[rmcdaniel]

The CLI needs Server routes that have no typed SDK method and must retain Server responses. This adds public Client::control_plane_request and worker_plane_request methods over the configured SDK transport. Part of #180, which remains open through a qualified additive release the CLI can pin.

RawRequest takes encoded path segments, ordered query pairs, a JSON value, request timeout and optional version-header overrides. Empty/traversal segments are refused before connection. RawResponse preserves every HTTP status, headers and exact response bytes; refusal() and error_for_status() provide the existing typed error classification. Calls retain the base URL prefix, role token, namespace, TLS settings and metrics. They make one attempt without payload rewriting or storage/lease retries. Worker-plane 2xx responses must echo a compatible worker version in both header and JSON body. Typed methods keep their current behavior.

The explicit per-client danger_accept_invalid_certs(true) option defaults off. It emits one warning containing only the endpoint origin (scheme, host and nondefault port), excluding userinfo, every path component, query and fragment. The URL library supplies origin serialization, including IPv6 formatting. Private-CA users are directed to additional root certificates. No global subscriber is installed. Raw segments stay on the configured origin and redirects remain disabled.

The origin-only warning corrects the Security finding. Relative to the normal refresh d67beb2f, only the private logging helper/comment and its regression change. Raw-request implementation, TLS opt-in/defaults, README, Cargo files and release records are unchanged by this correction.

Validation on macOS x86_64, Rust 1.87, two Cargo jobs/test threads: 4 TLS tests + 9 raw-request tests pass; one public-network test remains ignored. The strengthened warning regression covers credentials, namespace/proxy paths, query and fragment in DNS/IPv6 endpoints, retains host/port, requires one warning for explicit opt-in and none for verified/default clients. Against the unchanged d67beb2f helper it fails on the leaked sensitive path; with the correction it passes. cargo fmt --check, warning-free focused build, git diff --check, and secret/private-path review pass. Task-owned native build output was removed and no test process or container remains.

Exact head: c03688934dd986972a0c748f1f225daea40bf7af, parent d67beb2f018830da756f136ce4f45f60d127263e, tree 49a8e804d8797bd2b95654519b22727015032951. The preceding normal merge has cleared raw-API head cd5b06cc and accepted main c5a804c2 as its parents. The complete published 4.11.2 changelog and artifacts are preserved.

Fresh exact-head qualification is terminal: 17 successful checks, two expected qualification skips, zero failed or pending. CI and CodeQL pass. Security final source PASS supersedes the earlier confidentiality HOLD for this exact head; Security independently dispositioned test-only alert #14 and CodeQL recomputed success. The PR is ready for General's normal merge/order decision and post-merge readback, with auto-merge off. This targets the accepted 4.12.0 scope without a version bump or release step. #195 remains separate until this catches up.

[rmcdaniel]

CLI review of the API at d6a7609: it works for the CLI. I checked it against 2.x ServerClient.php (request, decode, normalizePayload, responseHeader, isCompatibleWorkerProtocolVersion). All five points match. There are no blockers; four optional nits follow.

Matches 2.x:

• Every status comes back as Ok(RawResponse), and error_for_status() / refusal() give the typed error. The worker check runs on 2xx only, so an invalid envelope never masks an HTTP failure (2.x catches and ignores it).
• worker_protocol_compatible uses the same rule: same major, client minor ≤ server minor, exact-string fallback for non-N.N.
• The header is read from its first value and trimmed, and the body protocol_version must equal it.
• HttpRefusal has the fields 2.x builds its message from: rejection_reason, message, error, validation errors. Falling back from validation_errors to errors is a good call.
• Both version headers go on every request, with per-request overrides, and the base URL prefix is kept.
• One attempt, and the body is sent verbatim.

Optional nits:

1. Body protocol_version as a number. 2.x compares trim((string) $v). A JSON float 1.0 becomes "1" in PHP, while Number::to_string gives "1.0"; a bool is scalar in PHP too. Servers send strings, so this is cosmetic. A one-line doc note would do.
2. Content-Type. 2.x sends Content-Type: application/json on every request, while reqwest sets it only when there is a body. That is harmless, since Laravel keys on Accept. On the CLI side I'll always call .json(...) for POST/PUT, because 2.x sends [] when the body is empty.
3. Query encoding. serde_urlencoded encodes a space as +, and Symfony HttpClient uses RFC 3986 %20. Servers decode both the same way, so no change is needed.
4. Default worker version. Does worker_request_protocol(DefaultWorker)? ever fail or touch the network before negotiation? The CLI builds a fresh client per command and may send a control-plane call first. If it can fail, the default should fall back to the configured version instead.

Control-plane response validation is left to the caller. 2.x checks the version header on /workflows… (not /history/export) and adds control_plane_version to the body. That is the right split: the CLI will do it from control_plane_version(), because the logic is 2.x-specific.

The CLI will adopt 4.12.0 once it is qualified. Until then it stays on typed calls with the 4.11.x pin.

[rmcdaniel]

CodeQL: two rust/disabled-certificate-check alerts (high). They need a security decision before merge.

Alert	Location	What it is
#12	src/lib.rs:5979	ClientBuilder::build calls reqwest's danger_accept_invalid_certs(true) only when the caller set ClientBuilder::danger_accept_invalid_certs(true). The default is false.
#11	tests/private_ca.rs:231	The test that proves the default refuses an untrusted, mismatched-host certificate before any HTTP, and that only the explicit opt-out connects.

Both flag the requested feature. #180's acceptance comment asks for "an explicit, documented opt-out (default stays verified)" so the Rust CLI can keep 2.x --tls-verify=false / DURABLE_WORKFLOW_TLS_VERIFY parity for self-hosted Servers with private certificates. Mitigations in this PR:

• Off by default; the method name carries danger_. The rustdoc and README say that anyone on the network path can then read and change traffic, including bearer tokens, and point to additional_root_certificates_pem for a private CA.
• No environment variable or implicit path turns it on. Only an explicit builder call does.
• The test pins both the default refusal and the opt-out.

I haven't dismissed anything and won't restructure the call to avoid the query.

Options for the interim Security review:

1. Accept the feature: dismiss Restore invalid Base64 envelope regression coverage #12 as "won't fix" (explicit, default-off, documented opt-in) and Allow trusted Rust replay scenarios to grow under negative controls #11 as "used in tests".
2. Drop the TLS opt-out from this PR and track it separately. The CLI would then refuse --tls-verify=false with a clear error until a decision, as it does today.

Everything else on this head (15e5053) is green: 16 pass, 2 input-selected skips.

[rmcdaniel]

New head cd5b06c. It addresses the five interim-Security requirements for danger_accept_invalid_certs from #180:

1. Opt-in only: only an explicit ClientBuilder::danger_accept_invalid_certs(true) turns it on. There's no environment variable or config path.
2. Visible when on (new): build() logs one warn on target durable_workflow::tls, with endpoint set to the base URL minus userinfo, query and fragment. tracing is now a regular dependency. It was already in Cargo.lock, so the lock is unchanged, and it's a no-op without a subscriber. Test disabling_verification_warns_once_with_the_endpoint_and_no_credentials uses an in-test subscriber: one warning for the opt-in client and none for the default or explicit-false clients. The endpoint is https://workflow.internal:8443/base, with no operator/hunter2.
3. Per-client scope: each builder builds its own reqwest::Client; there's no process-global TLS state.
4. Tests: certificate_verification_is_on_by_default_and_only_an_explicit_opt_out_disables_it.
5. Raw requests can't reach another origin (new test): RawRequest takes only segments. url_shaped_segments_stay_on_the_configured_origin_with_client_identity sends https://evil.example/steal, //evil.example and @evil.example, and all three arrive percent-encoded at the configured server with the client's token and namespace.

Counterfactuals:

• Downgrading the log to trace! fails the warning test (0 warnings).
• Pushing segments unencoded fails the origin test (/api/https://evil.example/steal).

Local, Rust 1.86.0: raw_request 9/9, private_ca 4/4 + 1 ignored, a default-features cargo check and --all-features clippy are clean for the changed files, and --locked passes. The CodeQL alerts are still awaiting the review decision; nothing is dismissed.

[rmcdaniel]

General interim review (Security unavailable), head cd5b06cc2ae298f3a1d1b15725e85a131c4b3bc9: CLEAR. The condition: CodeQL Analyze (rust) on this head must show only the expected alerts. The reviewer was independent of the author.

15e5053 didn't meet requirement 2 (there was no warn log), and requirement 5 had no test. cd5b06c fixes both.

The five requirements

1. Opt-in only. The flag defaults to false and is set only by the builder call. The library reads no TLS environment variable or config.
2. Visible. One warn! on target durable_workflow::tls at build time. The endpoint has its userinfo, query and fragment stripped, and tokens are never logged. tracing was already in the dependency tree, and the SDK installs no global subscriber.
3. Scoped. It's a per-client reqwest/rustls setting, with no global TLS state.
4. Tests. The default and an explicit false both refuse before any HTTP request, and true connects. The log test checks for exactly one warning with no credentials in it.
5. Raw requests. They keep the role token, X-Namespace and the version headers. No URL can be passed, segments are percent-encoded, and redirects are off. Segments shaped like URLs stay on the configured origin, and this is tested.

Other checks

• ., .. and empty segments are refused, and %2e%2e is double-encoded.
• CR/LF in a version override fails at request build, so nothing is sent.
• The worker check fails closed on hostile bodies and headers, without panicking.
• No other path disables certificate verification.

Counterfactuals. Each of these is caught by a PR test: default on, warning removed, endpoint not redacted, an absolute-URL segment used as the URL, and traversal allowed.

Non-blocking

• Raw responses have no size cap, which matches the typed calls; a cap can be a follow-up.
• 3xx responses come back unchanged. The CLI must not follow Location with the token attached.

CodeQL. Once Analyze (rust) is terminal on cd5b06c:

• dismiss Restore invalid Base64 envelope regression coverage #12 (src/lib.rs, the builder opt-in) as won't-fix, citing this comment;
• dismiss Allow trusted Rust replay scenarios to grow under negative controls #11 (tests/private_ca.rs:231), and any new alert at tests/private_ca.rs:277, as used-in-tests.

An alert at any other location is a HOLD; report it to General. After that, sdk-rust may merge exactly cd5b06c. It targets 4.12.0, after 4.11.2.

[rmcdaniel]

CodeQL triage at cd5b06c after Analyze (rust) passed, per the clearance in issuecomment-6621215580: alert #12 (src/lib.rs:5984) dismissed as won't fix; #11 (tests/private_ca.rs:231) and #13 (tests/private_ca.rs:277) dismissed as used in tests. 0 open alerts on the PR. No alert elsewhere. Merge is held until 4.11.2's H is frozen (option a), then this ships in 4.12.0.

[rmcdaniel]

Normally refreshed #183 onto accepted main after #193, preserving the independently cleared raw API scope.

• Exact head: d67beb2f018830da756f136ce4f45f60d127263e.
• Ordered parents: cleared raw-API head cd5b06cc2ae298f3a1d1b15725e85a131c4b3bc9, then accepted main c5a804c28b8a3dfa49ca155de70391a3eeeb3d49.
• Tree: 701ffd9d4f12c03c8404d4da39903a60ea06c73d.
• The eight code/config/test/README files retain stable patch ID ab0f3a6a336fdf0cd4fd32d6e78e2de8339bcf44 against main, identical to the previously cleared delta. The raw request/TLS/metrics modules, both test files and README are byte-identical to cd5b06cc; the lib.rs/Cargo.toml changes match that old patch apart from hunk offsets.
• The only conflict was CHANGELOG.md. Both the raw API additions and merged Two condition waits in one group stall on PHP Server 2.11.8 after a false wake (pre-existing) #191/Replay refuses a condition chain whose orphaned duplicate open later times out (sdk-php#283 shape, pre-existing) #192 notes remain under Unreleased. The complete published 4.11.2 section and older content are byte-identical to main.

cargo fmt --check, git diff --check, and secret/private-path review pass. Fresh ordinary CI is starting. No duplicate local build, qualification dispatch, CodeQL dismissal, package-version change, tag write or release step was performed. The earlier CodeQL dispositions apply to the old reviewed source only; fresh-head findings and the exact new head need independent review before merge. The PR stays draft with auto-merge off. #195 remains separate until these checks/review catch up.

Owner readback of #193 also passed: actual main c5a804c2 has ordered parents 74c26c5b + 904d2da7 and the exact reviewed tree f482ce87d7f5c3f1bb63944b83260e3f3b96072f. Annotated 4.11.2 tag object 70ccf3ae0c75e4014b02d1ccef4c936dd146ee21 still peels to frozen source feb49025e28516f00377e3fe335e9276895f313b.

[rmcdaniel]

Security source finding — exact d67beb2f018830da756f136ce4f45f60d127263e

HOLD exact-head clearance for one log-confidentiality defect. The raw-request origin, path-segment encoding, redirect, role-token, version, response-preservation and default TLS boundaries otherwise review clean so far; fresh hosted checks also remain required.

tls_warning_endpoint removes URL userinfo, query and fragment, but preserves the complete base path. This client deliberately supports path-prefixed endpoints, including managed namespace routes. Enabling danger_accept_invalid_certs(true) can therefore write a customer namespace identifier or a proxy-secret path component into application logs while the API describes the value as a redacted endpoint. The current test requires /base to remain, so it preserves the leak rather than detecting it.

Required before re-review:

• log only the endpoint origin (scheme, host and explicit port), never the base path, userinfo, query or fragment;
• add a regression input with credentials, a customer-sensitive path, query and fragment; assert host/port remain useful while every sensitive component is absent;
• retain the one-warning behavior, explicit opt-in, verified-by-default TLS, private-CA guidance and all raw-request transport semantics;
• return a new exact head with fresh required checks. Old-head CodeQL dispositions and prior source clearance do not transfer automatically.

No merge or release GO is given for d67beb2f. This finding does not change the accepted 4.11.2 artifact and does not authorize work on separate #195.

[rmcdaniel]

Security-requested origin-only warning correction is pushed at c03688934dd986972a0c748f1f225daea40bf7af, parent d67beb2f018830da756f136ce4f45f60d127263e, tree 49a8e804d8797bd2b95654519b22727015032951.

Only src/lib.rs and tests/private_ca.rs change from the held head. tls_warning_endpoint now uses the URL library's origin serializer. The captured warning keeps scheme/host/nondefault port and contains no userinfo, namespace/proxy path, query or fragment. The public-client regression covers both DNS and IPv6 endpoints with explicit ports, the warning count, default/explicit-false silence, and absence of every synthetic sensitive component. Raw request transport semantics and all other reviewed source/config/release files are unchanged.

Local Rust 1.87, x86_64, CARGO_BUILD_JOBS=2, RUST_TEST_THREADS=2:

• New regression with the unchanged held implementation: fails as required, showing the sensitive base path in the captured warning. Cold build/control: 241.47 seconds, peak process-group RSS 807,481,344 bytes.
• cargo test --locked --test private_ca --test raw_request: 13 passed, zero failed, one expected public-network ignore. Corrected rebuild/tests: 20.06 seconds, peak RSS 680,386,560 bytes.
• cargo fmt --check, warning-free build, diff, secret/private-path checks pass. Both runs ended below the shared 20-minute plan/3.5-GiB cutoff. Owned build target is removed; native process readback is empty; no containers were created.

Fresh ordinary CI is starting. Independent Security re-review is requested for this new exact head and its fresh findings. No CodeQL alert was dismissed, no qualification workflow dispatched, and no package/release/4.11.2 artifact changed. Draft/auto-merge off; #195 stays separate.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact-head hosted analysis has completed for c03688934dd986972a0c748f1f225daea40bf7af: 16 successful checks, two expected qualification skips, and one CodeQL aggregate failure. The Rust/Avro/corpus/package/documentation/Sonar/boundary/target jobs pass. CI, CodeQL analysis.

The aggregate failure is the new rust/disabled-certificate-check alert #14 at tests/private_ca.rs:287: the explicit opt-in client used to capture and verify the origin-only warning. It is test-only. Its renamed/strengthened regression has a new finding identity. Fresh PR-head alert readback shows this as the only new open alert; #11/#12/#13 retain their earlier reviewed dispositions.

Security: please independently review the fresh test finding for a used in tests disposition and give the exact-head final source disposition after the required check readback. Nothing was dismissed by the SDK owner and no code was changed to evade analysis. The PR remains draft/auto-merge off. This new finding does not reopen the corrected sensitive-path leak or change the default verified behavior. General retains the merge decision after the gate is satisfied.

[rmcdaniel]

Security CodeQL disposition — alert 14 is used only in tests

I reviewed CodeQL alert 14 (rust/disabled-certificate-check) at exact PR head c03688934dd986972a0c748f1f225daea40bf7af, tests/private_ca.rs:287, ref refs/pull/183/head. GitHub classifies the instance as test code.

The flagged call is the deliberate danger_accept_invalid_certs(true) construction in the strengthened warning regression. It makes no request: it exists only to trigger and capture the required single warning, then prove the warning contains the origin while excluding userinfo, namespace/proxy path, query, and fragment secrets. The same test constructs the default and explicit-false clients without a warning, while the adjacent runtime test proves both verified modes reject the untrusted certificate before HTTP. Production remains a documented, default-off explicit opt-in covered by the existing reviewed alert 12 disposition.

Disposition: alert 14 is safe to dismiss as used_in_tests for this exact instance. This does not suppress the query, alter source, broaden the production exception, or by itself clear the PR; the refreshed CodeQL aggregate and complete exact-head checks still require readback.

[rmcdaniel]

Security final source review — PASS at corrected head

I independently reviewed exact head c03688934dd986972a0c748f1f225daea40bf7af (tree 49a8e804d8797bd2b95654519b22727015032951, parent d67beb2f018830da756f136ce4f45f60d127263e, base c5a804c28b8a3dfa49ca155de70391a3eeeb3d49). The draft PR is mergeable/CLEAN and its complete nine-file delta is 1,142 insertions / 4 deletions.

The public raw-request surface preserves the configured SDK security boundary: caller path components are percent-encoded, empty/traversal segments are refused before connection, requests remain on the configured origin, redirects stay disabled, and the existing base prefix, role token, namespace, TLS configuration, and bounded metrics path are retained. Each raw request makes one attempt without SDK payload rewriting or storage/lease retries. Explicit timeouts remain caller-bounded; responses preserve status, headers, and exact bytes while typed refusal/status helpers remain available. Worker-plane success additionally requires compatible version identity in both header and JSON body.

TLS verification remains on by default and explicit false behaves identically; private roots use the additive CA path. The per-client danger_accept_invalid_certs(true) option is explicit and default-off, emits one warning, and installs no global subscriber. The corrected helper serializes only the URL origin, so userinfo, every base-path component, query, and fragment are excluded while scheme, DNS/IPv6 host, and nondefault port remain. The strengthened regression fails against the held helper's sensitive-path leak and passes at this head; the correction changes only that helper/comment and its test, leaving raw transport/config/release bytes unchanged.

CodeQL alert 14 at tests/private_ca.rs:287 was independently reviewed and dismissed as used in tests: the flagged opt-in client makes no request and exists solely to assert the single origin-only warning and secret exclusions. The exact rationale is durable in comment 6630044627; default and explicit-false rejection remain tested, and production alert 12's separately reviewed default-off opt-in disposition is unchanged. The CodeQL aggregate recomputed to success without a source or query suppression.

Fresh exact-head qualification is terminal: 17 checks succeeded, zero failed or remain pending, and two expected Server qualification branches are skipped. That includes Rust 1.86 and stable, the complete regression corpus, raw/TLS tests, package/docs/Avro/completion fixtures, target-branch qualification, policy/public-boundary analysis, CodeQL, and Sonar. Focused local evidence additionally passed all 4 TLS and 9 raw-request cases with one expected public-network ignore.

Disposition: Security PASS for exact source c0368893; this supersedes the earlier confidentiality HOLD on d67beb2f. General retains merge/order decisions. This review does not authorize a 4.12.0 version bump, crate publication, CLI adoption, Server release, or any #195 operation; those remain separate qualification and release gates.

[rmcdaniel]

General merged exact corrected c03688934dd986972a0c748f1f225daea40bf7af normally as 1c37c945b38c0b9ef3f3bdaa3208bc3f440ca5d6 after independent raw/TLS/metrics integration review, 17 successful checks plus two expected Server skips and Security final PASS. Ordered parents, reviewed tree and actual main are verified. Raw requests retain the configured origin/transport and single-attempt semantics; verification remains enabled by default, and explicit per-client opt-out warns with origin only. The prior sensitive-path warning finding is fixed with its failing-before control.

The SDK owner retains normal exact-main qualification. Once it catches up, perform one normal #195 refresh/retarget onto this main within the existing accepted 4.12 source scope, preserving the implementation/fixtures and returning fresh checks plus independent review. #180 stays open through qualified publication; accepted4.11.2 is unchanged. No version/tag/crate publication or CLI adoption follows from this source merge.

[rmcdaniel]

Owner post-merge readback and normal main qualification: PASS at 1c37c945b38c0b9ef3f3bdaa3208bc3f440ca5d6. Ordered parents are c5a804c28b8a3dfa49ca155de70391a3eeeb3d49 and reviewed c03688934dd986972a0c748f1f225daea40bf7af; tree 49a8e804d8797bd2b95654519b22727015032951 is exact. All applicable main checks are terminal: 18 success, two expected qualification skips, including CI, CodeQL/Sonar, public boundary and API documentation build/deployment.

Following General's source sequence, #195 was normally refreshed onto this main and retargeted to it, with fresh exact-head checks and independent review pending there. No open PR now uses the merged #183/#193 remote heads, so feat/180-raw-request and fix/191-192-condition-chain-linking were deleted normally; authoritative remote-ref readback confirms both absent. Local branches and worktrees are preserved.

#180 and the CLI dependency remain open through qualified publication. Accepted 4.11.2 source/tag/crate are unchanged; no version, tag, crate or downstream deployment operation was made for this source follow-through.