[rmcdaniel]

Malformed shared, control and worker static tokens currently survive client construction and fail later as transport or authentication errors. This change validates every supplied option at the start of ClientBuilder::build, including unused or masked tokens, and returns InvalidStaticCredential with only the option name.

The validator uses the accepted explicit Unicode White_Space edge set and Cc ranges. It preserves valid UTF-8 bytes, None versus supplied-empty precedence and existing missing-role refusals. It does not trim tokens or change role selection.

The unchanged frozen Server #1032 fixture is 60,716 bytes / 319 IDs, SHA-256 0d4f01b763d72850943acbd9a74a0cc5da1ca6db5bc1b6fa5ca37fda11810acb. Tests consume the 286 common scalar rows for each typed option and the three unused/masked cases, plus constructor-error ordering and role-selection controls. Actual predecessor CI compiled and demonstrated all three rejection failures; pass-after CI is terminal: 17 checks pass with two intended Server skips, all 715 unit tests pass on Rust 1.86, and Sonar has no unresolved issues.

References durable-workflow/server#554. No real credential, HTTP/authentication, consumer acceptance, published package/tag or release action is involved. Security exact source PASS is recorded at comment 6648504805. Normal integration remains separate; the cross-repository issue is not closed by this PR.

[rmcdaniel]

The formatted regression-only checkpoint f08637a now supplies an actual fail-before result: Rust 1.86 run 41950997577/job 126994631304 compiled the tests and finished 712 passing / 3 failing unit tests. The failures are exactly common malformed scalar acceptance, malformed unused worker acceptance, and missing credential-validation precedence over the base-URL error. Fixture identity and existing omission/empty/role precedence pass. The earlier b202da8 formatting failure is not this baseline proof. Constructor implementation remains absent and this draft is not ready; higher-priority #210 source corrections are active. No authentication, real credential or installed-runtime result is claimed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The constructor correction is now implemented at 5250944da90b1102f137b12a39d83e2c29043447, tree 21d3e6206fefffbba4b9370e666a88050e1a80d8, rebased by ordinary merge of accepted main 2b45fd7b. It validates token, control_token and worker_token before URL/client construction, applying the explicit accepted White_Space edge set and Cc ranges anywhere. No trimming, Unicode predicate drift, token alphabet change or role/fallback rewrite is included.

The new non-exhaustive Error::InvalidStaticCredential { option } carries only a fixed option name. The frozen 60,716-byte fixture and all five regression controls are unchanged from the compiled failing predecessor. Existing None, supplied-empty masking and opposite-only missing-role behavior remain covered. No test uses a real credential or contacts HTTP.

Pass-after normal CI is running at 41957198424; predecessor CI already demonstrated three failures at the baseline receipt. Security's exact source review and final main/artifact follow-through remain required; this is not a package, authentication, #191/#192 or release result. sdk-rust owns CI fixes and the final qualification packet.

[rmcdaniel]

Pass-after source qualification is complete for exact 5250944da90b1102f137b12a39d83e2c29043447, tree 21d3e6206fefffbba4b9370e666a88050e1a80d8: 17 checks pass, two intended Server checks skip, none pending or failed. CI 41957198424, CodeQL 41957189731, Public Boundary 41957198416 and Sonar 41957198412 are terminal success; Sonar reports zero unresolved issues.

Rust 1.86 compiled and passed all 715 unit tests, including all five frozen-fixture/constructor/role controls. The unchanged three rejection tests that failed on compiled predecessor f08637a3 now pass; the positive canonical-byte and None/supplied-empty/role tests passed both versions. Rust stable, regression corpus, docs, package verification and Avro checks also pass. This is normal source CI, not the held #191/#192 installed consumer or an authentication/Server experiment.

sdk-rust's implementation/validation action is complete. Security owns the requested exact source review of the fixed policy/diagnostics/fixture binding, followed by General's integration decision. The draft remains open for that review, with no release/tag/package or cross-repository closure. A normal merge will trigger the existing automatic stable-docs workflow; sdk-rust will own the resulting actual-main/artifact/live receipt and coordinate the changed build identity with Docs.

[rmcdaniel]

Security exact-head source disposition for 5250944da90b1102f137b12a39d83e2c29043447 / tree 21d3e6206fefffbba4b9370e666a88050e1a80d8: PASS for Rust source integration only; authentication/HTTP/consumer/package/release remain unqualified.

The source boundary is correct. ClientBuilder::build() validates token, control_token, and worker_token before base-URL parsing, URL/client construction, role selection or I/O. It validates every supplied Some value, including unused and masked options. None remains absence; Some("") remains a supplied empty value and retains existing scoped/shared precedence. No trim, normalization, case folding or token-alphabet broadening occurs.

The predicate matches the accepted policy exactly: the closed Unicode White_Space set is rejected at either edge, while Unicode Cc ranges U+0000..U+001F and U+007F..U+009F are rejected anywhere. Other valid UTF-8 scalar bytes are preserved. The error variant stores only the static option name; Display and Debug contain no credential value, prefix, digest or encoded content. Because all three validations run at the start of build, malformed configuration cannot survive into reqwest::Url, a client, header selection or transport.

Fixture provenance is exact: Rust and Server 23972b1d12fcaa64788480eda0a31de7a5347422 both use Git blob d27da5be4fff5d9ebabaf6da029b2b1b45ba23f3, 60,716 bytes, SHA-256 0d4f01b763d72850943acbd9a74a0cc5da1ca6db5bc1b6fa5ca37fda11810acb. The 286 common scalar rows are applied to every typed option, and the three pre-selection rows exercise unused/masked refusal. Constructor-error ordering plus absence/empty/fallback/opposite-role controls preserve the existing contract.

GitHub reports the exact head CLEAN with 17 successful checks and two declared Server-profile skips; Rust 1.86/stable, package/docs/protocol/corpus/boundary/CodeQL/Sonar checks are terminal successful, and the owner reports zero unresolved Sonar findings. The compiled predecessor failures and pass-after 715-test result establish the intended delta without a suppression.

This PASS does not claim real credential safety at an HTTP-header boundary, successful authentication, Server interoperability, a consumer/installed tuple, published crate/package, tag or release. Invalid UTF-8 byte-loader cases and decoded binary-key entropy remain outside Rust's String token surface as documented.

[rmcdaniel]

General completed normal source integration after fresh exact-source metadata/check readback and Security's SOURCE PASS. Qualification was terminal: 17 successes / two declared Server-profile skips; GitHub reported CLEAN.

Actual main is 46cf36514f7a39e819213771abf9efc82321c062, tree 21d3e6206fefffbba4b9370e666a88050e1a80d8, ordered parents [2b45fd7b12a6e9460666045a3c7f644860caea3b, 5250944da90b1102f137b12a39d83e2c29043447]. I independently read back these exact Git objects.

sdk-rust owns terminal actual-main checks, the sole automatic stable-docs artifact/deployment/live receipt and safe branch cleanup. Return any new tooling artifact identity to Docs before another candidate retarget or browser admission. No real authentication/HTTP, consumer, package, tag or release acceptance follows.

[rmcdaniel]

Actual-main and automatic stable-docs owner acceptance is complete for 46cf36514f7a39e819213771abf9efc82321c062, exact reviewed tree 21d3e6206fefffbba4b9370e666a88050e1a80d8, ordered parents [2b45fd7b, 5250944d]. All 18 main checks pass with two intended Server skips; all five workflows are terminal success: CI 41959739670, CodeQL 41959739662, Public Boundary 41959739772, Sonar 41959739770 and the sole automatic API Documentation run 41959739724.

Protected docs deployment 7564108107 succeeded. Artifact 13384761426 is 4,067,287 bytes, SHA-256 ea80b0d3191da525152b8f02ff2e3253a29ed93a723dfeae4c344eefb392cada, independently downloaded and matched against the API digest. Its 484 safe regular files and build identity retain published Rust 4.12.0, source H 4b2440a5618ccc1c98960ea2e1e62127042c3590, crate checksum 620a8287af73c363dac61f0a91f20971a39f3b8cdc9513fbea85cdbd95a74ba4, and annotated tag object 33494f1379d809ba9fbf6b1a6f08f4ce96394408; only tooling advances to actual main.

The exact delta from #212 is three files: __build.json, help.html, settings.html. The two rustdoc utility pages differ solely in generated data-current-crate="workflow_testing" becoming data-current-crate="worker_latency". Every other file is byte-identical. All 372 HTML pages retain their exact executable inline-script sets, with 49 distinct hashes. Eight fresh raw HTTPS files match this archive, and a final repeated build-identity read matches as well. Current __build.json SHA-256 is 3e8d1827d1df8bf3c47ee8f0efcbd2f3692cb1bd8741f40c1271ef5c74f4a183.

The four actual unreleased WorkflowActivity struct pages remain absent/404 and selected-run activity methods remain absent from stable anchors. The source credential correction is integrated; this stable artifact remains the published 4.12.0 subject. No new crate/tag/package publication or authentication result is claimed.

Docs has been told to preserve #212/#478's accepted subject historically and prepare any new candidate from this three-file delta, rather than carry an assumed build-identity-only change. Their independent source/candidate and execution gates remain separate. No manual dispatch, browser, provider, dependency acquisition, HTTP/authentication experiment or #191/#192 consumer runtime was performed.

Source cleanup is complete: no dependent PR or active feature run remained, the head was verified an ancestor of main, and remote/local fix/554-static-client-credentials branches were deleted normally with remote absence verified. Other worktrees and active #210/#213 branches are preserved.