SIB-003: prevent onStatus message leakage in parallel forEach

[jmrpineda]

Discovery date: 2026-05-28
Reported by: Codex
Severity: medium
Environment: local workflow execution with parallel endpoint forEach
Scope / affected surface: endpoint stage execution, onStatus.message, execution logging/reporting
Evidence: WorkflowExecutor.ApplyStatusActionOutput assigns stage.Message = statusAction.Message on the shared WorkflowStageDefinition instance.

Summary

onStatus.message mutates the shared stage definition during execution. When an endpoint stage runs through parallel forEach iterations, a branch-specific message from one iteration can overwrite the message observed by another iteration.

Expected behavior

Status-specific messages should be resolved per execution attempt or per iteration without mutating the shared workflow definition.

Current behavior

ApplyStatusActionOutput copies statusAction.Message into stage.Message. Because the same WorkflowStageDefinition instance is shared across iterations, parallel branches can leak messages across iteration boundaries.

Reproduction steps

1. Create an endpoint stage with forEach using the default parallel execution mode.
2. Configure onStatus entries with different message values for different HTTP statuses.
3. Return different statuses across iterations.
4. Observe that one iteration can overwrite stage.Message for another iteration because the shared stage definition is mutated during execution.

Environment details

• Runtime: SphereIntegrationHub CLI.
• Workflow shape: endpoint stage with parallel forEach and branch-specific onStatus.message values.
• Platform: not platform-specific.

Notes

• A likely fix is to carry the effective message as execution-local state instead of writing it back into WorkflowStageDefinition.
• Add a regression test with parallel forEach iterations returning different statuses and messages.