Preserve Nexus service-operation commands at worker ingress

[rmcdaniel]

Addresses #138 and packages the already-merged #134 fix in Server 2.3.1 / Helm 0.1.80.

Change

• Preserve required and optional Nexus fields through worker HTTP validation.
• Derive caller identity from authentication and the leased workflow namespace. Reject identity spoofing and unauthorized target namespaces.
• Reauthorize existing-call and idempotency replays against their owning workflow run and current catalog policy.
• Pin published Workflow 2.0.6 for the service-call history timeline fix (workflow#487 / workflow#488).
• Generate release consumers from the existing manifest. No schema or protocol change.

Verification

• The real HTTP reproduction fails on main with missing routing fields. Candidate dispatches and completes the target workflow through worker HTTP.
• 32 focused cases / 315 assertions pass, including optional fields, malformed Avro, namespace/lease authority, and replay ownership/policy.
• One official Avro fixture and HTTP proof: candidate passes; defective base and boundary-reverted candidate fail. The existing verifier was explicitly invoked because the normal classifier flags this request-validation change for review; no checker changes were made.
• Published Workflow package and Laravel upgrade verification passed: https://github.com/durable-workflow/workflow/actions/runs/34192337301
• Full Server release qualification and public CI are running.

An exploratory unrestricted PHPUnit run was stopped after failures. Its first failure is an unchanged legacy conformance-runner message assertion, reproduced identically on main e918f0c. That unrestricted suite is not claimed green. The repository's canonical feature/Nexus/codec/OpenAPI qualification runs separately.

Keep #134 and #138 open until the installable Server image is published and verified.

[rmcdaniel]

The public run on 1621299 completed 2,132 qualification tests with exactly one failure: the newly added corpus map-wrapper expectation. cb75a21 replaces only that new fixture and its request with the minimal string argument needed to reproduce the same validation defect; the actual dispatch/completion test still verifies the nested map payload. Focused HTTP + official corpus verification now passes 37 tests / 603 assertions against published Workflow 2.0.6. The explicit candidate/base/boundary-revert proof passes again with that fixture. Full checks are running on cb75a21. No product code changed after the preceding topology checks passed.

[rmcdaniel]

Public source qualification on cb75a21 is green: 2,132 tests / 42,925 assertions, no failures or skips (6 PHPUnit deprecations). MySQL replay/query HTTP topology and both MySQL/PostgreSQL predecessor-successor checks passed. Required feature check is green. The explicit Nexus candidate/base/reverted-boundary proof was separately verified as recorded above; the automatic classifier still correctly reports review-required rather than an automatically verified count. Awaiting the remaining short polling smoke and chart cleanup, then publish immutable Server 2.3.1 and verify the actual image.

[rmcdaniel]

Released and verified: Server 2.3.1 at d9bed70, bundled Workflow 2.0.6, Helm 0.1.80. Publication/readiness/chart verification passed: https://github.com/durable-workflow/server/actions/runs/34193465412

Pulled Docker Hub image digest sha256:9c52aa1252a4f19d7ec20adbf64e95d7b5bddf369412844f7b24e804c30eef2b and verified its source/dependency labels. Ran the published Compose server/bootstrap/MySQL/Redis services in an isolated project, then a PHP HTTP client using only the image-bundled code and dependencies (no product-source or vendor mounts). Created namespace/catalog/workers through the HTTP API. Malformed Avro returned 422, identity spoofing returned 422, and stale attempt returned 409. The same leased task then accepted a valid Nexus operation; its target completed, and a fresh caller history read contained StartAccepted, WorkflowStarted, ServiceCallStarted, WorkflowCompleted. Exactly one persisted Nexus call was reported. The test stack and volumes were removed afterward.

This confirms the installable artifact for #134 and #138. No Cloud rollout or provider spend was part of this verification.