Gap Claim
Workflow timeout reconciliation catches malformed persisted timestamps as if no timeout occurred, and compares the timeout against the wrong clock value. Corrupt state can therefore remain active indefinitely or be reconciled inconsistently.
Existing Surface Audit
Reviewed control_plane_timeouts.py, persisted operation timestamps, timeout state transitions, restart reconciliation, and the timeout fixes currently bundled into PR #1086.
Scope
OpenRAE runtime reliability only. Requirements: RUN-317 and RUN-318.
Chosen Architecture
Parse persisted timestamps through one strict boundary, reject malformed or future-inconsistent values with a stable fail-closed diagnostic, and compare monotonic elapsed duration against the configured workflow timeout without confusing wall-clock timestamps with durations.
Verification Plan
Cover malformed timestamps, timezone offsets, future timestamps, exact boundaries, elapsed-over-limit transitions, restart reconciliation, and stable public diagnostics. Keep unrelated PR #1086 changes outside this issue.
Gap Claim
Workflow timeout reconciliation catches malformed persisted timestamps as if no timeout occurred, and compares the timeout against the wrong clock value. Corrupt state can therefore remain active indefinitely or be reconciled inconsistently.
Existing Surface Audit
Reviewed
control_plane_timeouts.py, persisted operation timestamps, timeout state transitions, restart reconciliation, and the timeout fixes currently bundled into PR #1086.Scope
OpenRAE runtime reliability only. Requirements: RUN-317 and RUN-318.
Chosen Architecture
Parse persisted timestamps through one strict boundary, reject malformed or future-inconsistent values with a stable fail-closed diagnostic, and compare monotonic elapsed duration against the configured workflow timeout without confusing wall-clock timestamps with durations.
Verification Plan
Cover malformed timestamps, timezone offsets, future timestamps, exact boundaries, elapsed-over-limit transitions, restart reconciliation, and stable public diagnostics. Keep unrelated PR #1086 changes outside this issue.