[OKAN-SOFTWARE]

Issue

Fixes #836.

Description of changes

This PR brings the Python local checkpoint server's OperationUpdate.SubType validation into alignment with the AWS service model.

Previously, the local runner could accept subtype values that the AWS service rejects. Consequently, an execution could pass locally but fail when deployed.

Changes implemented:

• Validate every non-null OperationUpdate.SubType before applying checkpoint updates.
• Enforce the service's 1–32-character length constraint and [a-zA-Z0-9-_]+ pattern.
• Return an HTTP 400 ValidationException with the invalid value, its 1-based update position, and the violated constraint.
• Report multiple validation failures in update order, with a maximum of ten errors.
• Reject the entire checkpoint request before changing execution state or advancing its checkpoint token.
• Translate local service-model validation failures into non-retryable checkpoint errors so invalid requests terminate durable executions as FAILED.

Root cause and design

The checkpoint validator previously checked operation-state consistency without enforcing the service-model constraints on SubType.

The fix adds validation at the shared checkpoint entry point, protecting requests regardless of how they were constructed.

The in-memory service client also needed to handle the new validation exception consistently with the production client. Without this handling, the local runner retried invalid checkpoint requests until execution timeout instead of treating them as unrecoverable failures.

Scope and design decisions:

• Validation is limited to SubType, as requested in [Testing]: Local checkpoint server accepts a SubType the service rejects #836.
• Existing validation behavior for unrelated checkpoint fields remains unchanged.
• A dedicated ValidationException represents the service's HTTP 400 response.
• The local client converts this exception into a non-retryable checkpoint error.
• No core SDK public API changes are introduced.
• Broader validation of other service-model fields remains outside this PR's scope and can be addressed under [Testing] Confirm Validation Logic with backend #452.

The design follows the service constraints described in #836. Maintainer feedback on the approach is welcome; prior design approval was not obtained.

Regression coverage

Tests cover:

• Valid subtype values at the minimum and maximum permitted lengths.
• Empty, oversized, whitespace-containing, and non-ASCII values.
• Multiple invalid updates and error ordering.
• The maximum of ten reported validation errors.
• Rejection without modifying execution state.
• Translation of local validation exceptions into non-retryable checkpoint errors.
• End-to-end verification that invalid subtype values cause durable executions to fail.

Validation results

• Python testing-package suite — 1,762 passed.
• Focused client, validator, and end-to-end regression tests — 19 passed.
• Python type checking — no issues found in 137 source files.
• Ruff linting and formatting checks — passed.
• git diff --check — passed.
• Complete monorepo test suite — not executed.
• JavaScript SDK example compatibility tests — execution blocked during setup by an environment permission error while creating a local IPC socket.
• Live AWS service comparison — not performed.

The Python testing-package run produced two deprecation warnings but no test failures.

CI status

The upstream Python package, JavaScript examples, and cloud test workflows currently report action_required. Their results are pending; these statuses should not be interpreted as passing tests.

Review status

This PR remains a draft pending outstanding CI and cross-language verification and maintainer design feedback.

Contribution checklist

• The change addresses the behavior reported in [Testing]: Local checkpoint server accepts a SubType the service rejects #836.
• Regression tests cover valid and invalid inputs.
• Invalid checkpoint requests are verified to terminate local executions.
• The implementation remains focused on SubType validation.
• No unrelated core SDK public API changes are introduced.
• Remaining upstream checks must complete successfully.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.