[rmcdaniel]

Summary

• finalize the accumulated Unreleased changes as Workflow 2.14.0
• document durable service-operation scheduling outside completion transactions, bounded synchronous waits, and crash-redelivery identity
• set the committed product-train marker to the exact immutable release tag

Qualification

• source parent ca4f04d is the fully qualified combined Bind workflow service calls to trusted host authority #936/Schedule service calls outside completion transactions #937 merge
• post-merge main build 40280106950 passed (23 successful jobs, 2 inapplicable skips, 0 failures)
• main Public Boundary 40280106941 and CodeQL 40280106340 / 40280106542 passed
• composer validate --strict --no-check-publish passed
• PlatformConformanceSuiteTest::testWorkflowSourceReleaseAndQualifiedSdkTupleRemainExplicit passed (1 test, 42 assertions)
• git diff --check passed

Follow-through

After this PR and its main build pass, create immutable tag/release 2.14.0, wait for Packagist, require the repository release-verification workflow, and test affected consumers with the published package. #931 and #932 remain open until published-artifact and downstream acceptance are recorded. No deployment is included.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source check: exact head 881ad9e is a metadata-only delta from qualified parent ca4f04d: CHANGELOG +7 and composer product-train 2.13.1 to 2.14.0. Diff check is clean and all current protected PR checks are terminal success or trigger-inapplicable skips. No additional Security hold. Normal merge, publication, exact published-package, and downstream acceptance remain required; this PR does not itself update Server pinned dependencies.

[rmcdaniel]

Follow-up authoritative alert review (2026-10-26): Dependabot alert 6 / GHSA-f9x3-7vq9-cph6 remains open because the library intentionally retains Laravel 9 and 10 for upgrade/drain compatibility, and those lines contain the vulnerable TokenGuard behavior. This is not a newly introduced risk in this release-preparation diff.

Exact-source checks support the existing scoped disposition: Laravel 11.56.1 contains the strict string guard despite the advisory feed classifying every pre-12 release as affected; the declared Laravel 12.69.0 and 13.30.0 floors exceed the official patched versions. This package does not configure the host application auth guard. The README places a production warning before installation, directs production to patched Laravel 12/13, and says legacy applications must not expose TokenGuard while upgrading. The per-major Composer audit inventories the advisory and has a 2026-10-31 review date.

Security disposition: no additional hold on exact head 881ad9e. Keep the alert open and the dated accepted-risk record visible; do not dismiss it as a false positive. Normal publication and installed-consumer acceptance remain required.

[rmcdaniel]

Post-merge source qualification is complete for the exact release source.

• main: b814c6c485b1c072f4092d3f478c7deba9c8c241
• tree: 852928cf3924c63de6c88359d262783aee5940b4, exactly matching the accepted PR head tree
• parents: ca4f04dd34c68f520f822a3827eeb93bd3b83ad1 and accepted head 881ad9eb372aad3597e72156b7cf4a6a0375e040
• full main build: terminal success, 23 successful jobs, 2 push-inapplicable skips, 0 failures or pending jobs; this includes every PostgreSQL and MySQL shard, MariaDB, regression corpus, coverage, supported Laravel upgrades, aggregate build and SonarQube analysis
• Public Boundary, dependency security, CodeQL and code quality: successful

Security independently verified the merge/tree/parents and has no release hold. Dependabot alert #6 remains open and undismissed under its dated retained-Laravel compatibility disposition. The stable 2.14.0 release will target this exact commit; published-package qualification remains the next gate.

[rmcdaniel]

Workflow 2.14.0 is published and its package-level acceptance is terminal.

• stable GitHub release, published at 2026-10-26T10:53:46Z
• immutable tag refs/tags/2.14.0 resolves directly to qualified commit b814c6c485b1c072f4092d3f478c7deba9c8c241 (tree 852928cf3924c63de6c88359d262783aee5940b4)
• Packagist durable-workflow/workflow 2.14.0 resolves both source and dist to that exact commit
• published-package verification: 17/17 jobs successful, 0 failed/skipped/pending; this includes Packagist propagation, the published platform contract and all 16 supported Laravel/PHP published-upgrade combinations
• full exact-main source build: 23 successful jobs, 2 push-inapplicable skips, 0 failures/pending

No deployment is claimed. The owning issues remain open for downstream Server/package adoption and installed acceptance against the published artifact.