[swkeever]

Change

A Ruby application can read and stop the durable executions it started, with the credential start already uses: the active session, then a service key, then the anon key. Before this, get and stop called only the owner routes, which need a platform token.

client.durable.get_from_application(function_name, execution_id, client_token: nil)  # => Volcano::DurableExecution
client.durable.stop_from_application(function_name, execution_id, client_token: nil) # => Volcano::DurableExecution

• They call GET /durable-functions/{functionId}/executions/{executionId} and POST .../stop.
• client_token: goes out as X-Volcano-Client-Token when given, with any credential, and is omitted otherwise. A service key holding * reaches any execution; one scoped to a list without * needs the token, as an anon key does. It is checked like the messages one: 1 to 128 printable ASCII characters.
• 404 raises Volcano::Error::NotFoundError, which is also what a credential that cannot reach the execution gets. A 409 on stop (only a service key holding * reaches a pending execution) raises Volcano::Error::ConflictError. A 503 raises Volcano::Error::ServerError; the docs say a throttled stop may already have been sent. retry_after stays nil on it: the shared transport reads Retry-After only on 429, as the Python SDK does.
• The owner-scoped get, list and stop are unchanged. Doc comments, docs/functions.md and the README no longer say an application credential can only start.
• Purely additive.

Server support shipped in Kong/volcano-hosting#2364 (merged as 29807384cf).

Coordination branch: skeever/durable-execution-data-plane.

Contract snapshot

openapi/openapi.yaml takes only the durable sections #2364 changed, copied verbatim from Hosting main's public bundle (scripts/ci/openapi-bundle.sh at 1ccff82a16, byte-identical to docs/public/api-reference/openapi.yaml): the start, read and stop paths under /durable-functions/{functionId}/executions, the DurableClientToken parameter, and the DurableExecution schema. Those sections now parse equal to Hosting main's. That brings in what changed after the draft this PR first vendored: scoped service keys, * for pending, 503 Retry-After, the start's execution_name_held 409, and description text. The rest of Hosting's drift is left to the automated sync PR (#5). The client was regenerated with bin/generate-openapi, bin/check-openapi passes, and the pinned snapshot digest in spec/volcano_generation_spec.rb is updated.

Verification

bundle exec rake quality on 583625d (Ruby 3.4.10, Java 21):

• quality:audit: no vulnerabilities. quality:generated: generated boundary up to date.
• quality:lint: 417 files, no offenses.
• quality:types: RBS validate and both Steep targets, no errors.
• quality:spec: 2,197 examples, 0 failures. Line coverage 100% (5,907/5,907) and branch coverage 100% (1,645/1,645).
• quality:defects: all five injected defects detected. quality:package: gem built and smoke-tested in an isolated install.

New specs cover:

• the request path, method, Authorization and X-Volcano-Client-Token, through the real generated client (spec/volcano/durable_application_http_spec.rb), including the token sent with a service key;
• which credential is used: anon, service key, or session;
• response mapping;
• 404 and 409, with the bodies these routes return (error only, no code);
• argument checks before transport;
• consumer type fixtures.

Cross-language impact

Classification: public facade and SDK-facing wire contract.

• Requirement IDs and affected behavior: none yet. tests/sdk-contract/requirements.md has no ID for application-route reads or stops (#2364 does not add one).
• JavaScript / Python / Ruby companion PRs: feat(durable): read and stop executions with the application credential volcano-sdk-js#357 and feat(durable): read and stop executions with application credentials volcano-sdk-python#422, on the same branch name.
• Canonical scenarios, bindings and active/staged copies: not added. They belong in Hosting's tests/sdk-contract.
• Public examples updated in each affected language: docs/functions.md and the README here; Hosting's docs/public/functions/durable-functions.md shipped in #2364.
• Native checks and shared acceptance evidence: native checks above on 583625d. Shared acceptance has not run.

Coordination

Companion PRs, all on skeever/durable-execution-data-plane: Kong/volcano-sdk-js#357, Kong/volcano-sdk-python#422, #366.

Merge order:

1. The server support, Kong/volcano-hosting#2364 (merged).
2. These three SDK PRs.
3. A hosting PR that adds the shared tests/sdk-contract scenarios for both routes.

🤖 Generated with Claude Code

[github-actions]

AI review: no P0-P2 findings

Reviewed 03c61b9. Run log

Adds Durable#get_from_application and #stop_from_application. They call the new application routes with the credential start uses and send X-Volcano-Client-Token when a token is given. The PR also vendors the matching OpenAPI sections, regenerates the client, and adds transport wiring, RBS signatures, specs, and docs. The change is purely additive and low-risk. The earlier P2 is fixed at this head: the README, docs/functions.md and the get_from_application comment now say a private function raises NotFoundError, and only an anon key on an authenticated function (or a missing functions.invoke) raises PermissionDeniedError.

Not checked: The AI review read the diff, the code, and the PR's text; it ran no tests or builds and read nothing outside this repository.

• Whether the vendored durable sections of openapi/openapi.yaml match Kong/volcano-hosting's public bundle at 1ccff82a16, as the description says.
• Whether the live server follows the documented access rules for scoped service keys, pending executions, private vs authenticated functions, and 503 throttled stops.
• The shared tests/sdk-contract acceptance scenarios for these two routes don't exist yet; a later Kong/volcano-hosting PR is planned to add them.
• Verify the vendored durable OpenAPI sections match Kong/volcano-hosting's public bundle at 1ccff82a16.
• Verify both routes against Hosting through shared acceptance scenarios covering credential scopes, visibility, pending executions, and throttled stops.

Human review: not needed