Skip to content

Replace the invalid 2.13.1 reused cancellation-clock evidence with a valid redrive successor #237

Closed

Description

@rmcdaniel

Found by the cross-SDK sweep in sdk-rust#174 / sdk-rust#175. This follows Security's acceptance boundary (sdk-rust#174 comment 6615113533) and its review of sdk-rust#173 (comment 6614655259).

Problem

The reused cancellation-clock test (from #233), shipped in 2.13.1, is a history Workflow can't emit:

  • there is no redrive WorkflowStarted envelope;
  • the cancellation request and delivery come before the reused prefix;
  • its 18.123456 result (the valid order gives 22.123456) depends on that order.

Real redrive writes the start and the reused prefix in one write, so a successor cancel always comes later. It supports the 2.13.1 clause "the cancellation clock prefers a reused step's reused_recorded_at" (test test_a_reused_step_keeps_its_original_time_for_the_remaining_budget).

redrive-start-replayed-clock.json also lacks a full redrive envelope; it has no reused steps, so it is ambiguous rather than a clock defect.

Done when

  • Valid replacements: valid successor fixtures (full envelope, Core-identical reused prefix, successor cancel after the prefix, resume = highest reused step + 1) replace the evidence. They are validated by check_redrive_successor from Enforce search-attribute replay identity and qualify redriven memo and search-attribute reuse #236. In a valid history the reused times are not observable through remaining(), so the claim becomes non-leakage, not "prefers reused_recorded_at".
  • Old fixtures: they stay byte-identical (the corpus is immutable). A test-side registry names them as non-qualifying, and each must keep failing the successor check with its specific error. This follows sdk-rust#175. Don't weaken the corpus policy.
  • Gate: every redrive-* fixture, and any fixture with reuse keys, must pass the successor check except the named exceptions.
  • Notes: a CHANGELOG correction under Unreleased, plus proposed text for the 2.13.1 GitHub Release notes. Don't rewrite the tag or the package.

The product behavior is harmless. This is about evidence and claims.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions