openstack/mistral — 2026-11-07

Workflow engine behavior. The bulk of the churn tightened how the engine handles paused, failing, and looping workflows. Delayed task iterations no longer run while a workflow is paused, join tasks are refreshed on resume, and the with-items index selection was corrected when retries combine with concurrency. New global limits cap with-items and task-loop expansion, and publish errors are now deferred until the retry policy has had a chance to run. The event engine also keeps running when an individual event fails, rather than tearing itself down.

Size limits and access control. Workflow outputs that exceed the configured size limit now fail the workflow outright, and the field size limit check compares exact sizes instead of approximations. On the security side, two changes close denied_cidrs bypasses in std.http, and action-definition deletion now enforces access control.

Scheduler and robustness. The legacy scheduler is deprecated and the default scheduler is now, in fact, the default. Smaller fixes handle exceptions without args when wrapping RPC errors and allow arbitrary strings for node identifier options.

Tooling and tests. Unit tests gained a fake RPC transport run, keystone auth option registration, profiler-test isolation, and fixes for YAQL engine caching and auth_enable leakage between tests. A devstack HTTP-server test fixture landed across three changes. Docs saw a sweep replacing non-breaking spaces and refreshing the OpenStack actions mapping and async callback example.