ARCH-WF-001 — Route runtime operations through the managed workflow boundary
| Field | Value |
|---|---|
| Status | Open; source-verified |
| Architecture state | Deployed split path; managed runtime path implemented but inactive |
| Severity | High |
| Affected surface | Runs, tasks, logs, XCom, source, graph, grid, trigger, clear, and mark state |
| Components | sparqd/oqullus, sparqd/bff-api, sparqd/workflow-backend, OpenFGA, Airflow |
| Associated issue | Not opened |
Where the problem appears
Open any managed workflow and use its runtime tabs and actions while recording request paths.
Concrete observed case
Definition, list, pause, and selected lifecycle calls use workflow-backend, while most runtime reads and mutations still call the BFF generic Airflow facade. Workflow-backend source has explicit workflow-scoped runtime routes and OpenFGA checks, but the BFF Workflow facade does not expose them, Oqullus does not call them, and OpenFGA is not activated in the assessed deployment.
Expected condition
First, route every managed runtime operation through the Workflow facade while preserving the documented single-project compatibility policy. For a future multi-project rollout, activate OpenFGA and require the facade to resolve the canonical workflow UUID and check the operation-specific permission before it calls one explicit Airflow operation.
Cause and evidence
- Oqullus latest main calls Airflow routes directly for runtime detail and recovery.
- BFF latest main exposes definition routes but not workflow-backend runtime routes.
- Workflow-backend latest main implements the workflow-scoped runtime surface and OpenFGA calls, but this is an inactive source capability rather than the deployed browser route.
Why it matters
Identity, authorization, errors, caching, and observability are split across two control planes. Fixes in the managed backend do not protect callers still using the generic path.
Existing controls and workarounds
Limit runtime access to tightly controlled roles and verify the selected DAG name matches a managed workflow. This does not provide per-workflow enforcement.
Alternatives considered
- Recommended: expose the existing workflow-backend runtime routes through the BFF and migrate each UI call, without claiming their dormant OpenFGA checks are active.
- Keep a generic proxy behind a managed lookup — still broader and harder to audit than explicit operations.
- Continue both paths — rejected because drift is already visible.
Component involvement
- sparqd/bff-api adds an explicit Workflow runtime facade.
- sparqd/oqullus migrates identity and error handling per view.
sparqd/workflow-backendbecomes the Airflow credential boundary first and the workflow authorization boundary only after OpenFGA activation.
Reproduction and verification
Follow WF-S001.
Resolution conditions
Close the routing finding when browser traffic for every managed runtime journey uses only the Workflow facade and direct Airflow endpoints are unavailable to that browser role. Do not mark workflow-level authorization complete until OpenFGA is separately activated and verified.
Validation and blockers
Oqullus, BFF, workflow-backend, Airflow, and security owners must validate. Live route evidence is pending.