{"record":{"id":"6b1baf1bc5af29a8","repo":"nautechsystems/nautilus_trader","slug":"postgres-execution-requires-protected-payload-stor","errorCode":null,"errorMessage":"Postgres execution requires protected payload storage","messagePattern":"Postgres execution requires protected payload storage","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"crates/adapters/blockchain/src/cache/database.rs","lineNumber":4658,"sourceCode":"                ),\n            }\n        }\n\n        self.validate_execution_payload_ready(keys).await\n    }\n\n    /// Requires ready protected storage and authenticates every persisted signed payload.\n    pub(crate) async fn require_execution_payload_storage(\n        &self,\n        keys: &PayloadKeySet,\n        policy: PayloadPolicy,\n        batch_size: i64,\n    ) -> anyhow::Result<ExecutionPayloadLease> {\n        self.require_execution_payload_storage_ready(keys).await?;\n        let (check, transaction) = self\n            .inspect_execution_payload_storage(Some(keys), Some(policy), batch_size)\n            .await?;\n        anyhow::ensure!(\n            check.protected,\n            \"Postgres execution requires protected payload storage\"\n        );\n        Ok(ExecutionPayloadLease {\n            _transaction: transaction,\n        })\n    }\n\n    /// Requires protected storage to be ready before execution schema initialization.\n    pub(crate) async fn require_execution_payload_storage_ready(\n        &self,\n        keys: &PayloadKeySet,\n    ) -> anyhow::Result<()> {\n        anyhow::ensure!(\n            self.execution_payload_marker().await?.is_some(),\n            \"Postgres execution requires protected payload storage\"\n        );\n        self.validate_execution_payload_ready(keys).await","sourceCodeStart":4640,"sourceCodeEnd":4676,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/cache/database.rs#L4640-L4676","documentation":"`require_execution_payload_storage` authenticates that signed-transaction payloads are stored in protected storage before any execution action. After checking readiness it inspects storage with the given keys/policy and throws this error when `check.protected` is false — i.e. the schema is ready but the storage fails the protection check (e.g. active key not configured/validated).","triggerScenarios":"Calling an execution path that acquires a payload lease when `inspect_execution_payload_storage(Some(keys), Some(policy), batch_size)` reports `protected == false`: missing or mismatched payload key in PayloadKeySet, encryption/protection not fully activated, or policy not satisfied by current storage state.","commonSituations":"Starting a live execution node against a database where payload protection was never fully activated; rotating keys but the PayloadKeySet passed to the node lacks the new active key; running with a config that disables protection while the code path requires it.","solutions":["Run `ensure_execution_payload_storage` at startup so activation/migration completes before execution","Verify the PayloadKeySet contains the correct deployment id and active key id matching execution_payload_state.active_key_id","Inspect the check output from inspect_execution_payload_storage to see which protection condition failed","Confirm node config enables protected payload storage and points at the right database"],"exampleFix":"// before: executing without completing activation\nlet lease = db.require_execution_payload_storage(&keys, policy, batch).await?;\n// after: ensure storage first\ndb.ensure_execution_payload_storage(&keys).await?;\nlet lease = db.require_execution_payload_storage(&keys, policy, batch).await?;","handlingStrategy":"validation","validationCode":"let (check, _) = db.inspect_execution_payload_storage(Some(&keys), None, 1).await?;\nif !check.protected {\n    return Err(anyhow::anyhow!(\"payload storage is not protected; run ensure_execution_payload_storage before executing\"));\n}","typeGuard":null,"tryCatchPattern":"match db.require_execution_payload_storage(&keys, policy, batch).await {\n    Err(e) if e.to_string().contains(\"requires protected payload storage\") => {\n        // activate protection, verify keys match active_key_id, then retry once\n        db.ensure_execution_payload_storage(&keys).await?;\n        db.require_execution_payload_storage(&keys, policy, batch).await?;\n    }\n    other => other?,\n}","preventionTips":["Always call ensure_execution_payload_storage at node startup before execution paths","Keep PayloadKeySet in sync with the deployment id and active key id in the database","Enable protected storage in configuration for any live execution node","Re-run the protection check after key rotation"],"tags":["postgres","encryption","payload-protection","config"],"backgroundTag":"invalid-state-transition","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}