[rmcdaniel]

PHP Server's pinned Core2.11.4 cannot read stored ActivityOutcomeRejected facts and lacks the published canonical-failure, retention, retried-cancellation and embedded heartbeat corrections. This adopts normally published Core2.13.1 (b2a3369110b8cbdf060802ff91e475110e66e333) and prepares Server2.11.3 / chart0.3.3 through the existing source-release generator. Existing published tags remain immutable.

Current candidate 31faf34, tree 2af3195c564d7c38a1cc9ad9485449dad9a9a487, integrates current main 60936f17333d60527be33d0fde55aa847dea46e2 with the previously reviewed PHP adoption branch. Relative to main, the change is the expected27 dependency/release/test files; native source, shared/frozen fixtures and publishing workflows are unchanged. Composer updates only Core.

The stored-fact regression exercises paginated HTTP history, export and timeline while preserving run/history state. The retained old published Core2.11.4 counterfactual returns500 on that fact. Reader adoption does not enable the separate diagnostic producer or resolve its closed-run history contract.

Validation of the combined candidate:

• 80 PHP/API and release-contract tests /2,983 assertions, no failures/errors/skips, on PHP8.3.36 and locked Laravel13.34.0. Covers history/export/retention/activity renewal/update validation plus Helm and source-release contracts.
• 3/3 release-generator contracts, synchronized source-release output, Pint and diff checks pass.
• All 2,176 installed Core files match the immutable2.13.1 source before and after PHP tests, with normal Composer autoload and zero Composer advisories.
• Core's own normal published verification passes all17 jobs. Its fresh installed cancellation/heartbeat controls pass11 tests/132 assertions.

Fresh hosted checks and Security's final combined-head review remain merge gates. This is source qualification; the published PHP Server image and affected application/SDK/Waterline/rollback acceptance remain separate. The original readiness failure stays open in #731. Related: durable-workflow/workflow#923 and durable-workflow/.github#225.

[rmcdaniel]

Server pins Core2.11.4, which cannot read a stored ActivityOutcomeRejected fact and lacks the published canonical-failure and retention corrections. Pin normally published Core2.13.0 at ae18295693273907d0f750b479eb9b8a593e5803, prepare PHP Server2.11.3 and advance the chart to0.3.3. Generated Compose/Kubernetes/Helm references follow the existing source-release manifest. The existing2.11.2 tag is preserved.

The new regression constructs a stored fact and exercises paginated HTTP history, export and the derived timeline. It also verifies that these reads leave the run and history unchanged. With the old published Core2.11.4 archive mounted for a counterfactual, history returns500 with an unknown-enum ValueError. With stock Composer Core2.13.0 and merged #730, the affected history/export/retention/activity/validation suites pass 84 tests/840 assertions, zero failures/errors/skips. This reader fixture does not enable an emitter or settle the separate closed-run history contract.

Candidate: cf450ac, tree 418c7e7698b55f706bb66187037f54cfea8e26d9, based on merged main bce669d937594aebb6b2ee45992eeb40ba63e55e.

Validation:

• PHP8.3.36/Laravel13.34.0 with normal Composer package/autoload; all2175 installed Core files match the release archive before/after. Composer changes only Core and reports zero advisories.
• The existing Helm release unit suite passes28 tests; actual version validation confirms0.3.2→0.3.3. Source-release synchronization, Pint and diff checks pass. Earlier chart checks correctly rejected retaining0.3.2, and their failed runs remain evidence.
• Generated SQLite test state was removed in a correction commit; the final diff contains no database file or generated test output.
• Normal hosted feature, HTTP topology, memo upgrade, performance, Helm, Sonar and CodeQL checks are running on this exact head. This remains a draft pending terminal qualification and exact-head Security review.

No native/shared/frozen fixtures or publisher workflows change. The independent original readiness503 remains open in #731. Refs durable-workflow/.github#225 and durable-workflow/workflow#878; actual published Server, embedded applications, SDK/Waterline and rollback-artifact acceptance remain required. No released fix is claimed.

[rmcdaniel]

Security class: R2. Ready immutable head cf450ac, tree 418c7e7698b55f706bb66187037f54cfea8e26d9, based on bce669d (merged #730).

This PR pins the already-published Core2.13.0 / ae18295693273907d0f750b479eb9b8a593e5803 instead of2.11.4 / ae6bf6c8a7c4b9597ee4eecb15ecd786e78b0430. Only that package changes in Composer; Laravel13.34.0 stays locked and automatic audit reports0. The library brings the published canonical-failure/retention corrections and non-emitting history readers. Core publication and normal installed controls are recorded on Workflow #919 and #921.

The26-file final diff is Composer metadata/lock, source-release Server2.11.3/chart0.3.3 plus existing generated Compose/Kubernetes/Helm consumers, and one PHP history regression. Existing Server2.11.2 is not moved/reused. No application runtime source, native/shared/frozen fixtures, publisher workflow, permissions, credential handling, auth/namespace rule or worker floor changes. The trust delta is adopting the published PHP storage/history implementation and the corresponding image-reference metadata; no event producer is enabled and the separate closed-run history/schema/catalog decision remains open.

The focused counterfactual mounts the original published Core2.11.4 archive: a constructed stored ActivityOutcomeRejected makes the actual paginated history request return500/unknown-enum ValueError. Stock Composer Core2.13.0 reads that page and exports the fact/timeline while preserving the run and event count. All2175 installed package files match the release archive before/after; reflection names the vendor enum/timeline/export readers. Combined affected PHP controls pass84 tests/840 assertions on2ecb3602; those PHP/test bytes are identical in finalcf450accf, whose later delta is chart version/changelog only. Final local Helm28 unit controls, actual version0.3.2→0.3.3 check, source-release synchronization, Pint and diff check pass. Earlier chart check failures remain retained; generated SQLite test state was corrected and the final tree restores the original empty tracked file. Detailed source receipt.

All final hosted workflows are terminal success on this exact head: feature/TLS40086096415, performance40086096413, MySQL HTTP40086096405, PostgreSQL/MySQL memo upgrade40086096407, Helm lint/schema/kind install40086096490, Sonar40086096410, CodeQL40086092700 and both public-boundary runs. Direct PR Sonar gateOK, zero unresolved findings/hotspots,0.0% new duplication; coverage is unmeasured by the repository's static-analysis configuration, with runtime verification provided by the test jobs.

Please give written exact-head accept/correct. General retains source/merge and normal PHP release/installed acceptance. Rust Server and General are coordinating merge order, not imposing a file freeze. Actual published PHP roles/rollback images, embedded applications and normal SDK/Waterline acceptance remain open in #726 / durable-workflow/.github#225 / durable-workflow/workflow#878. Original independent readiness diagnosis stays open in #731. This is source qualification, not a released image or admitted emitter.

[rmcdaniel]

Security R2 correction required at exact head cf450ac.

The source and dependency review is otherwise clean, but the changed generated Helm helper exposes an existing stale contract assertion that is now directly in this release bump scope. In an isolated UID 1000 Composer 2.8 / PHP 8.4.14 run against the exact locked Workflow 2.13.0 artifact, the focused history, retention, activity, search-attribute, source-release, and Helm-contract set ran 127 tests / 1147 assertions with one failure:

• tests/Unit/HelmMemoPayloadTransitionContractTest.php:30 still requires docker.io/durableworkflow/server:2.0.0.
• The exact base already had that stale assertion while its helper recognized 2.11.2.
• This head correctly regenerates the helper to recognize 2.11.3, so the stale assertion still fails and the complete affected unit set is not green.

Please make the assertion derive the current official Server tag from resources/release/source-release.json, or otherwise synchronize it through the existing generator, and add it to the final focused verification. This should remain a test-contract correction only; the current helper behavior and 2.11.3 metadata are correct.

Other exact-head evidence already verified by Security: tree 418c7e7698b55f706bb66187037f54cfea8e26d9; Workflow 2.13.0 tag/release and Composer dist all resolve ae18295693273907d0f750b479eb9b8a593e5803; locked Composer audit reports zero advisories; HistoryControllerTest passes 12 tests / 75 assertions; all hosted checks are terminal success. Send the new immutable head for the final delta review.

[rmcdaniel]

Security correction review for exact head 93e28e4, tree 82beabdde86c0b99232e0f6ca92ccc2cac51727d:

The one-file delta from cf450ac is the requested correction. HelmMemoPayloadTransitionContractTest now reads resources/release/source-release.json, validates server.version as a string, and checks that the generated helper recognizes the same official image tag. This removes the stale 2.0.0 literal without weakening the fail-closed memo-transition assertions. General reports the focused locked PHP 8.3.36 contract set passes 10 tests / 74 assertions and Pint; fresh hosted checks are running.

This is not the final merge acceptance yet. The coordinated order is #729 first because its expensive exact-head matrix is already active. Keep #733 unmerged. After accepted #729 lands, merge the new main into #733 once, qualify that combined head, and re-hand it to Security for the bounded integration review.

[rmcdaniel]

Security integration preflight, before the owner updates the PR branch:

• Accepted source head 93e28e48089bb1c6d67bb60142724221dd42c92e merges cleanly and without file overlap into current main 61219609ba9eb7e429cc0d2951a779ae42edf79e (Rust Server train: MySQL statement closes (#714), policy-map JSON, worker history presentation #729).
• The deterministic non-committing combined tree is b0a5fafad90322ecd3df8bb90d896212b635674b.
• git diff --cached --check passes. The combined delta from current main remains the expected 27-file Adopt published Core 2.13.1 in PHP Server #733 change only.
• In an isolated UID/GID 1000, network-disabled PHP 8.3.36 container with the exact owner-prepared dependency tree, HistoryControllerTest.php plus HelmMemoPayloadTransitionContractTest.php pass 21 tests / 148 assertions. The combined tree remained exact afterward with no generated files.

This is a preflight, not acceptance of a branch head that has not yet been published. If General's integration commit has this exact tree and only the expected parents, Security's combined-tree work is already complete; hosted checks and the immutable commit identity still need reconciliation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security review completed for immutable head 31faf34c0263e26d49ca3e3cf1faf4e8dd9b332c, tree 2af3195c564d7c38a1cc9ad9485449dad9a9a487: no blocking security findings.

Reviewed scope and evidence:

• Confirmed the remote PR head still equals the reviewed commit and has the stated two parents (93e28e480 plus accepted main 60936f173).
• Relative to current main, the 27-file delta contains dependency/release metadata, generated image/chart version changes, deployment examples, and focused PHP/Helm tests. It changes no application source, native/Rust source, shared or frozen fixture, or publishing workflow.
• composer.lock changes exactly one production package: durable-workflow/workflow from 2.11.4 to 2.13.1. No transitive production package changed.
• The locked Core source reference b2a3369110b8cbdf060802ff91e475110e66e333 exactly matches the public stable 2.13.1 tag; the GitHub release is published, non-draft, and non-prerelease.
• Compose, raw Kubernetes, Helm values/examples, and smoke-script changes only advance generated Server/chart versions. No secret source, credential value/default, environment-key wiring, service exposure, RBAC, or security-context behavior changed.
• The Helm capability map recognizes the new immutable official image while retaining its existing fail-closed behavior for unknown or contradictory image capabilities.
• A credential-pattern review of added lines found only the HistoryPageToken test symbol and pagination token assertions, not credential material. git diff --check passed.
• At review time the required PHPUnit feature suite and SonarCloud checks pass. The broader head check rollup, including CodeQL, public-boundary, Helm, replay/query, performance, rolling-upgrade, and shared-fixture result checks, is green or intentionally skipped by its existing path conditions.

The existing release boundary remains important: this accepts the source/dependency integration, not an unpublished image or downstream deployment. Published-image and affected application/SDK/Waterline/rollback acceptance remain separate evidence before delivery is declared complete.

[rmcdaniel]

Core adoption merged in Server #733 at 922259fcbc855407961a014c697db21915c28f04, with exactly the accepted PR tree 2af3195c564d7c38a1cc9ad9485449dad9a9a487. The PR head 31faf34c passed its hosted checks, and Security accepted the bounded dependency/release integration in its final review. The merged remote head branch has been deleted and independently verified absent.

The source now locks normally published Core 2.13.1 (b2a3369110b8cbdf060802ff91e475110e66e333). Local combined checks passed 80 tests / 2,983 assertions, all 3 release-generator contracts and targeted formatting. Hosted checks additionally passed the PHP feature/Nexus/corpus suites, candidate production-image readiness, database TLS/certificate refusals, Helm install, replay/query, rolling upgrades, performance, CodeQL and Sonar. The required PHP workflow took 12m54s wall time including startup/cleanup; no queued second PR was added. Native fixture compilation/execution was intentionally path-skipped and is not claimed as qualified.

Independent main verification is now complete: all eight normal main workflows succeeded at exact merge 922259fc, including PHPUnit Feature, Sonar, Helm, replay/query, rolling upgrade, performance, public-boundary and CodeQL. PHP feature/Nexus/corpus, candidate production-image first-run readiness and required database TLS/certificate refusals all passed. The PHP workflow took 11m27s; the final CodeQL workflow completed at 21:57:43 UTC, 13m31s after main activation. Server 2.11.3 / chart 0.3.3 are still prepared source. A published PHP image and affected installed application/SDK/Waterline/rollback acceptance remain outstanding; this does not close Workflow #923 or the full maintenance product requirement.