Document qualified cancellation caller and access coverage

conformance/README.md

@@ -28,7 +28,7 @@ each public experiment.
 | Namespaces | `durable-workflow/server`: `scripts/conformance/namespaces-published-artifacts.sh`; `durable-workflow/sample-app`: [`scripts/sdk-namespaces.sh`](https://github.com/durable-workflow/sample-app/blob/main/polyglot/namespaces/README.md) (Rust namespace-bound clients/workers, denied cross-namespace operations and cold recovery) |
 | Nexus | `durable-workflow/server`: `scripts/conformance/nexus-published-artifacts.sh` (supported PHP/Python caller-service directions) |
 | Polyglot | `durable-workflow/sample-app`: `scripts/polyglot.sh` |
-| Principal attribution | `durable-workflow/server`: `scripts/conformance/principal-attribution-published-artifacts.sh`; `durable-workflow/sample-app`: [`scripts/sdk-namespaces.sh`](https://github.com/durable-workflow/sample-app/blob/main/polyglot/namespaces/README.md) (Rust named and anonymous actors, runtime credential rotation, start/signal/completion/query/failure/terminal-cancellation attribution, forged metadata refusal, cold recovery, CLI JSON/human history and Waterline remote selected-run API); [`scripts/sdk-children.sh`](https://github.com/durable-workflow/sample-app/blob/main/polyglot/child-workflows/README.md) (legacy token requester through Rust-involving cooperative propagation, duplicate requests and cold cleanup replay under forged metadata) |
+| Principal attribution | `durable-workflow/server`: `scripts/conformance/principal-attribution-published-artifacts.sh`; `durable-workflow/sample-app`: [`scripts/sdk-namespaces.sh`](https://github.com/durable-workflow/sample-app/blob/main/polyglot/namespaces/README.md) (Rust named and anonymous actors, runtime credential rotation, start/signal/completion/query/failure/terminal-cancellation attribution, forged metadata refusal, cold recovery, CLI JSON/human history and Waterline remote selected-run API); [`scripts/sdk-children.sh`](https://github.com/durable-workflow/sample-app/blob/main/polyglot/child-workflows/README.md) (legacy, runtime-token and anonymous cooperative requests through actual PHP/Python/Rust clients, duplicate identity and actor preservation, access refusals and cold cleanup replay under forged metadata) |
 | Replay | `durable-workflow/server`: `scripts/conformance/replay-published-artifacts.sh` |
 | Sagas | `durable-workflow/server`: `scripts/conformance/sagas-published-artifacts.sh` (PHP/Python matrix); `durable-workflow/sample-app`: [`polyglot/sagas/`](https://github.com/durable-workflow/sample-app/blob/main/polyglot/sagas/README.md) (five Rust-involving workflow/compensation directions) |
 | Schedules | `durable-workflow/server`: `scripts/conformance/schedules-published-artifacts.sh` (PHP/Python matrix); `durable-workflow/sample-app`: [`polyglot/schedules/`](https://github.com/durable-workflow/sample-app/blob/main/polyglot/schedules/README.md) (PHP- and Python-created schedules, Rust worker) |
@@ -82,6 +82,17 @@ timer, lineage and duplicate request identity, finish both runs as Cancelled
 within the original 30-second budget, and produce matching complete API/CLI
 cascade views. Report the executed scenarios and exact tuple separately;
 these results do not add Rust cells to the Server runner.
+The child command also runs five runtime-token and five anonymous cascades
+through actual PHP, Python and Rust cancellation clients. Runtime operator
+requests retain their original actor when an administrator repeats the request.
+Worker-role cancellation is refused with HTTP 403. Missing authentication is
+refused with HTTP 401, including Python's discovery wrapper around that response.
+The separate auth-disabled phase checks the configured anonymous actor.
+Both families preserve their original request identity, deadline and cleanup
+history through SIGKILL and cold replacement. They require both original runs
+to reach Cancelled within the initial shared 30-second budget. CLI and
+selected-run API inspection cover these cascades. Actual Waterline browser
+rendering remains a separate case.
 The ordinary Rust authored-workflow playground does not prove
 cross-language child-workflow behavior by itself.
 

conformance/sdk-coverage.md

@@ -42,7 +42,7 @@ Their SDK installation lists do not widen that scope.
 | --- | --- | --- |
 | Remote activity external effects: Sample App `scripts/sdk-activity-recovery.sh --external-effects` | All nine PHP/Python/Rust workflow/activity directions commit an operation to an isolated downstream HTTP service before activity-worker SIGKILL. A distinct replacement retries with the original operation key, immutable input and total deadline. Require one business effect, two delivery receipts tied to the actual attempt identities, the original effect identity, stale completion refusal, unchanged history and one workflow completion. Separate service tests exercise concurrent duplicates, conflicting inputs and physical downstream restart over the same SQLite ledger. | This fixture requires application idempotency supplied by the downstream service. It does not establish exactly-once effects for arbitrary external systems or cover compensation, child or update-handler side effects. |
 | Authoring, inputs/results and remote activities: Sample App `scripts/polyglot.sh`, full matrix in `polyglot/README.md`, `scripts/sdk-activity-recovery.sh`; Server `activities-published-artifacts.sh` | Featured PHP → Python → Rust journey and the full nine-direction successful activity matrix are separate commands. The recovery command executes retryable first-attempt failure, activity-worker SIGKILL, total deadline expiry across attempts, exhaustion of two retryable failures and application progress heartbeat expiry in all nine PHP/Python/Rust workflow/activity directions. It checks actual SDK claims, the original run/execution/total deadline, distinct attempts, recorded backoff, stale completion refusal while the retry is active and unchanged history. The progress case verifies typed details, liveness beyond the initial heartbeat deadline, a heartbeat retry with the same live worker, preserved expired progress and obsolete heartbeat refusal. Successful cases have one durable result/completion. Failed cases retain the actual terminal activity cause in one workflow failure, reject results after closure and admit no third attempt or successful result. Server's activity manifest primarily uses embedded PHP/Python cells, with a focused PHP SDK heartbeat-renewal shard. | The focused cases cover two attempts, start-to-close and heartbeat timeout retries, total deadline expiry, retry exhaustion and application progress in every supported workflow/activity language direction. Recovery of an external side effect requires a separate application idempotency or downstream fencing fixture. |
-| Child workflows: Server `child-workflows-published-artifacts.sh`; Sample App `scripts/sdk-children.sh` and `polyglot/child-workflows/` | Server's four embedded PHP/Python parent-child directions. Sample App runs all nine PHP/Python/Rust SDK completion directions and the five Rust-involving typed failure, cold worker-recovery and cooperative cancellation directions. Cancellation uses wait-for-child cleanup, worker SIGKILL during a recorded cleanup timer, original delivery/timer replay, immutable duplicate identity/deadline and complete matching API/CLI cascade views. | Process loss during an external side effect, direct child TRY_CANCEL/ABANDON requests and parent close after normal completion require separate scenarios. Keep the Server runner's PHP/Python cells and Sample App's SDK cells distinct. |
+| Child workflows: Server `child-workflows-published-artifacts.sh`; Sample App `scripts/sdk-children.sh` and `polyglot/child-workflows/` | Server's four embedded PHP/Python parent-child directions. Sample App runs all nine PHP/Python/Rust SDK completion directions and the five Rust-involving typed failure, cold worker-recovery and cooperative cancellation directions. Separate five-case runtime-token and anonymous cancellation families execute actual PHP/Python/Rust cancellation clients, operator/administrator duplicate actor preservation and worker/missing-authentication refusals. Cancellation uses wait-for-child cleanup, worker SIGKILL during a recorded cleanup timer, original delivery/timer replay, immutable duplicate identity/deadline and complete matching API/CLI cascade views. | Process loss during an external side effect, direct child TRY_CANCEL/ABANDON requests, parent close after normal completion and actual Waterline browser rendering require separate scenarios. Keep the Server runner's PHP/Python cells and Sample App's SDK cells distinct. |
 | Heartbeats: Server `heartbeats-published-artifacts.sh`, `heartbeats-python-published-artifacts.sh`, `heartbeats-rust-published-artifacts.sh`, shared wave runner; Sample App `scripts/sdk-activity-recovery.sh` | Server covers all three actual SDK worker heartbeat loops, cadence, metrics, stale transitions and routing exclusion. Sample App separately executes application progress heartbeat and missing-progress retry in all nine workflow/activity directions using the published cooperative worker opt-in, while the activity worker stays running. Its four ordinary recovery scenarios retain their existing worker mode. | Worker health, application progress and cancellation observation have distinct contracts and observations. Stopping application progress must not be hidden by healthy worker heartbeats. External effects still require application idempotency or downstream fencing. |
 | Timers: Server `timers-published-artifacts.sh`; Sample App `scripts/sdk-timers.sh` | Server's embedded PHP timer scenarios. Sample App supplies separate PHP/Python/Rust SDK completion, worker SIGKILL/cold replay, Server restart and cooperative cancellation cells. | Concurrent distinct deadlines and timer-bearing application upgrades need separate SDK execution. |
 | Sagas: Server `sagas-published-artifacts.sh`; Sample App `polyglot/sagas/` | Server's PHP/Python workflow-compensation directions; Sample App's five Rust-involving directions, typed compensation failure and restart before compensation. | Process loss during an external compensation side effect, duplicate delivery and external-effect recovery require explicit side-effect fixtures. Restart before compensation does not establish them. |
@@ -57,7 +57,7 @@ Their SDK installation lists do not widen that scope.
 | Nexus: Server `nexus-published-artifacts.sh` | Published PHP/Python caller/service execution, shared-service behavior, replay and cancellation probes. | Require all four supported caller/service directions and their actual async completion, typed failure and cancellation evidence. Rust is outside the current API scope. |
 | 1.x → 2.x migration: Server `migration-published-artifacts.sh` | Supported 1.x PHP artifacts and their durable state, target PHP/Python and operator surfaces. | Rust has no 1.x source artifact to migrate. Rust starting against the migrated target is a meaningful post-migration case. SDK upgrades within 2.x/3.x are separate from this engine migration. |
 | Compatibility skew: Server `skew-published-artifacts.sh` | CLI, PHP/Python SDK, Waterline and worker protocol pairings. | Add Rust's supported and refused protocol pairings. A major SDK package number is not itself a worker protocol compatibility boundary. |
-| Principal attribution: Server `principal-attribution-published-artifacts.sh`; Sample App `scripts/sdk-namespaces.sh` and `scripts/sdk-children.sh` | Server covers named/anonymous/raw HTTP actors, PHP/Python clients, worker completion/failure, CLI and Waterline. Sample App separately executes real Rust starts, signals, remote activities and workflow completions with namespace-bound operator and worker credentials. A disposable gateway injects the published principal contract's forged body fields and headers into actual SDK requests. During worker absence, all four credentials are rotated through the Server API. Duplicate rotations preserve their timestamp, real Rust calls refuse the old credentials, and new credentials complete the original runs with the same authenticated subjects. Successful request receipts and original-run histories retain start/signal/completion actors through worker SIGKILL and cold replacement. Selected-run queries distinguish Server's authenticated response principal from a forged application-result principal and leave history unchanged. Additional Rust workflows fail with the worker actor or receive terminal cancellation with the operator actor after a declared wait, preserving their original runs and one terminal boundary. A final isolated phase requires token-driver refusal before explicitly recreating the disposable frontend with the `none` driver. Actual credential-free Rust callers and worker then execute activity/workflow completion, signals, queries, authored failure and terminal cancellation with server/anonymous actors and the same forged metadata matrix. Published native CLI JSON and human tables inspect every original terminal run. Published Waterline uses its read-only remote backend to inspect the same selected runs, statuses, complete timelines and command actors. Both views must match preserved Server histories without mutating them. | The Rust case covers named and anonymous actors, runtime credential rotation and start/signal/completion/query/failure/terminal-cancellation attribution, plus CLI and Waterline API visibility of actual Rust runs. Activity execution identities are checked separately, while internal events may have explicit null principals. The separate child runner checks the legacy token requester through actual Rust-involving cooperative propagation, duplicate requests, committed delivery and cold cleanup recovery under forged metadata. It uses a published Python cancellation caller. Runtime-token roles, anonymous cooperative requests, Rust cancellation-client calls and Waterline browser rendering remain separate cases. The anonymous phase qualifies auth-disabled self-hosting, not anonymous Cloud access or namespace isolation without authentication. Credential administration uses the Server API. Transport injection does not add a custom-header SDK API, and the query observer does not add a Rust raw-response API. |
+| Principal attribution: Server `principal-attribution-published-artifacts.sh`; Sample App `scripts/sdk-namespaces.sh` and `scripts/sdk-children.sh` | Server covers named/anonymous/raw HTTP actors, PHP/Python clients, worker completion/failure, CLI and Waterline. Sample App separately executes real Rust starts, signals, remote activities and workflow completions with namespace-bound operator and worker credentials. A disposable gateway injects the published principal contract's forged body fields and headers into actual SDK requests. During worker absence, all four credentials are rotated through the Server API. Duplicate rotations preserve their timestamp, real Rust calls refuse the old credentials, and new credentials complete the original runs with the same authenticated subjects. Successful request receipts and original-run histories retain start/signal/completion actors through worker SIGKILL and cold replacement. Selected-run queries distinguish Server's authenticated response principal from a forged application-result principal and leave history unchanged. Additional Rust workflows fail with the worker actor or receive terminal cancellation with the operator actor after a declared wait, preserving their original runs and one terminal boundary. A final isolated phase requires token-driver refusal before explicitly recreating the disposable frontend with the `none` driver. Actual credential-free Rust callers and worker then execute activity/workflow completion, signals, queries, authored failure and terminal cancellation with server/anonymous actors and the same forged metadata matrix. Published native CLI JSON and human tables inspect every original terminal run. Published Waterline uses its read-only remote backend to inspect the same selected runs, statuses, complete timelines and command actors. Both views must match preserved Server histories without mutating them. | The Rust case covers named and anonymous actors, runtime credential rotation and start/signal/completion/query/failure/terminal-cancellation attribution, plus CLI and Waterline API visibility of actual Rust runs. Activity execution identities are checked separately, while internal events may have explicit null principals. The separate child runner checks legacy, runtime-token and anonymous requesters through actual PHP/Python/Rust cancellation clients, Rust-involving cooperative propagation, duplicate identity and original actor preservation, committed delivery and cold cleanup recovery under forged metadata. It also requires actual worker-role 403 and unauthenticated 401 refusals. Waterline browser rendering remains a separate case. The anonymous phase qualifies auth-disabled self-hosting, not anonymous Cloud access or namespace isolation without authentication. Credential administration uses the Server API. Transport injection does not add a custom-header SDK API, and the query observer does not add a Rust raw-response API. |
 | Cooperative cancellation and worker affinity: SDK integration suites, public qualification records and the timer command above | Source integration tests exist in every SDK. Published local-activity/session and mixed-cancellation qualifications are distinct release evidence. Python 2.5.0 and Rust 3.4.0 provide opt-in bounded sticky history with Server 2.5.10, covering paged warm reuse, entry/byte limits, expiry, build refusal and SIGKILL/replacement cold replay. Rust also checks cached canonical cancellation and cleanup on a cold successor. Exact installed-package and tuple evidence is recorded in [.github #124](https://github.com/durable-workflow/.github/issues/124). | Keep installed-package proof separate from source CI. Sticky history does not retain live workflow objects or session resources. Older affinity manifest expectations must not override the tested tuple's capabilities. |
 | Failover and diagnosis: Server `single-region-failover-published-artifacts.sh`, `agent-operability-published-artifacts.sh`; [operator diagnosis drill](operator-diagnosis.md) | Published container/backend failover and public API/CLI/Waterline operator paths. | Backend recovery success is not three-language workflow continuity. Include affected workers and pending work when that is the customer claim. Embedded Laravel injection/testing remains a PHP framework-specific case. |
 | Managed Cloud | Private Cloud repository's isolated qualification | Keep account, provisioning, provider chaos and commercial qualification private. Public SDK protocol coverage does not establish managed-plan capacity or Cloud recovery. |