{"record":{"id":"57e0e95a023132cd","repo":"nautechsystems/nautilus_trader","slug":"payload-rewrap-requires-an-active-payload-key","errorCode":null,"errorMessage":"Payload rewrap requires an active payload key","messagePattern":"Payload rewrap requires an active payload key","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/client.rs","lineNumber":899,"sourceCode":"            .ok_or_else(|| anyhow::anyhow!(\"Payload protection requires an active payload key\"))?;\n        database.ensure_execution_payload_storage(&keys).await\n    }\n\n    /// Rewraps all protected payloads in this execution database with the configured active key.\n    ///\n    /// The prior active key must remain configured as a retired key until this method and a\n    /// subsequent full check both succeed.\n    ///\n    /// # Errors\n    ///\n    /// Returns an error if the client is connected, storage is not protected, required keys are\n    /// unavailable, or any bounded rewrap batch fails authentication.\n    pub async fn rewrap_payload_storage(&self, batch_size: usize) -> anyhow::Result<()> {\n        let batch_size = validate_payload_operation_batch_size(batch_size)?;\n        let database = self.payload_operation_database().await?;\n        let keys = self\n            .load_payload_keys()?\n            .ok_or_else(|| anyhow::anyhow!(\"Payload rewrap requires an active payload key\"))?;\n        database\n            .rewrap_execution_payload_storage(&keys, batch_size)\n            .await\n    }\n\n    /// Restores authenticated plaintext payloads and removes protection from this database.\n    ///\n    /// This incident-only operation is resumable. Keep the complete key set configured until it\n    /// succeeds and the unprotected database passes a full payload check.\n    ///\n    /// # Errors\n    ///\n    /// Returns an error if the client is connected, storage is not protected, required keys are\n    /// unavailable, or any bounded rollback batch fails authentication.\n    pub async fn rollback_payload_storage(&self, batch_size: usize) -> anyhow::Result<()> {\n        let batch_size = validate_payload_operation_batch_size(batch_size)?;\n        let database = self.payload_operation_database().await?;\n        let keys = self","sourceCodeStart":881,"sourceCodeEnd":917,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/client.rs#L881-L917","documentation":"rewrap_payload_storage() re-encrypts the execution payload storage under fresh keys, but it refuses to run when no active payload key set is loaded on the client. The keys are loaded from durable storage during connect/protect flows; without them the rewrap cannot authenticate or produce valid ciphertext. This is a deliberate guard preventing data corruption from operating on an unkeyed database.","triggerScenarios":"Calling client.rewrap_payload_storage(batch_size) before the client has connected/initialized payload keys, after keys were cleared, or when load_payload_keys() returns None because no key set was persisted or protected.","commonSituations":"Running rewrap on a fresh environment before the initial protect_payload_storage call; a wiped or misconfigured key store; pointing the client at a database never initialized with payload protection.","solutions":["Call protect_payload_storage() (after connecting) to initialize and persist payload keys before rewrapping.","Verify the key store / config so load_payload_keys() can find the persisted key set.","Check payload key status via check_payload_storage() before attempting rewrap.","Ensure the Postgres cache database configured is the same one that holds the protected payloads."],"exampleFix":"// before\nclient.rewrap_payload_storage(1000).await?;\n// after\nif client.load_payload_key_status()?.is_some() {\n    client.rewrap_payload_storage(1000).await?;\n} else {\n    client.protect_payload_storage(1000).await?;\n}","handlingStrategy":"validation","validationCode":"let keys = client.load_payload_key_status()?;\nanyhow::ensure!(keys.is_some(), \"initialize payload keys (protect_payload_storage) before rewrap\");\nclient.rewrap_payload_storage(batch_size).await?;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always run protect_payload_storage() before any rewrap in a fresh environment.","Call check_payload_storage() first to confirm key state.","Script rewrap only after a successful connect+protect sequence."],"tags":["rust","encryption","payload-storage","missing-state"],"backgroundTag":"missing-required-config-field","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}