Repository navigation
Keep embedded history imports within their target namespace #928
Description
Delivered in Workflow2.15.12, immutable source 7c80ffccdb6ab6e6ace8339618a9d6f1d6d9432f, and adopted by the actual published PHP Server2.11.8 image. Final downstream installed acceptance completes Server#765: cross-namespace run/instance conflicts refuse without writes, legitimate/repeated imports work, canonical ownership holds across list/resolution, activity-poll replay and workflow-history continuation, and signing-key controls pass. Every cell verifies all2259 committed Core files/12 runtime origins and369 Server files before/after, with no source overlay. The generated image provenance is validated separately from Composer's path locator. The normal image/chart publisher passes.
Core package qualification remains in the2.15.12 receipt: all17published jobs pass, normal Composer adoption, full package-byte/origin proof and the complete86-case bridge on SQLite/MySQL. The prior2.15.11 installed import/namespace/history/retention/projection275-case and lineage79-case receipts remain retained. This closes the PHP package and actual Server delivery requirement; native/shared/frozen work remains with its owner. Broader Server#789 ingress/recovery acceptance stays open separately.
Historical review and original acceptance criteria follow. Historical checks below do not replace qualification of the current head.
Previous immutable review: The continuation authority blocker is corrected in exact draft PR #929 head a6f9195ba74a7dd601943efb3467c8bf6696427e / tree 1cd553c06a1110e81683d6cf392e5db33d11961f. Both continue-as-new paths now require the exact locked imported parent/child edge before copying a child link or imported parent reference; an unresolved raw imported parent reference is not propagated. The six new successor controls pass with 49 assertions and produce four intended failures against 5e01a938, while the two legitimate imported-edge cases remain green. The exact full lineage matrix passes on SQLite and MySQL (55 tests / 402 assertions, two PostgreSQL-only skips each) and PostgreSQL (55 / 445, no skips). Focused ECS/PHPStan pass. Exact evidence and counterfactual. Security accepts this immutable source and terminal hosted run 40252025019: all eight executed jobs passed, seven path/bounded-selection jobs skipped, none failed. The PR remains draft and behind main; no merge, publication, or deployment is claimed, and any rebase/successor requires fresh validation.
The broader fix fences imported targets, same-bundle commands, directed lineage effects, and self-lineage. Its retained 129-case import cohort passed on SQLite/MySQL/PostgreSQL; new scope controls passed on each database; 42 prior-source assertion failures plus five valid controls and zero errors demonstrated the preceding defects. Earlier evidence.
Next: complete the copied-reference/runtime audit and full style/static/unit/coverage/feature qualification; qualify database/concurrency/retry/legacy controls on current main; update draft #929 with a backed-up exact source and obtain fresh review. Publish a qualified immutable Core package and verify the actual PHP Server consumer/image under its existing publication gates. Native/shared/frozen work remains with its owner. PHP signing-key URL follow-through remains in Server #765; separate query authority is in Server #526 / draft #758.
An embedded v2 history bundle imported into one namespace can resolve an existing run or workflow instance in another namespace. Published PHP Server reproduction and downstream delivery requirements are tracked in durable-workflow/server#765. The defect remains present in current Workflow 2.13.1.
The importer must reject a globally conflicting run ID rather than return already_imported for another namespace. It must also refuse to attach an imported run to a foreign workflow instance, preserve all existing rows, and keep same-namespace repeat imports idempotent. Preview and actual import must agree on these conflicts, including the embedded null namespace.
The related reference audit from durable-workflow/server#764 also remains required before declaring the import boundary complete: both directions of lineage links, signal/update command references, and other copied relational IDs must preserve namespace ownership. Define safe handling for unresolved related IDs without silently creating future cross-namespace edges. Preserve legitimate import and same-namespace lineage behavior, and qualify the affected database families.
General owns the PHP implementation and downstream follow-through. Source tests and a merged Core fix do not complete Server delivery: publish a new immutable Workflow package, update the Server consumer, and verify the actual fixed published image under its existing publication gates. Native implementation and shared fixtures remain with their current owner.
Activity
rmcdaniel commentedon Oct 25, 2026
Lineage compatibility decision: simply rejecting every unresolved endpoint would prevent importing a parent and child whose bundles both contain the edge in either order. The current import contract explicitly permits diagnostic lineage from separate bundles, so the remaining fix must preserve that legitimate journey while preventing active cross-namespace edges.
The candidate design is quarantined deferred import state, bound to the namespace and exact import/receipt identity. Deferred edges must stay absent from replay, export, runtime and wait projections. Activation requires both endpoints to exist and be revalidated in that namespace under an atomic fence; an unrelated later run with a matching ID must not capture the edge. Retry, cleanup and expiry behavior must be explicit and inspectable. Security reviewed these design boundaries in coordination; no schema or implementation acceptance is claimed yet.
The next source action is the complete copied-reference inventory and ownership checks, beginning with signal/update command IDs and their later application path, plus update failure references, activity attempt/task references, history references and both lineage directions. Direct target guards are isolated in draft #929. Keep #928 and downstream Server #765 open through complete graph qualification and installed delivery.
rmcdaniel commentedon Oct 25, 2026
Lineage design update from the native owner's current implementation: omitting an unresolved physical edge is different from rejecting the entire import. Because a normal source link appears in both endpoint exports, the second endpoint's own import may be able to materialize the link after both runs exist in the same namespace. This could preserve either import order without persistent pending state. No quarantine table or schema change has been implemented; the earlier quarantine discussion remains a candidate, not a settled implementation requirement.
PHP needs an additional check before adopting that path. Source inspection at
f0e6e9beshowsRunLineageView::resolveRun()globally finding a bundle/history-supplied related run ID after its same-instance lookup.ChildRunHistoryalso has run/instance fallback resolution. Typed history can therefore reconstruct lineage independently of the physical link writer; omitting an unresolvedworkflow_linksrow alone is not yet proof that a later foreign or unrelated matching ID cannot be resolved. This is a source finding, not a newly executed lineage leak or native-runtime claim.Next proof: exercise parent-first and child-first source bundle imports, then introduce unrelated matching IDs and rebuild/query/export the lineage. Validate both physical links and history/projection fallback lookups. Preserve legitimate same-namespace related imports and original history attribution. Historical event-command references also need their own controls: continuation moves an accepted message command to the successor, so the earlier event's identifier cannot be treated as an active same-run message-command reference. Remaining copied fields stay in the full #928 audit.
rmcdaniel commentedon Oct 31, 2026
General resumed the current-main integration of this accepted PHP defect. The previous immutable reviewed source
a6f9195ba74a7dd601943efb3467c8bf6696427eis preserved; its Security approval and historical test results remain scoped to that exact tree.The old working copy also contained an unfinished copied-reference audit. That code is now backed up unchanged as
82a0a86e628b493cf5b57eee24a5eea6d9eaa0ab, branchwip/928-reference-audit-20261031: seven tracked-file changes plusEmbeddedV2ImportReferences, 1,045 insertions / seven deletions. It is unqualified work in progress, not new security acceptance. The original dirty working copy is preserved.A separate successor starts at current main/Core 2.15.10 (
e2b199673d087fd278628db066e215217eec61cb) and merges the reviewed source. Three conflicts remain:ChildRunHistory,EmbeddedV2HistoryImportand the embedded replay corpus test. Next: resolve those while retaining current callback/late-child fixes and corpus cases, review and port the backed-up reference audit, then qualify namespace/lineage/retry/legacy/concurrency controls and the full quality cycle. Native/shared/frozen work remains with its owner. No successor source is yet qualified, merged, published or deployed.rmcdaniel commentedon Oct 31, 2026
Current-main integration is backed up as
7a7361cec05af26cfb10746cc36780e284ea47b6onfix/928-current-main-authority. The three conflicts are resolved, preserving Core 2.15.10's configured-storage and late-child fixes, current replay corpus cases, and the prior import authority fences. Draft #929 still points at the previously reviewed immutable source; its Security acceptance does not cover this successor or the recovered reference-audit changes.Fresh PostgreSQL recovery controls exposed four failures in six cases, without test errors: a repeat import could repair links inside a caller-owned transaction, schema inspection could consult the application database instead of Workflow storage, and either endpoint direction could attach an unrelated later same-namespace run. The candidate uses one configured-storage serializable boundary for fresh imports and repairs, and requires persisted relationship evidence before restoring a missing edge. The expanded import cohort passed 204 tests / 1,567 assertions / one skip, including preview/write controls against both native and imported unrelated endpoints.
Additional controls found and corrected an unresolved update-failure reference, rejection of a valid repeat import containing its own failure, disagreement between reciprocal continuation exports about a missing sequence, and redrive successor-first compatibility. Cleanup controls also reproduced four failures where copied requested/resolved IDs let pruning delete another workflow's message rows, including across namespaces. That deletion now requires the pruned run's workflow-instance ownership. The combined real continuation/redrive, update-failure and cleanup controls pass 11 tests / 83 assertions.
These are local candidate results, not final qualification. Full style/static/unit/coverage/feature checks, the complete database/concurrency/corpus matrix, fresh exact-source review, an immutable Core release and actual PHP Server delivery remain required. Native/shared/frozen work remains with its owner; existing image-publication gates remain in force.
rmcdaniel commentedon Oct 31, 2026
Final-head review found a further legacy namespace case at
0daa5a18: an older import can leave runs from different namespaces attached to the same instance. Signal/update views trusted the shared instance ID and exposed the other namespace's command metadata. A valid isolated reproduction gives four intended failures and five passing controls, zero errors. The permanent extended regression now covers message metadata, current-run resolution/detail data and pointer writes: against preceding source, 12 tests / 30 assertions, eight intended failures and four passing controls, zero errors; the local repair passes 12 / 50. Same-namespace handoff/navigation controls remain valid, and rejected reads/pointer writes preserve stored rows.The repair adds command-run namespace checks, scopes current-run lookup and pointer synchronization by both instance and namespace, and prevents foreign instance/cached-summary metadata from reaching run details. Source is not yet committed or pushed; full style/non-fixing style and static qualification are running, then database and complete quality checks must be repeated for the changed runtime. Historical approval is not extended to this source.
The preceding full unit run was stopped at partial progress after this reproduction and is not a pass; coverage/feature did not run. It also exposed two existing bounded-history byte-count failures on SQLite 3.40.1 (32,051 expected versus 51 reported for NUL-bearing payloads). That separate compatibility defect is under diagnosis and must be corrected before claiming the full quality cycle. No package or fixed Server image has been published.
rmcdaniel commentedon Oct 31, 2026
Further legacy retention regression, corrected in
f5bb8c769e8c59f80f076a90723376a9005097ae/ treeafbe29445e580a4d38fae418f4e8ce2f34670099.A prior import can leave differently namespaced runs sharing one instance. Pruning a closed run still trusted that shared instance ID and a copied requested/resolved reference, deleting the other namespace's commands, signals and updates. Unbound commands had the same problem when their owning instance belonged to another namespace.
The repair requires the owning run's exact instance and namespace, or the instance namespace for a command with no owning run. It preserves legitimate same-namespace cleanup, including embedded null namespaces. The database identity predicate is shared with current-run resolution so MySQL/MariaDB collation cannot fold distinct namespaces together.
The exact final regression test bytes against
905c7520give 24 tests / 48 assertions: 16 intended failures, eight valid controls, zero errors. The complete corrected retention file passes 34 tests / 260 assertions. Full ECS, a subsequent non-fixing style check and full PHPStan pass. The source is committed and pushed to draft #929.The preceding matrix passed four 580-case cells before this finding; it was stopped before the last MariaDB/full quality phases and is not final qualification. A fresh 604-case matrix and complete unit/coverage/feature sequence are now running on the new source. Core 2.15.11 remains prepared, not published; downstream Server acceptance remains open.
rmcdaniel commentedon Nov 1, 2026
Legacy projection follow-through is committed and pushed as
aabcc1ccb7e9157e9cd685ce108c4862e21329e5, tree1c36fb9c74597a18619ef7b6141d2cbcd88077bb.All five 604-case database cells passed at predecessor
f5bb8c76. Its full unit run then stopped at 89 tests / 405 assertions / one projection-rebuild idempotence failure. Coverage and feature did not run. Investigation found that a legacy foreign instance could still supply business metadata to summaries and exports, and repaired summaries could remain incorrectly stale.The repair scopes full/fresh and bounded-claim projection metadata, history exports and detail views; old imported list summaries verify their canonical ownership. Local summary cache schema 3 records the corrected derivation, and the existing rebuild command's drift join now uses exact null-safe namespace identity. Native/current-cache list reads keep their existing path. Foreign durable rows are preserved.
The exact final tests against
f5bb8c76produce 20 tests / 67 assertions, 15 intended failures and five valid controls, zero errors. The fixed source passes 20 tests / 88 assertions, including actual task claims. The unchanged original rebuild test also passes. Eight adjacent files covering projection commands, list contracts, prefetch/memory bounds, retained projections, configured models and role routing pass 135 tests / 468 assertions. Full ECS, a subsequent non-fixing style check and full PHPStan pass.The complete unit, coverage and feature commands are running on this exact successor, followed by an expanded 13-file matrix on PostgreSQL, SQLite, MySQL and both MariaDB modes. Results remain pending. Still draft; Core 2.15.11 is prepared for November 1, not published. Server #765 needs both published-Core adoption and its direct cached-summary API scope checks, then actual fixed-image acceptance under its existing release gates.
rmcdaniel commentedon Nov 1, 2026
Workflow 2.15.11 is published at immutable source
20bbe9402b688ce8399b10c0fbf5caace7d59ab4. Packagist source and distribution references both match that commit. Published verification 41272712132 passed all 17 package/Laravel-PHP jobs. Actual merged-main Sonar binds this source at 04:04:05 UTC with gate OK. The original main PostgreSQL queue-fake failure remains retained; after unchanged local case/file diagnostics, one targeted failed-job/dependants retry passed. Its cause remains unconfirmed; no source, assertion, deadline or gate was changed for that retry.Independent normal Composer update in a consumer upgraded only Workflow 2.15.10 to 2.15.11. All 2,259 installed files match the committed tag, with 13 runtime class origins verified inside consumer vendor before and after execution. No runtime source overlay was used.
The complete import/legacy-namespace, history-budget, retention and projection-command files pass on both PHP 8.3.36 / SQLite 3.40.1 and PHP 8.5.12 / SQLite 3.53.4: 275 tests / 1,668 assertions / zero errors or failures / two MySQL-specific skips per cell. The history-budget file itself passes 46 tests / 168 assertions / two MySQL skips in this consumer; its extra migration assertion runs once per test.
The initial consumer attempt's two missing-helper errors and three command-role failures were harness setup defects: the minimal consumer lacked the published test base's JSON assertion helper, and its migration command initialized application commands before tests installed custom bindings. Copying that unchanged assertion helper and using Testbench's standard post-migration command reset fixes the five cases plus a valid control (6 / 96 pass), then the complete unchanged four-file suite passes above. Product files and regression expectations are unchanged.
Additional complete directed-lineage acceptance passes 79 / 689 / three PostgreSQL skips on SQLite 3.40.1 and 79 / 670 / four skips on SQLite 3.53.4. The latter stock image lacks process-control support. Its extra skipped SQLite reciprocal-import concurrency case now passes separately 1 test / 20 assertions / zero skips on the same PHP 8.5.12 / SQLite 3.53.4 stack in a disposable image adding only official
pcntl/posixtest extensions. Before/after all 2,259 package files still match the tag, with the same 13 verified runtime origins; no product or fixture bytes, assertion, deadline or production dependency changed. Exact source/fixture bytes and package identities remain preserved. Server adoption and its published-image acceptance remain separate under #765 and existing release gates.Commands use the normal installed vendor autoloader, for example:
The consumer uses private file-backed SQLite databases and public packaged migrations. Tests/fixtures are exact tag copies; runtime loading and full package hashes are independently checked.
The additional command is:
Core's published-package and installed import/namespace/lineage acceptance is complete. PHP Server #765 still needs its normal published dependency pin, consumer qualification and image acceptance under existing gates. This does not claim a fixed Server image or Cloud deployment.
rmcdaniel commentedon Nov 1, 2026
Security installed-package disposition for Core 2.15.11:
85a97b382b7cea84bbc4e6f0db3146c1c3f5fd7bdiffers from the Security-cleared production/import source at73a6e6f6f4c5d9c658d33e74c2ce9f7c331ed8b3only by two explicit index names inV2RebuildProjectionsCommandTest; no production or namespace regression assertion changed. Merge commit20bbe9402b688ce8399b10c0fbf5caace7d59ab4has the exact final-head tree.2.15.11, Packagist source and distribution references, and successful 17-job publication run 41272712132 all bind to that merge commit.Security therefore has no remaining Core 2.15.11 source, provenance, or installed-package hold for the #928 namespace boundary. This does not close #928 or Server #765: adoption by the Server consumer, direct cached-summary/API namespace guards, exact published-image qualification, and rollback-preserving rollout remain separate required gates. No Cloud deployment or operator action is claimed.
rmcdaniel commentedon Nov 1, 2026
The additional activity-poll correction is draft PR972, exact immutable source
b04a656e7ccbcf0a6ec293b2e3cd010294e42150. Product train2.15.12 is prepared and remains unpublished.The complete hosted build41284181529 passed at07:32:47UTC:22successful jobs and three expected skips. Exact results: full unit coverage5574tests/76314assertions/48skips/15PHPUnit notices; four MySQL shards total2614/25746/3skips; four PostgreSQL shards total2614/25497/18skips. A separate PostgreSQL contract cohort21/94 is not added to those totals. All five supported Laravel source-upgrade cells, full style/static checks and normal PR checks pass. Combined coverage93.74% (73877/78809) passes the unchanged93.08% floor. Actual Sonar analysis07:01:09 bindsb04, gateOK/zero unresolved issues/zero hotspots.
Local complete
composer featurepassed07:33:26:2614/25746/3skips/zero errors or failures. Local completecomposer coveragepassed07:34:05:5574/76575/48skips/15notices/zero errors or failures; unit-only coverage80.60% (63489/78766) passes its unchanged60.00% floor. That unit-only contract is distinct from the combined CI93.08% contract. The corrected run passes both large-fanout cases and all13cases that previously errored on the overlay runner. The full Postgrescomposer unitrerun with corrected temporary storage remains active; its terminal result and fresh source review are still pending. No package, fixed Server image or Cloud deployment is claimed.The defect: stock2.15.11's
DefaultActivityTaskBridge::poll()filters task namespace alone. An imported legacy task can name the requested namespace while its run or canonical instance belongs elsewhere. Server's preclaim guard refuses those leases, but a batch full of such rows hides valid work behindLIMIT. An actual-stock2.15.11 prepared-Server HTTP probe reproduces ten foreign tasks hiding a valid default-owned activity (1test/6assertions/one intended failure). A disposable source-only bridge overlay resolves that probe, without changing permanent vendor; it is not published-package acceptance.The fix requires exact task, run and canonical instance namespaces in SQL before ordering/limit, retaining ordinary indexed predicates and the existing exact-identity helper.
namespace:nullremains unfiltered embedded behavior. The15newcases cover named/case/null ownership at all three rows, unchanged rows on refusal, and valid work behind a foreign task with limit1. Original20bb bridge: SQLite15/21/nine intended failures/six controls/zero errors; MySQL15/20/ten intended failures/five controls/zero errors, including case-folded task ownership. Corrected focused SQLite15/30 passes. The complete bridge file86/532, zero skips/errors/failures, passes on each MySQL8.0.46, Postgres17.11, SQLite3.40.1 and MariaDB10.11.19 through both drivers. Full1,582-file non-fixing style and static analysis pass.Runner corrections and retained exclusions: the unchanged35case redrive file exposes Redis's string counter (one failure) and passes35/722 with the canonical array cache; no source/assertion change. A basic MySQL fixture account could not SELECT performance_schema lock observations (SQL1142); repository CI's disposable-root profile makes the existing concurrency file pass3/160, then the full suite above passes. The first full MySQL attempt was deliberately stopped/excluded. A tracing migration case times out at its existing15second bound on Docker overlay (1/0/one error); private executable temporary memory storage makes the unchanged case pass1/122 in2.561seconds. Existing stage telemetry confirms migrations-started versus migrations-ready/schema-ready. The first coverage attempt was deliberately stopped/excluded, exit137 from ownstop rather than OOM.
The complete original Postgres unit run is retained:5574/74511/13errors/zero failures/33skips/15notices, completed07:27:31. All13errors are bounded tracing subprocesses (11admit timeouts plus two large-fanout bounds). A four-file tracing control at one CPU gives15/2066/two large-fanout errors; a two-CPU file gives2/557/one pass and one late-inspection timeout. Original20bb bridge with the same two-CPU disabled case passes1/310 in88.621seconds, almost the same90second bound. That comparison alone is inconclusive about source effects. The subsequent complete corrected coverage run above passes every same case. Only temporary storage and task-runner CPU capacity changed; product, assertions, deadlines and coverage contracts did not.
Next: finish the corrected full Postgres unit run, fresh source review and protected integration, publish an immutable qualified patch, then verify actual installed-package/Server adoption and fixed-image acceptance under the existing publication boundary. Core2.15.11's import provenance/acceptance remains valid; this poll-selection gap is additional follow-through.
rmcdaniel commentedon Nov 1, 2026
Workflow2.15.12 is published at immutable source
7c80ffccdb6ab6e6ace8339618a9d6f1d6d9432f. Annotated tag object497cc544b46a897c59f1530062e1cbcf6caaba97points to that merge. Its tree7d1298f1aee7891c221f12506e4fc4d567b32646exactly matches the reviewed/tested PR972 headb04. Packagist source and distribution references both match7c80. Published verification41286988930 passed all17package/Laravel-PHP jobs. Merged-main build41286850309 also passes.A normal independent Composer consumer upgraded only Workflow2.15.11→2.15.12; all other118locked package records stayed identical. All2259installed package files match the immutable tag before and after execution, and12relevant runtime origins resolve inside consumer vendor. No runtime source overlay or root Workflow autoload was used.
The complete unchanged activity-bridge regression file passes 86tests/532assertions/zero errors, failures or skips on each PHP8.3.36/SQLite3.40.1 and PHP8.3.36/MySQL8.0.46. Actual driver/server versions and installed references were captured. The same new15cases against actual installed2.15.11 reproduce nine intended failures on SQLite (15/21, six passing controls) and ten on MySQL (15/20, five passing controls), with zero errors. This confirms both the old artifact behavior and the fixed customer-installable package.
Source qualification is retained in PR972 and the source receipt: full quality-cycle commands, all five86-case database cells, normal/full hosted checks, actual exact-head Sonar and Security source acceptance. The corrected complete Postgres unit run passes5574/76947/33skips/15notices; original overlay-run errors remain retained. Combined CI coverage93.74%/unchanged93.08%floor and unit-only coverage80.60%/unchanged60%floor are distinct passing contracts.
Core2.15.12's package and installed activity-poll acceptance are complete. General is adopting it normally in the PHPServer#765 branch refreshed from currentmain, retaining the separate Server guards and an HTTP poll-window regression. Combined Server checks/protected integration and actual fixed-image acceptance remain open under the existing publication gates. No new Server tag/image or Cloud deployment is claimed.