orchestra 1.0.0-alpha23

WARNING: THERE IS NO MIGRATION PATH. YOU MUST REINSTALL FROM SCRATCH.

Do not update an existing site to this release. Orchestra ships no update hooks, and none is coming until the first beta release. A site on an earlier alpha holds a database and a module list this code does not match.

Uninstall the Orchestra modules, drop what they leave behind, and install 1.0.0-alpha23 fresh. Every instance, token, task, incident, variable, attachment and delegation from an earlier alpha is lost, and that is expected.

Between alpha22 and alpha23 in particular, the modules are laid out anew. The root module orchestra is now the contract every site installs, and the engine is the new orchestra_engine, with its permissions under their old names. orchestra_api is gone (its contract is now orchestra), orchestra_server_api is renamed orchestra_server, and orchestra_webform and orchestra_client_webform are new. The engine services are now orchestra_engine.*. The attribute orchestra instances permission is gone. The OAuth consumer has new fields: orchestra_identity_scheme replaces orchestra_identity_schemes, and orchestra_identity_proof_schemes, orchestra_site_url and three orchestra_presence_* fields are added. A human step stores two new settings, action_title and action_description. The Message interaction's page title moved onto the External interaction, as features.interaction.title, next to a new features.interaction.description. The webform interaction has a new location setting. The notices and remote Orchestras pages moved from /admin/orchestra to Configuration, Web services, next to a new request limits page.

New

• A webform on another site can start and resume workflows. A site that only hosts forms installs orchestra_client and orchestra_client_webform, without the engine. A fresh submission starts the configured workflow on the remote Orchestra, and a submission opened from a step link completes that step there. On the engine site, the webform interaction gets a Form location setting: this site, as before, or the calling site the instance came from. A step then sends the person to the form where it lives. #3631390: Let orchestra_api and orchestra_client run without the Orchestra engine, moving server-only code to orchestra_server_api and the request limits and remote pages under Web services #3631449: Resume a parked step through the client contract with a resume handle and a proof of the actor, the resume handle seam moving into the engine #3631778: Add orchestra_client_webform, so a webform on a site without the engine starts and resumes workflows on a remote Orchestra #3631779: Let the webform interaction show a form that lives on a calling site, as well as one on this site
• A calling site proves who is acting, with identity proof schemes the engine site grants per consumer. With presence, the person confirms who they are on the engine site, signed in its usual way, and the calling site gets a short-lived key it keeps only in that browser, never in its database. A person sees and withdraws these approvals on a tab of their account. With asserted, the engine site takes the calling site's word, as it did before for a consumer holding the attribute orchestra instances permission, which granting it replaces. Starts and step resumes from another site both take a proof. #3631429: Let a calling site prove who is acting, with identity proof scheme plugins, for starts and step resumes
• A human step says what the person is asked to do, above its buttons: the Action description, written with a text format, its @name placeholders filled from the instance. An operation shows it in place of "Choose how to proceed.", and an inbox task at the top of its form. #3631111: Let a human step say what the person is asked to do, above its buttons #3631215: Format a human step's action description with a text format
• A human step can have a page title of its own (Action page title), separate from the action label shown in lists and from the step label. A page with no title written for it is titled with its action label, then with its interaction's own heading, then with the step label. #3631156: Give a human step a page title of its own, separate from its action label and its step label #3631383: Title a step's page with its interaction's own heading when no title is written for it, and give the comment page "Add a comment" #3631280: Rebuild a step page's breadcrumb from the title the instance shows, and give the step form template the label the page shows
• The page a step link opens can have a title and a description, for every External interaction that shows a page of its own: Message, Webform, Payment and Comment. The description is written with a text format and shown below the title. Until now, only the Message interaction had a page title. #3631172: Let an author title the visitor's page of an external interaction that shows its page in place #3631293: Give the External interaction an optional Page description, shown to the visitor below its Page title #3631288: Title a step's page and show its interaction by the way in that opened it, so a visitor's comment page takes the External interaction's page title
• The comment page is titled with the step it opens, instead of "Comment", or with the External interaction's page title when it is opened from a step link. With no title written for it, it reads "Add a comment". #3631287: Title the comment page with the title of the step it opens #3631383: Title a step's page with its interaction's own heading when no title is written for it, and give the comment page "Add a comment"
• A theme can lay out the operation and inbox task forms, through one template, orchestra-step-form.html.twig, overridable per tenant, workflow or step. #3631115: Lay out the operation and inbox task forms with a template a theme can override per tenant, workflow or step

Fixes worth naming

• Security: a step claimed by one person could be completed by anybody else it was offered to, through the operation page: it asked only whether the account was among the people the step is offered to, while the inbox already refused them. It now asks what the inbox asks, delegation and reassignment included. #3631972: Let only the person who may act on a step's work item open and complete it through the operation doorway
• Security: an orchestra_return return path with a tab or a line break could send the person to another site, as /%09/evil.example left the site as //evil.example. Return paths now refuse control characters. #3631709: Name the calling site's presence return guard getInternalReturnPath(), and check it with UrlHelper::isExternal()
• Two people completing the same webform step at once could leave the second person's answers with the first person's decision. The answers are now written in the claim that completes the step, so the losing completion changes nothing. The API also refuses a field it does not know, instead of ignoring it, so a misspelled field fails rather than being dropped silently. #3631974: Write a step's answers in the claim that completes it, and refuse unknown fields at the API doors
• The Complete Modeler could not switch an External interaction away from Redirection while its URL was empty: the new plugin's settings never appeared. The same held for the timeout deadline and action selects, and for every plugin list. #3631283: Switch a node's or a flow's plugins without validating the settings they replace
• Add node and Add flow could add nothing and say nothing in the Complete Modeler, and its validation errors after an AJAX action were dropped. They now show next to the control that was pressed, and the add forms mark the fields they need. #3631359: Tell the author why Add node or Add flow added nothing, and mark the fields they need #3631389: Show the Classic modeler's validation errors after an AJAX action, next to the control that was pressed

Changed

• A site that only calls a remote Orchestra no longer installs the engine. The modules follow the Kessai layout: orchestra is the contract every site installs, orchestra_engine runs workflows on this site, orchestra_client and orchestra_client_webform call a remote Orchestra, and orchestra_server answers other sites. See the warning above for the renames. #3631390: Let orchestra_api and orchestra_client run without the Orchestra engine, moving server-only code to orchestra_server_api and the request limits and remote pages under Web services #3631451: Rename orchestra_api to orchestra_client_api and orchestra_server_api to orchestra_server, and make the contract part of the engine, with the in-process client in orchestra, as in Personal Data Vault #3631455: Lay Orchestra out as Kessai: the contract as the root module orchestra, the engine as orchestra_engine
• The person following a step link is called the link holder, not the visitor, in the interface, its French translation and the documentation. #3631391: Call the person who follows an External interaction's link the link holder, not the visitor
• A token waiting at a join offers "Fire join timer now" on the instance page, instead of "Fire timer now". #3631084: Label the instance trace's timer action "Fire join timer now" on a token waiting at a join
• A table that is the whole page no longer shows its caption above it (Instances, Incidents, Inbox, My actions and the delegation pages). Screen readers still read it. #3631089: Hide the caption of a table that is the whole page, keeping it for screen readers
• The step link request limit no longer runs on every request of the site, only on the pages a step link opens. My actions and the instance lists load their rows in batches. #3631710: Limit the interaction doorway from its own controllers, not from a subscriber on every request #3631975: Load the actions list in batches, name five methods with verbs, fold duplicated helpers, fix stale comments and name each Withdraw button

For module developers

• IdentityProof replaces the initiator name and scheme of OrchestraClientInterface::startProcess(), and the contract gains getStepView(), checkStepCompleteAccess() and resumeStep(), keyed by a resume handle. #3631429: Let a calling site prove who is acting, with identity proof scheme plugins, for starts and step resumes #3631449: Resume a parked step through the client contract with a resume handle and a proof of the actor, the resume handle seam moving into the engine
• A handler extending OrchestraInteractionHandler receives the resumed token in onResumed($submission, $instance, $token), can ask findStepToResume() which step a submission would resume before it is saved, and reads the handle with getResumeHandle() (was getBindingHandle()) and the protected getBoundResumeHandle(). #3632009: Pass the resumed token to a webform interaction handler's onResumed() #3632103: Let a webform interaction handler ask which step a submission would resume, before it is saved #3631874: Rename getBindingHandle() to getResumeHandle() and make getBoundResumeHandle() protected for handler subclasses

Housekeeping

• Code names follow the domain (step texts, doorways and surfaces) and every method name starts with a verb. #3631281: Rename ActionTitle and ActionDescription to StepTitle and StepDescription, fill author texts and check the current tenant in one place each, and delete unused methods #3631897: Say doorway for the way a person reaches a step and surface for the page they act on, with one name per doorway #3631975: Load the actions list in batches, name five methods with verbs, fold duplicated helpers, fix stale comments and name each Withdraw button
• The codebase metrics page is refreshed: 1,634 files and 160,239 lines of code.

AI-Generated: Yes (Claude Code was used to help draft these release notes. I reviewed them.)