[rmcdaniel]

Closes #527 together with durable-workflow/durable-workflow.github.io#521.

General decided on 2026-11-11 to correct the docs now and build a dispatcher only when a user needs one. Native has no HTTP client: service_calls.rs only stamps a request id, and invocable mappings are validated and then returned on the activity poll. docs/server-reference.md now says plainly that a process you run must poll the queue, call the endpoint and report the result, and that with no poller the task waits. docs/contracts/external-execution-surface.md already said dispatch belongs to a carrier implementation. Docs-only change.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security: PASS (head c3e87e2f). This is docs only. server-reference.md now states that the Server never sends invocable_http requests itself: an operator-run poller reads task.external_executor, calls the endpoint and reports through the normal complete/fail paths. That's the accurate and security-relevant statement: the Server makes no server-side outbound call to a user-supplied URL, so it has no SSRF surface from this feature. A future Server-side dispatcher (#527) would need its own Security review covering egress allowlisting, internal-address blocking and redirect handling.