src/Arcp.Runtime/Internal/JobSubmitFlow.fs registers the JobRecord, claims the idempotency key, creates the cancellation source, and starts the expiry watchdog before issueCredentialsAsync completes. If the provisioner returns an error, the code writes an error response but does not remove the job, release the idempotency key, cancel the watchdog, dispose the cancellation source, or mark the job terminal. A failed job.submit can therefore leave a pending job visible in list results and reserve an idempotency key for work that was never accepted.
Fix prompt: make credential provisioning part of the acceptance transaction. Either issue credentials before registering the job and claiming durable idempotency state, or add an explicit cleanup path that removes the job record, releases the idempotency key, stops and disposes the watchdog, cancels and disposes the cancellation source, and revokes any partially tracked credentials before responding with the error. Add integration tests with a provisioner that throws and a provisioner that returns an ArcpException, then assert ListJobsAsync does not show a pending job and retrying the same idempotency key is not poisoned by the failed attempt.
src/Arcp.Runtime/Internal/JobSubmitFlow.fsregisters theJobRecord, claims the idempotency key, creates the cancellation source, and starts the expiry watchdog beforeissueCredentialsAsynccompletes. If the provisioner returns an error, the code writes an error response but does not remove the job, release the idempotency key, cancel the watchdog, dispose the cancellation source, or mark the job terminal. A failedjob.submitcan therefore leave a pending job visible in list results and reserve an idempotency key for work that was never accepted.Fix prompt: make credential provisioning part of the acceptance transaction. Either issue credentials before registering the job and claiming durable idempotency state, or add an explicit cleanup path that removes the job record, releases the idempotency key, stops and disposes the watchdog, cancels and disposes the cancellation source, and revokes any partially tracked credentials before responding with the error. Add integration tests with a provisioner that throws and a provisioner that returns an
ArcpException, then assertListJobsAsyncdoes not show a pending job and retrying the same idempotency key is not poisoned by the failed attempt.