Reject malformed serialized worker payloads before committing history

[rmcdaniel]

Confirmed behavior

During the isolated native-storage experiment for #131/#132, a test worker submitted a workflow completion result as a plain string instead of an official Avro value. The completion committed successfully, but reading the completed run failed with a codec decode exception (HTTP 500). Repeating the experiment with Serializer::serializeWithCodec("avro", value) produced a readable result.

The affected caller is an authenticated worker submitting malformed data for a task it owns. This was observed in a disposable test runtime, not customer data. Normal SDK-generated Avro completions worked.

Cause to address

WorkerController::resolveWorkflowTaskCommandPayloadReferences currently only resolves array-valued command payloads. Serialized strings bypass that envelope validation, and the downstream normalizer can persist them without proving they are valid Avro. Valid serialized Avro strings are supported and must keep working.

This is separate from closed #61, which hardened direct conformance helper inputs rather than the runtime HTTP ingress.

Acceptance

• Reject malformed serialized worker command payloads with a useful validation response before any task completion or history mutation.
• Use the existing official Avro codec/validator; do not add JSON fallback or a custom decoder.
• Cover unframed text, JSON strings/scalars, corrupt/truncated frames, and valid serialized/enveloped Avro, including a large result.
• Prove a rejected completion leaves the task retryable and a subsequent valid completion readable after a fresh reload.
• Audit related worker acknowledgement ingress for the same validation gap without changing application values nested inside valid Avro.

Priority

Accepted follow-up after publishing the already-merged storage recovery fixes. This does not invalidate the corrected Avro native-capacity experiment and does not authorize production admission enablement.

[rmcdaniel]

Implementation merged in #139 at e918f0c. Public CI passed 2,099 tests / 42,585 assertions, the MySQL replay/query HTTP topology, polling-cache bounded-growth smoke, and candidate/base/individually reverted-source regression checks. Cold-reload coverage proves a rejected completion remains retryable and a later valid large Avro result is readable in a fresh PHP process.

Keeping this open until patch publication and an installable-image check. The related, already-reproduced Nexus command-field defect (#138) is next; both worker-ingress fixes will ship in one patch rather than publishing two successive patches for the two known findings. No new scope is being added to that patch.

[rmcdaniel]

Fixed in #139 and shipped with #140 as Server 2.3.1. The focused malformed-payload corpus covers plain text/JSON, corrupt frames, valid serialized/enveloped and large results, rejection without consuming the lease, and subsequent readable completion; the public qualification passed 2,132 tests / 42,925 assertions. Published-image HTTP validation and cleanup are recorded at #140 (comment). Image publication/readiness verification passed in run 34193465412.