|
| 1 | +# Per-Workflow State (`{{state.*}}`) + REST `options.auth` Providers |
| 2 | + |
| 3 | +## Summary |
| 4 | + |
| 5 | +Two generic, reusable gateway extensions (PR #662, merged to `staging` 2026-07-16). Design record: |
| 6 | +`PLAN_WORKFLOW_STATE_GUARDIAN_MONITORING.md`. The first consumer is the studio "guardian" wallet-risk |
| 7 | +monitor, but neither extension is guardian-specific. |
| 8 | + |
| 9 | +1. **`{{state.*}}` — durable, cross-run, per-workflow state.** A `customCode` node can call |
| 10 | + `state.get/set/list` to persist arbitrary client-defined JSON that survives across scheduled runs, |
| 11 | + scoped to the workflow (`taskId`) — not the user. This is what lets a monitor alert on *new* |
| 12 | + findings only (diff current-vs-last-seen) without any studio callback in the hot path. |
| 13 | +2. **REST `options.auth` providers.** A `restApi` node can set |
| 14 | + `config.options.auth = { provider: "goplus" }`; the gateway mints/attaches the provider credential |
| 15 | + server-side so the secret never lives in the (client-visible) workflow JSON. GoPlus is provider #1. |
| 16 | + |
| 17 | +## Extension 1 — `{{state.*}}` |
| 18 | + |
| 19 | +- **Storage**: new `wfstate:<taskId>:<stateKey>` BadgerDB namespace (`core/taskengine/schema.go` |
| 20 | + `WorkflowStateKey` / `WorkflowStatePrefix`). Scoped by `taskId` only, so a user's multiple monitoring |
| 21 | + workflows never collide and a workflow's state can be wiped exactly on deletion. Additive — no |
| 22 | + migration (`make storage-check` clean). |
| 23 | +- **Binding**: `state.get/set/list` bound into the goja runtime in both `NewJSProcessor` and |
| 24 | + `NewJSProcessorWithIsolatedVars` (`core/taskengine/vm_runner_customcode.go` `installStateBinding`), |
| 25 | + over `vm.db`. Bound after the step vars so a node named `state` can't shadow it. |
| 26 | +- **Non-persistent mode**: in simulation, single-node runs (no `taskId`), or when no DB is wired, |
| 27 | + reads/writes use a VM-scoped scratch map (`vm.stateScratch`, mutex-guarded, `core/taskengine/vm.go`) |
| 28 | + so `nodes:run` / `workflows:simulate` previews never mutate live state, yet read-after-write and |
| 29 | + cross-node coherence still hold within one run. |
| 30 | +- **Deterministic `list`**: results are sorted in both the DB and scratch paths so simulation and real |
| 31 | + execution agree on ordering. |
| 32 | +- **Lifecycle**: cascade-deleted on task teardown (`DeleteWorkflowByUser`, `core/taskengine/engine.go`); |
| 33 | + a `ListKeys` failure is logged rather than silently orphaning state. |
| 34 | +- **Namespace convention**: `{{state.*}}` is the mutable, client-defined, read/write namespace parallel |
| 35 | + to `{{settings.*}}` (immutable config) and `{{context.*}}` (read-only runtime). |
| 36 | + |
| 37 | +## Extension 2 — REST `options.auth` (GoPlus) |
| 38 | + |
| 39 | +- **`restAuthProvider(node)`** reads `options.auth.provider` from the node's `options` bag (mirrors |
| 40 | + `shouldSummarize`). No proto/SDK type change — `options` is already an open `structpb.Value`. |
| 41 | +- **`goplusAuthHeader()`** mints a GoPlus session token from `macros.secrets` |
| 42 | + (`goplus_app_key`/`goplus_app_secret`): `sign = sha1_hex(app_key + time + app_secret)` → POST |
| 43 | + `/api/v1/token`. Token is module-cached (RWMutex), **keyed by `app_key`** so a rotated key never |
| 44 | + reuses a stale token, refreshed ~60 s early. Uses an `http.Client` with a 15 s timeout, checks for a |
| 45 | + 2xx status, and normalizes the token to a `Bearer ` prefix defensively. |
| 46 | +- **Injection**: if the provider mints a token, it's set as the `Authorization` header in |
| 47 | + `processedHeaders` before the request; on `""` (keys unset or mint failed) no header is sent — GoPlus |
| 48 | + answers keyless (lower rate limits). A `goplusTokenProvider` seam makes the injection unit-testable. |
| 49 | +- **Config**: `goplus_app_key`/`goplus_app_secret` added to `macros.secrets` in the example configs; |
| 50 | + real values via Railway env on the deployed `gateway-railway.yaml` (`${GOPLUS_APP_KEY}` / |
| 51 | + `${GOPLUS_APP_SECRET}`). `guardian_ruleset` (the tunable verdict knobs) is inlined as JSON (not a |
| 52 | + secret). |
| 53 | + |
| 54 | +## Files |
| 55 | + |
| 56 | +`core/taskengine/schema.go`, `vm.go`, `vm_runner_customcode.go`, `vm_runner_rest.go`, `engine.go`, |
| 57 | +`vm_workflow_state_test.go`; `config/gateway.example.yaml`, `config/test.example.yaml`. |
| 58 | + |
| 59 | +## Testing |
| 60 | + |
| 61 | +- Go: state set/get/list roundtrip, cross-run persistence, simulation no-op guard; `restAuthProvider` |
| 62 | + parsing; Authorization-injection via `httptest` + the `goplusTokenProvider` seam. |
| 63 | +- Live: verified against a local gateway with real GoPlus keys — the guardian scan mints an authed |
| 64 | + token (`attached GoPlus session token (authed)`) and the `state`-backed verdict runs; the ava-sdk-js |
| 65 | + guardian template test passes 14/14 with the verdict step asserting. |
| 66 | + |
| 67 | +## Deferred / follow-ups |
| 68 | + |
| 69 | +- `SetIfAbsent` storage primitive for **strict** exactly-once claim-once (mark-after-send is the v1 |
| 70 | + default); `{{state.*}}` template auto-load for non-CustomCode nodes; GoPlus `code:4033` retry-keyless |
| 71 | + nuance; held-token (critical-token) scan (approvals-only for v1). |
| 72 | +- Ops: republish `avs-dev:latest` so the SDK E2E guardian **live** test asserts against a gateway with |
| 73 | + these extensions. |
| 74 | +- Studio (separate): the `enable_guardian_monitoring` advisor tool, web-sign enrollment, and syncing |
| 75 | + `guardian_ruleset` from `app/lib/goplus.ts`. |
0 commit comments