeStore implements ExecutionStore, TriggerStore, Bindi
         JOIN dispatch_execution_attempts attempt ON attempt.execution_id=execution.id AND attempt.tenant_id=execution.tenant_id
         JOIN dispatch_events event ON event.id=execution.event_id AND event.tenant_id=execution.tenant_id
         WHERE execution.tenant_id=$1 AND execution.id=$2 AND attempt.fencing_token=$3
+          AND execution.state IN ('PROVISIONING','RUNNING')
           AND attempt.state IN ('LEASED','RUNNING') AND attempt.lease_expires_at > clock_timestamp()
         FOR UPDATE OF execution`, [command.tenantId, command.executionId, command.fencingToken]);
       if (!execution.rows[0]) throw new Error("Execution effect capability is not current");
@@ -1199,7 +1200,9 @@ export class PostgresRuntimeStore implements ExecutionStore, TriggerStore, Bindi
       const effect = await client.query<{ fence_hash: string; github_pull_request_id: string | null; pull_request_number: number | null; pull_request_url: string | null; repository_full_name: string; state: string }>(`SELECT effect.*
         FROM dispatch_github_pull_request_effects effect
         JOIN dispatch_execution_attempts attempt ON attempt.execution_id=effect.execution_id AND attempt.tenant_id=effect.tenant_id
+        JOIN dispatch_executions execution ON execution.id=effect.execution_id AND execution.tenant_id=effect.tenant_id
         WHERE effect.tenant_id=$1 AND effect.id=$2 AND effect.execution_id=$3 AND attempt.fencing_token=$4
+          AND execution.state IN ('PROVISIONING','RUNNING')
           AND attempt.state IN ('LEASED','RUNNING') AND attempt.lease_expires_at > clock_timestamp()
         FOR UPDATE OF effect`,
       [command.tenantId, command.effectId, command.executionId, command.fencingToken]);

test/e2e/supplied-wake-context-persistence.test.ts

@@ -148,6 +148,31 @@ describe("supplied wake context persistence", () => {
     await pool.query("delete from dispatch_github_pull_request_effects where id=$1", [effect.id]);
   });
 
+  it("rejects PR effect registration and reporting after cancellation is requested", async () => {
+    const registrationExecutionId = await createDeveloper();
+    const registrationClaim = await store.claimNextQueuedExecution({ leaseOwner: `cancel-registration-${randomUUID()}`, leaseDurationMs: 60_000 });
+    if (!registrationClaim || registrationClaim.executionId !== registrationExecutionId) throw new Error("Expected developer claim");
+    await store.requestExecutionCancellation({ actor: "test", executionId: registrationExecutionId, reason: "cancel", requestedAt: new Date().toISOString(), tenantId: "default", transitionId: randomUUID() });
+
+    const registration = { baseRef: "main", executionId: registrationExecutionId, fencingToken: registrationClaim.lease.fencingToken, headRef: "feature", pullRequestTitle: "PR",
+      registeredAt: new Date().toISOString(), repositoryFullName: "acme/repo", repositoryId: 7, requestHash: hashCanonicalJson({ owner: "acme", repo: "repo", title: "PR", head: "feature", base: "main" }), tenantId: "default" };
+    await expect(store.registerGitHubPullRequestEffect(registration)).rejects.toThrow("Execution effect capability is not current");
+    expect((await pool.query("select count(*)::int as count from dispatch_github_pull_request_effects where execution_id=$1", [registrationExecutionId])).rows[0]).toEqual({ count: 0 });
+
+    const reportExecutionId = await createDeveloper();
+    const reportClaim = await store.claimNextQueuedExecution({ leaseOwner: `cancel-report-${randomUUID()}`, leaseDurationMs: 60_000 });
+    if (!reportClaim || reportClaim.executionId !== reportExecutionId) throw new Error("Expected developer claim");
+    const effect = await store.registerGitHubPullRequestEffect({ ...registration, executionId: reportExecutionId, fencingToken: reportClaim.lease.fencingToken });
+    await store.requestExecutionCancellation({ actor: "test", executionId: reportExecutionId, reason: "cancel", requestedAt: new Date().toISOString(), tenantId: "default", transitionId: randomUUID() });
+
+    await expect(store.reportGitHubPullRequestEffect({ effectId: effect.id, executionId: reportExecutionId, fencingToken: reportClaim.lease.fencingToken,
+      githubPullRequestId: "9001", pullRequestNumber: 61, pullRequestUrl: "https://github.com/acme/repo/pull/61", reportedAt: new Date().toISOString(), tenantId: "default" }))
+      .rejects.toThrow("Execution effect capability is invalid");
+    expect((await pool.query("select state,github_pull_request_id,pull_request_number,pull_request_url from dispatch_github_pull_request_effects where id=$1", [effect.id])).rows[0])
+      .toEqual({ state: "REGISTERED", github_pull_request_id: null, pull_request_number: null, pull_request_url: null });
+    await pool.query("delete from dispatch_github_pull_request_effects where id=$1", [effect.id]);
+  });
+
   it("recovers a registered effect from its exact signed PR event", async () => {
     const executionId = await createDeveloper();
     const claimed = await store.claimNextQueuedExecution({ leaseOwner: `recovery-worker-${randomUUID()}`, leaseDurationMs: 60_000 });