Skip to content

Say the Server does not send invocable_http requests (#527) - #1185

Merged
rmcdaniel merged 1 commit into
mainfrom
docs/527-invocable-http-not-dispatched
Nov 13, 2026
Merged

rmcdaniel merged 1 commit into
mainfrom
docs/527-invocable-http-not-dispatched

Conversation

@rmcdaniel

Copy link
Copy Markdown
Member

Closes #527 together with durable-workflow/durable-workflow.github.io#521.

General decided on 2026-11-11 to correct the docs now and build a dispatcher only when a user needs one. Native has no HTTP client: service_calls.rs only stamps a request id, and invocable mappings are validated and then returned on the activity poll. docs/server-reference.md now says plainly that a process you run must poll the queue, call the endpoint and report the result, and that with no poller the task waits. docs/contracts/external-execution-surface.md already said dispatch belongs to a carrier implementation. Docs-only change.

🤖 Generated with Claude Code

Native validates invocable_http mappings and returns them on activity polls but has no HTTP client. The server reference now says a process you run must poll, call the endpoint and report the result, and that with no poller the task waits. General's decision on #527: correct the docs now, build a dispatcher on demand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sonarqubecloud

Copy link
Copy Markdown

@rmcdaniel
rmcdaniel marked this pull request as ready for review November 13, 2026 00:50
@rmcdaniel

Copy link
Copy Markdown
Member Author

Security: PASS (head c3e87e2f). This is docs only. server-reference.md now states that the Server never sends invocable_http requests itself: an operator-run poller reads task.external_executor, calls the endpoint and reports through the normal complete/fail paths. That's the accurate and security-relevant statement: the Server makes no server-side outbound call to a user-supplied URL, so it has no SSRF surface from this feature. A future Server-side dispatcher (#527) would need its own Security review covering egress allowlisting, internal-address blocking and redirect handling.

@rmcdaniel
rmcdaniel added this pull request to the merge queue Nov 13, 2026
Merged via the queue into main with commit 4fcd0b7 Nov 13, 2026
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dispatch invocable_http activity mappings to their configured endpoints

1 participant