FA-1191 / Workflow orchestration / Open access

Deliver a signal to a durable workflow: External signals exhaust the workflow pending-event budget · case 01

The workflow signal operation is admitted even though external signals exhaust the workflow pending-event budget.

Verified by executionVariant 1 · 9 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The admission path omits the mailbox capacity invariant while validating the other operation preconditions.

VERIFIED REPAIR

Require r['mailbox_capacity'][0] < r['mailbox_capacity'][1] together with every other stated precondition before accepting the operation.

Unsuccessful approach: Adding the mailbox capacity check repairs the reported defect, but replacing the adjacent sequence dependency check loses that independent invariant.

Case contract

Return a Boolean admission decision for deliver a signal to a durable workflow. The record r must satisfy all of: r['signal_identity'][0] not in r['signal_identity'][1]; r['recipient_run'][0] == r['recipient_run'][1]; r['signal_declared'][0] in r['signal_declared'][1]; r['mailbox_capacity'][0] < r['mailbox_capacity'][1]; r['sequence_dependency'][0] <= r['sequence_dependency'][1]. Extra tracing fields are ignored; validation does not mutate the record.

Why this case matters

A deterministic local contract for workflow orchestration. Each negative fixture violates exactly one invariant. No transport timing, persistence, cryptographic verification, or full protocol implementation is claimed.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(r):
    return (r['signal_identity'][0] not in r['signal_identity'][1]) and (r['recipient_run'][0] == r['recipient_run'][1]) and (r['signal_declared'][0] in r['signal_declared'][1]) and (r['sequence_dependency'][0] <= r['sequence_dependency'][1])
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
r = {'signal_identity': ['s2', ['s1']], 'recipient_run': ['run2', 'run2'], 'signal_declared': ['approve', ['approve', 'reject']], 'mailbox_capacity': [9, 10], 'sequence_dependency': [4, 4]}
check('valid operation', solve(r), True)
check('Duplicate signal delivery applies the external command twice', solve(dict(r, **{'signal_identity': ['s1', ['s1']]})), False)
check('A delayed signal reaches a different run under the same workflow name', solve(dict(r, **{'recipient_run': ['run1', 'run2']})), False)
check('An unknown signal type bypasses workflow dispatch', solve(dict(r, **{'signal_declared': ['delete', ['approve', 'reject']]})), False)
check('External signals exhaust the workflow pending-event budget', solve(dict(r, **{'mailbox_capacity': [10, 10]})), False)
check('A signal is applied before its required earlier command', solve(dict(r, **{'sequence_dependency': [5, 4]})), False)
check('unrelated tracing metadata', solve(dict(r, trace='run-'+str(N))), True)
check('repeat validation is pure', solve(r), True)
invalid = {'signal_identity': ['s1', ['s1']], 'recipient_run': ['run1', 'run2'], 'signal_declared': ['delete', ['approve', 'reject']], 'mailbox_capacity': [10, 10], 'sequence_dependency': [5, 4]}
keys = list(invalid)
pair = {keys[N % len(keys)]: invalid[keys[N % len(keys)]], keys[(N+1) % len(keys)]: invalid[keys[(N+1) % len(keys)]]}
check('two independent violations in variant', solve(dict(r, **pair)), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
valid operation	`True`	`True`	Passed
Duplicate signal delivery applies the external command twice	`False`	`False`	Passed
A delayed signal reaches a different run under the same workflow name	`False`	`False`	Passed
An unknown signal type bypasses workflow dispatch	`False`	`False`	Passed
External signals exhaust the workflow pending-event budget	`True`	`False`	Failed
A signal is applied before its required earlier command	`False`	`False`	Passed
unrelated tracing metadata	`True`	`True`	Passed
repeat validation is pure	`True`	`True`	Passed
two independent violations in variant	`False`	`False`	Passed

SHA-256 / 280876af249c525cbf7560ac09ec0209579493800d21bd78404fbfbfdf05ec21

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(r):
    return (r['signal_identity'][0] not in r['signal_identity'][1]) and (r['recipient_run'][0] == r['recipient_run'][1]) and (r['signal_declared'][0] in r['signal_declared'][1]) and (r['mailbox_capacity'][0] < r['mailbox_capacity'][1])
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
r = {'signal_identity': ['s2', ['s1']], 'recipient_run': ['run2', 'run2'], 'signal_declared': ['approve', ['approve', 'reject']], 'mailbox_capacity': [9, 10], 'sequence_dependency': [4, 4]}
check('valid operation', solve(r), True)
check('Duplicate signal delivery applies the external command twice', solve(dict(r, **{'signal_identity': ['s1', ['s1']]})), False)
check('A delayed signal reaches a different run under the same workflow name', solve(dict(r, **{'recipient_run': ['run1', 'run2']})), False)
check('An unknown signal type bypasses workflow dispatch', solve(dict(r, **{'signal_declared': ['delete', ['approve', 'reject']]})), False)
check('External signals exhaust the workflow pending-event budget', solve(dict(r, **{'mailbox_capacity': [10, 10]})), False)
check('A signal is applied before its required earlier command', solve(dict(r, **{'sequence_dependency': [5, 4]})), False)
check('unrelated tracing metadata', solve(dict(r, trace='run-'+str(N))), True)
check('repeat validation is pure', solve(r), True)
invalid = {'signal_identity': ['s1', ['s1']], 'recipient_run': ['run1', 'run2'], 'signal_declared': ['delete', ['approve', 'reject']], 'mailbox_capacity': [10, 10], 'sequence_dependency': [5, 4]}
keys = list(invalid)
pair = {keys[N % len(keys)]: invalid[keys[N % len(keys)]], keys[(N+1) % len(keys)]: invalid[keys[(N+1) % len(keys)]]}
check('two independent violations in variant', solve(dict(r, **pair)), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
valid operation	`True`	`True`	Passed
Duplicate signal delivery applies the external command twice	`False`	`False`	Passed
A delayed signal reaches a different run under the same workflow name	`False`	`False`	Passed
An unknown signal type bypasses workflow dispatch	`False`	`False`	Passed
External signals exhaust the workflow pending-event budget	`False`	`False`	Passed
A signal is applied before its required earlier command	`True`	`False`	Failed
unrelated tracing metadata	`True`	`True`	Passed
repeat validation is pure	`True`	`True`	Passed
two independent violations in variant	`False`	`False`	Passed

SHA-256 / d3b234ef3e8bcaefd31e69379a1226a718dfb59ecd88a6a52d60b0c3a9e1787d

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(r):
    return (r['signal_identity'][0] not in r['signal_identity'][1]) and (r['recipient_run'][0] == r['recipient_run'][1]) and (r['signal_declared'][0] in r['signal_declared'][1]) and (r['mailbox_capacity'][0] < r['mailbox_capacity'][1]) and (r['sequence_dependency'][0] <= r['sequence_dependency'][1])
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
r = {'signal_identity': ['s2', ['s1']], 'recipient_run': ['run2', 'run2'], 'signal_declared': ['approve', ['approve', 'reject']], 'mailbox_capacity': [9, 10], 'sequence_dependency': [4, 4]}
check('valid operation', solve(r), True)
check('Duplicate signal delivery applies the external command twice', solve(dict(r, **{'signal_identity': ['s1', ['s1']]})), False)
check('A delayed signal reaches a different run under the same workflow name', solve(dict(r, **{'recipient_run': ['run1', 'run2']})), False)
check('An unknown signal type bypasses workflow dispatch', solve(dict(r, **{'signal_declared': ['delete', ['approve', 'reject']]})), False)
check('External signals exhaust the workflow pending-event budget', solve(dict(r, **{'mailbox_capacity': [10, 10]})), False)
check('A signal is applied before its required earlier command', solve(dict(r, **{'sequence_dependency': [5, 4]})), False)
check('unrelated tracing metadata', solve(dict(r, trace='run-'+str(N))), True)
check('repeat validation is pure', solve(r), True)
invalid = {'signal_identity': ['s1', ['s1']], 'recipient_run': ['run1', 'run2'], 'signal_declared': ['delete', ['approve', 'reject']], 'mailbox_capacity': [10, 10], 'sequence_dependency': [5, 4]}
keys = list(invalid)
pair = {keys[N % len(keys)]: invalid[keys[N % len(keys)]], keys[(N+1) % len(keys)]: invalid[keys[(N+1) % len(keys)]]}
check('two independent violations in variant', solve(dict(r, **pair)), False)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
valid operation	`True`	`True`	Passed
Duplicate signal delivery applies the external command twice	`False`	`False`	Passed
A delayed signal reaches a different run under the same workflow name	`False`	`False`	Passed
An unknown signal type bypasses workflow dispatch	`False`	`False`	Passed
External signals exhaust the workflow pending-event budget	`False`	`False`	Passed
A signal is applied before its required earlier command	`False`	`False`	Passed
unrelated tracing metadata	`True`	`True`	Passed
repeat validation is pure	`True`	`True`	Passed
two independent violations in variant	`False`	`False`	Passed

SHA-256 / fd3de3ff0b482c3432a6355efa119d29aa1daa70ee3ac6574465788eecef7bca

Verification & scope

This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:36:59.902023+00:00.

Case digest / a7f910299285cd51989a1557e00a118b9e1ba496dbe4c3bf8d389aba9cb1f25d