Uh oh!
There was an error while loading. Please reload this page.
[codex] Guard event consumers during replay - #2030
Merged
Merged
Conversation
Contributor
🦋 Changeset detectedLatest commit: d680a29 The changes in this PR will be included in the next version bump. This PR includes changesets to release 21 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
📊 Benchmark Results
workflow with no steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 1 step💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) workflow with 10 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 25 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro | Express workflow with 50 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express Promise.all with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) Promise.all with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) Promise.all with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Next.js (Turbopack) | Nitro Promise.race with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.race with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.race with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro | Express workflow with 10 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro workflow with 25 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Nitro | Next.js (Turbopack) workflow with 50 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) workflow with 10 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Next.js (Turbopack) | Nitro workflow with 25 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) workflow with 50 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Stream Benchmarks(includes TTFB metrics)workflow with stream💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro stream pipeline with 5 transform steps (1MB)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro 10 parallel streams (1MB each)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro fan-out fan-in 10 streams (1MB each)💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) SummaryFastest Framework by WorldWinner determined by most benchmark wins
Fastest World by FrameworkWinner determined by most benchmark wins
Column Definitions
Worlds:
|
Contributor
🧪 E2E Test Results✅ All tests passed Summary
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
✅ 📋 Other
|
pranaygp
commented
May 20, 2026
Uh oh!
There was an error while loading. Please reload this page.
pranaygp
commented
May 20, 2026
Uh oh!
There was an error while loading. Please reload this page.
pranaygp
commented
May 20, 2026
Uh oh!
There was an error while loading. Please reload this page.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds “ownership” guard metadata to step/wait/hook lifecycle events and validates that metadata during replay so consumers don’t accidentally resolve the wrong entity purely by correlationId.
Changes:
- Extend World event schemas to optionally persist guard metadata (stepName, wait resumeAt, hook token).
- Add replay-time guard checks in step, sleep, hook, and abort-hook consumers and persist guard metadata from runtime emitters.
- Add focused unit + runtime-entrypoint tests to ensure bad committed events deterministically become
run_failed(RUNTIME_ERROR) instead of looping.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| packages/world/src/events.ts | Extends event schemas to carry optional replay guard metadata. |
| packages/core/src/workflow/sleep.ts | Validates wait_completed.resumeAt during replay to guard wait consumers. |
| packages/core/src/workflow/sleep.test.ts | Adds coverage for legacy wait_completed and resumeAt mismatch behavior. |
| packages/core/src/workflow/hook.ts | Validates hook token metadata on hook lifecycle events during replay. |
| packages/core/src/workflow/hook.test.ts | Adds mismatch tests for hook lifecycle events (created/received/disposed/conflict). |
| packages/core/src/workflow/abort-controller.ts | Validates abort-hook token metadata during replay; minor refactor. |
| packages/core/src/workflow.test.ts | Adds integration tests for hook/wait guard failures via runWorkflow. |
| packages/core/src/step.ts | Validates stepName metadata on step lifecycle events during replay. |
| packages/core/src/step.test.ts | Adds mismatch tests for step lifecycle events (created/completed/failed). |
| packages/core/src/runtime/suspension-handler.ts | Persists hook token when emitting hook_disposed / abort hook_received. |
| packages/core/src/runtime/step-handler.ts | Emits stepName metadata on step lifecycle events. |
| packages/core/src/runtime/step-executor.ts | Emits stepName metadata from direct step execution path. |
| packages/core/src/runtime/runs.ts | Includes wait resumeAt when emitting wait_completed during wakeups. |
| packages/core/src/runtime/resume-hook.ts | Includes hook token on hook_received in non-legacy mode. |
| packages/core/src/runtime.ts | Includes wait resumeAt when auto-completing waits during entrypoint handling. |
| packages/core/src/runtime.test.ts | Adds runtime-entrypoint regression coverage for committed bad events -> run_failed. |
| packages/core/src/abort-controller.test.ts | Adds test for abort hook token mismatch surfacing as WorkflowRuntimeError. |
| .changeset/guard-step-consumer-events.md | Changeset for patch bumps to core + world. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Uh oh!
There was an error while loading. Please reload this page.
VaguelySerious
previously requested changes
May 20, 2026
VaguelySerious
left a comment
Member
There was a problem hiding this comment.
AI review: blocking issues found
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Comment on lines
+69
to
+82
| const eventToken = | ||
| 'eventData' in event && event.eventData && 'token' in event.eventData | ||
| ? event.eventData.token | ||
| : undefined; | ||
| if (typeof eventToken === 'string' && eventToken !== token) { | ||
| ctx.promiseQueue = ctx.promiseQueue.then(() => { | ||
| ctx.onWorkflowError( | ||
| new WorkflowRuntimeError( | ||
| `Corrupted event log: hook event ${event.eventType} for ${correlationId} belongs to token "${eventToken}", but the current hook consumer expects "${token}"` | ||
| ) | ||
| ); | ||
| }); | ||
| return EventConsumerResult.Finished; |
Comment on lines
+139
to
+156
| const eventToken = | ||
| 'eventData' in event && event.eventData && 'token' in event.eventData | ||
| ? event.eventData.token | ||
| : undefined; | ||
| if ( | ||
| typeof eventToken === 'string' && | ||
| eventToken !== this[ABORT_HOOK_TOKEN] | ||
| ) { | ||
| ctx.promiseQueue = ctx.promiseQueue.then(() => { | ||
| ctx.onWorkflowError( | ||
| new WorkflowRuntimeError( | ||
| `Corrupted event log: abort hook event ${event.eventType} for ${correlationId} belongs to token "${eventToken}", but the current abort hook expects "${this[ABORT_HOOK_TOKEN]}"` | ||
| ) | ||
| ); | ||
| }); | ||
| return EventConsumerResult.Finished; | ||
| } |
VaguelySerious
approved these changes
May 20, 2026
VaguelySerious
left a comment
Member
There was a problem hiding this comment.
AI review: no blocking issues
Contributor
Backport to To resolve manually, push a backport branch and open a PR against git fetch origin stable
git checkout -b backport/pr-2030-to-stable origin/stable
git cherry-pick -S b124365e14b0c47a5c830c7009dd5bf0149d5a59 # -S signs the commit# Fix conflicts, then:
git add -A
git cherry-pick --continue
git push -u origin backport/pr-2030-to-stable
gh pr create --base stable --head backport/pr-2030-to-stable \
--title "Backport #2030: <original PR title>" \
--body "Manual backport of #2030 (cherry-pick b124365e14b0) to \`stable\`." |
pranaygp added a commit
that referenced
this pull request
May 20, 2026
* Guard event consumers during replay * Address event guard review feedback * Update event guard test fixtures
This was referenced May 20, 2026
pranaygp added a commit
that referenced
this pull request
May 20, 2026
Merged
VaguelySerious added a commit
that referenced
this pull request
Jun 10, 2026
… export ResumedHook; docs - Only take the resilient path when the target run's recorded @workflow/core version understands hookInput on the queue payload. Runs keep executing on the deployment they were created on (skew protection), and older runtimes parse the queue message with a schema that silently strips unknown fields - the resume payload would be lost while resumeHook() reported success. Fail fast (propagate the original event-write error) for such runs instead, preserving the caller's ability to retry. - Carry the hook token on hookInput and write it into the materialized hook_received event so it gets the same replay-divergence guard as a directly written event (#2030 parity). - Export ResumedHook from @workflow/core/runtime and workflow/api. - Add changelog page and update resumeHook() API reference docs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
TooTallNate added a commit
that referenced
this pull request
Jul 31, 2026
…ilures (#1834) * Make resumeHook() resilient to transient hook_received event write failures When events.create('hook_received') fails with a retryable error (429/5xx), resumeHook() now dispatches the queue message with a `hookInput` payload carrying the dehydrated hook payload. The workflow runtime materializes the missing hook_received event from that payload on its next delivery, mirroring the existing resilient-start behavior of start() / run_created / run_started. Returned Hook carries a new `resilientResume: true` flag when the fallback path was taken. Both write paths share a client-minted `resumeId` as an idempotency key so the runtime can dedup if the direct write actually committed but the client saw a transient error. Uses a sequential write-then-queue flow (not parallel) to avoid a dedup race on the happy path: hook_received events have no entity-level conflict guard (unlike run_created), so a duplicate written before the direct write commits would double-deliver the payload to the workflow. * Fix resilient resume: use local payload in materialized hook_received event The server returns a 'lazy' response for hook_received event creation, where eventData.payload may be a RefDescriptor (when the payload exceeded the inline size and was offloaded to blob storage) rather than the raw bytes. Pushing this directly to the in-memory events array caused the workflow VM to fail with 'Invalid input' when trying to deserialize the RefDescriptor as a Uint8Array. Substitute the eventData we already have locally so the in-memory event matches what getWorkflowRunEvents would return after client-side ref hydration. * Gate resilient resume on target runtime capability; carry hook token; export ResumedHook; docs - Only take the resilient path when the target run's recorded @workflow/core version understands hookInput on the queue payload. Runs keep executing on the deployment they were created on (skew protection), and older runtimes parse the queue message with a schema that silently strips unknown fields - the resume payload would be lost while resumeHook() reported success. Fail fast (propagate the original event-write error) for such runs instead, preserving the caller's ability to retry. - Carry the hook token on hookInput and write it into the materialized hook_received event so it gets the same replay-divergence guard as a directly written event (#2030 parity). - Export ResumedHook from @workflow/core/runtime and workflow/api. - Add changelog page and update resumeHook() API reference docs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Address review: correct capability cutoff, drop own-version escape hatch, replay-side resumeId dedup Review fixes for the resilient-resume capability gate and dedup: - Bump the supportsQueueHookInput cutoff to 5.0.0-beta.39: 5.0.0-beta.38 is published WITHOUT this feature (its queue-payload schema strips hookInput), so classifying it as capable would silently lose resume payloads. The cutoff is now a single exported constant (QUEUE_HOOK_INPUT_MIN_VERSION) with a TODO(release) requiring re-verification at merge time. - Remove the own-version exact-match escape hatch entirely: version strings do not identify builds (a published beta.38 and a main-built tarball can share a version string while differing in content), so the check could declare a featureless published deployment capable. Pre-release builds now fall back to fail-fast until the version is bumped past the cutoff — the safe direction. Tests simulate a capable target explicitly. - Make duplicate suppression authoritative at the replay boundary: replay now dedups hook_received events sharing a resumeId (same resume attempt), so even when concurrent redelivery of the same queue message double-materializes the event (no World enforces uniqueness on hook_received), the payload reaches workflow code exactly once. This is a pure function of the persisted log, keeping replay deterministic. The runtime's snapshot check remains as best-effort write suppression, with its comment corrected to say so; the EntityConflictError catch is kept as the forward-compatible signal for planned server-side (runId, resumeId) uniqueness, with its comment corrected to say it is defensive today. - Stamp materialized hook_received events with occurredAt decoded from the resumeId ULID so resiliently-resumed hooks are timestamped at resume time rather than after the queue round-trip. - Pin the cross-version compat contract in a test: the direct write is resumeId-only (no digest or negotiation fields), which later server-side idempotency work must keep accepting. - Exercise the published boundary (5.0.0-beta.38) in fail-fast tests, and make the capability tests self-check against the exported cutoff constant instead of restating literals. - Docs: changelog date June -> July 2026, dash consistency, and document the replay-side dedup guarantee. * Encode release-gate and successor-rebase contracts into code comments Comment-only changes capturing the review agreements so they survive the parallel-resume successor rebase (no behavior change): - capabilities.ts: the QUEUE_HOOK_INPUT_MIN_VERSION re-verification point is the actual combined SDK release (after the successor lands and its server-side dedup is deployed), not source-merge time — this PR merges source-only and no SDK is published from it alone. Every Version Packages merge in between moves the earliest possible carrier. - workflow/hook.ts + runtime.ts: scope the replay-side resumeId dedup honestly as defense-in-depth over the persisted log, not a cross-invocation exactly-once guarantee — concurrent invocations replaying pre-duplicate snapshots each see only their own row; the storage-level (runId, resumeId) constraint in the successor work is the correctness boundary. The set stays useful post-constraint for logs written before it deployed. - runtime.ts: document the EntityConflictError swallow's known gap while the branch is defensive (this invocation's local log lacks the payload; progress relies on the other writer's delivery or redelivery) and pin the rebase contract for when the constraint makes it live: a matching claim must append the canonical event locally and succeed; a real conflict must rethrow for redelivery. - resume-hook-resilient.test.ts: reframe the wire-shape pin as a tripwire rather than a permanent contract — the successor deliberately widens it (ID/digest pair + attestation) before any SDK release, so the resumeId-only shape never ships as a published server contract. --------- Co-authored-by: Peter Wielander <peter.wielander@vercel.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds replay-time ownership guards for step, wait, and hook lifecycle events so consumers do not resolve solely by correlation ID when guard metadata is present.
resumeAt, and hook tokens.run_failedwithRUNTIME_ERROR.run_failedinstead of retrying forever.Validation
pnpm --filter @workflow/core exec vitest run src/workflow/sleep.test.ts src/workflow/hook.test.ts src/abort-controller.test.ts src/runtime.test.tspnpm --filter @workflow/core exec vitest run src/workflow.test.ts -t "resumeAt mismatches|hook_received token mismatches"pnpm --filter @workflow/core typecheckgit diff --checkNote:
pnpm exec biome check ...still reports pre-existing complexity/legacy lint diagnostics in touched runtime files; safe formatter/import fixes were applied.