db

const (
	// RunOpLockClass serializes the operations that act on one run's proxy and
	// broker credentials from a row they read earlier (a revive, the lease
	// sweep's stop). obj = the run id.
	RunOpLockClass int32 = 0x57524F50 // ASCII "WROP"
	// ADORunTokenLockClass serializes the mint and revoke of one run's Azure
	// DevOps run token. Reserved for ha-l2.4, which takes it; named here so the
	// order below is one list.
	ADORunTokenLockClass int32 = 0x57415254 // ASCII "WART"
	// AWSSSOLockClass is the AWS SSO refresh single-flight: obj = the
	// secret-store namespace the credential lives in.
	AWSSSOLockClass int32 = 0x57415753 // ASCII "WAWS"
	// ADOSignInLockClass is the Entra sign-in refresh single-flight (Azure
	// DevOps and Azure AI Foundry): obj = person and provider row.
	ADOSignInLockClass int32 = 0x5741444F // ASCII "WADO"
	// SiteConfigLockClass serializes the read-modify-write writers of the one
	// site-config document.
	SiteConfigLockClass int32 = 0x57534346 // ASCII "WSCF"
	// CapEnforcementLockClass serializes writers of the capability-enforcement
	// document.
	CapEnforcementLockClass int32 = 0x57434150 // ASCII "WCAP"
	// AuditSweepLockClass admits one audit-chain verify sweep at a time. It is
	// taken last and only ever tried, never waited for.
	AuditSweepLockClass int32 = 0x57415357 // ASCII "WASW"
)

The classid half of each ordered lock's two-argument key. Distinct from every other class in this package (LoginSupersedeLockClass, SecretRowLockClass, PushPathListLockClass) and from the one-argument keys, which carry a different objsubid.

const AuditChainLockKey int64 = 0x5741524459_434841 // ASCII "WARDYCHA"

AuditChainLockKey serializes appends to the audit_events hash chain. Transaction-scoped, never session-scoped: released by the commit that makes the new row visible, so the next writer's head read can't miss it. Since 0056_audit_chain_serialize.sql the trigger takes it too and allocates seq inside the trigger under this lock, so position and chain link are decided together (0047 alone let two racing writers invert chain order against seq order, since seq was assigned before the trigger ran). In-tree insert paths still take it before their INSERT; re-entrant within a transaction, so the trigger's own acquisition is free for them. ponytail: ONE lock for the whole chain — a chain has exactly one head, and write volume is nowhere near contention. Upgrade only if that changes: per-partition chains with a key per partition.

const AuditPartitionLockKey int64 = 0x5741524459_415054 // ASCII "WARDYAPT"

AuditPartitionLockKey serializes the creators of audit_events partitions: two replicas booting at once, or a boot beside the daily sweeper, would otherwise both create the same month. audit_ensure_partitions takes it inside the database as a transaction lock; the literal in 0111_audit_partitioned.sql must equal this. It is deliberately NOT AuditChainLockKey: creating a month must not queue behind (or hold up) an append.

const AuditPartitionMonthsAhead = 12

AuditPartitionMonthsAhead is how many months past the current one audit_ensure_partitions keeps created. A constant, not a setting: the function itself refuses anything outside 1..24, and the boot and the daily sweeper both pass this.

const BootKeyLockKey int64 = 0x5741524459_424B59 // ASCII "WARDYBKY"

BootKeyLockKey serializes the CREATE path of cmd/wardynd's boot keys across WARDYN_HA replicas: without it, two booting against an empty store each generate a key and the loser serves one nobody else holds.

const DefaultPoolMaxConns = 10

DefaultPoolMaxConns is the pool size when the DSN leaves pool_max_conns unset, or the CPU count if that is larger. pgx's own default is the larger of 4 and the CPU count, but on a 4-CPU host the single-instance lock, the sweeper leader and the ground-truth rotator held three pooled connections for the process lifetime, so the reaper's tick lock took the fourth and waited forever for a fifth to prune, and every request after it hung. Since 0.8.7 those three hold connections of their own, outside the pool (TryAdvisoryLockDedicated); the default stays 10.

const GovernanceAssignmentLockClass int32 = 0x57474153 // ASCII "WGAS"

GovernanceAssignmentLockClass is the classid of the TRANSACTION-scoped two-argument lock keyed to one governance assignment's natural key (hashtext of subject_type and subject). The assignment upsert and the approval of a held assignment change both take it, so a create that was absent when it was proposed cannot be overwritten by an upsert that landed in between.

const GovernanceGraphLockClass int32 = 0x57474750 // ASCII "WGGP"

GovernanceGraphLockClass is the classid of the TRANSACTION-scoped two-argument lock store.PG.WriteGovernanceProfile and DeleteGovernanceProfile take (second key 0): one write to the governance profile graph at a time, so the cycle and depth checks they make are the ones the stored graph keeps.

const GovernanceTargetLockClass int32 = 0x57474754 // ASCII "WGGT"

GovernanceTargetLockClass is the classid of the TRANSACTION-scoped two-argument lock keyed to one target of a held governance change (hashtext of the kind and its natural key), for the kinds whose row may be absent: a capability grant, a restriction, the enforcement map, a role mapping. The direct write and the approval of a held change to that target both take it, so a write that landed between the approval's staleness check and its own write cannot be overwritten.

const GroundTruthRotatorLockKey int64 = 0x5741524459_475452 // ASCII "WARDYGTR"

GroundTruthRotatorLockKey elects the ground-truth token rotator's leader. Unlike ReaperAdvisoryLockKey, acquired ONCE and held for the process lifetime; other replicas back off and retry.

HONEST CEILING: at most one steady-state leader, not mutual exclusion — an advisory lock dies with its SESSION, not the process, so a Postgres restart/failover/idle-timeout can release it under a still-running leader and a standby takes over unaware. Harmless only because every write is an atomic rename of a stateless token; work needing genuine fencing must not reuse this key.

const KeyDomainAssignmentLockClass int32 = 0x574B4441 // ASCII "WKDA"

KeyDomainAssignmentLockClass is the classid of the TRANSACTION-scoped two-argument lock (second key 0) every key-domain assignment write takes, the direct write and the approval of a held one alike: one write at a time, so the membership check a set makes (two groups of one person in different domains) sees every assignment written before it, including another group's.

const LoginSupersedeLockClass int32 = 0x574C474E // ASCII "WLGN"

LoginSupersedeLockClass is the classid half of a TWO-argument advisory lock key (objid = one person's actor string folded to int32, store.LoginLocker). Serializes ONE person's concurrent sign-in launches: without it, two launches' independent supersede/insert/supersede statements can each read the other as not-yet-existing, leaving two live sandboxes each holding a captured AWS SSO session. Taken BLOCKING: the loser must run AFTER the winner, not skip the supersede. A separate key space from db.go's int64 keys — the one- and two-argument lock forms carry different objsubid, so they cannot collide.

const PushPathListLockClass int32 = 0x57505054 // ASCII "WPPT"

PushPathListLockClass is the classid of the TRANSACTION-scoped two-argument lock store.PG.RecordPushPathList takes, keyed to one run: that run's list inserts serialize, so the per-run cap it counts is the cap it enforces.

const ReaperAdvisoryLockKey int64 = 0x5741524459_524541 // ASCII "WARDYREA"

ReaperAdvisoryLockKey makes the lifecycle reap tick single-flight. Unlike migrateAdvisoryLockKey, only ever taken with TryAdvisoryLock: a losing replica SKIPS the tick, since a queued second reap is duplicate work.

const RunCapLockClass int32 = 0x57525243 // ASCII "WRRC"

RunCapLockClass is the classid of the TRANSACTION-scoped two-argument lock store.PG.CreateRunUnderCap takes (second key 0): one capped run insert at a time across replicas, so the count it checks is the cap it enforces.

const RunOutputLockClass int32 = 0x57524F55 // ASCII "WROU"

RunOutputLockClass is the classid of the TRANSACTION-scoped two-argument lock store.PG's run_outputs writers, readers and erasure take, keyed to one run: an erasure's tombstone and a writer's tombstone check are serialized, so no writer commits a row the erasure has already ruled out. A leaf: taken last inside the one transaction and never held while taking another lock, so it sits outside LockOrder.

const SecretConvertLockKey int64 = 0x5741524459_454E56 // ASCII "WARDYENV"

SecretConvertLockKey makes the boot conversion of legacy (v0) secrets rows to envelope v1 single-writer (secretstore/pg's ConvertV0): a second replica booting at the same moment waits, then finds nothing left to convert.

const SecretRekeyLockKey int64 = 0x5741524459_524B59 // ASCII "WARDYRKY"

SecretRekeyLockKey serializes `wardynd -rotate-age-key` maintenance mode: two concurrent rekeys would each re-encrypt from an old key the other already replaced, so the second is refused.

HONEST CEILING: does NOT detect a running wardynd (that's SingleInstanceLockKey). "Stop the daemon first" is an operator procedure, not enforced here — a live daemon would write ciphertext under an already-retired key.

const SecretRowLockClass int32 = 0x57534543 // ASCII "WSEC"

SecretRowLockClass is the classid of the TRANSACTION-scoped two-argument lock secretstore/pg takes around a store-mode Put, keyed to one (owner, name) row: one writer per row at a time across replicas. Taken with pg_advisory_xact_lock inside the Put's own transaction, released by the commit that writes the row — not through AdvisoryLockKeyed.

const SingleInstanceLockKey int64 = 0x5741524459_494E53 // ASCII "WARDYINS"

SingleInstanceLockKey is the RUNTIME half of the one-replica safety control (the Helm chart's `replicas > 1` render refusal is the other half). Taken once at boot, held for the process lifetime: a second instance refuses to start.

SECURITY: not modesty. wardynd keeps per-process state a second instance can't see — sharpest in the secret-masking registry (internal/secretmask), an in-memory map that FAILS OPEN: a recording uploaded to the wrong instance is persisted VERBATIM with live credentials in cleartext under a `success` audit event. The chart's refusal is render-time only; `kubectl scale` or an HPA defeats it silently.

HONEST CEILING, same mechanism as GroundTruthRotatorLockKey: at most one steady-state instance, not a fence.

const SweeperLeaderLockKey int64 = 0x5741524459_53574C // ASCII "WARDYSWL"

SweeperLeaderLockKey elects the one replica that runs the sweepers which must run once (approvals, recordings, credentials, the always-egress reconcile and the run pause). Acquired ONCE and held for the process lifetime by SweeperLeader; followers retry on a backoff and take over when the leader's session ends.

HONEST CEILING, as for GroundTruthRotatorLockKey: an advisory lock dies with its SESSION, so a Postgres failover can release it under a still-running leader. Unlike the rotator, this lock IS used for work that needs fencing, so each acquisition bumps the durable epoch in sweeper_leader (0110) and a multi-step operation re-checks its epoch (SweeperLeader.Current) before it writes.

const TerminalSandboxSweepLockKey int64 = 0x5741524459_545353 // ASCII "WARDYTSS"

TerminalSandboxSweepLockKey makes the terminal-sandbox sweep tick single-flight across control planes (#710), the same shape as ReaperAdvisoryLockKey and for the same reason SingleInstanceLockKey alone is not enough: that lock is at most one steady-state instance, not mutual exclusion (its own HONEST CEILING) — a deployment booted with WARDYN_HA skips the claim entirely, and a Postgres restart/failover can release its session under a still-running daemon while a second one boots and claims it. Either way, two tickers running at once would both re-run teardown for the same aged KILLED run, doubling its run.kill rows and calling the runner twice. Always taken with TryAdvisoryLock: a control plane that loses simply skips the tick, since a queued second sweep of the same page is pure duplicate work.