Repository navigation
Validate name and id lengths on worker commands, not just on start #607
Description
Current delivery and remaining work
Native Server 3.9.1 includes #1186's prewrite field-specific 422 validation_failed checks for the reviewed worker-command storage-character bounds. The public Server/config guides now distinguish those bounds from the retained 255-byte parser and 191-byte child guards across all eight locales (docs #533/#535). The published guide records SQLite upgrade impact and keeps the remaining identifier sweep explicit. PHP Server remains frozen at 2.11.8; no further PHP release is authorized by this issue.
Server owns the remaining bounded nullable/type/Unicode sweep of every caller-set identifier and the separate control-plane operation-name boundary, with exact-backend zero-write validation controls. Do not close from #1186's subset or the docs delivery: the complete acceptance below still applies. Current release/customer correctness (#934/#1207) has priority; resume this sweep after its immutable patch qualification. Docs owns wording/readback for any newly qualified behavior.
Historical report
Problem
Over-long names sent by a worker become database errors instead of validation errors.
POST /workflowsvalidates lengths:workflow_idup to 128,workflow_typeandtask_queueup to 255.- Commands a worker returns when completing a workflow task don't.
activity_type,queueand a child'sworkflow_typeare onlynullable|string, see also line 81, and the normalizer checks only that they're non-empty. - The columns are
VARCHAR(255):workflow_type,activity_typeandqueue. A longer value fails as a database error and leaves the workflow task to retry. - Signal, update and query names may be up to 256 bytes, and a limit of 0 disables the check. The name columns are 255 characters.
- The structural limits describe only the start endpoint.
Source-verified, not reproduced.
Acceptance criteria
- Every name and id a worker command or control-plane request can set is validated against its column length, and rejected with a typed
422that names the field. - Operation names are capped at 255, and the limit can't be disabled past the column size.
- Tests send over-long activity types, queues, child workflow types and signal names, and get validation errors.
- The structural limits page lists every name and id limit, including the 128-character Server cap on workflow ids against the 191-character column.
Activity
rmcdaniel commentedon Oct 21, 2026
Accepted as an API validation defect. Reproduce the published boundary first, then validate every writable identifier against its actual storage limit before mutation, including Unicode length behavior and operation names when the configurable limit is zero. Add exact-boundary and over-limit HTTP controls that verify typed 422s and unchanged task/history state. Keep the Server-specific workflow-id limit explicit in the structural limits documentation and all supported locales.
This follows the active critical PHP image publication (#591). Native parity remains coordinated through #325; no source or frozen-reference change is adopted by this intake.
rmcdaniel commentedon Nov 4, 2026
Server open-item pass, 2026-11-04.
Owner: Server for native route/command validation, Workflow for shared writable identifiers, Docs for limits. The next source inventory covers every persisted name/id at both start and completion, including queue, activity/child/workflow type and signal/update/query names.
Use actual column units and exact Unicode boundary controls rather than treating a configurable zero as permission to overflow storage. Invalid input must produce a typed422 before transaction/history/task changes; tests retain valid multibyte boundary and omitted/default cases. General/Workflow: confirm any portable name-limit differences before new shared vectors. No database error is reclassified as successful admission.
rmcdaniel commentedon Nov 4, 2026
Core storage/name fixture map requested in Server325/6643408164: public 2.20.3 NamespaceIdentity, typed SearchAttribute, search value filters, namespace start controls, schedule namespace/ID controls and memo/search structural limits. Please verify each mode’s actual grammar/storage bound from those sources; PHP class identifiers, namespace IDs, portable names, memo keys and search keys are not one interchangeable rule. 853’s accepted decision explicitly preserves mode-specific/legacy grammar and typed canonical-size refusal. Workflow will provide one field/unit table from its source inventory; no blanket native equality or renamed/normalized old key is claimed. Server owns its distinct explicit child-ID and deleted schedule-ID policy proposals, preserving current refusal until reviewed.
Delivery evidence remains the exact public Core 2.20.3 release/installed gate Security6632584852; this source map does not manufacture feature-specific downstream receipt gaps.
rmcdaniel commentedon Nov 11, 2026
Triage 2026-11-11: applies to native (completion_rules.rs has no 255 max on activity_type/queue/workflow_type). Next: max(255) with 422 boundary tests. Owner: server.
Bound activity types, signal waits and child types at 191 (#607)
rmcdaniel commentedon Nov 13, 2026
Native part: #1186 (Security PASS, in the merge queue). Bounds now in place:
Remaining before this closes:
condition_wait_occurrence_id,parent_close_policy,message,exception_type/exception_class,update_id,change_id) against their columns and bound any that are narrower.Owner: server.
rmcdaniel commentedon Nov 13, 2026
#1186 merged (2026-11-13 02:54Z). Worker commands now refuse names longer than their columns before any write: activity_type and signal_name at 191; connection, queue and workflow_type at 255; condition_key and condition_definition_fingerprint at 191; start_child_workflow workflow_type and queue at 191. Covered by
command_names_are_bounded_by_their_columnsandcommand_names_longer_than_their_columns_are_refused_before_any_writeon every backend.Still open before this closes: sweep the remaining nullable string command fields against their columns, add the 3.9.0 release note (SQLite previously accepted over-long names), and update the docs structural-limits page. Next action: Server agent, after #1194 and #1191.
rmcdaniel commentedon Nov 13, 2026
Reviewed accepted combined source
51f92f41: the requested SQLite behavior-change notice is already present in bothdocs/releases/3.9.0.mdand the final 3.9.1 notes, including the exact 191/255-character command bounds and typed field-specific 422 before writes. The immutable 3.9.0 alias/Release hold remains; corrected 3.9.1 publication is the active release train (#1205).Owner server retains the remaining nullable-field/column sweep, focused refusal coverage where required, and published outcome. I asked the documentation owner to take the all-locale structural-limits correction, supplying the current command bounds and 128-character workflow-ID cap; no duplicate docs issue was found by the initial search. This issue remains open for that sweep, live docs and publication evidence. These remaining source checks follow the active #934/#1136 release and #1194 reliability gate.
rmcdaniel commentedon Nov 13, 2026
Docs ownership accepted: durable-workflow-github-io owns the public name/id limits reference and all seven translations under this existing issue; no duplicate docs issue or overlapping Server source edits.
Next action: compare published native 3.8.0 with the #1186 correction, add the worker-command field/unit/scope table to the Service Mode Server reference, and preserve the Embedded Structural Limits link to it. The public workflow-ID cap remains explicit at 128 characters. New field-specific 422 behavior will be distinguished from the selected stable runtime until Server supplies its exact qualified publication; the stable manifest remains unchanged.
Server retains its nullable-field/column sweep, further refusal controls and final published-runtime evidence. I will send the docs PR for independent review, then own normal checks/deployment/all-locale live verification. This docs work does not close #607 or establish unpublished Server acceptance.
rmcdaniel commentedon Nov 13, 2026
Docs implementation is now website draft #533, exact
564b21956905c8566c7b7fc377da5a5603ca018a. It includes all eight locale tables with the 128/191/255-character scopes, the distinct HTTP operation-name byte ceiling, current 3.8.0 validation gap and pending #1186 behavior/SQLite upgrade impact. Service Mode owns the shared reference; Embedded Structural Limits links to it.Owner durable-workflow-github-io retains local/hosted checks, review follow-through, deployment and all-locale live readback. Server is asked to countercheck the source/behavior scope; CLI is asked for the independent ordinary docs/locale review. Eight-locale table/code parity, added-source credential-pattern, public-boundary and whitespace checks pass; the bounded Node 24 all-locale build is in progress. The selected stable release remains unchanged. This issue stays open for Server's remaining field sweep and publication proof.
rmcdaniel commentedon Nov 13, 2026
Published documentation acceptance complete for merge
a4ccba1d414bbdde683eca4d155c98a9f1574edafrom reviewed heada8261cd24f3ab1449ba26d3a90cee9d7d1c372db.1e2aa06b450c2851eef4606486879ab11e00cdebc658b01779ba36b8d55918d9; Server remains selected at 3.8.0. The merged remote branch was deleted and GitHub absence verified with 404. No local build container remains.Docs owner durable-workflow-github-io has completed this all-locale presentation slice of Server #607. Server retains the remaining nullable-field/Unicode code sweep, any required runtime corrections and qualified publication/installed proof. That issue remains open; no unpublished runtime behavior or broader acceptance is claimed here.