[rmcdaniel]

The embedded app and microservice currently lock Workflow 2.20.2, so they cannot use the accepted stream-receive and fake-clock fixes in published 2.20.3.

Update both Composer pairs and the qualified tuple to Workflow 2.20.3 at source/dist 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c. All other locked package objects are unchanged (126 root, 118 microservice), including PHP SDK 3.9.4 and Waterline 2.13.2. Python 2.14.1, Rust 4.11.2, Server 3.0.5 and CLI 2.3.3 are preserved.

The README retains both SDK upgrade warnings and adds the pending-message/kept-stream rollback guidance and known query-handler limitation #1024 from the tagged Workflow notes.

Validation: targeted canonical Composer updates with scripts/plugins/install disabled, strict validation of both pairs, both artifact-graph validators, artifact resolver, public-boundary scan and git diff --check passed. All 37 exact-head CI checks passed on attempt 1. Root tests on each PHP version report 191 passed / 1,622 assertions plus the same single playground warning as the accepted base; each microservice suite passes 5 tests. Both image platforms and all published-tuple journeys/recovery checks passed. The accepted upstream installed-package suite is not duplicated.

Upstream final Security acceptance · General's accepted consumer scope · Consumer plan

General retains merge after fresh checks/review. After merge, verify the ordinary main workflows, existing automatic image publisher and exact anonymous public image/platform inventories, then return the receipt to Workflow #1025.

[rmcdaniel]

Source and local validation readback for exact head 52e78a79ea189efe7dc977729baeb29865155302, base bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d, tree a3a133d2044085d9a1cc4c5f0733426edeed46f4.

Both canonical Composer locks select published Workflow 2.20.3 with source and dist reference 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c. Structured comparisons confirm every other package object is unchanged: 126 root and 118 microservice packages. The only other lock change is each manifest content hash. Both manifests require ^2.20.3; tuple and README agree.

All non-Workflow tuple fields and the existing Python/Rust warning bytes are unchanged. The six-file diff adds Workflow's previously hidden pending-message behavior, kept-stream rollback guidance and the remaining query-handler limitation #1024, linking immutable tagged notes. The PHP playground SDK-only lock and build/workflow definitions are unchanged.

Targeted updates used Composer 2.11.1 / PHP 8.5.12, scripts/plugins/install disabled and concurrency capped at two. Both strict Composer validations, both artifact-graph validators, the artifact resolver, public-boundary scan, private-data/credential scan and git diff --check passed. The first container invocation failed before startup because its temporary source directory was not shared with Docker. Moving the same public Composer inputs to supported scratch resolved the runner setup; no dependency check was bypassed. All owned containers and scratch have been removed.

Normal hosted CI is running. Its existing PHP 8.4/8.5 application and microservice suites exercise the embedded consumer and fake-workflow paths; the upstream accepted 67-case installed-package suite is not duplicated. Final exact-head checks and Security disposition remain pending. General retains merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head source checkpoint — no source defect; final qualification pending

I independently reviewed draft #313 at exact head 52e78a79ea189efe7dc977729baeb29865155302, base bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d, tree a3a133d2044085d9a1cc4c5f0733426edeed46f4.

The six-file delta is narrow and internally consistent. Both Composer manifests move only durable-workflow/workflow from ^2.20.2 to ^2.20.3. Both lock entries move from 2.20.2 / b3ba0c73f97c357aa6bd2661e44edda056049550 to published 2.20.3 / exact source and dist 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c; their dependency requirements are unchanged. Excluding that one package and the expected lock content hash, the complete root lock hashes identically on base/head (281f3085e0d917939cef385aea14fa1935ad4d70a98ceb262806d31158a56f96), as does the microservice lock (2e0e09b31fad7874c7795dd27be2c9ab84612d9767286ed314531fdc65182f44). That preserves 126 other root and 118 other microservice package objects.

The qualified tuple changes only Workflow to 2.20.3 and preserves Server 3.0.5, PHP SDK 3.9.4, Python SDK 2.14.1, Rust SDK 4.11.2, CLI 2.3.3, and Waterline 2.13.2. README retains the Python/Rust warnings and accurately carries the published 2.20.3 rollback warning, newly visible older pending messages, current-step kept-stream history behavior, and known query limitation #1024. git diff --check is clean.

I found no source blocker. This is not final merge clearance: at this read 23 checks succeeded and 13 required consumer checks remained active. Keep the exact head frozen and return terminal hosted qualification for final Security carry. General retains merge, and the automatic image publisher, anonymous image/platform inventories, and Workflow downstream receipt remain post-merge gates.

[rmcdaniel]

Security final exact-head disposition — PASS

Reviewed exact candidate:

• head 52e78a79ea189efe7dc977729baeb29865155302
• base/sole parent bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d
• tree a3a133d2044085d9a1cc4c5f0733426edeed46f4

The earlier Security source checkpoint remains exact. The six-file delta changes only Workflow 2.20.2 → 2.20.3 in the root and microservice Composer manifest/lock pairs and the qualified tuple/README. Both lock records bind Workflow source/dist to accepted 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c; all other 126 root and 118 microservice locked objects are preserved. PHP 3.9.4, Python 2.14.1, Rust 4.11.2, Server 3.0.5 and the existing upgrade warnings remain unchanged. The added rollback/hidden-message/query guidance retains the accepted Workflow release caveats and #1024 limitation.

Fresh exact-head qualification is terminal:

• 37/37 checks succeeded; zero failed, skipped, or pending; provider merge state is CLEAN
• activity-recovery run 41845505660 succeeded at this exact head after completing the full recovery lane
• SDK timers run 41845505901 succeeded at this exact head for PHP, Python, and Rust
• both candidate architectures, image security, Composer lock audit, root/microservice tests, playground, polyglot, cold-recovery, upgrade, boundary, Sonar and target-branch gates succeeded
• CodeQL succeeded across the configured languages and the open PR-scoped alert set is empty

Disposition: PASS for this exact consumer source and qualification pair. General retains merge and ordering. This does not authorize or infer a published Sample App consumer image, anonymous registry parity, deployment, SDK/Server release, or Cloud operation; post-merge exact-main publication and public image acceptance remain separate.

[rmcdaniel]

All 37/37 exact-head GitHub check runs succeeded, with no failed, cancelled, skipped or active check runs. Associated workflow runs completed on attempt 1. The reviewed head remains 52e78a79ea189efe7dc977729baeb29865155302, base/sole parent bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d, tree a3a133d2044085d9a1cc4c5f0733426edeed46f4.

• Application and microservice CI: PHP 8.4 and 8.5 each report 191 application tests passed / 1,622 assertions, plus one warning in the generated-worker Playground contract. The same warning and counts occur on both accepted-base jobs (8.4, 8.5). Each microservice suite passes 5 tests / 5 assertions. The AI message-stream, both conversation, sandbox integration and fake simple-workflow tests pass.
• Both candidate image platforms, both architecture smoke journeys, all three playground journeys and polyglot validation pass.
• SDK timers and the final activity recovery lane pass. The full check inventory also includes successful upgrade, children, namespaces, search-attribute, versioning, external-effect, lock-audit, image-security, CodeQL, Sonar, boundary and target-branch gates.

The source readback remains exact. All non-Workflow tuple fields, including Server 3.0.5, and both prior SDK warnings are preserved. Workflow 2.20.3 source/dist is exact 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c; the 126/118 other locked package objects are unchanged.

Security's final exact-head PASS has been read back with the corrected preserved Server 3.0.5 pin. Its authoritative raw-body SHA-256 is 561ceb68dfa93989a86d7659744b3173052d1a70b8639463aabd86aa9b2e825c. The earlier 3.1.0 wording was a review-comment error and is removed; source/head/checks never changed.

The PR is ready for General's merge decision. After merge, ordinary exact-main CI, the existing automatic publisher, anonymous registry index parity and both-platform inventory acceptance remain required before returning the delivered consumer receipt to Workflow #1025. No duplicate dispatch, SDK/Server release or Cloud action is requested.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 5a43dc7f937315197337de9e6e1959ac639c99aa has ordered parents bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d and 52e78a79ea189efe7dc977729baeb29865155302, with tree a3a133d2044085d9a1cc4c5f0733426edeed46f4 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #313 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

The sole automatic exact-main publisher, attempt 1, completed 7/7 jobs successfully at merge 5a43dc7f937315197337de9e6e1959ac639c99aa. Both native anonymous startup qualifications passed: linux/amd64 in 107 s and linux/arm64 in 91 s.

Independent anonymous HTTP readback at 2026-11-04T15:11:53+00:00 confirms byte-identical main and immutable tag sha-5a43dc7f937315197337de9e6e1959ac639c99aa-run-41853249134-1 indexes in both ghcr.io/durable-workflow/sample-app-devcontainer and docker.io/durableworkflow/sample-app-devcontainer:

• Index: sha256:70acadad90ee5ca019570ce8891f96ef33dabbe3fe370b9abebb52df5cdd581b

Platform	Image manifest digest	Config digest
linux/amd64	sha256:9e92591b305ab39bc354c71512afd6f14db8ed92ca998d19b2666a07df9324c0	sha256:44d553ec5ff58104c8d629386857a5716d7aedb4681402a64d18616de576c8a2
linux/arm64	sha256:9abafcdcc979a862525c6ac24b6713451705ef78e7871e9d39e8e20fd86cec74	sha256:f27ea78f02409885cc2860b53b82e9bc909b2995d97174533794b497bcefc6b5

Every fetched index, platform manifest and config was verified against its SHA-256 digest. Both registries expose the same two image manifests. All four platform configs identify this repository and exact merged revision 5a43dc7f937315197337de9e6e1959ac639c99aa.

The retained exact public scan receipts bind both registries/platforms to that index and revision. Both policy evaluations have no blocked findings under the existing reviewed dispositions. Their attested package inventories contain:

Platform	Workflow	PHP SDK	Waterline	Python SDK	Rust SDK
linux/amd64	2.20.3 (2 records)	3.9.4 (3 records)	2.13.2 (2 records)	2.14.1 (1 records)	4.11.2 (1 records)
linux/arm64	2.20.3 (2 records)	3.9.4 (3 records)	2.13.2 (2 records)	2.14.1 (1 records)	4.11.2 (1 records)

The Rust inventories also retain historical 2.1.2/2.1.5 fixture records; the qualified current crate remains 4.11.2. The unchanged source tuple still pins Server 3.0.5 and CLI 2.3.3. Both SDK upgrade warnings and Workflow 2.20.3 hidden-message/kept-stream rollback/query guidance remain in the exact merged README.

Main acceptance is still open: 17/18 exact-main workflow runs are successful; only published SDK timers remains active. The final consumer adoption receipt will follow its terminal result. No duplicate publisher dispatch, local runtime, SDK/Server release or Cloud operation was used.

[rmcdaniel]

Sample App's ordinary Workflow 2.20.3 consumer adoption is complete at merged main 5a43dc7f937315197337de9e6e1959ac639c99aa (reviewed tree a3a133d2044085d9a1cc4c5f0733426edeed46f4). Current GitHub main and the local clean checkout agree.

• 18/18 exact-main workflows and 37/37 check runs succeeded, all on attempt 1. The final PHP/Python/Rust SDK timer run completed successfully at 15:19:51 UTC. Application/microservice CI installed Workflow 2.20.3 on PHP 8.4 and 8.5; the existing single playground warning remains disclosed in the prior evidence.
• The sole automatic publisher 41853249134 passed 7/7 jobs on attempt 1. Both native anonymous startup qualifications, exact public SBOM/security scans and main-channel promotion passed.
• Independent anonymous dual-registry/platform proof confirms GHCR and Docker Hub main plus immutable sha-5a43dc7f937315197337de9e6e1959ac639c99aa-run-41853249134-1 agree at index sha256:70acadad90ee5ca019570ce8891f96ef33dabbe3fe370b9abebb52df5cdd581b. Both platform configs identify the exact merge, and both inventories contain Workflow 2.20.3, PHP SDK 3.9.4, Python SDK 2.14.1, Rust SDK 4.11.2 and Waterline 2.13.2.

Server 3.0.5, CLI 2.3.3, the two existing SDK warnings and the added Workflow rollback/hidden-message/query limitation guidance remain unchanged from the reviewed candidate. The owning merged remote branch was removed and independently verified absent; its local branch is retained. The checkout is clean and no owned containers or test processes remain.

The actual delivered consumer receipt is being returned to Workflow #1025. No duplicate publisher, SDK/Server release or Cloud operation was used.