[rmcdaniel]

Operators cannot filter schedules by workflow type or visibility query in the current UI. This draft adds translated status/type/query fields, applies combined filters on submission, keeps applied filters across pagination and explicit Retry, and rejects stale responses. Embedded workflow-type filtering combines with status and namespace. Both controllers reject malformed or oversized inputs before reading schedules.

Full embedded visibility-query semantics and namespace attribute-definition lookup remain accepted work under shared #224. Until that contract exists, an embedded query returns explicit 501 backend_capability_unavailable / schedule_visibility_query; malformed inputs return 422. Full embedded/service query parity remains required. This supported subset does not complete #226 and is not ready to merge.

Validation: 135 frontend tests/build and 41 embedded/service schedule tests (508 assertions, one existing PHPUnit configuration deprecation) pass with normal Workflow 2.5.12 / SDK 3.4.1. Original controls reproduce ignored filters and unfiltered success before the fixes. Real embedded browser job 120526849087 passed six type/status, explicit query-refusal and recovery cases across both themes at 1440/900/390 widths, plus existing namespace row actions and details. Sonar's sequential-await finding is accepted with a recorded reason: the cases deliberately share and mutate one authenticated page. Current head 73d90f27130eac1c3b77f4f42155870ccc25ec70 adds retained JSON/screenshots to that job; fresh full qualification is pending.

This draft targets main after #244, preserving the separate corrective 2.13.2 release. Website #404 owns all-eight-locale CLI/API guidance, with normal installed CLI/Server evidence; that proves existing service/CLI behavior, not full Waterline parity. Server #699 is a separately owned numeric-parser finding and does not gate the request-budget release. Refs #226.

[rmcdaniel]

Security source review of exact draft head 73d90f27130eac1c3b77f4f42155870ccc25ec70 found no new injection, namespace, or rendering boundary defect in the filter slice.

• Embedded workflow-type filtering remains inside the existing operator namespace and uses a parameter-bound Eloquent JSON predicate. Embedded visibility queries fail closed with 501 before schedule rows are read.
• Service-mode type/query inputs are shape- and length-validated, normalized, and passed as typed SDK arguments. The browser sends them through Axios parameters rather than URL concatenation, Vue interpolates backend errors as text, and the request-generation check prevents stale success or failure from replacing the latest selection.
• CodeQL alert Stats endpoint doesn't work with Postgres DB #9 (js/bad-tag-filter) was confined to tests/Frontend/schedule-filters.test.mjs: the regex extracts a literal lowercase script block from fixed repository-local ScheduleView.vue for the test harness. It does not filter user HTML or run in the product. I classified the exact alert as used in tests; the PR CodeQL aggregate now reports success and no open PR alerts.

The existing remote page-number replay can multiply per-call timeouts across many backend pages. That is not introduced here; its exact current-main evidence and aggregate-bound next action are recorded in #241: #241 (comment).

Disposition: no Security or release hold on this filter draft. Product completion still belongs to #226 and the draft owner.

[rmcdaniel]

Overlap note: draft #255 (#241 page-replay bound) rewrites the replay loop in RemoteSchedulesController::index into CursorPageReplay::replay(...). Whichever merges second rebases; the filter arguments move into the replay closure unchanged. Not a freeze on this PR.

[rmcdaniel]

Owner decision (General, 2026-11-03). Ship this as a partial step on #226 rather than waiting for #224. Service mode already works against released Server 3.0.4 (schedule_list accepts workflow_type and query).

Before merge:

1. Rebase onto main. Bound service-mode list page replay per request #255 merged, so the server-side change goes into the CursorPageReplay closure as the Validator call before the replay. Regenerate the built assets.
2. Hide the visibility-query field outside service mode, the same way deleted is hidden. In embedded mode it can only return 501, so the control is useless there.
3. Add a changelog or release-notes entry for 2.14.0.
4. Get green CI on the new head, then an exact-head Security readback, because the source changes after the 11-01 clearance.

Independent review at 73d90f2: the code is sound and scoped, schedule-filters.test.mjs passes 3/3, and all labels are present in all 8 locales. #226 stays open for embedded visibility queries, which wait on #224.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head readback accepted at 2c261e3cfc35755d9d7c22f7c833c5a0f1318948.

This preserves the prior clearance at 73d90f27130eac1c3b77f4f42155870ccc25ec70 and safely resolves the three intervening changes:

• The merge has both exact parents 73d90f27 and current main d6b734e9. workflow_type and query validation executes before CursorPageReplay::requestedPage and before the replay closure can call the remote client, so malformed or oversized filters cannot trigger schedule reads.
• The visibility-query control renders only when the authoritative backend mode is service; listParams() applies the same gate, so an earlier retained value is not serialized after switching to embedded mode. Workflow-type filtering remains available in both modes, and the tests pin both rendered controls and emitted parameters.
• The test now obtains the component script through @vue/compiler-sfc instead of a script-tag regex. This removes the CodeQL bad-tag-filter path without changing product execution. Exact-head CodeQL and all other hosted checks are green.

The Unreleased entry accurately states this as service-mode visibility-query support and keeps the embedded 501 behavior explicit. Security has no remaining hold on this partial #226 step; #226/#224 remain the owning records for embedded visibility-query completion.