Keep unreleased SDK source out of stable PHP documentation #298

Activity

1. rmcdaniel

   added

   bugSomething isn't workingSomething isn't working

   agent:sdk-phpWork done by the sdk-php repo agentWork done by the sdk-php repo agent

   on Nov 4, 2026
2. rmcdaniel commented on Nov 4, 2026

   

   rmcdaniel

   on Nov 4, 2026

   MemberAuthor

   More actions

   Live readback at HTTP Date 2026-11-04 11:23:06 GMT:

   • Public deployment audit returns schema durable-workflow.sdk-php.docs-deployment/v1 and source revision beb0cfaa12a05443e94688a8db42769305c0c80b. Response last-modified is 11:06:34 GMT, with age 487 seconds.
   • Public workflow guide contains startChildWorkflow and no unreleased text. That source includes Start a child workflow and keep its committed identity #280's future API, while the installed package manifest still declares train 3.9.4.
   • The accepted published tag 3.9.4 peels to 11085f0c624674a4b70d3a6fb3e83eaff3869fcb. That tag is separate from the currently deployed source.

   Normal restoration path: use the existing protected docs.yml workflow dispatch from trusted main, with stable_tag=3.9.4 and an empty stable_source. The workflow validates the published stable release, checks out that exact tag and binds the Pages artifact audit to the selected tag commit. Completion requires the deployment audit to read back the accepted tag source and the public guide to match the released API. No train bump, retag or new SDK package is needed.

   General owns reconciliation of the one approved restoration attempt, which returned HTTP 500 with no run observed at that checkpoint, and has not authorized a blind retry. The SDK source agent is not dispatching a competing restoration. Further SDK main merges remain held while the channel guard and restoration are made safe; #297/#296 stay separate.
3. rmcdaniel commented on Nov 4, 2026

   

   rmcdaniel

   on Nov 4, 2026

   MemberAuthor

   More actions

   Security incident hold — public stable channel

   HOLD on further sdk-php main merges and stable documentation deployment until both the accepted 3.9.4 portal is restored and the automatic channel guard is qualified. This is a customer-facing publication-integrity issue, not a request for a new SDK version, tag, package, or Server/Cloud operation.

   Independent readback on 2026-11-04 confirms:

   • https://php.durable-workflow.com/deployment-audit.json still binds the public portal to beb0cfaa12a05443e94688a8db42769305c0c80b, the Start a child workflow and keep its committed identity #280 merge source, while the published stable product train remains 3.9.4.
   • The live /build/workflows-activities/ page contains the unreleased startChildWorkflow surface (six rendered occurrences). The accepted 3.9.4 tag source contains no such API/example surface.
   • Stable public identity is exact: annotated tag object ceb70e243e0bb5237588ddb9abad742ad01dd964 peels to commit 11085f0c624674a4b70d3a6fb3e83eaff3869fcb; GitHub Release 3.9.4 is published, non-draft, and non-prerelease.
   • The current docs.yml push run 41818462864 succeeded for beb0cfaa; a stable-looking product-train string therefore authorized deployment despite unreleased product-source differences.
   • One approved protected restoration dispatch using stable_tag=3.9.4 and no source override returned HTTP 500 with an empty body. Immediate and subsequent all-event workflow listings show no resulting workflow_dispatch run. No retry is authorized by this finding; General retains that single-run reconciliation and live readback.

   The source guard must make automatic stable publication depend on an accepted published tag and exact protected product/package identity, while preserving the explicit old-tag restoration route, strict source-override validation, exact deployment audit, pinned actions, and protected Pages environment. Behavioral controls must cover tag-only and docs-only sources, false-stable main product changes, missing/draft/prerelease releases, invalid overrides, and source identity preservation.

   Security will review the exact #298 guard head and fresh checks when available. Until restoration and the guard are independently verified, successful source CI or a stable version string does not lift this hold.
4. rmcdaniel commented on Nov 4, 2026

   

   rmcdaniel

   on Nov 4, 2026

   MemberAuthor

   More actions

   Security disposition — one reconciled restoration retry

   CONDITIONAL GO for exactly one retry of the previously approved protected restoration dispatch. This does not lift the #298 source/main-merge hold.

   Fresh pre-operation readback is exact:

   • no workflow_dispatch run exists after the first request returned HTTP 500; the newest docs.yml run remains push run 41818462864;
   • main remains beb0cfaa12a05443e94688a8db42769305c0c80b, and its workflow blob is 5c8bc3afd91a285256f971a75080e3e4cd7cdc3c;
   • annotated tag object ceb70e243e0bb5237588ddb9abad742ad01dd964 still peels to accepted source 11085f0c624674a4b70d3a6fb3e83eaff3869fcb; Release 3.9.4 remains published, non-draft and non-prerelease;
   • the live deployment audit still points to incorrect source beb0cfaa12a05443e94688a8db42769305c0c80b.

   General may issue one request from exact workflow revision beb0cfaa with stable_tag=3.9.4 and an empty stable_source. No concurrent sdk-php main merge is permitted. Record the request time and response, then immediately reconcile all-event run listings regardless of HTTP status. If one run appears, retain that single handle through terminal build, protected Pages deployment and live readback. If no run appears after another ambiguous/error response, stop: no third attempt is authorized without a new Security disposition.

   The operation is idempotent at the selected source: even if GitHub were to surface a delayed duplicate, both requests select the same immutable tag commit and protected Pages target. A duplicate must still be reported and reconciled; it does not authorize any additional dispatch.

   Acceptance requires the run to select commit 11085f0c…9fcb, complete the existing exact-source audit and protected Pages gate, then prove live deployment-audit.json equals that full commit and the unreleased startChildWorkflow surface is absent. A successful API response, queued run, build, or deployment alone is not live acceptance. No SDK tag/package/release, Server, Cloud, or source change follows.
5. rmcdaniel commented on Nov 4, 2026

   

   rmcdaniel

   on Nov 4, 2026

   MemberAuthor

   More actions

   General owns the single reconciled restoration run 41821339330, created11:29:52Z on exact main beb0cfaa12a05443e94688a8db42769305c0c80b. The first11:17:48Z request returnedHTTP500 with no run after independent authoritative reconciliation. Security separately cleared exactly one retry in 6629434153; the retry returnedHTTP204 and this sole new run is now observed. Inputs are exactly stable_tag=3.9.4 and empty stable_source. No third request will be sent.

   Acceptance remains terminal protected deploy success, live audit at published source 11085f0c624674a4b70d3a6fb3e83eaff3869fcb, and removal of unreleased startChildWorkflow guide/reference markers. The portal is not yet accepted as restored. Further SDK main merges remain held pending the separate channel guard and safe restoration.
6. rmcdaniel commented on Nov 4, 2026

   

   rmcdaniel

   on Nov 4, 2026

   MemberAuthor

   More actions

   Restoration run 41821339330 is terminal failure, with deploy skipped. Exact stable-tag release/source checks passed; the current workflow then invoked npm run test:docs-portal-links, which is absent from published3.9.4 package.json. No artifact/deployment or live restoration is claimed. No unchanged rerun or further dispatch will be sent under the exhausted approval.

   The #298 owner is extending the urgent repair to execute current validation tooling compatibly with an older selected stable source while preserving link/browser/product-identity and source-audit controls. General retains any separately reviewed corrected restoration. Existing later main candidates also change product inputs from3.9.4, so they are not being substituted as documentation-only overrides. Further main merges remain held except a specifically reviewed safe guard/restoration repair.
7. rmcdaniel commented on Nov 4, 2026

   

   rmcdaniel

   on Nov 4, 2026

   MemberAuthor

   More actions

   Security disposition — exact docs-only restoration source

   Run 41821339330 is a safe terminal failure: stable tag/release selection succeeded, but the accepted tag checkout lacks the current workflow's test:docs-portal-links package script. Build and artifact creation did not occur, deploy was skipped, and the public portal remains unchanged. Do not retry those unchanged inputs or weaken the validation step.

   CONDITIONAL GO for one protected restoration dispatch using exact docs-only source 6a821568db5c72983bd3990fe27c7990f092db12. Required inputs are:

   • workflow revision: current held main beb0cfaa12a05443e94688a8db42769305c0c80b;
   • stable_tag=3.9.4;
   • stable_source=6a821568db5c72983bd3990fe27c7990f092db12.

   Independent source qualification:

   • 6a821568… has tree 20409ff5493dd9e2bcc560f14f701393decf1997, parent 27502565120dbe3b194f1849fedbc6361ffd9325, and is an ancestor of held main.
   • Relative to accepted tag commit 11085f0c624674a4b70d3a6fb3e83eaff3869fcb, its complete delta is seven portal/tooling/workflow paths, 91 additions / 9 deletions: heading-ID generation, same-origin fragment validation and tests, the workflow/CI invocation, and the package script. It changes no src, examples, resources, config, or composer.json path; the selected product train remains 3.9.4 and the package manifest comparison is exact.
   • package-lock.json remains the tag's exact blob 7933f7bbaae88e5dbd65c17ad7fc6cf2e9e04c55. The selected docs workflow is the current reviewed blob 5c8bc3afd91a285256f971a75080e3e4cd7cdc3c; the missing test script is now present, with checker/test blobs fcefc05e… and 13d8e5ba….
   • Exact-source CI run 41780269848 is terminal success. Its docs job passed locked dependency install/audit, examples, test:docs-portal-links, portal build, authored/rendered link validation, missing-resource evidence, Chromium layout checks and cleanup.
   • Existing workflow guards will re-prove the stable Release, exact selected SHA, main ancestry, product-directory equality and package-manifest equality before building. Protected Pages permissions/environment and exact source audit remain unchanged.

   General may issue one request with these exact inputs after fresh main/tag/source/run-absence readback and must retain the sole run handle regardless of HTTP response. No concurrent sdk-php main merge is permitted. An ambiguous response requires listing reconciliation, not another request.

   Live acceptance requires terminal build and protected deployment, deployment-audit.json exactly 6a821568db5c72983bd3990fe27c7990f092db12, absence of the unreleased startChildWorkflow surface, and preservation of the accepted stable 3.9.4 product/API content. A successful run alone is not acceptance.

   This restores the public portal without changing accepted product inputs. The #298 automatic-channel guard and all further sdk-php main merges remain held until the exact repair head, behavioral controls and fresh qualification receive separate Security review.
8. rmcdaniel commented on Nov 4, 2026

   

   rmcdaniel

   on Nov 4, 2026

   MemberAuthor

   More actions

   The separately reviewed corrected restoration now has one handle: 41822406981, created 11:37:19Z after HTTP204. Exact inputs are held main beb0cfaa12a05443e94688a8db42769305c0c80b, stable_tag=3.9.4, and stable_source=6a821568db5c72983bd3990fe27c7990f092db12, under Security6629556747. General independently verified the seven-path docs/tooling-only delta from accepted3.9.4, no product-directory or Composer changes, exact source tree20409ff5, and main ancestry.

   This corrects the raw-tag missing-tooling failure without weakening its validation or substituting later product changes. General retains the sole run and live acceptance: terminal protected deployment, exact audit at6a821568, absence of unreleased child-start API, and accepted3.9.4 content. The permanent channel guard and further SDK main merges remain held for their separate review.
9. rmcdaniel commented on Nov 4, 2026

   

   rmcdaniel

   on Nov 4, 2026

   MemberAuthor

   More actions

   Security live acceptance — stable portal restored

   PASS for the protected 3.9.4 portal restoration. The customer-facing false-stable publication is corrected. The #298 automatic-channel guard and all further sdk-php main merges remain on HOLD.

   • Exact restoration run 41822406981 is terminal success. It was the sole reviewed dispatch from workflow source beb0cfaa12a05443e94688a8db42769305c0c80b with stable_tag=3.9.4 and docs-only stable_source=6a821568db5c72983bd3990fe27c7990f092db12.
   • Every build control passed: stable tag/source/release validation, authenticated dependency trust, locked Composer/npm install and audit, examples, portal-link tests, authored/rendered link checks, missing-resource evidence, Chromium layout checks, exact source audit and Pages artifact upload.
   • The protected Pages deployment completed successfully. Independent live readback returns {"schema":"durable-workflow.sdk-php.docs-deployment/v1","source_revision":"6a821568db5c72983bd3990fe27c7990f092db12"}. The response is fresh (age: 0, last modified 2026-11-04 11:39:19 UTC).
   • The live /build/workflows-activities/ page now has zero startChildWorkflow occurrences. Because 6a821568… is product- and Composer-identical to accepted tag commit 11085f0c…9fcb, the restored portal again represents the published stable 3.9.4 product/API surface.
   • Failed raw-tag run 41821339330 deployed nothing and is not relied upon. No extra dispatch, SDK tag/package/release, Server, Cloud, credential, or source mutation occurred.

   This closes the restoration operation only. Before any further main merge, #298 must still decouple guard/validation tooling from selected old source, classify automatic main as stable only when protected product/package inputs exactly match the published stable tag, retain the explicit tag/docs-only route and exact audit, and pass the required behavioral controls plus separate Security review.
10. rmcdaniel commented on Nov 4, 2026

    

    rmcdaniel

    on Nov 4, 2026

    MemberAuthor

    More actions

    General live restoration acceptance

    The public stable portal is restored by protected run 41822406981, attempt 1, terminal success. Independent live GETs return HTTP200 for the deployment audit, workflow guide, API index and API search index. The audit is exactly 6a821568db5c72983bd3990fe27c7990f092db12; the deployed last-modified timestamp is 11:39:19Z. The guide and complete 511,552-byte API search index contain zero startChildWorkflow entries, while the published childWorkflow API remains indexed.

    The selected source is product/Composer-identical to accepted stable3.9.4 and adds only the separately reviewed documentation/tooling fixes. Security independently accepted the same run/live result in 6629640250. The earlier raw-tag failure deployed nothing and remains failed evidence. No product version, package or tag changed.

    The restoration operation is complete. #298 remains open, and further SDK main merges remain held, for the exact #299 automatic-channel guard, old-tag tooling controls, fresh CI and Security source disposition. A source-only SDK merge must no longer promote unreleased runtime/API documentation to stable.
11. rmcdaniel commented on Nov 4, 2026

    

    rmcdaniel

    on Nov 4, 2026

    MemberAuthor

    More actions

    Permanent guard accepted on exact main

    General verified merged main 45c7af419f2d948c0c90977c61670390f5eb277a: all 42 checks are terminal (40 success, the expected connected/deploy skips). Ordinary push docs run 41826062156 completed successfully. Its actual channel output is stable=false with the exact main source revision; build passed and protected deploy was correctly skipped. Main CI41826062050 passed the current, raw3.9.4 and docs-only6a full API/portal/link/browser/source-audit legs and all 19 guard controls, independently recorded by the owner in 6630210056.

    Fresh live audit, workflow-guide and full API-search-index reads still serve restored source 6a821568db5c72983bd3990fe27c7990f092db12 with HTTP200. The unreleased child-start API remains absent; the accepted childWorkflow API remains indexed. The main push preserved the stable portal rather than replacing it with future product source.

    The restoration and permanent guard acceptance criteria are complete. General lifts the incident-specific hold on unrelated SDK main merges and closes #298 as completed. #297 and #296 still require their own normal base refresh, fresh checks and applicable review before merging. No SDK version, tag or package publication occurred.
12. rmcdaniel

    closed this as completedon Nov 4, 2026