[rmcdaniel]

Rust 4.15 forces a batch above the ordinary request cap into external storage even when each argument is valid and the Server accepts a larger completion. Without a store, the worker exits and leaves the run pending.

Use the optional advertised completion cap on the existing workflow-completion planner, preserving per-value/ordinary limits, old-producer fallback and configured-storage authority. Explicitly unconfigured/disabled/unsupported storage can keep an atomic inline batch; an over-cap request retains the Server's authoritative typed 413. Invalid fields refuse planning before uploads. The unsupported raw continuation path is unchanged.

Validation: 1000 all-target/all-feature tests pass; nine focused planner tests consume the exact shared negotiation fixture; existing upload/lease tests pass. The published-worker fixture compiles but remains ignored until Server #1203 is qualified and published. No installed fan-out or over-limit delivery claim is made.

Refs #254, durable-workflow/.github#228, durable-workflow/server#1136.

[rmcdaniel]

Source implementation is ready for review. The final scope is the existing workflow-completion payload planner. The raw activity-continuation route remains unchanged: no new offload or completion lease authority. Its native wire allowance remains Server-owned.

The planner consumes the optional aggregate cap only on the exact worker workflow-completion route. Explicit invalid values refuse planning; ordinary routes ignore the unused field; absent fields retain the old ordinary cap. Individually valid inline batches remain atomic only with explicitly unconfigured/disabled/unsupported storage. Configured storage thresholds, transient refusals, per-value checks and lease-bound uploads retain their existing behavior. An over-cap inline batch is sent once for the authoritative typed Server 413, with the managed worker's existing one-shot structural failure.

Validation: all-target/all-feature suite 1000 passed, 0 failed, 70 ignored, with two Cargo jobs and two test threads. Nine focused completion tests include shared negotiation vectors from Server e69df7c37d675681ca301b9eedc2398bc1a3ac18; fixture SHA-256 f08034e42118f0be10381f5263230b48e2b65a5668bc49ecb60f513d35cf1b9a is byte-identical. Existing 16 upload tests pass. Formatting, diff and credential/private-path/public-boundary scans pass.

A separate installed-package-compatible integration test now compiles and is explicitly ignored without a qualified isolated Server. It will check 300 × 10 KB inline fan-out, a 60 × 450 KB aggregate refusal with no partial activities, and same-worker follow-up. It has not run as published acceptance. Server #1203 review/CI/publication and the exact next SDK package remain gates; #254 and shared #228 stay open. API docs and changelog make that distinction explicit.

[rmcdaniel]

Security review HOLD on exact head 5338f45bd773519f71c1dfcab85d4f13082fa6a4 for one fail-closed gap.

Client::externalize_runtime_payloads returns immediately when payloads.is_empty() before it fetches the policy or validates max_workflow_task_completion_bytes. Consequently, an exact workflow-completion request containing no inline payload blob (for example, an empty/no-argument command batch or only already-encoded external references) can be submitted even when discovery explicitly supplies null, zero, negative or another invalid cap. That contradicts the shared negotiation contract at this head: explicit invalid values must refuse completion planning before upload or submission on the consuming route; absence alone preserves fallback.

Please identify the exact workflow-completion route before the empty-payload return, fetch/validate its optional cap there, and only then return when there is no externalization work. Ordinary routes must retain their existing no-discovery behavior, and continuation must remain unchanged/unowned. Add a regression showing every invalid shared vector refuses an empty/no-inline-payload workflow completion before the completion request, with only cluster-info observed. A positive or absent cap may continue, and over-cap authority should remain the Server's typed 413.

Other inspected boundaries are aligned: no-store inline behavior is limited to explicit unconfigured/disabled/unsupported status; configured transient/storage planning, per-value and ordinary caps, existing workflow upload lease handling, and raw continuation behavior remain separate. The copied Server fixture is byte-identical to the reviewed shared vector. Published Server plus installed Worker acceptance remains required after source correction.

[rmcdaniel]

Security's empty-payload finding is fixed in 3283d0425fce11810c130f07d31d93b561b1e595; final test-only successor is 831d76c59f4c2920c39e6cadbe59e1569557e062, tree c7fb2ab26c1ffd7c35ab19e3a5f6f3a57fd996fe. Exact workflow completions discover and validate the optional cap before the empty-payload shortcut. Ordinary/raw continuation requests retain their previous shortcut.

All eight invalid shared vectors now exercise empty commands, timer-only commands and reference-only commands: only cluster-info may be observed, with no upload or completion submission. Ten focused completion tests pass. The complete unit run had 855 passes and one stale assertion that a valid reference-only completion made no discovery; that assertion now requires one discovery while retaining zero uploads and exactly one valid completion. Its focused rerun passes. All 145 integration cases pass, with 71 explicit ignores including the unqualified real-Server feature fixture. Fresh required CI and exact-head independent counter-review are outstanding. No merge/publication gate is waived.

Separately, the public 4.15.0 GitHub Release now leads with the confirmed inline fan-out limitation and #254/#1136 links. This metadata correction changes no tag, source or package bytes. Shared #212 now records the scoped published pending-to-null readback PASS; shared #228 retains both product failures and their owners.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security counter-review — PASS on exact head 831d76c59f4c2920c39e6cadbe59e1569557e062 (tree c7fb2ab26c1ffd7c35ab19e3a5f6f3a57fd996fe), subject to the normal required checks finishing green.

The prior empty/no-inline shortcut finding is fixed at the correct boundary:

• exact workflow-completion routes now discover and validate max_workflow_task_completion_bytes before returning for an empty inline payload set;
• ordinary and raw-continuation routes retain their existing no-discovery behavior;
• all shared invalid negotiation cases refuse before upload or completion submission for empty, timer-only, and valid-reference-only bodies;
• the reference-only success path performs exactly one discovery, zero uploads, and one submission, preserving strict reference validation.

I independently reviewed the two-commit delta from 5338f45bd773519f71c1dfcab85d4f13082fa6a4, ran git diff --check, and ran the two changed focused Rust controls locally: completion_limits_refuse_invalid_vectors_even_without_inline_payloads and runtime_upload_low_level_references_are_strict_and_never_reuploaded both passed.

This remains source authority only: no published Server/SDK delivery claim, no raw-continuation capability expansion, and shared #228 stays open for published installed acceptance.