Jens/MobilityOps
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs: record root cause and fix for the RAGcore credential-issuance bug

Browse Source 
With explicit owner approval, traced the persistent credential-issuance
rejection to a cross-transaction race in RAGcore's own dependency
injection (two independent DB transactions per request instead of one
shared transaction), fixed and deployed it in RAGcore, and verified a
working "RAGcore Sync Token" n8n credential now exists. Unblocks
workflow 3 and the RAGcoreKnowledgeProvider adapter rewrite.
This commit is contained in:
NuklearRabbit
2026-08-04 18:11:34 +02:00
parent cf4d8e3649
commit 2afceea5e4
2 changed files with 46 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
n8n/workflows/MANIFEST.md
+13 -11
View File
@@ -37,20 +37,22 @@ credential values are never embedded; nodes reference named n8n credentials inst
## 3. Fleet Ops — RAGcore Procedure Sync
Not yet built. Blocked on a RAGcore application credential (scope `sources:sync`) for the
`fleet-ops` application. Two independent issuance attempts have failed with an opaque
server-side rejection: the raw API (`POST /v1/applications/{id}/credentials`, 400
"authoritative service-account state rejected issuance") and the RAGcore admin UI's
"Issue credential" form as the Platform Admin role (generic "Something went wrong",
trace reference `1955c6a8968c4941a22a1faef39e17a7`). The `fleet-ops` application itself
shows as ordinary/`Active` with no visible lock in the RAGcore admin UI, and the OpenAPI
spec documents no validation constraint that would explain either rejection — this is a
RAGcore-side policy or bug, not a Fleet Ops request-shape or permission problem. Needs
RAGcore's own operator to look up the trace IDs above in RAGcore's logs. Will sync
Not yet built, but no longer blocked. Credential issuance for the `fleet-ops` application
previously failed 100% of the time with an opaque rejection ("authoritative service-account
state rejected issuance" via the raw API; a generic error via the admin UI). Root-caused to
a genuine bug in RAGcore itself — a cross-transaction race in
`src/ragcore/api/v1/control/dependencies.py` where `get_control_application` and
`get_credential_service` each opened their own independent database transaction, so a
freshly-created service account was invisible to the immediately-following credential-issue
read. Fixed in RAGcore (with explicit owner approval) by sharing one request-scoped
transaction between both dependencies; verified against RAGcore's own test suite (64
passing) and deployed to the live instance. A working credential now exists: n8n credential
**"RAGcore Sync Token"** (Header Auth, `Authorization: Bearer <token>`), scope
`sources:sync` for `fleet-ops`. Will build
`n8n/workflows/fleet-ops-ragcore-procedure-sync.json` against the real RAGcore contract
(`POST /v1/uploads`, `GET /v1/knowledge-spaces`, etc. — see
`contracts/ragcore-contract-assumptions.md` and the live inspection notes in
`docs/live-ai-integration/n8n-current-state.md`) once a working credential exists.
`docs/live-ai-integration/n8n-current-state.md`) next.
| Field | Value |
|---|---|