{"record":{"id":"b7e609ba6a8717c8","repo":"nautechsystems/nautilus_trader","slug":"legacy-execution-transaction-contains-an-envelo","errorCode":null,"errorMessage":"Legacy execution transaction {} contains an envelope","messagePattern":"Legacy execution transaction (.+?) contains an envelope","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/cache/database.rs","lineNumber":5246,"sourceCode":"                        hash.id\n                    );\n                    let envelope = hash.sealed_transaction.as_deref().ok_or_else(|| {\n                        anyhow::anyhow!(\n                            \"Protected execution transaction {} has no envelope\",\n                            hash.id\n                        )\n                    })?;\n                    let key_id = envelope_key_id(envelope)?;\n                    anyhow::ensure!(\n                        keys.contains_key(&key_id),\n                        \"Execution transaction {} requires an unavailable payload key\",\n                        hash.id\n                    );\n                    key_ids.insert(alloy::hex::encode(key_id));\n                    let context = payload_context(&intent, hash, deployment_id)?;\n                    keys.unseal(envelope, &context)?\n                } else {\n                    anyhow::ensure!(\n                        hash.sealed_transaction.is_none(),\n                        \"Legacy execution transaction {} contains an envelope\",\n                        hash.id\n                    );\n                    hash.raw_transaction.clone().ok_or_else(|| {\n                        anyhow::anyhow!(\"Legacy execution transaction {} has no plaintext\", hash.id)\n                    })?\n                };\n                authenticate_retained_payload(\n                    &raw_transaction,\n                    &intent,\n                    hash,\n                    deployment_id.as_deref().unwrap_or(\"\"),\n                )?;\n\n                if let Some(policy) = policy\n                    && retained_payload_requires_policy(&intent, hash, policy)?\n                {","sourceCodeStart":5228,"sourceCodeEnd":5264,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/cache/database.rs#L5228-L5264","documentation":"In the legacy load path (no payload-protection keys or no deployment id), rows must contain plaintext raw transactions only. This ensure! fires when a row holds a sealed envelope, which the legacy path cannot decrypt — indicating the row was sealed while the caller is loading without protection keys.","triggerScenarios":"Calling the execution-transaction load with keys=None or deployment_id=None while the scanned row has a non-NULL sealed_transaction column.","commonSituations":"Deployment misconfiguration: payload protection is enabled in the database but the loader's keys/deployment_id were not passed (env var or config not set on this node); loading a protected database with an unprotected legacy code path or old software version.","solutions":["Configure and pass the payload keys plus deployment_id so the protected branch runs and can unseal the envelope.","Upgrade the loading component to the version that supports envelope payload protection.","Check that the deployment-id environment/config value is set and matches execution_payload_state.deployment_id.","If legacy mode is intentional, this database is incompatible — migrate or rewrap, or point the loader at the correct database."],"exampleFix":"// before: legacy load against a protected database\nload_execution_transactions(&pool, None, None).await?;\n// after: supply keys + deployment id\nlet deployment_id = std::env::var(\"EXECUTION_PAYLOAD_DEPLOYMENT_ID\")?;\nload_execution_transactions(&pool, Some(&keys), Some(&deployment_id)).await?;","handlingStrategy":"validation","validationCode":"// Detect protected rows before choosing legacy load\nlet has_state = sqlx::query_scalar::<_, bool>(\n    \"SELECT EXISTS(SELECT 1 FROM execution_payload_state WHERE component='signed_transactions')\"\n).fetch_one(&pool).await?;\nassert!(!has_state, \"database is protected; supply keys + deployment_id\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Propagate payload key config (keys + deployment id) to every component that reads this database.","Fail fast at startup if execution_payload_state exists but keys are unconfigured.","Keep loader and writer versions in lockstep regarding payload protection."],"tags":["database","encryption","configuration","rust"],"backgroundTag":"missing-config-value","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}