@obsunified/collector 2.2.1 → 2.2.3

package/src/auth/dashboard-auth.ts

@@ -293,6 +293,21 @@ export function createDashboardAuth(config?: DashboardAuthConfig): {
 				: new LoginRateLimiter(config?.loginRateLimit ?? {});
 		let warnedUnkeyedClient = false;
 
+		// `Secure` when the request itself is https, or when the operator
+		// declared a trusted TLS-terminating proxy (`trustProxyHeaders`, i.e.
+		// TRUST_PROXY) that reports `X-Forwarded-Proto: https`.
+		const isSecureRequest = (
+			c: Context<{ Bindings: CollectorEnv }>,
+			limitConfig: { trustProxyHeaders?: boolean } | undefined,
+		): boolean =>
+			c.req.url.startsWith("https:") ||
+			(limitConfig?.trustProxyHeaders === true &&
+				c.req
+					.header("x-forwarded-proto")
+					?.split(",")[0]
+					?.trim()
+					.toLowerCase() === "https");
+
 		app.post("/auth/login", async (c) => {
 			const configuredPassword = config?.password ?? c.env.DASHBOARD_PASSWORD;
 			if (!configuredPassword) {
@@ -342,7 +357,7 @@ export function createDashboardAuth(config?: DashboardAuthConfig): {
 			const sig = await sign(payload, configuredPassword);
 			const cookieValue = `${payload}.${sig}`;
 
-			const isSecure = c.req.url.startsWith("https:");
+			const isSecure = isSecureRequest(c, config?.loginRateLimit || undefined);
 			c.header(
 				"Set-Cookie",
 				`${SESSION_COOKIE}=${encodeURIComponent(cookieValue)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${SESSION_MAX_AGE}${isSecure ? "; Secure" : ""}`,
@@ -405,7 +420,7 @@ export function createDashboardAuth(config?: DashboardAuthConfig): {
 		});
 
 		app.post("/auth/logout", (c) => {
-			const isSecure = c.req.url.startsWith("https:");
+			const isSecure = isSecureRequest(c, config?.loginRateLimit || undefined);
 			c.header(
 				"Set-Cookie",
 				`${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${isSecure ? "; Secure" : ""}`,

package/src/lib/ai-store/calls.ts

@@ -53,6 +53,48 @@ export async function ingestAICallBatch(
 	await db.batch(batch);
 }
 
+function mapAICallRow(row: AICallRow): AICallRecord {
+	return {
+		projectId: row.project_id ?? "default",
+		callId: row.call_id,
+		traceId: row.trace_id,
+		spanId: row.span_id,
+		serviceName: row.service_name,
+		modelName: row.model_name,
+		provider: row.provider,
+		callType: row.call_type,
+		requestJson: row.request_json,
+		responseJson: row.response_json,
+		promptTokens: row.prompt_tokens,
+		completionTokens: row.completion_tokens,
+		totalCostUsd: row.total_cost_usd,
+		latencyMs: row.latency_ms,
+		isError: row.is_error === 1 || row.is_error === true,
+		errorMessage: row.error_message,
+		occurredAt: row.occurred_at,
+		receivedAt: row.received_at,
+		expiresAt: row.expires_at,
+		sessionId: row.session_id ?? null,
+		interactionId: row.interaction_id ?? null,
+	};
+}
+
+/** One call by id, scoped to the project; `null` when absent. */
+export async function getAICallById(
+	db: SqlDb,
+	projectId: string,
+	callId: string,
+): Promise<AICallRecord | null> {
+	if (!projectId) throw new Error("AIStore.getAICall: projectId is required");
+	const row = await db
+		.prepare(
+			`SELECT * FROM ai_calls WHERE project_id = ? AND call_id = ? LIMIT 1`,
+		)
+		.bind(projectId, callId)
+		.first<AICallRow>();
+	return row ? mapAICallRow(row) : null;
+}
+
 export async function getAICallsOverview(
 	db: SqlDb,
 	options: AICallsOverviewOptions,
@@ -109,29 +151,7 @@ export async function getAICallsOverview(
 			.bind(...summaryParams)
 			.first<AICallSummaryRow>()) || {};
 
-	const calls: AICallRecord[] = (results.results || []).map((row) => ({
-		projectId: row.project_id ?? "default",
-		callId: row.call_id,
-		traceId: row.trace_id,
-		spanId: row.span_id,
-		serviceName: row.service_name,
-		modelName: row.model_name,
-		provider: row.provider,
-		callType: row.call_type,
-		requestJson: row.request_json,
-		responseJson: row.response_json,
-		promptTokens: row.prompt_tokens,
-		completionTokens: row.completion_tokens,
-		totalCostUsd: row.total_cost_usd,
-		latencyMs: row.latency_ms,
-		isError: row.is_error === 1 || row.is_error === true,
-		errorMessage: row.error_message,
-		occurredAt: row.occurred_at,
-		receivedAt: row.received_at,
-		expiresAt: row.expires_at,
-		sessionId: row.session_id ?? null,
-		interactionId: row.interaction_id ?? null,
-	}));
+	const calls: AICallRecord[] = (results.results || []).map(mapAICallRow);
 
 	return {
 		calls,

package/src/lib/ai-store.ts

@@ -10,7 +10,11 @@ import type {
 	AISpansOverviewOptions,
 	AISpansOverviewResponse,
 } from "@obsunified/types";
-import { getAICallsOverview, ingestAICallBatch } from "./ai-store/calls";
+import {
+	getAICallById,
+	getAICallsOverview,
+	ingestAICallBatch,
+} from "./ai-store/calls";
 import {
 	getAIEvaluation,
 	ingestAIEvaluations,
@@ -37,6 +41,13 @@ export class AIStore {
 		return getAICallsOverview(this.db, options);
 	}
 
+	async getAICall(
+		projectId: string,
+		callId: string,
+	): Promise<AICallRecord | null> {
+		return getAICallById(this.db, projectId, callId);
+	}
+
 	async purgeExpired(): Promise<number> {
 		return purgeExpiredAIData(this.db);
 	}

package/src/lib/autosre-findings.ts

@@ -15,10 +15,11 @@ import type {
 import {
 	buildCanonicalNodeId,
 	buildFindingFingerprint,
+	OntologyNodeKindSchema,
 } from "@obsunified/types";
 import { consoleLogger, type Logger } from "../framework/logger";
 import { computeChangeBlastRadius } from "./autosre-change-correlation";
-import { randomHex } from "./hash";
+import { randomHex, sha256Hex } from "./hash";
 import { parseJsonArray, parseJsonRecord } from "./json";
 import type { SqlDb } from "./sql-db";
 
@@ -221,6 +222,97 @@ function resolveSafeCausalProofTier(
 	return "unverified_locus";
 }
 
+export interface FaultLocusSpanRow {
+	service_name: string | null;
+	span_name: string;
+	status_message: string | null;
+	error_signature?: string | null;
+}
+
+/** Looks up the span a finding's fault locus refers to (newest match wins). */
+export async function loadFaultLocusSpan(
+	db: SqlDb,
+	projectId: string,
+	environment: string,
+	spanId: string,
+	traceId?: string,
+): Promise<FaultLocusSpanRow | null> {
+	if (!spanId) return null;
+	return db
+		.prepare(
+			`SELECT service_name, span_name, status_message, error_signature
+			 FROM telemetry_spans
+			 WHERE project_id = ? AND environment = ? AND span_id = ?
+			 ${traceId ? "AND trace_id = ?" : ""}
+			 ORDER BY start_time DESC
+			 LIMIT 1`,
+		)
+		.bind(
+			...(traceId
+				? [projectId, environment, spanId, traceId]
+				: [projectId, environment, spanId]),
+		)
+		.first<FaultLocusSpanRow>();
+}
+
+/** Fingerprint inputs derivable from a span; empty fields are left undefined. */
+export type SpanFingerprintInput = Pick<
+	FindingFingerprintInput,
+	"environment" | "originatingNodeId" | "downstreamTargetNodeId"
+> &
+	Partial<
+		Pick<FindingFingerprintInput, "normalizedOperation" | "errorSignature">
+	>;
+
+/** True for `kind:env:ns:name...` ids built by buildCanonicalNodeId. */
+function looksLikeCanonicalNodeId(id: string): boolean {
+	const parts = id.split(":");
+	return (
+		parts.length >= 4 &&
+		(OntologyNodeKindSchema.options as readonly string[]).includes(parts[0])
+	);
+}
+
+/**
+ * Splits a `<traceId>:<spanId>` span locus. Returns null for anything that
+ * is a canonical node id or does not have exactly two non-empty parts.
+ */
+function splitTraceSpanLocus(
+	id: string,
+): { traceId: string; spanId: string } | null {
+	if (looksLikeCanonicalNodeId(id)) return null;
+	const parts = id.split(":");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+	return { traceId: parts[0], spanId: parts[1] };
+}
+
+/**
+ * Stable recurrence-fingerprint inputs for a fault-locus span: the service node,
+ * the span name as the operation and the span's error signature (falling back
+ * to its status message). No instance ids participate, so two traces failing
+ * the same way on the same service/route share a fingerprint. Used by both
+ * finding creation and the evidence bundle's prior-finding lookup.
+ */
+export function fingerprintInputFromSpan(
+	span: FaultLocusSpanRow,
+	environment: string,
+): SpanFingerprintInput {
+	return {
+		environment,
+		originatingNodeId: buildCanonicalNodeId({
+			kind: "service",
+			environment,
+			serviceName: span.service_name || "unknown-service",
+		}).id,
+		// Empty strings are "absent": returning undefined lets the caller's
+		// `??` chain reach its title/summary fallbacks.
+		normalizedOperation: span.span_name?.trim() || undefined,
+		errorSignature:
+			span.error_signature?.trim() || span.status_message?.trim() || undefined,
+		downstreamTargetNodeId: null,
+	};
+}
+
 export async function recordInvestigationFinding(
 	db: SqlDb,
 	projectId: string,
@@ -237,23 +329,86 @@ export async function recordInvestigationFinding(
 		.trim()
 		.toLowerCase();
 
-	const defaultOriginNode = input.faultLocusEntityId.includes(":")
-		? input.faultLocusEntityId
+	// Idempotent retries: one key maps to one finding id per project and
+	// environment, and a replay returns the stored finding untouched.
+	const idempotencyKey = input.idempotencyKey?.trim();
+	let idempotencyId: string | undefined;
+	if (idempotencyKey) {
+		idempotencyId = `fnd_k${(await sha256Hex(`${projectId}\u0000${environment}\u0000${idempotencyKey}`)).slice(0, 20)}`;
+		const replay = await getInvestigationFinding(
+			db,
+			projectId,
+			idempotencyId,
+			environment,
+		);
+		if (replay) return replay;
+	}
+
+	// Findings pointing at a span id (no colon) must not mint a per-incident
+	// fingerprint. Resolve the span to its service/operation/error signature so
+	// every incident on the same service + route + error shares one identity.
+	// Caller-supplied fingerprint fields always win; unknown spans fall back to
+	// treating the locus id as a service name.
+	const supplied: Partial<FindingFingerprintInput> =
+		input.fingerprintInput ?? {};
+	const locusId = input.faultLocusEntityId.trim();
+	let spanDerived: Partial<FindingFingerprintInput> = {};
+	const traceSpan =
+		input.faultLocusEntityKind === "span" ? splitTraceSpanLocus(locusId) : null;
+	if (traceSpan) {
+		const spanRow = await loadFaultLocusSpan(
+			db,
+			projectId,
+			environment,
+			traceSpan.spanId,
+			traceSpan.traceId,
+		);
+		if (spanRow) spanDerived = fingerprintInputFromSpan(spanRow, environment);
+	} else if (
+		!locusId.includes(":") &&
+		input.faultLocusEntityKind !== "service"
+	) {
+		const spanRow = await loadFaultLocusSpan(
+			db,
+			projectId,
+			environment,
+			locusId,
+		);
+		if (spanRow) spanDerived = fingerprintInputFromSpan(spanRow, environment);
+	}
+	const defaultOriginNode = locusId.includes(":")
+		? traceSpan
+			? buildCanonicalNodeId({
+					kind: "service",
+					environment,
+					serviceName: locusId,
+				}).id
+			: locusId
 		: buildCanonicalNodeId({
 				kind: "service",
 				environment,
-				serviceName: input.faultLocusEntityId,
+				serviceName: locusId,
 			}).id;
 
-	const fpResult = buildFindingFingerprint(
-		input.fingerprintInput ?? {
-			environment,
-			originatingNodeId: defaultOriginNode,
-			normalizedOperation: input.title,
-			errorSignature: input.summary.slice(0, 120),
-			downstreamTargetNodeId: null,
-		},
-	);
+	const fpResult = buildFindingFingerprint({
+		environment: supplied.environment ?? environment,
+		originatingNodeId:
+			supplied.originatingNodeId ??
+			spanDerived.originatingNodeId ??
+			defaultOriginNode,
+		normalizedOperation:
+			supplied.normalizedOperation ??
+			spanDerived.normalizedOperation ??
+			input.title,
+		errorSignature:
+			supplied.errorSignature ??
+			spanDerived.errorSignature ??
+			input.summary.slice(0, 120),
+		downstreamTargetNodeId:
+			supplied.downstreamTargetNodeId ??
+			spanDerived.downstreamTargetNodeId ??
+			null,
+	});
 
 	// Check for prior verified findings with the same stable fingerprint
 	const priorRow = await db
@@ -346,7 +501,7 @@ export async function recordInvestigationFinding(
 		finalConfidence: confidence,
 	};
 
-	const id = input.id?.trim() || `fnd_${randomHex(10)}`;
+	const id = idempotencyId ?? (input.id?.trim() || `fnd_${randomHex(10)}`);
 	const expiresAt = new Date(Date.now() + 90 * 24 * 3600_000).toISOString();
 
 	await db

package/src/lib/autosre-remediation-gate.ts

@@ -1,6 +1,7 @@
 import type {
 	CausalTriple,
 	EvidenceEntityKind,
+	GrantCallbackDelivery,
 	IncidentInvestigation,
 	IncidentStatus,
 	RemediationActionKind,
@@ -538,8 +539,15 @@ export async function dispatchIncidentWebhook(
 		fetchImpl?: typeof fetch;
 		logger?: Logger;
 		grant?: { proposalId: string; status: string; grantToken: string };
+		/** Test hook: replaces the real backoff sleep between grant attempts. */
+		sleep?: (ms: number) => Promise<void>;
 	},
-): Promise<{ delivered: boolean; status?: number; error?: string }> {
+): Promise<{
+	delivered: boolean;
+	status?: number;
+	error?: string;
+	attempts: number;
+}> {
 	const logger = webhook.logger ?? consoleLogger;
 	const incident = await getIncidentInvestigation(
 		db,
@@ -548,10 +556,14 @@ export async function dispatchIncidentWebhook(
 		webhook.environment,
 	);
 	if (!incident) {
-		return { delivered: false, error: "Incident not found" };
+		return { delivered: false, error: "Incident not found", attempts: 0 };
 	}
 	if (!webhook.grant && incident.dispatchAttempts >= 5) {
-		return { delivered: false, error: "MAX_DISPATCH_ATTEMPTS (5) exceeded" };
+		return {
+			delivered: false,
+			error: "MAX_DISPATCH_ATTEMPTS (5) exceeded",
+			attempts: 0,
+		};
 	}
 
 	let safeUrl: URL;
@@ -581,7 +593,7 @@ export async function dispatchIncidentWebhook(
 			incidentId,
 			error,
 		});
-		return { delivered: false, error };
+		return { delivered: false, error, attempts: 0 };
 	}
 
 	const nowIso = new Date().toISOString();
@@ -620,40 +632,59 @@ export async function dispatchIncidentWebhook(
 	}
 
 	const fetchFn = webhook.fetchImpl ?? fetch;
+	const sleep =
+		webhook.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)));
+	// Grant handoffs retry on network error, timeout and 5xx (never 4xx or a
+	// redirect); each attempt keeps the manual-redirect and 5 s timeout rules.
+	const maxAttempts = webhook.grant ? GRANT_DELIVERY_BACKOFF_MS.length + 1 : 1;
 	let delivered = false;
 	let status: number | undefined;
 	let errorMsg: string | undefined;
+	let attempts = 0;
 
-	try {
-		const res = await fetchFn(safeUrl.toString(), {
-			method: "POST",
-			headers,
-			body,
-			// Never follow redirects: a 3xx could re-aim the POST (and its
-			// signed body, which may carry a grant token) at another host.
-			redirect: "manual",
-			signal: AbortSignal.timeout(5000),
-		});
-		status = res.status;
-		if (res.status >= 300 && res.status < 400) {
-			errorMsg = `Redirect (HTTP ${res.status}) refused`;
-		} else {
-			delivered = res.ok;
-			if (!res.ok) errorMsg = `HTTP ${res.status}`;
+	while (attempts < maxAttempts) {
+		attempts++;
+		let retryable = false;
+		status = undefined;
+		errorMsg = undefined;
+		try {
+			const res = await fetchFn(safeUrl.toString(), {
+				method: "POST",
+				headers,
+				body,
+				// Never follow redirects: a 3xx could re-aim the POST (and its
+				// signed body, which may carry a grant token) at another host.
+				redirect: "manual",
+				signal: AbortSignal.timeout(5000),
+			});
+			status = res.status;
+			if (res.status >= 300 && res.status < 400) {
+				errorMsg = `Redirect (HTTP ${res.status}) refused`;
+			} else {
+				delivered = res.ok;
+				if (!res.ok) {
+					errorMsg = `HTTP ${res.status}`;
+					retryable = res.status >= 500;
+				}
+			}
+		} catch (err) {
+			errorMsg = err instanceof Error ? err.message : String(err);
+			retryable = true;
 		}
-	} catch (err) {
-		errorMsg = err instanceof Error ? err.message : String(err);
+		if (delivered || !retryable || attempts >= maxAttempts) break;
+		await sleep(GRANT_DELIVERY_BACKOFF_MS[attempts - 1]);
 	}
 
 	if (!delivered) {
 		logger.warn("[autosre] incident webhook delivery failed", {
 			incidentId,
 			error: errorMsg,
+			attempts,
 		});
 	}
 
 	if (webhook.grant) {
-		return { delivered, status, error: errorMsg };
+		return { delivered, status, error: errorMsg, attempts };
 	}
 
 	await db
@@ -675,7 +706,37 @@ export async function dispatchIncidentWebhook(
 		)
 		.run();
 
-	return { delivered, status, error: errorMsg };
+	return { delivered, status, error: errorMsg, attempts };
+}
+
+/** Backoff before attempt 2 and 3 of a grant webhook delivery. */
+const GRANT_DELIVERY_BACKOFF_MS = [500, 1500];
+
+/**
+ * Persists the last grant-webhook delivery outcome on the proposal. The JSON
+ * holds only status/attempts/error/time, never the URL or secret.
+ */
+export async function recordCallbackDelivery(
+	db: SqlDb,
+	projectId: string,
+	environment: string,
+	proposalId: string,
+	outcome: { delivered: boolean; attempts: number; error?: string },
+): Promise<GrantCallbackDelivery> {
+	const record: GrantCallbackDelivery = {
+		status: outcome.delivered ? "delivered" : "failed",
+		attempts: outcome.attempts,
+		lastError: outcome.delivered ? null : (outcome.error ?? null),
+		at: new Date().toISOString(),
+	};
+	await db
+		.prepare(
+			`UPDATE remediation_proposals SET callback_delivery = ?
+			 WHERE project_id = ? AND environment = ? AND id = ?`,
+		)
+		.bind(JSON.stringify(record), projectId, environment, proposalId)
+		.run();
+	return record;
 }
 
 interface ProposalRow {
@@ -703,11 +764,42 @@ interface ProposalRow {
 	remediation_agent_run_id: string | null;
 	resulting_change_id: string | null;
 	failure_reason: string | null;
+	callback_url?: string | null;
+	callback_secret?: string | null;
+	callback_delivery?: string | null;
 	created_at: string;
 	updated_at: string;
 	expires_at: string | null;
 }
 
+/** Host (never path, query or credentials) of a stored grant callback URL. */
+function callbackHostOf(url: string | null | undefined): string | null {
+	if (!url) return null;
+	try {
+		return new URL(url).host || null;
+	} catch {
+		return null;
+	}
+}
+
+function parseCallbackDelivery(
+	raw: string | null | undefined,
+): GrantCallbackDelivery | null {
+	if (!raw) return null;
+	try {
+		const v = JSON.parse(raw) as Partial<GrantCallbackDelivery>;
+		if (v.status !== "delivered" && v.status !== "failed") return null;
+		return {
+			status: v.status,
+			attempts: Number(v.attempts ?? 0),
+			lastError: typeof v.lastError === "string" ? v.lastError : null,
+			at: String(v.at ?? ""),
+		};
+	} catch {
+		return null;
+	}
+}
+
 export const mapProposalRow = (
 	row: ProposalRow,
 	grantToken?: string,
@@ -739,6 +831,8 @@ export const mapProposalRow = (
 	remediationAgentRunId: row.remediation_agent_run_id,
 	resultingChangeId: row.resulting_change_id,
 	failureReason: row.failure_reason,
+	callbackHost: callbackHostOf(row.callback_url),
+	callbackDelivery: parseCallbackDelivery(row.callback_delivery),
 	createdAt: row.created_at,
 	updatedAt: row.updated_at,
 	expiresAt: row.expires_at,
@@ -847,7 +941,11 @@ export async function proposeRemediationAction(
 	db: SqlDb,
 	projectId: string,
 	input: RemediationProposalInput,
-	options: { logger?: Logger } = {},
+	options: {
+		logger?: Logger;
+		/** Persisted on a pending proposal and used when it is approved later. */
+		callback?: { url: string; secret?: string };
+	} = {},
 ): Promise<RemediationProposal> {
 	const logger = options.logger ?? consoleLogger;
 	const nowIso = new Date().toISOString();
@@ -977,6 +1075,12 @@ export async function proposeRemediationAction(
 		status = "rejected";
 	}
 
+	// Only a proposal that still awaits a human can use a stored callback; an
+	// autonomous grant is delivered inline by the propose request itself.
+	const storedCallback =
+		status === "pending_human_approval" && options.callback?.url
+			? options.callback
+			: null;
 	const id = `rem_${randomHex(10)}`;
 	const expiresAt = new Date(Date.now() + 30 * 24 * 3600_000).toISOString();
 
@@ -997,8 +1101,9 @@ export async function proposeRemediationAction(
 				expected_current_state_json, desired_target_state_json,
 				requested_autonomy, effective_autonomy, policy_decision_reason,
 				status, grant_token_hash, grant_expires_at,
+				callback_url, callback_secret,
 				created_at, updated_at, expires_at
-			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 			ON CONFLICT DO NOTHING`,
 		)
 		.bind(
@@ -1018,6 +1123,8 @@ export async function proposeRemediationAction(
 			status,
 			grantTokenHash,
 			grantExpiresAt,
+			storedCallback?.url ?? null,
+			storedCallback?.secret ?? null,
 			nowIso,
 			nowIso,
 			expiresAt,
@@ -1123,6 +1230,25 @@ export async function listRemediationProposals(
 	return rows.results.map((r) => mapProposalRow(r));
 }
 
+/**
+ * Reads the grant callback persisted at propose time. Server-side use only:
+ * the secret is never mapped into API responses. Call before
+ * `approveRemediationProposal`, which clears the stored callback.
+ */
+export async function getRemediationCallback(
+	db: SqlDb,
+	projectId: string,
+	proposalId: string,
+	environment?: string,
+): Promise<{ url: string; secret?: string } | null> {
+	const row = await loadProposalRow(db, projectId, proposalId, environment);
+	if (!row?.callback_url) return null;
+	return {
+		url: row.callback_url,
+		...(row.callback_secret ? { secret: row.callback_secret } : {}),
+	};
+}
+
 /**
  * Human dashboard session approval for `pending_human_approval` proposals
  * (RFC 0013 § 6.B & P1 #4). Mints a single-use `grantToken`.
@@ -1169,6 +1295,8 @@ export async function approveRemediationProposal(
 			     grant_expires_at = ?,
 			     approved_by_user_id = ?,
 			     approved_at = ?,
+			     callback_url = NULL,
+			     callback_secret = NULL,
 			     updated_at = ?
 			 WHERE project_id = ? AND environment = ? AND id = ?
 			   AND status = 'pending_human_approval'`,
@@ -1241,6 +1369,8 @@ export async function rejectRemediationProposal(
 			`UPDATE remediation_proposals
 			 SET status = 'rejected',
 			     grant_token_hash = NULL,
+			     callback_url = NULL,
+			     callback_secret = NULL,
 			     failure_reason = ?,
 			     updated_at = ?
 			 WHERE project_id = ? AND environment = ? AND id = ?