[rmcdaniel]

Purpose

Prepare the compatible Python SDK 2.8.0 release for Workflow #878 and sdk-python #186.

The actual PyPI release remains 2.7.0 at ab7ee6f8. Current main d6da755e already contains the guarded activity lease API/automatic maintenance from #183, its settled-loop correction and the heartbeat-authority refusal fix from #187. This PR changes only release metadata and the changelog. It introduces no new runtime code, dependency, protocol floor or Server/frozen-reference change.

Qualification

Exact candidate 7f6e130847428a894723dae191eee692c4029a47 / tree b71654367c07bb529d1381268c87e5016ceb9e1c passes a normal, noneditable source installation on Python 3.10.22. All 36 installed production files match the source hashes before and after testing. Results: 3,120 passed, 3 skipped, 105 integration tests deselected, Ruff passes, mypy reports no issues in 36 source files, and the official regression corpus validator passes against parent d6da755e.

Separate wheel and sdist builds pass the release metadata verifier for this exact commit and version 2.8.0. The tools ran in ephemeral containers; their installed dependencies and build outputs are removed. All 18 exact-candidate checks now pass, including Python 3.10/3.11/3.12, integration, packaging, lint, corpus, portal, boundaries, CodeQL, Sonar and the required Target branch qualification. Normal merge b73a5d9d9d7149f3ee04b44aa66e271c23bfb452 has the identical reviewed whole tree. Fresh-main CI 39689028055 and companion checks are newly admitted, not passed. The earlier main CI cancellation remains separate. No 2.8.0 tag, publication or normally installed 2.8.0 acceptance is claimed yet.

The optional runtime lease capability still needs the matching Server. The separately prepared Server/PHP-source cohort has actual six-minute and owner-loss evidence at Workflow #878; it is not published Server or Python acceptance. Real Python and Rust consumers remain required on the final published tuple. Do not close #878 from this metadata PR or package publication alone.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

All 18 checks on exact release candidate 7f6e130847428a894723dae191eee692c4029a47 pass, including Python 3.10/3.11/3.12, integration, packaging, lint, regression corpus, developer portal, both boundaries, CodeQL, Sonar and the required Target branch qualification. The normal merge is b73a5d9d9d7149f3ee04b44aa66e271c23bfb452; its whole tree b71654367c07bb529d1381268c87e5016ceb9e1c exactly matches the reviewed candidate.

Fresh-main CI 39689028055, portal, boundary, Sonar, CodeQL and dependency-graph checks are admitted separately. Their outcomes are pending; candidate passes do not establish fresh-main qualification. No 2.8.0 tag, PyPI publication or installed 2.8.0 acceptance is claimed yet.

Next: finish those gates, publish the exact qualified release through the protected publisher, verify normal PyPI installation, and run the matching published-Server long-activity and owner-loss acceptance. The open activity-lease product issue is not closed by this metadata merge alone. Existing failed originals remain separate.

[rmcdaniel]

Python SDK 2.8.0 is published and normally installed.

• Exact source: b73a5d9d9d7149f3ee04b44aa66e271c23bfb452, whole tree b71654367c07bb529d1381268c87e5016ceb9e1c. All 18 candidate checks and all 18 independent main checks passed before tagging. Tag object: f88c8a74ae5713f37dbaf7e272c6ceb2b7fea4d6.
• Protected publisher 39692495473 passed. GitHub Release and canonical PyPI metadata identify 2.8.0.
• Published wheel SHA-256: 908267666c35890fce13ab9c8e62a5c93abac78bdffbb0e56423eb3b3e57a77b. Source archive SHA-256: 11dc35f8d4eb0e39bc47b3e9aa36b64b9893ee5458067906ef63e9be927f59bb.
• Fresh Python 3.10.22 virtual environment: normal pip install --index-url https://pypi.org/simple durable-workflow==2.8.0, dependency check and imports pass. All 37 installed package files match the published wheel bytes. No editable checkout or source substitution was used.

The first local install, during registry propagation, failed because the version was not yet listed. After the canonical simple index exposed both 2.8.0 files, a separate fresh installation passed. The initial failure is retained; no SDK source correction was made to rescue it.

This proves publication and package installation. The long-activity and owner-loss tests against the final published Server tuple remain part of Workflow #878 acceptance; this package result does not close that requirement. Both disposable installation containers and all their dependencies/wheel bytes are gone.