feat(workflow): add atomic durable task claim and checkpoint CAS

[seonghobae]

Scope

P0 Workflow / Task Execution + State / Checkpoint implementation tracked by #541. This lane owns durable claim/recovery/checkpoint authority and Worker/Durable Object composition only; it does not copy provider/model routing, foreign domain truth, quarantine/security verdicts, outbound authority, Context Graph source or EA implementation.

Current exact authority — 2026-09-06 KST

Protected Noema is main@e26d771470a4ece873c367b40b3cd6cb03ac7de3. The post-#527 semantic restack had a real overlap in wrangler.toml: branch authority requires private NOEMA_WORKFLOW_STATE, while protected authority requires ALLOWED_WORKFLOW_SHA=43024633eba9d96b0456970391360da5a171fbda. Ordinary two-parent/non-force commit 9236775bad5476a70601c3dd0331211d42eaed12 preserves both, together with the complete atomic-claim/checkpoint/recovery/payload-minimization delta.

Fresh exact-head reviewer-ci 34027045430, ci 34027045443, required Security Scan 34027045440, and patch-validator-image 34027045436 are queued. Predecessor GREEN does not transfer. Keep Draft until current CI/reviewer/Security/image and owned 100% coverage/docstring/edge evidence are terminal with zero valid unresolved findings.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

내구성 워크플로 실행 권한

Layer / File(s)	Summary
권한 경계 결정과 기준선 문서 docs/adr/*, docs/product-technical-gap-baseline.md	ADR과 기술 기준선에 실행별 Durable Object 라우팅, 단일 admitted plan authority, pre-authority 레코드 정책 및 검증 기준을 기록합니다.
상태 계약과 원자적 저장소 연산 src/workflow-task-execution/workflow-state-store.ts, test/workflow-state-store-atomicity.test.ts, test/workflow-state-store-failure-contracts.test.ts, test/workflow-state-store-integrity-regressions.test.ts	상태 스키마, transition ledger, plan authority 검증, 원자적 claim, checkpoint CAS, 의존성 무결성, 오류 정규화 및 실패 계약을 구현하고 검증합니다.
효과 경계, 취소, 복구와 provenance src/workflow-task-execution/workflow-state-store.ts, test/workflow-state-store-cancellation-policy.test.ts, test/workflow-state-store-provenance.test.ts, test/workflow-state-store-recovery.test.ts	효과 시작 증거, terminal completion, descendant 차단, bounded recovery, cancellation authority 및 bounded transition provenance를 구현하고 검증합니다.
태스크 실행 순서와 재시작 claim 복구 src/workflow-task-execution/workflow-task-runner.ts, src/workflow-task-execution/workflow-recovery-claim.ts, test/workflow-task-runner.test.ts, test/workflow-recovery-claim.test.ts	태스크 실행 순서를 claim, 효과 시작 영속화, 효과 실행, terminal outcome 영속화 순으로 고정합니다. 재시작 후 durable claim을 복구합니다.
Durable Object 라우팅과 운영 배포 src/workflow-task-execution/workflow-state-durable-object.ts, src/runtime-entrypoint.ts, wrangler.toml, test/workflow-state-durable-object-*.test.ts, test/workflow-state-store-plan-authority.test.ts	실행 ID를 SHA-256 기반 객체 이름으로 변환하고, 내부 JSON 명령을 동일한 Durable Object로 라우팅합니다. 요청 검증, 오류 매핑, plan authority 충돌, 런타임 export, SQLite binding 및 통합 테스트를 추가합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟠 High · up to 3cb93

Existing workflows could acquire conflicting plan histories, while corrupted transition receipts may be accepted as valid. These integrity issues should be fixed before merge.

Sequence Diagram(s)

sequenceDiagram
  participant Scheduler
  participant NOEMA_WORKFLOW_STATE
  participant NoemaWorkflowState
  participant DurableWorkflowStateRepository
  participant EffectExecutor
  Scheduler->>NOEMA_WORKFLOW_STATE: route command by execution ID
  NOEMA_WORKFLOW_STATE->>NoemaWorkflowState: forward internal JSON command
  NoemaWorkflowState->>DurableWorkflowStateRepository: initialize or require plan authority
  DurableWorkflowStateRepository-->>NoemaWorkflowState: accept exact plan or return conflict
  NoemaWorkflowState->>DurableWorkflowStateRepository: claim task
  DurableWorkflowStateRepository-->>Scheduler: active claim
  Scheduler->>NoemaWorkflowState: persist effect start
  Scheduler->>EffectExecutor: execute effect
  EffectExecutor-->>Scheduler: terminal outcome
  Scheduler->>NoemaWorkflowState: persist terminal outcome
  NoemaWorkflowState->>DurableWorkflowStateRepository: commit state transition

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 40 functions across 16 files. (1 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 원자적 durable task claim과 checkpoint CAS라는 PR의 핵심 구현을 정확히 설명합니다. Durable Object 라우팅과 실행 권한 등 추가 변경을 모두 포함하지는 않지만, 제목으로서 간결하고 주요 변경과 직접 관련됩니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 40 functions across 16 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/workflow-state-store-atomic-claim

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh current-head repair after da225d15...:

• RED c744f9dde9ffd30df1b99ce332b6440be6184905 proves the application runner accepted an impossible state-port claim attempt above MAX_AUTOMATIC_RECOVERY_ATTEMPTS far enough to invoke effect-start persistence instead of rejecting the claim authority itself.
• Production f3a02262ba7b15fc287fbfe61d9f61c6d3b744bb makes requireClaimAuthority(...) enforce the same canonical bounded attempt interval 1..MAX_AUTOMATIC_RECOVERY_ATTEMPTS already owned by durable state/recovery policy. The repair is limited to Workflow / Task Execution + State / Checkpoint application authority; it does not infer retry, compensation, provider routing, security verdict, outbound policy, or foreign domain truth.

Current exact authority supersedes the older head/run block in the PR description: protected base main@bbee33270b496255d785c766fc009a5f9162a695; exact head f3a02262ba7b15fc287fbfe61d9f61c6d3b744bb; Draft / mergeable. Exact-head runs are ci 33827829254, reviewer-ci 33827829267, required Security Scan 33827829256, and patch-validator-image 33827829271; all are non-terminal. CI job 100884174260 is queued before steps with no assigned runner. The existing source-repaired thread PRRT_kwDOTJkwWc6exAXX remains unresolved until executable exact-head GREEN exists. No predecessor result transfers.

[seonghobae]

Fresh application-boundary review found another claim-authority fail-open path on the live branch. executeNextWorkflowTask(...) verified execution/plan/task/effect and bounded attempt, but it did not re-admit the claim identity itself. A non-Durable-Object state adapter could therefore echo a caller-supplied claim ID containing spaces/non-canonical bytes and still reach effect-start persistence; the canonical repository rejects those bytes, but the runner port contract is storage-independent and must not rely on one adapter to enforce the invariant.

TDD repair on the same non-force branch:

• RED 3f42df7650f420c2adb8ae42555b7b814868417f adds rejects a non-canonical caller claim identity even when the state adapter echoes it; against the predecessor runner the invalid claim reaches markEffectStarted(...) instead of failing as claim authority.
• Production da3c53c97b23fab7706a475e09c23806aa74d147 requires the echoed claimId to satisfy the same 1–128 printable non-whitespace ASCII shape before effect-start persistence. Existing execution/plan/task/effect and 1..MAX_AUTOMATIC_RECOVERY_ATTEMPTS checks remain intact.
• The repair stays inside Noema Workflow / Task Execution + State / Checkpoint application authority. It does not add retry/compensation policy, provider routing, security verdict, quarantine authority, outbound policy, or foreign domain truth.

Current exact head is da3c53c97b23fab7706a475e09c23806aa74d147 on protected base bbee33270b496255d785c766fc009a5f9162a695. Fresh exact-head runs are ci 33831824296, reviewer-ci 33831824261, required Security Scan 33831824262, and patch-validator-image 33831824266; all are queued/non-passing. No predecessor GREEN transfers, and the storage-fake thread remains intentionally unresolved until this unchanged head executes.

[seonghobae]

Verified: CodeRabbit's Wrangler exports version finding is accurate

Confirming with independent evidence, since this hasn't been addressed on the current exact head (da3c53c97b23fab7706a475e09c23806aa74d147):

• wrangler.toml on this head declares three [exports.<Class>] blocks (NoemaRateLimiter, NoemaOidcReplayGuard, NoemaWorkflowState) and no [[migrations]] block — the declarative exports lifecycle map is the only DO-lifecycle mechanism present.
• package-lock.json on this head pins wrangler@4.105.0 (node_modules/wrangler.version), while package.json only constrains "wrangler": "^4.25.0".
• Per Cloudflare's own changelog (developers.cloudflare.com/changelog/post/2026-06-30-declarative-do-class-exports/) and the workers-sdk 4.107.0 release notes, declarative Durable Object exports support was added in Wrangler 4.107.0 — after the 4.105.0 pinned here.

Net effect: on this exact head, npm run deploy / npm run dev would run against a Wrangler binary that predates exports support, so the new NoemaWorkflowState DO's lifecycle declaration is not guaranteed to be honored the way the PR body's "Verified deployment-boundary repair" section describes (Cloudflare's exports_reconciliation behavior). This is a real gap, not a re-run/congestion artifact — CI can't currently catch it because the runners are queued, and it's not the kind of thing the unit-level config-parser tests would exercise without an actual wrangler invocation.

I'm not pushing a fix here: package-lock.json / the Wrangler version bump is #540's owned lane (its own body already flags "package-lock.json is still stale" and stages a lockfile regeneration as its next step, for the unrelated GPL/LGPL toolchain reason). Bumping the pin independently in #542 would race #540's regeneration and likely produce a second, conflicting lockfile diff. Recommend: land #540's Wrangler bump (>= 4.107.0) first, or explicitly coordinate the version floor between #540 and #542 before either claims the deployment-boundary repair as complete.

No source changed by this comment.

---

Generated by Claude Code

[seonghobae]

Fresh current-head authority supersedes the stale body snapshot: protected main is e1ac9d50f6c646f04be8c137c8acdc7200182fcd, exact #542 head is 7188da7d41f4d20cd61682726cec66b245fcaa63, open / Draft / mergeable. Exact-head ci 33856475387, required Security Scan 33856475384, reviewer-ci 33856475345, and patch-validator-image 33856475332 all completed cancelled; reviewer job 100970858672 ended with steps=[], runner_id=0, empty runner name, so no repository code executed. The application-service claim repairs therefore remain source-level evidence, not hosted GREEN, and the existing source-repaired review thread must stay unresolved. No leaf source churn, gate weakening, or predecessor evidence transfer is justified by this cancellation.

[seonghobae]

2026-09-06 KST authority refresh: #546 exact 7d3de5a859be96b953927201d9ba782673f4bb8e reached terminal reviewer/CI/Security/image GREEN with valid threads resolved and was normally merged as protected main@85b17014b8d46eacc95e096ca114568c321d0263. This lane was then ordinarily/non-force restacked as d4e3f27d44c814dfa358bf087ae943a75ef6b8e7; fresh compare is 131 ahead / 0 behind with merge-base exactly protected main and the 29-file Workflow / Task Execution + State / Checkpoint delta retained. Current exact-head CI/reviewer/Security/image are newly queued/pending, so predecessor results do not transfer and Draft remains correct.