Repository navigation
Enforce payload and pending-count limits on service-mode commands and start input #865
Description
Problem
The structural limits guide says all limits are enforced at scheduling, recording or command intake. That holds only in embedded mode.
- Embedded mode is guarded. The embedded executor guards payload size and pending counts when scheduling activities, children and timers, at continue-as-new and on the workflow result (e.g.).
- Service mode isn't. The bridge that records SDK worker commands calls only the memo and command-batch guards. Activity, child and continue-as-new arguments, workflow results and pending counts from SDK workers are recorded unchecked. Update admission is the one Server path that applies the guards.
- Start input is never checked. Workflow start input is stored without a size guard in either mode. An oversized input is accepted, and the run fails later when the value moves to continue-as-new or a child.
- Two Server settings do nothing.
DW_MAX_PENDING_ACTIVITIES/CHILDRENare documented as rejecting a command batch. Only the health endpoint reads them.
Operators who tighten limits get partial, mode-dependent enforcement.
Acceptance criteria
- Each documented payload and pending-count limit applies to service-mode worker commands with the same typed
structural_limitoutcome as embedded mode. Regression tests cover each payload site and each pending count. - Workflow start input is checked at intake in both modes and rejected with a typed reason before a run is created.
- The Server enforces its pending-count settings, or stops advertising them.
- The structural limits guide lists every payload site and its outcome, and covers size-based soft warnings. The public Cloud guide states the payload and request limits for Cloud namespaces.
Activity
rmcdaniel commentedon Nov 4, 2026
Owner: Workflow for package intake consistency; Server for exposed settings/native acceptance; Docs for the actual limits table. Current source already has bridge pending activity/timer/child guards from #933 and a start-input payload guard. Those parts supersede the original blanket 'unchecked' description, but do not establish every requested payload site and typed outcome.
Next is a table-driven current-source audit of start, schedule activity/child, continue-as-new, workflow result, memo/search and pending counts, with exact/one-over controls and zero durable effects. I asked Server to reconcile accepted settings with shared #228's encoded request versus raw value limit. #930's completion-wide meter is separate. Remaining missing guards will receive a narrow source fix; no duplicate #933 implementation or broad limit change is proposed.
rmcdaniel commentedon Nov 11, 2026
#1083 is merged. Service-mode activity, child and continue-as-new arguments and workflow results now get the payload size limit. It ships in the next patch release. Still open here: the rest of the payload-site table (side-effect, local-activity and update results, search attributes) and the Server-side check. Owner: Workflow.
rmcdaniel commentedon Nov 11, 2026
The service-mode argument/result payload guards (#1083) shipped in Workflow 2.23.1. Still open here: the remaining payload sites and the Server-side check.
rmcdaniel commentedon Nov 11, 2026
#1086 is merged. Side-effect results, local-activity arguments and results, and update results from service-mode workers now get the payload size limit. It ships in the next patch release. Remaining here: search-attribute sizes and the Server-side check. Owner: Workflow.
rmcdaniel commentedon Nov 11, 2026
#1087 is merged: worker search-attribute upserts now get the search-attribute size limit. That completes the Workflow-side sites on this issue (#1083, #1086, #1087), which ship in 2.23.2 (#1088). Remaining: the Server-side check against its own size table, owned by Server.
rmcdaniel commentedon Nov 11, 2026
Closing: Workflow's part is delivered. Embedded mode already guarded start input and scheduling. The service-mode worker bridge now applies the payload size limit to activity, child and continue-as-new arguments, workflow results, side-effect results, local-activity arguments and results, and update results. It also applies the search-attribute size limit to upserts. All refusals are typed and roll back the whole completion. These shipped in Workflow 2.23.1 (#1083) and 2.23.2 (#1086, #1087), and release verification passed for both. Server's side: Native structural-limit enforcement was delivered in durable-workflow/server#612, and large fan-out completions are tracked in durable-workflow/server#1136 (.github#228). PHP Server is frozen at 2.11.8.
Apply payload size limits to service-mode worker commands
Apply payload size limits to worker side-effect, local activity and u…
Apply the search attribute size limit to worker upserts