Repository navigation
Embedded v2 history import reads and attaches across namespaces (published 2.11.1) #765
Description
Published Server 2.11.1, with Workflow 2.10.2's EmbeddedV2HistoryImport, lets an embedded v2 history import in one namespace read and change another namespace's workflow state. The route is admin-only, but namespaces are meant to stay isolated.
1. Cross-namespace duplicate. EmbeddedV2HistoryImport::existingRunOutcome looks the bundle's run up in any namespace. A bundle already imported into namespace B, imported again into namespace A, answers 200 with already_imported for A, which holds no such run.
2. Cross-namespace instance attach. EmbeddedV2HistoryImport::writeBundle finds the workflow instance in any namespace and attaches the imported run to it. A run imported into namespace A becomes the current run, and bumps the run count, of an instance that belongs to namespace B.
Evidence. Both behaviors were recorded three times from the published image, with identical results, in tests/Fixtures/ServerParity/workflow-import.json under workflow_import.published_defects (cross_namespace_duplicate, cross_namespace_instance_attach). The fixture arrives with #764.
Native behavior (#764). A run id held in another namespace is refused as run_id_conflict. An instance of another namespace is refused rather than taken over, and the other namespace is left unchanged. The parity fixture keeps the published answers bounded as defects, so native isn't required to reproduce them.
Suggested PHP fix. Scope both lookups by the requested namespace: the existing-run check and the instance resolution in the write. A run id or instance id already present in another namespace should then be a conflict.
Activity
Name the workflow import defects' issue
rmcdaniel commentedon Oct 25, 2026
General is implementing the PHP root correction in durable-workflow/workflow#928. Current-source counterfactual coverage reproduces both original defects in all twelve named/null namespace and write/preview cases: twelve assertion failures, zero test errors, against the unchanged Workflow 2.13.1 import class.
The candidate restricts run-idempotency to the target namespace, reports an explicit foreign-instance conflict before preview/write, and scopes the transaction's locked instance lookup so a preflight race cannot attach the run to a foreign instance. The ordinary run-number-conflict control now explicitly selects its existing namespace, preserving the intended SQL uniqueness/rollback check. Full current-candidate qualification is running; no merged or published correction is claimed.
The reference audit from #764 is retained in Workflow #928, including parent/child links, signal/update command IDs and other copied relational identifiers. These direct target guards do not complete that audit or the installed-image acceptance. Native/shared/frozen work remains with its owner. Server #526's separate query-authority race remains open in draft #758.
rmcdaniel commentedon Oct 25, 2026
The direct target guards are now visible in Workflow draft PR #929 at 5c766e3188fb1fb7ac9ebb267773bcc5e37912f6. Full ECS/PHPStan and 44 tests / 607 assertions pass locally; exact counterfactual and current-scope evidence is in durable-workflow/workflow#929 (comment). Workflow #928 retains the full copied-reference graph and compatible quarantined-lineage work. Hosted qualification and independent partial source review are live. This is source-only, with no package or Server image publication; keep #765 open through complete fixed-image acceptance.
rmcdaniel commentedon Oct 25, 2026
Workflow draft PR #929 now includes the active signal/update command-reference boundary at f0e6e9be13de3d5d3dcdf5de42af720bc35ad8bd. Each message must bind to a matching command imported from the same bundle and transaction. SQLite, MySQL 8.0.46 and PostgreSQL 17.11 each pass 82 tests / 779 assertions; counterfactual worker completions reproduce foreign-command mutation before the guard. Evidence: durable-workflow/workflow#929 (comment) . Full copied-reference/historical/lineage acceptance remains in Workflow #928, including the new source-only projection audit in comment 6402344424. Keep #765 open through complete source and fixed published-image verification. Native/shared/frozen work remains with its owner; no publication is claimed.
Rust #325: fence embedded v2 imports to their own bundle and namespace
rmcdaniel commentedon Oct 25, 2026
Native reference isolation for embedded v2 import, from the Security review of #764. General owns the published PHP side in Workflow #928 and Core #929. Published Server 2.11.1, with Workflow 2.10.2 through 2.13.1, copies every reference a bundle carries without checking it. Native refuses such a bundle. This is the audit of every field the importer copies, at #764 head
6f109c2c118bf3c3c309eb606631357d5a29e6a4.Published defects beyond the two run/instance lookups already recorded here:
command_idcan name another workflow's command. Later application then updates that command by id alone:applied_at, plusoutcomefor updates.activity_execution_idcan name another run's activity. A lost lease then settles that activity, because it is looked up by id alone.signing_keyis read from the query string too. Access logs, tracing and client history keep URLs.What native does (writes are atomic, and nothing is committed on refusal):
commands/signals/updates[].resolved_run_idreferences.foreign_run)commands/signals/updates[].requested_run_idsignals[].command_idupdates[].command_idupdates[].failure_idhistory_events[].workflow_task_id,workflow_command_idworkflow_run_idactivities[].current_attempt_idactivities[].attempts[].workflow_task_id/task_idtasks[].payload.{activity_execution_id, activity_attempt_id, timer_id, workflow_signal_id, workflow_update_id, workflow_command_id}andresume_source_idfor those kindsfailures[].source_id(kindactivity_execution)workflow.archive_command_idlinks.parents/childrenendpointssignals[].signal_wait_id,attempts[].worker_attempt_idworkflow_links(fenced above) or a namespace-checked visible-run lookup.The signing key is read only from the body or the configured secret. A query
signing_keyin any spelling,signing_key[]included, gets 422signing_key_in_query, and the answer never repeats the value.Evidence:
rust/tests/execution/workflow_import_fences.rsruns on SQLite, PostgreSQL and MySQL. It covers refusal in both lineage directions, refusal of a foreign instance, a deferred link that a later foreign run never captures, refusal of each foreign row reference, forged signal and update rows refused at application, worker and operator 403s with admin as the positive control, and the URL signing key. Each refusal is checked against byte-for-byte export snapshots of the other namespace. Without the fence and predicates, five of the seven tests fail.🤖 Generated with Claude Code
rmcdaniel commentedon Oct 25, 2026
PHP source follow-through is now at Workflow PR #929 head
c2d32ac2171587e27f76c6b8ad7393f2e1e62456, still draft. Evidence and exact remaining gates cover the new-import lineage slice, same-bundle message command ownership, and direct target guards.Both lineage directions now check namespace plus run/instance identity, missing endpoints do not become physical edges, and display/export and ChildRunHistory reader fallback cannot attach a later unrelated run. Mutating consumers were not fenced at this head; Security found those gaps, addressed in the successor below. Qualifying omission exposed a PostgreSQL reciprocal-import race; a real two-process regression now observes a complete serializable retry and exactly one edge. The common 100-case cohort passes on SQLite/MySQL/PostgreSQL, with only the two PostgreSQL-specific controls skipped on the other databases. Retained PHP replay consumers pass 76/3,789; the 17 new lineage controls all fail against the preceding importer/readers with zero test errors.
The native copied-field audit is received for PHP comparison. Next are task payload/lost-lease references, resolved/requested run IDs, historical task/command IDs and the other copied references. Legacy dangling-edge recovery, continuation/retry compatibility and MySQL/SQLite concurrency remain unqualified. The PHP signing-key URL path also remains required here. Existing source review applies to earlier slices only; no current-head acceptance, package publication, Server consumer update or fixed published image is claimed.
Successor and correction: durable-workflow/workflow#929 (comment). Exact head
5e01a93awaits review; this receipt is historical evidence forc2d32ac2only.rmcdaniel commentedon Oct 25, 2026
Security re-review of Workflow PR #929 exact head
c2d32ac2171587e27f76c6b8ad7393f2e1e62456found two remaining PHP lineage authority blockers: history-only missing endpoints are still consumed by scoped child cancellation and parent-resume mutation paths without an exact materialized edge, and self-lineage is still accepted/resolved. Exact source paths, counterexamples, and required controls are recorded in durable-workflow/workflow#929 (comment).The new import/store/view work is not accepted at this head. PostgreSQL serializable retry evidence remains valid; MySQL/SQLite absent-row concurrency, legacy dangling-edge recovery, and the broader copied-reference audit remain open separately.
rmcdaniel commentedon Oct 25, 2026
PHP import follow-through is at Workflow draft PR #929 head
5e01a938a8766af8f47861aba69d5497bf6731d0. Exact source evidence and open gates are recorded for review. This successor fences imported child cancellation/parent-resume effects with exact directed edges and rejects self-lineage, addressing Security's twoc2d32ac2blockers. It has not yet been accepted.The 129-case importer cohort passes on SQLite, MySQL and PostgreSQL; 18 scope-effect cases pass on each database. The 47 current controls against preceding production source produce 42 assertion failures, five valid-pair passes and zero errors. Native scope behavior (63/525), focused child consumers (46/2,076) and retained PHP replay consumers (76/3,789) pass. Hosted quality/corpus are green; unit/feature are pending. A broader local selection hit a tracing subprocess timeout, so full-suite completion is not claimed.
The prior handoff's fallback claim has been narrowed to the display/export and ChildRunHistory readers it actually covered; mutating paths were unsafe at that old head. Legacy dangling-edge recovery, continuation/retry import compatibility, MySQL/SQLite concurrency, the remaining copied-reference/runtime audit and PHP signing-key URL path remain open. No package, consumer update or fixed published image is claimed. General next addresses the separately owned Workflow #931 service-operation authority boundary while this exact-head review runs; #928/#765 remain General commitments.