Workable.AspNetCore 1.1.81126.1

• net10.0

  • Workable.Abstractions (>= 1.1.81126.1)

# 1.1.081126.1

Date: 2026-08-11

## Breaking Changes

- Custom `IWorkConfigurationBuilder` implementations must implement the two new `AllowChildExecution(...)` overloads. Workable's built-in builder already provides them. Child-execution grants are registration-specific and cannot be supplied through `WithWorkDefaults(...)`.
- Workflow-started child input no longer carries the legacy `workflow-definition` or `workflow-step` identifiers. `workflow-run` remains as system-assigned correlation metadata and is now reserved: ordinary and delegated queue requests cannot supply it. Consumers should use typed workflow events, step-event payloads, workflow views, and the trusted `WorkflowRunId` worker projection instead of treating input identifiers as workflow authority.
- SQL schema auto-deployment now treats a database as fresh only when it has no Workable component versions and no known Workable objects. A database containing Workable tables without `SchemaVersion` metadata is rejected as an ambiguous legacy or partial installation and must be repaired or explicitly versioned before upgrade.

## Added

- Added delegated child-work execution. A parent registration can declare explicit `AllowChildExecution(...)` edges and use a scoped `IChildWorkQueueService` to execute those children without granting the initiating caller direct queue permission on the child definitions.
- Added immutable child-execution graph validation. Catalog startup rejects missing child definitions, self-references such as `A -> A`, and cycles such as `A -> B -> A`, while allowing acyclic graphs with shared descendants.
- Added execution-scoped child authority. The child queue accepts only definitions declared by the active parent, retains the initiating actor and origin for audit, and is revoked when the initializer or executor returns. Escaped service references cannot be used after the parent attempt ends.
- Added workflow-native child delegation. `DispatchWork(...)`, `DispatchWorkFromWorkflowInput(...)`, and `DispatchEach(...)` use the accepted workflow execution authority for their declared edges. Workflow pause, resume, and cancel can likewise propagate to that run's own outstanding children without granting the caller general worker-control permission.
- Added system-owned `WorkflowProvenance` containing the run, workflow definition, and step identity. Workable retains it separately from caller-controlled input, persists it through SQL durability, and uses it to validate workflow containment and delegated child control.
- Added trusted `WorkflowRunId` projections to worker snapshots, worker overview responses, SignalR updates, and the admin UI. Authorized child readers can navigate to an associated run without exposing the workflow definition or step provenance used internally for containment checks.
- Added durable failed-worker recovery support to the persistence contract and SQL Server provider. Failed workers retain their failure time and messages, are restored after restart in `Failed` without executing, and resume normal explicit restart, cancellation, and auto-cancel behavior.
- Added typed work-event definition identity through `WorkEventDefinitionKind`, `WorkflowDefinitionId`, and corresponding realtime fields so work and workflow definitions can safely share the same name.

## Changed

- Direct queueing still enforces the target child's ordinary authorization. Delegated execution bypasses only the child's queue authorization and continues to apply input and configuration validation, capacity, concurrency, idempotency, and durability rules.
- Child relationships are frozen with the catalog and cannot be changed by runtime work-definition reconfiguration. `AllowChildExecution(...)` is rejected inside `WithWorkDefaults(...)` with an explanatory exception rather than being inherited broadly.
- Workflow control delegation now requires an authoritative worker snapshot whose system-owned provenance matches the current run, workflow definition, and recorded step membership. A mismatch falls back to the caller's normal authorized worker operations.
- Authorization read fingerprints now include the logical system name, normalized groups, typed readable work and workflow definition ids, diagnostics visibility, and authentication state using length-prefixed hashing.
- Authorization projection reuse now accepts only the exact factory-issued snapshot object for the same system. Cloned, forged, cross-system, actor-mismatched, or otherwise unattested snapshots are recomputed through normal authorization resolution.
- Bulk worker actions now select candidates from the authoritative worker store instead of the eventually consistent read model, authorize against typed definition ids, and execute the captured versions serially. Non-bulk queries and operations retain their existing paths.
- SQL Server schema deployment now installs the complete current schema directly for a new database and otherwise runs only the ordered migrations required by each installed component version. The queue durability upgrade is collapsed into schema version 4, execution diagnostics advances to version 7, and migration scripts contain schema changes plus version metadata only—not application-data rewrites.
- The SQL schema removes deprecated queue state columns from `WorkEntries`, removes obsolete claimed timestamps from `WorkQueueEntries`, and removes unused workflow `UpdatedAt` state. The generated sample schema and runtime/CLI deployment continue to share one source.

## Fixed

- Fixed retained durable failures disappearing from the in-memory control plane after process restart. SQL-backed failures are now leased, restored exactly once, and kept non-executable until an explicit valid action or configured auto-cancel settles them.
- Fixed ready-work notifications and normal reader drains unnecessarily querying failed-worker recovery. Failed recovery now runs during startup and on its own lease-duration interval, keeping the common ready-work path to one claim query.
- Fixed unexpected durability reader, cleanup, failure-retention, and lease-renewal exceptions being hidden or losing retry context. Retry boundaries now record diagnostics and warnings, preserve cancellation behavior, and retry without silently swallowing unexpected failures.
- Fixed durable claim and final-cleanup lock ordering that could deadlock under concurrent SQL activity. Candidate selection and primary-key mutation now use a consistent order, with integration coverage for simultaneous claim and cleanup.
- Fixed retained failed rows remaining in general ready indexes. Ready and persistent-concurrency-ready indexes are now filtered to `Disposition = 'Ready'`, preventing failed-row accumulation from degrading normal claims.
- Fixed startup failures leaving partially prepared workers, materialized durable workers, workflow observers, recovered workflows, automatic starts, or startup-source state behind. Startup cleanup is serialized and reversible, and a later `Start()` can retry from a clean state.
- Fixed workflow and work definitions with the same name sharing event authorization scope. Typed event namespaces and ids now keep their catalog visibility, subscriptions, and realtime groups separate without forbidding same-name registrations.
- Fixed authorization projection caches surviving group, authentication, workflow visibility, diagnostics visibility, or system-scope changes. Cache keys and fingerprints now cover the complete projection inputs.
- Fixed bulk actions missing authoritative workers or acting on stale read-model versions. The bulk-only candidate path now uses current worker records while preserving per-action authorization and optimistic version checks.
- Fixed malformed, blank, and caller-mutated identifiers reaching queue admission. Workable snapshots caller-owned identifier collections before validation and rejects empty identifier types or values and caller-supplied reserved workflow metadata.
- Fixed worker-to-workflow navigation trusting searchable input identifiers. HTTP, SignalR, and the admin UI now use the trusted worker `WorkflowRunId` projection.
- Fixed `UnwatchView` and `UnwatchWorkerOverview` surfacing expected `OperationCanceledException` failures when the SignalR connection had already been aborted. Unwatch now matches the watch methods by suppressing cancellation only when `ConnectionAborted` is cancelled.
- Fixed SQL schema initialization applying every historical migration to a new database, rewriting version metadata for already-current components, or partially upgrading before discovering an unsupported component version. Deployment inspection and application are serialized under the schema lock and transaction.
- Fixed schema generation and deployment for quoted schema names, concurrent fresh installation, missing component versions, and current-version no-op paths.
- Fixed benchmark races against background read-model publication and fixture exhaustion. Relevant benchmarks now wait for read-model quiescence, isolate consuming invocations, fail the command on invalid or missing BenchmarkDotNet results, and document how to treat multimodal measurements.

## Security

- Delegated child authority is reachable only through the scoped child service or the registered workflow graph; the general queue and worker-operation surfaces continue to enforce direct authorization.
- Parent executors remain responsible for validating caller-controlled tenant, account, subject, and other business scope before constructing child input, and for bounding caller-driven fan-out. Delegation intentionally does not infer application-specific business authorization.
- System-owned workflow provenance is persisted separately from `WorkInput` and revalidated against authoritative run membership before delegated workflow control. The searchable `workflow-run` identifier is correlation data only and is never accepted as proof of containment.
- Work and workflow events now carry typed definition scope, closing same-name authorization collisions without requiring applications to rename either definition.
- Authorization fingerprints are system-scoped and unambiguous, and delayed projection work preserves the authenticated state. Publicly constructible or cloned snapshot values cannot opt into the trusted projection cache.
- Null, blank, malformed, reserved, and mutation-raced identifiers fail queue admission without creating a worker or elevating child/workflow authority.

## Performance

- The authoritative bulk candidate source is used only by bulk actions; ordinary reads, single-worker operations, and worker execution are unaffected.
- Ready-work signals no longer run failed-recovery claims, and filtered ready indexes keep retained failures out of the executable claim path.
- A repeated 1,000-worker SQL durable lifecycle benchmark completed 10 of 10 runs with no reader, lease, or cleanup failures, zero pending cleanup, and zero final durable work rows. The reviewed build recorded a 1.755-second median versus 1.800 seconds immediately before the ready-index change.

## Documentation

- Added delegated child-execution guidance, configuration examples, stored-procedure security-boundary guidance, workflow delegation behavior, immutable graph constraints, and `WithWorkDefaults(...)` restrictions.
- Updated workflow, queueing, authorization, observability, failed-worker, SQL durability, realtime, core API, and admin UI documentation for trusted provenance, typed event scope, durable failed recovery, and schema deployment behavior.
- Expanded regression coverage across child authorization, workflow propagation, startup rollback, bulk actions, authorization caching, SignalR projection, durable recovery, SQL migration paths, deadlock prevention, and benchmark correctness.