{"record":{"id":"df71a9ab2c94d2a9","repo":"nautechsystems/nautilus_trader","slug":"current-database-payload-key-is-not-configured-for","errorCode":null,"errorMessage":"Current database payload key is not configured for rewrap","messagePattern":"Current database payload key is not configured for rewrap","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/cache/database.rs","lineNumber":5361,"sourceCode":"        .fetch_optional(&mut *transaction)\n        .await\n        .context(\"failed to lock execution payload state for rewrap\")?\n        .ok_or_else(|| anyhow::anyhow!(\"Execution payload protection is not active\"))?;\n        let state = execution_payload_state_from_row(&state_row)?;\n        anyhow::ensure!(\n            state.protocol_version == EXECUTION_PAYLOAD_PROTOCOL_VERSION\n                && state.deployment_id == keys.deployment_id(),\n            \"Execution payload rewrap context does not match this database\"\n        );\n\n        match state.operation.as_str() {\n            \"ready\" => {\n                let current_id: [u8; 32] = state\n                    .active_key_id\n                    .as_slice()\n                    .try_into()\n                    .context(\"database active payload key ID is invalid\")?;\n                anyhow::ensure!(\n                    keys.contains_key(&current_id),\n                    \"Current database payload key is not configured for rewrap\"\n                );\n                validate_execution_payload_key_inventory(&mut transaction, keys).await?;\n                if current_id == *keys.active_key_id() {\n                    transaction\n                        .commit()\n                        .await\n                        .context(\"failed to complete no-op execution payload rewrap\")?;\n                    return Ok(());\n                }\n                sqlx::query(\n                    \"UPDATE execution_payload_state \\\n                     SET operation = 'rewrap', active_key_id = $1, progress_id = 0, updated_at = NOW() \\\n                     WHERE component = 'signed_transactions'\",\n                )\n                .bind(keys.active_key_id().as_slice())\n                .execute(&mut *transaction)","sourceCodeStart":5343,"sourceCodeEnd":5379,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/cache/database.rs#L5343-L5379","documentation":"In the 'ready' rewrap phase, the state's active_key_id identifies the key currently wrapping payloads in the database. The ensure! requires the supplied PayloadKeySet to contain that key; otherwise old envelopes could never be unwrapped for rewrapping, so the operation aborts.","triggerScenarios":"Calling rewrap_execution_payload_storage in state 'ready' when execution_payload_state.active_key_id is not a key present in the supplied keys set (keys.contains_key(current_id) is false).","commonSituations":"Key rotation replaced the configured active key and dropped the old key from config before the database's envelopes were rewrapped; loading only the new key in a fresh environment while the database still uses the retired key; secret-manager deletion of a still-in-use wrapping key.","solutions":["Add the key whose id equals execution_payload_state.active_key_id to the PayloadKeySet and retry.","Recover the retired wrapping key from your secret manager or backup and register it with the payload key set.","Complete the interrupted rotation: with the old key present, rerun the rewrap so envelopes move to the new active key, then retire the old key.","Compare configured key ids with the database's active_key_id (hex) to confirm which key is missing."],"exampleFix":"// before: only the new key configured, db still on old key\nlet keys = PayloadKeySet::builder().active_key(new_key).build();\n// after: retain the database's current key until rewrap completes\nlet keys = PayloadKeySet::builder()\n    .active_key(new_key)\n    .retained_key(old_key) // must cover execution_payload_state.active_key_id\n    .build();","handlingStrategy":"validation","validationCode":"let active_id: Vec<u8> = sqlx::query_scalar(\n    \"SELECT active_key_id FROM execution_payload_state WHERE component='signed_transactions'\"\n).fetch_one(&pool).await?;\nif !keys.contains_key(active_id.as_slice().try_into()?) {\n    return Err(anyhow!(\"configured key set lacks the database active key {}\", alloy::hex::encode(&active_id)));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["During rotation, retain the old key in config until the rewrap fully completes.","Never delete wrapping keys from the secret manager while the database still references them.","Reconcile configured key ids against execution_payload_state.active_key_id at startup."],"tags":["database","key-management","key-rotation","rust"],"backgroundTag":"missing-credentials","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}