Refresh codebase wiki

Author: github-actions[bot]

doc/wiki/http-scheduling-resilience.md

@@ -139,6 +139,12 @@ Core contracts:
 
 Use resilience when an activity performs IO that can fail transiently. Keep strategy types registered by the owning module.
 
+## Simulate-Response Endpoint Security
+
+[SimulateResponseEndpoint](../../src/modules/Elsa.Resilience/Endpoints/SimulateResponse/Endpoint.cs) is a testing utility that cycles through a configured list of HTTP status codes. It requires one of the following permissions: `exec:*`, `exec:resilience`, or `exec:resilience:simulate-response`.
+
+Session isolation is enforced per authenticated identity: the session ID stored in `SimulateResponseSessionStore` is a SHA-256 hash of the caller's identity key concatenated with the caller-supplied `sessionId` query parameter. This prevents one authenticated user from advancing another user's session counter. The `sessionId` and `codes` query parameters are validated and length-capped by `SimulateResponseOptions`.
+
 ## Cross-Cutting Graceful Shutdown
 
 HTTP and Scheduling both register runtime ingress sources so graceful shutdown can pause new external work. When adding a new external event source, implement and register an `IIngressSource` in the owning module, then add runtime tests that prove pause/resume/drain behavior.

doc/wiki/identity-tenancy-security.md

@@ -106,6 +106,15 @@ Structured logs define diagnostics permissions in [StructuredLogsPermissions](..
 
 Identity endpoints and user-management endpoints are permission-based; see [ADR 0010](../adr/0010-default-admin-user-bootstrap-for-initial-identity-access.md).
 
+## SignalR Hub Authorization
+
+[WorkflowInstanceHub](../../src/modules/Elsa.Workflows.Api/RealTime/Hubs/WorkflowInstanceHub.cs) requires authenticated callers (`[Authorize]` attribute). Before joining an instance observation group, `ObserveInstanceAsync` enforces two checks:
+
+1. **Permission check** — the caller must hold one of `exec:*`, `read:*`, or `read:workflow-instances`.
+2. **Tenant check** — the requested workflow instance must belong to the caller's current tenant, or be tenant-agnostic.
+
+Any violation throws a `HubException("Access denied.")` and prevents group membership. The tenant check uses `ITenantAccessor` and is skipped when tenancy is not configured.
+
 ## Ingress Rate Limiting
 
 Elsa exposes opt-in ASP.NET Core rate limiting hooks for two ingress surfaces:
@@ -125,3 +134,4 @@ The reference server registers disabled-by-default fixed-window policies under `
 - Are bootstrap credentials only for development or secret-managed environments?
 - Does any diagnostic/logging feature expose sensitive data without redaction?
 - Do token settings use production-grade signing keys and data protection configuration?
+- Do SignalR hub methods check both authentication and permission before joining groups?

doc/wiki/persistence.md

@@ -120,6 +120,18 @@ When adding a new store implementation:
 5. Add unit tests for store-specific query behavior if logic is nontrivial.
 6. Add integration tests for provider behavior, migrations, and multi-target concerns where practical.
 
+## Workflow JSON Type Resolution
+
+Workflow JSON uses short type aliases rather than assembly-qualified names. [WorkflowJsonTypeResolver](../../src/modules/Elsa.Workflows.Core/Serialization/Helpers/WorkflowJsonTypeResolver.cs) resolves these aliases through `IWellKnownTypeRegistry` to prevent arbitrary CLR type instantiation during deserialization.
+
+Resolution order:
+1. Registered short alias (e.g. `"String"`, `"Int32"`, `"MyActivity"`).
+2. Compound array alias (`TypeAlias[]`).
+3. Compound generic-collection alias (`List<TypeAlias>`, `IEnumerable<TypeAlias>`, etc.).
+4. Legacy assembly-qualified name, restricted to types already registered in `IWellKnownTypeRegistry`.
+
+If none of these match, deserialization throws a `JsonException`. Unrecognized type strings are never passed to `Type.GetType` unconstrained. Modules that introduce new serializable activity or variable types must register their types with `IWellKnownTypeRegistry` at startup; see [WorkflowRuntimeTypeAliasRegistrar](../../src/modules/Elsa.Workflows.Runtime/WorkflowRuntimeTypeAliasRegistrar.cs) for a reference implementation.
+
 ## Persistence Risk Checklist
 
 - Does the change affect multiple target frameworks?