Finding
Task state machine transitions are enforced only in Python code (\�ackend/app/modules/tasks/lifecycle.py). There is no CHECK constraint or exclusion constraint at the database level.
Risk
A direct database write (bug, migration, admin query) can bypass application-level state machine enforcement, putting tasks into illegal states.
Location
- \�ackend/app/modules/tasks/lifecycle.py\ — \ALLOWED_TASK_TRANSITIONS\ as a Python tuple
- \�ackend/app/modules/tasks/models.py\ — \WorkstreamTask.status\ column has no CHECK constraint
Recommendation
Add a PostgreSQL CHECK constraint on \workstream_tasks.status\ that restricts transitions, or use a state machine pattern in SQLAlchemy that also generates DB constraints.
Severity: Medium
Finding
Task state machine transitions are enforced only in Python code (\�ackend/app/modules/tasks/lifecycle.py). There is no CHECK constraint or exclusion constraint at the database level.
Risk
A direct database write (bug, migration, admin query) can bypass application-level state machine enforcement, putting tasks into illegal states.
Location
Recommendation
Add a PostgreSQL CHECK constraint on \workstream_tasks.status\ that restricts transitions, or use a state machine pattern in SQLAlchemy that also generates DB constraints.
Severity: Medium