task: #3610754 Pre-1.0.0-alpha11 audit fixes: indexes, inbox tenant cache context, lazy flow variables, N+1 batching, and hardening

Frank Mablyrequested to merge
issue/orchestra-3610754:3610754-pre-1.0.0-alpha11-audit-fixes into 1.x

Fixes from the pre-1.0.0-alpha11 full audit, in one MR (baseline was clean: phpcs, phpstan false-positives only, whole kernel+unit suite green).

Performance

  • Index the bridge's orchestra_token field on kessai_payment (the settlement and payment-step lookups scanned the shared payments table). kessai's schema is final, so orchestra_payment swaps in a storage schema that re-declares kessai's subject index and adds (orchestra_token, kind, state).
  • (tenant, status) index on orchestra_token (account-wide pending-actions scan); (tenant, id) on orchestra_instance (remote API list).
  • Lazy flow-condition variables: no lineage/variable query when a node's flows are all unconditional.
  • Batch the trace's "Open" links (one work-item query per page) via an optional BatchActUrlInterface; memoize settings-only assignment audiences in a scan; warm Views label loads in preRender.

Cache correctness

  • orchestra_tenant cache context on the inbox render (cross-tenant disclosure under domain multitenancy).
  • cache: none on the trace/tokens Views (token state mutated by raw SQL bypasses tags).

Hardening / config

  • HttpsPolicy: IPv6 loopback, uppercase HTTPS://, non-scalar allowlist entries.
  • Choice constraints on notify delivery and webform mode; no_cache on the signal route.

Docs / i18n

  • allow_http_hosts, the trace "Open" link, the decision/decision.result equivalence, api.php cross-ref, and French translations for the touched strings.

Tests

New/updated kernel tests: lazy variable resolution (query-log discriminator), inbox tenant context, pending-actions batch, HttpsPolicy IPv6/uppercase. Full kernel+unit suite green locally.

Deferred to their own issues: pending-actions and teardown performance (#3610755), the orchestra_workflow_version index (#3610756), and the 12 missing submodule READMEs (a pre-existing completeness gap).

Merge request reports