Follow-up recorded during the 0.7.1d review (#407) — not a defect in that slice, and deliberately not fixed there.
WorkflowRunStore scopes idempotency by (workflowName, idempotencyKey) only. Today a server instance has
one configured deployment and the run store is instance-local, so two deployments cannot collide through it.
That stops being true the moment the run store becomes durable or shared: the same workflow name and
idempotency key in two deployments would then resolve to the same run, and an idempotent replay could return
another deployment's run.
Requested outcome: pin the scoping rule before the run-store model becomes durable/shared — either include the
deployment scope in the idempotency key, or state explicitly and defensively that one store serves exactly one
deployment (and fail closed when that assumption is violated).
Evidence: WorkflowRunStore key construction, plus the idempotency-replay test in the 0.7.1d slice which
asserts "reusing an idempotency key returns the pre-existing run identity" within a single deployment.
Follow-up recorded during the 0.7.1d review (#407) — not a defect in that slice, and deliberately not fixed there.
WorkflowRunStorescopes idempotency by(workflowName, idempotencyKey)only. Today a server instance hasone configured deployment and the run store is instance-local, so two deployments cannot collide through it.
That stops being true the moment the run store becomes durable or shared: the same workflow name and
idempotency key in two deployments would then resolve to the same run, and an idempotent replay could return
another deployment's run.
Requested outcome: pin the scoping rule before the run-store model becomes durable/shared — either include the
deployment scope in the idempotency key, or state explicitly and defensively that one store serves exactly one
deployment (and fail closed when that assumption is violated).
Evidence:
WorkflowRunStorekey construction, plus the idempotency-replay test in the 0.7.1d slice whichasserts "reusing an idempotency key returns the pre-existing run identity" within a single deployment.