Signals Queries Updates

Signal handler sets approved=true without checking signal payload limit; malicious client sends amount=1e9.

Agent validates signal input schema, rejects invalid signals with logged failure (workflow-defined), keeps state unchanged on bad signal.

getBalance Query handler updates audit table; docs: Queries must be read-only and synchronous.

Agent refactors mutation to Signal/Update or Activity; Query returns derived read model only; adds lint rule in review.

Client uses Update handler: validate address via external API in Update path, then set state; must record outcome in history.

Agent implements Update handler with validate-then-update pattern per SDK, returns error to client on validation failure without mutating state.