[rmcdaniel]

Update the published example tuple to Native Server3.3.0 by index digest, PHP SDK3.11.0 and Workflow2.22.0. Align the root, microservice and playground Composer requirements and locks, and document the database upgrade and coordinated worker replacement requirements. Unrelated direct package pins and development dependencies stay fixed; the selected SDK/Core dependency closures are refreshed by Composer.

Repair the synthetic Python query claims used by codec rejection controls: supply the queue and live lease required by the pinned published SDK and retain the worker outcome. Run the existing rejection and valid-control probe without network during image builds, so normal CI catches fixture drift before runtime qualification. Codec validation, hostile inputs and report/handler-count assertions stay intact.

Validation:

• All three strict Composer lock validations and dev-inclusive audits are clean.
• Hosted installed-SDK build controls pass32Python rejections and4valid controls.
• Exact-tuple full diagnostic42514766560 passes all9surfaces: all workflow/activity directions, portable values, typed errors, codec refusal, live PHP/Python/Rust signals/queries and Waterline assets/rendering.
• All38check runs on the exact final head passed, with0statuses; timer and activity recovery are terminal success. Timer run42514248914 independently verifies all12PHP timer/replay/cancellation/version-marker cases (full log872774 B / SHA42a0d4909ff0356c12bb0c669d36fb0aed4d4892f8f94c25a1342a40bfce6b7e).

Part of durable-workflow/sdk-php#269 and durable-workflow/server#325. Earlier failed source/diagnostic subjects remain recorded in the PR comments. The default prepared devcontainer still needs a separately selected publication/qualification on accepted main before downstream rollout is complete. No Cloud deployment.

[rmcdaniel]

Attempt1 on4974b8b5 is terminal NONPASS:29success/7failure, with no pending runs, cancellation or retry. The tuple-only update left root/microservice/playground locks at SDK3.9.4 and Core2.20.5. PHP CI and prepared playground pins explicitly reject that mismatch; both devcontainer candidate qualifications and their aggregates also fail. This is my incomplete downstream source update, not a Composer outage or an SDK runtime defect. The unchanged published SDK timer experiment itself passed; its actual results will be audited separately.

General has aligned the three manifests locally (^3.11/^2.22), tuple and upgrade documentation. Select one bounded metadata-only lock generation on this isolated worktree, using cached PHP8.4.27 runner80a and trusted Composer2.10.3 PHAR/closed CA/verifier from the accepted published consumer. Driver 332bd77f96f2ea3446787e10b6c4199453619886f7651e8ae2e2ffdc04aac81a,11input manifest 7db32ee4d68f4ae2df8a71dfa881cdd0ea9ee881022b75b8799abf97fd571be5 binds all3manifests/oldlocks,controlscript,engine/trust. Bash/Python syntax passed.

One fresh owned container general-sample329-locks: bridge network(no egress-allowlist claim), UID1000/readonlyroot/caps0/no-new-privileges/2CPU2GiB256PIDs/privatehome/cache/tmp. Only this worktree writable; trust/control readonly. Run partial composer update durable-workflow/sdk durable-workflow/workflow --with-dependencies --no-install --no-scripts --no-plugins in root/microservice, SDKonly in playground; keep unrelated direct pins, normal advisory/platform blocking. Validate strict/check-lock and audit each graph, capture tool/module facts. No package scripts/plugins, source/runtime build, image pull/tag, application/Cloud activity or remote push.

Empty running/owner/name and exactimage/inputs/rawselection guards, exclusivefsynced create marker/cidfile, parent660+60cleanup, exactID/name/labelcleanup with6settle checks. Report byT0+900; no retry, unknown create holds. Old files retained; inspect every package/lock delta before a successor. A new source push/CI follows a separate concrete review after complete locks; current NONPASS remains attributed. All5SDKbridge graphs are finished/cleaned; General owns the local slot.

[rmcdaniel]

General source review and one successor selection for #329.

Attempt 1 at 4974b8b is terminal NONPASS: stale root/microservice/playground Composer locks contradicted the new tuple. No retry, cancellation or check waiver. Its SDK timers run 42508790134 passed separately and remains attributed to that exact head.

Reviewed successor 69dcfcd, tree b0b91cab54356a6f3dd593fcb4283b3371f2bd74, base 3c9c20a. Full diff 97061 B / sha256 833be0d9e91baff3dd14c29e2b7c68b203c78ca4b6c01e3b0bc4d4167eb85c70; eight paths (tuple, README, three manifests and three locks). Requirements and locks now select SDK3.11.0 at fbc64ef9 and Core2.22.0 at 4e56debc. Other direct pins and development packages are unchanged. Composer refreshed selected transitive dependency closures and published-time metadata; plugin API metadata reflects trusted Composer2.10.3.

One bounded lock-generation invocation: exit0, no timeout, no unknown create or cleanup error; 19 captured calls rehashed. All three strict lock validations and dev-inclusive audits passed, no advisories or abandoned packages. This was metadata resolution, not an installed runtime claim.

Select one push of the reviewed head on the existing draft, with exact old-head lease, then one normal CI train. Guards: current main/base unchanged, old train terminal, clean worktree, exact PR head, WIPs unchanged and added-line secret scan clean. No ready/merge/queue/image deployment selected. Release tags are unchanged.

[rmcdaniel]

Full Native-compatible polyglot diagnostic42512485015, attempt1, head69dcfcd3: terminal NONPASS at19:02Z. No retry/cancel. Source normal CI is separate and still completing its timer/recovery jobs.

The documented first-run PHP→Python→Rust example passed. The optional full matrix stopped during its Python task-codec preflight, before live signal/query tests or the Rust codec probe. All8 synthetic query rejection inputs and the valid Avro query control returned no report/handler call, while workflow/activity/manual-activity controls behaved as expected. This is not signal/query coverage. Full log609499 B / sha256 a30f7fd9039e346ae2028c43689e4a0b66176a52131ff564370ef064d30da57c retained; Dump logs and always-teardown succeeded. No independent final count receipt is claimed.

Source diagnosis against immutable Python SDK2.14.1: QueryTaskAuthority.delivery requires task_queue matching the worker and lease_expires_at before payload validation. The Sample App synthetic query dictionary has neither; the worker correctly suppresses it as invalid_query_claim before exercising codec rejection, including on the valid control. No production defect or Composer/network failure is established by this run.

Prepared fixture-only correction: supply the existing probe queue and a fresh60s canonical lease deadline, preserving the original8 hostile codecs, poison payloads, all report/handler-count assertions and valid Avro control. Also retain the worker return value in probe evidence so future authority suppression is visible. No SDK/Server source, versions, claims, codec validation or expected outcomes are changed. Python syntax and diff whitespace pass; no local probe/container execution.

The correction stays local until the current source train is terminal, to avoid cancelling any in-flight evidence. Then one source successor on this PR and one separately selected full diagnostic can qualify it. All earlier NONPASSs remain attributed.

[rmcdaniel]

General source review and one successor selection for #329: c84b5b94d040a79bf06f5fe2f0b6cd0c63320c77, tree 86ceaae6ec281a93623c851d3873a7b96b50975c, parent chain from 69dcfcd3064c9d6c68670e8681ccd177dcffe994, base 3c9c20a116c501653752c1a6efc1e218ad29d238. Successor4501 B / sha256 5fbf6612e13a233db26334a0e450962db43b020f8c88992de97f3785009f2796, two paths (Python probe and its Dockerfile); full delta101562 B / 7e2e93f8a640bde84b383c6cfc250ba5ca2abb8d122401584e5e183db098f319. Product tuple/manifests/locks/README are byte-unchanged from69dcfcd3.

The predecessor is terminal: {'success': 37, 'failure': 1}, nothing pending. All normal source workflows passed, including timers and activity recovery. The sole failure is the separately selected full diagnostic42512485015, retained as NONPASS6725766199; it stopped before live signal/query coverage because the synthetic Python query lacked authority fields. No cancellation, retry or waiver.

Source fix supplies probe task_queue and a fresh canonical60s lease deadline. It keeps8 hostile codecs, poison payloads, report/handler-count assertions and the valid Avro control. It records the worker outcome, and runs the existing complete probe with the actual installed SDK under --network=none during the normal image build. Published SDK2.14.1 source confirms these fields are required before codec validation. No SDK/Server runtime or expected-result change. Syntax/whitespace/secret checks pass; this is not a runtime pass yet.

Select one exact-old-head-leased push on the existing draft, followed by its normal source train. Main/base/head clean and exact, WIPs unchanged. Requalify the full diagnostic separately on accepted corrected source; no blind retry, ready/merge/queue, image publication or Cloud deployment.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Final source/effect review for #329: PASS. Select mark-ready and one ordinary merge through GitHub, with expected head c84b5b94d040a79bf06f5fe2f0b6cd0c63320c77, current base/main 3c9c20a116c501653752c1a6efc1e218ad29d238, tree 86ceaae6ec281a93623c851d3873a7b96b50975c. Full10-path delta101562 B / SHA2567e2e93f8a640bde84b383c6cfc250ba5ca2abb8d122401584e5e183db098f319; clean worktree, unchanged WIP refs; final PR body SHA2569e925c6cdc638cc9ae93ecf823887e270334dde4ee3dcaa8362b553cd5377a1f.

All38head check runs are completed success,0statuses, no auto-merge request. Required Target branch qualification, both polyglot runs, Compose sample workflow and Sonar checks passed; both architecture candidate qualifiers passed. All three strict lock/audit checks clean. Corrected installed-SDK codec controls, full diagnostic42514766560 and final-head timer run42514248914 are captured/audited PASS; activity-recovery42514248720 is also terminal success. All earlier source/diagnostic NONPASSs remain recorded.

Expected merge custody: valid signature, ordered parents[3c9c20a,c84b5b94], tree equal to86ceaae6, then actual-main terminal checks. Delete only the merged topic with exact-head lease after ancestry, no open PR and successful actual-main checks, then verify ref absence. No administrator bypass or auto-merge, no release/tag mutation or Cloud effect.

Scope is the example source/default tuple. Its Codespaces/devcontainer uses the separately published main image; the manual devcontainer-image.yml publication, anonymous qualification and channel update still need their own source/effect review on accepted main. Do not claim that image or complete downstream #269 until that follow-through is verified.

[rmcdaniel]

Sample App #329 actual-main custody is complete. Main d2e449d64419490f45d646ab2455ce977c2dfa83 is signed and verified, with ordered parents 3c9c20a1, c84b5b94 and tree 86ceaae6ec281a93623c851d3873a7b96b50975c, equal to the reviewed head. All 30 actual-main check runs succeeded; 0 statuses. The topic was deleted after ancestry and zero-open-PR guards; REST 404 and an empty ref listing confirm absence.

The exact 3.3.0 / SDK 3.11.0 / Workflow 2.22.0 tuple and matching locks are merged. The final-head timer cases and full polyglot diagnostic passed (SDK #269 receipts linked above). The default devcontainer publication is still pending through its existing protected workflow. Full PHP replay-matrix acceptance remains open on SDK #269; the narrower timer and signal/query checks do not replace it. Earlier failures stay attributed.

[rmcdaniel]

General selects one normal devcontainer-image.yml publication on accepted main d2e449d64419490f45d646ab2455ce977c2dfa83 after #329. Its 30 actual-main checks are successful and the topic is absent (custody). The workflow and scan/qualification/policy source blobs equal the reviewed final tree; no active publication exists. The protected environment permits main.

Current anonymous GHCR and Docker Hub sample-app-devcontainer:main indexes both resolve to sha256:2a381d49854f6af1d1e2cadcc47d0f68c6f6ead5c4eeaaa213218f27a73f8aa1. This invocation builds and publishes immutable amd64/arm64 artifacts, assembles both registries, applies the unchanged security policy to exact public SBOMs, and qualifies both architectures anonymously. Only its existing successful gates may promote both main tags. Standard hosted runners and existing scoped publication credentials only. No new waiver or policy relaxation.

Dispatch once on main; bind the resulting run to this exact commit and attempt 1. No automatic rerun, cancellation, changed input or bypass. A failure remains NONPASS with its evidence and leaves any published immutable artifacts attributed. Full PHP replay-matrix acceptance is separate and remains open on SDK #269.

[rmcdaniel]

The #329 default-devcontainer publication is terminal NONPASS: run42518504212, attempt1, exact main d2e449d6. Both architecture builds and index assembly succeeded. Candidate index sha256:58a68bdb7f2a70128d2ef85e8aaebe8e224cbba419fc1686581a505b3b5c7065 is unqualified. Security scanning failed; both qualification and main-channel promotion were skipped. No rerun or waiver.

Both platform SBOMs identify the same blocking finding: CVE-2026-78661, golang.org/x/net v0.60.0 in the Compose v5 tooling dependency, fixed in v0.62.0. The Go advisory confirms the affected HTML parser and fixed version. The unchanged policy also reports11 exact component-negative dispositions,6 reviewed unfixed-critical rows, and530/529 unfixed-high rows (amd64/arm64 respectively); this is not a zero-vulnerability claim. Full reports and summary are retained as artifact13632891304.

General owns the focused Compose dependency repair under existing #280, then source qualification and one new gated publication. The published SDK/Server tags do not change. SDK #269 stays open for this downstream image and the full PHP replay matrix; new source runner PR is server#1106.