[devhawk]

Called from inside a workflow, or from one of its steps, cancelWorkflow(s), resumeWorkflow(s) and deleteWorkflow(s) now throw IllegalArgumentException when their targets include the calling workflow. Nothing is written, and the workflow can catch the exception and carry on.

Why

Each of these clears or removes the caller's own workflow_status row, so under the ownership fence the caller's next checkpoint fails:

• a self-cancel ended CANCELLED, with its cancel step never recorded;
• a self-delete ended with the workflow gone;
• a self-resume put the workflow back on the queue before its own step was recorded. Each dispatch replayed to the same resume and did it again, with no end short of deleting the workflow.

How

The check runs first inside the call's internal step, before any database call:

• From a workflow body, the refusal is recorded as the error of DBOS.cancelWorkflow / DBOS.resumeWorkflow / DBOS.deleteWorkflow, so a recovery or fork rethrows it instead of deciding again.
• From a step body, the call takes no step of its own, and the refusal is thrown into the enclosing step.

Calls with no workflow context (outside a workflow, DBOSClient, Conductor, the admin server) are unaffected, as are calls that target other workflows, including the caller's own children's trees.

This PR refuses only a caller that names itself. Refusing a cancel or delete of an ancestor's tree that contains the caller (cancelChildren / deleteChildren) needs the cascade and its step record in one transaction, and comes with #656.

Tests

• New SelfTargetTest covers:
  • self-cancel, self-resume and self-delete, from a workflow body and from a step;
  • a bulk cancel naming the caller, which leaves the other targets untouched;
  • replay of a recorded refusal through a fork;
  • an uncaught refusal becoming the step's error;
  • cancelling another workflow and one's own child's tree, which still work.
• OwnershipFenceTest: removes the three tests that recorded the old self-cancel, self-delete and self-resume behaviour.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Workflow-body refusal errors can lose their exception type during replay with a type-losing serializer, causing workflows that initially handle the error to fail on recovery or fork.

1 open issue

• Preserve refusal exception types across replay · New

What changed in this PR

This PR prevents workflows from explicitly cancelling, resuming, or deleting themselves, including calls made inside their steps. Management calls targeting other workflows remain unchanged; ancestor-tree protection is deferred to #656.

Changes:

• Adds self-target checks inside internal management steps, before target mutations.
• Documents the new IllegalArgumentException behavior across public API overloads.
• Adds refusal and replay tests, replacing tests for the previous self-target behavior.

File	Description
transact/​src/​test/​java/​dev/​dbos/​transact/​workflow/​SelfTargetTest.java	Tests refusals, replay, bulk-call safety, and allowed operations.
transact/​src/​test/​java/​dev/​dbos/​transact/​workflow/​OwnershipFenceTest.java	Removes tests and helpers for the previous self-target behavior.
transact/​src/​main/​java/​dev/​dbos/​transact/​execution/​DBOSExecutor.java	Adds shared self-target validation for cancel, resume, and delete.
transact/​src/​main/​java/​dev/​dbos/​transact/​DBOS.java	Documents self-target exceptions on public management methods.

_{Review effort: Balanced}