Summary
The released trsd library workspace write, workspace submit, reviews decide, and reviews publish commands bind operations whose SDK descriptors require optimistic concurrency, but the canonical command mappings expose only body version/input fields. runOperator initializes empty request headers and never maps the inspected version to If-Match.
Observed on generation 81
trsd library workspace write <id> --input <yaml> --json fails before the service handler with precondition_required: If-Match is required, even though the YAML includes the current workspace version. The same command succeeds through the released SDK descriptor when If-Match: <current version> is supplied.
Required fix
Add a general concurrency input/header path for descriptor-driven CLI commands (not a knowledge-specific bypass), require an inspected/current ETag or exact version, and cover stale and successful write/submit/decide/publish cases. Preserve the API fail-closed precondition.
This was discovered while publishing the governed Platform generation 81 certification; review a479e398-8b53-43af-ab52-8ceebcee2cf6 contains the submitted record.
Summary
The released
trsd library workspace write,workspace submit,reviews decide, andreviews publishcommands bind operations whose SDK descriptors require optimistic concurrency, but the canonical command mappings expose only body version/input fields.runOperatorinitializes empty request headers and never maps the inspected version toIf-Match.Observed on generation 81
trsd library workspace write <id> --input <yaml> --jsonfails before the service handler withprecondition_required: If-Match is required, even though the YAML includes the current workspaceversion. The same command succeeds through the released SDK descriptor whenIf-Match: <current version>is supplied.Required fix
Add a general concurrency input/header path for descriptor-driven CLI commands (not a knowledge-specific bypass), require an inspected/current ETag or exact version, and cover stale and successful write/submit/decide/publish cases. Preserve the API fail-closed precondition.
This was discovered while publishing the governed Platform generation 81 certification; review
a479e398-8b53-43af-ab52-8ceebcee2cf6contains the submitted record.