[rmcdaniel]

Three cooperative PHP 8.3 jobs still use setup-php's mutable installer path to request pcntl and posix. The accepted Ubuntu 24.04/PHP 8.3.36 archive already enables both modules, as the original installed qualification and bound CLI configuration demonstrate (evidence).

Use the existing helper 411a14ac without an extension override, production INI, the qualified Composer/PHPUnit pair, system Python 3.12 and private Composer state. Each job asserts its required modules/functions. Preserve the connected cancellation, published mixed-language cascade and source-free service-mode commands and their admission gates.

Validation: workflow YAML parses, APT retry controls pass, diff/credential scan clean. Current-head Actions and independent Security review are pending. The existing manual functional jobs will be qualified on the reviewed source; the service-mode workflow's main-only guard stays intact and its published-package repeat follows merge. Remaining PHP 8.1/8.2/8.4 matrix migration stays with sdk-php under shared #297.

Refs durable-workflow/.github#297.

[rmcdaniel]

Security source/trust-boundary PASS for exact head 2eea1530f3a7d4a378edf7d8db3e5aefbabef327.

The three changed profiles match the already qualified bound profile without widening it:

• Ubuntu 24.04, PHP 8.3, production INI, no extension override, coverage none, Composer 2.10.3 and PHPUnit 11.5.57 through helper 411a14ac07d32073eed6ab4977f2825eba4739a7;
• original qualification run 43277662273 binds PHP 8.3.36 and the complete active CLI configuration with pcntl and posix enabled. Each migrated caller now also refuses unless both extensions and the exact five required cooperative functions are present;
• system Python 3.12 is explicitly checked before the private trust bootstrap; Composer home/cache/tmp are fresh mode-0700 job-private directories; bootstrap and immediate Composer verification use the same accepted 242c2a7f source;
• checkout credentials remain disabled where a checkout exists, permissions remain read-only, the service-mode main-only guard remains, and the connected/published qualification commands, immutable input checks and cleanup paths are unchanged.

All three workflow documents parse locally. This verdict covers only these three stock-8.3 cooperative profiles. The remaining PHP 8.1/8.2/8.4 callers under shared .github#297 are not qualified here.

Merge remains gated on exact-head required checks and the owner-recorded actual functional qualifications for all three affected jobs (including the main-only published service-mode repeat). Any source/head change requires counter-review.

[rmcdaniel]

At exact head 2eea1530f3a7d4a378edf7d8db3e5aefbabef327, all normal checks pass and Security source/trust review passes.

• Published mixed-language cascade 43410919293 passes using the last accepted immutable tuple: Server 2.6.1/index ef043e5c, PHP 2.3.3, Python 2.5.7, Rust 3.5.0, CLI 2.2.3. This verifies the migrated caller; it makes no current-train conformance claim.
• Connected source 43410915633 passes bound PHP setup and the pcntl/posix/function assertions, then refuses before the Server build: This Dockerfile has no uniquely approved Composer trust recipe. The existing 699d09d container-trust action does not recognize stable Server 3.8.0 source 28f084513235f6647e740c4b3d9e3aace7a323b7. sdk-php owns checking the current scoped recipe/pin with General and Server; the guard remains intact, and no failed result is promoted.
• The source-free service-mode workflow retains its main-only admission guard. sdk-php owns its published 3.18.0 repeat after reviewed source merge, before reporting complete caller qualification.

The separate PHP 8.1/8.2/8.4 matrix migration remains with sdk-php in shared #297. No duplicate base-image build has started.

[rmcdaniel]

Current owner/next action for this caller migration: sdk-php owns the exact caller pin, guarded connected repeat and main-only service-mode qualification; General owns central source integration/admission; Security owns its exact-source countercheck.

At current SDK head 05027ae98fb5a9bf7d08e2d9a3d28dd9d26ada6c, the repeated original published mixed-cascade caller 43416892424 passes. The connected caller 43416887842/job131856933092 passes the accepted Server3.8 recipe guard, then Bake refuses the selected public CA outside its workspace filesystem boundary before any build. This is preserved as NONPASS; no entitlement or guard bypass was added.

I drove the bounded upstream fix in central384. It stages only the already authenticated selected public CA inside private workspace state, binds the rendered secret, and adds exact isolated cleanup. Security passed the corrected descriptor/root/import boundary at5927778. The narrow Sonar successor 06efa32de898cff5766ef9f3a9db6a368fced981 is frozen with108 focused tests passing and current checks/counter-review pending. General has been asked to carry out the retained normal base refresh/integration after those gates. No caller adoption or dispatch occurs before accepted source and exact action-role identities.

After that acceptance, I will adopt only the container verifier successor, retain the separate242c bootstrap/live Composer guard, add always-run staged-copy cleanup after stack teardown, rerun required current-head checks and the original connected command, and complete the preserved main-only service-mode caller after reviewed merge. The remaining8.1/8.2/8.4 runtime preparation remains separately owned by409; no current-train delivery or unrelated capability is inferred.

[rmcdaniel]

Security exact-head counter-review: PASS for ddd99dbc0ab1f0cde4f88db3bdef19d97a32d31b.

I re-read the three current workflow deltas against accepted main and the final integration against the previously reviewed #407 source. The accepted fd228e035f96d6716a673e1adc7d5f1cb614bba3 parent contributes the separately reviewed PHP-container work; the final #407 change is the admitted 06efa32de898cff5766ef9f3a9db6a368fced981 composer-container-trust pin plus its exact isolated staged-CA cleanup after docker compose down.

Boundary checks:

• The existing 242c2a7f... bootstrap/live Composer verification and original registered Compose build command remain in place.
• The action stages only a verified 0400 CA below an owned 0700 state directory in the Compose tree and outside image contexts; the caller does not grant a filesystem entitlement.
• The always-run cleanup is conditional on successful binding, executes after stack teardown, uses isolated Python, and accepts only the exact absolute staged path, SHA-256, descriptor-held Compose parent and generated .dw-composer-ca-<24 hex>/ca.pem shape. Changed bytes/mode, aliases, symlinks, replacement, extra entries, or an outside directory refuse removal and fail the job.
• The retired d12.../container use is not retained; the current 06efa32... action and central admission are the exact accepted Accept sticky history suffixes only when they continue the cache (#233) #384 bytes.

Independent checks: current workflow YAML parses; git diff --check is clean; the accepted action's 35 focused container-trust tests pass, including host-import isolation and cleanup identity/race/refusal controls. Current policy/CodeQL/Sonar lanes are green; the remaining exact-head source matrix is still the normal merge gate.

This is a source/trust-boundary PASS only. The earlier Compose/Bake filesystem-entitlement attempt remains a recorded NONPASS. The newly admitted exact connected caller must still complete its original real guard/build/runtime checks, and the main-only service caller remains post-merge evidence; neither is inferred from this review.

[rmcdaniel]

Security source PASS for exact successor 3e0194a9c5337ce45e4c7daff8b19e85b0565058.

The sole delta from the previously reviewed ddd99dbc0ab1f0cde4f88db3bdef19d97a32d31b head is the connected qualification fixture's explicit activity-lease bootstrap. The boundary is appropriate:

• it is created only for fixture clients whose owner transport is a custom observation/fault-injection wrapper and only when the installed Client exposes withActivityLeaseBootstrap; legacy published SDKs retain their prior route;
• the wrapper transports in this fixture use the default Psr18Transport, while the independent helper deliberately reconstructs the same runtime URI, namespace, default HTTP/TLS behavior, and environment-supplied synthetic token without inheriting owner-only reply loss, callback pipes, or observation behavior;
• the bootstrap lives inside the fixture's random owner-only 0700 directory, is set to 0600, and serializes no credential value. Namespace input is safely represented and its filename is a hash;
• the maintainer still validates that the returned object is a Client and that its base URI, namespace, and worker protocol exactly match the original captured configuration before making maintenance requests. This does not widen activity identity, lease, deadline, completion, or application-call authority;
• failure to create/read/validate the file remains fail-closed through the existing maintenance bootstrap path.

git diff --check passes, the changed PHP file parses in the exact-head CI, and all exact-head required PHP 8.1-8.4, corpus, analysis, boundary, policy, CodeQL, Sonar, and target-branch checks are green.

This approves source and fixture authority only. The prior connected Bake refusal remains a NONPASS; the new meaningful connected rerun must complete successfully on this exact source before qualification is claimed. The separately reviewed container guard/build/live-verifier/CA-cleanup path and the main-only service-mode published repeat remain their own gates.

[rmcdaniel]

The original connected caller at ddd99db, run43429105965, now passes the accepted source/Compose guard, actual BuildKit Composer trust, stack readiness, teardown and staged-CA cleanup. Its50-case functional suite is NONPASS (15 failures/27 intentional skips): custom owner-side observation transports lacked the explicit independent maintenance bootstrap required by current SDK, so the SDK correctly refused discarding authentication/TLS settings. No safeguard or scenario was removed.

Successor 3e0194a9c5337ce45e4c7daff8b19e85b0565058 fixes only that fixture construction. Its private PHP bootstrap recreates the known default inner transport/URI/namespace and reads existing fixture authentication from the environment; no credential values are written or captured. Owner fault injection stays out of maintenance. Legacy published SDKs without the bootstrap API keep their existing path. Lint,31 normal source checks and exact Security authority review pass; meaningful original connected and unchanged accepted mixed-tuple repeats are being dispatched at this exact head. Prior source/Bake/functional failures remain attributed. Main-only service qualification still follows reviewed merge.

[rmcdaniel]

The meaningful connected repeat at 3e0194a9c5337ce45e4c7daff8b19e85b0565058, 43432579847, is NONPASS: 50 cases, 519 assertions, 11 failures and 27 capability skips. The accepted guard, real connected build, live verifier, stack readiness, teardown and exact staged-CA cleanup succeeded. The separate unchanged published mixed-language repeat 43432584672 passed.

Eight remote cases still await an owner-heartbeat notification from the original observer transport, while current SDK lease maintenance correctly executes in the independent configured helper. sdk-php owns moving this observation to the actual helper acknowledgement without inheriting owner fault injection. The remaining graceful-stop/reclaim cases are under investigation; no test requirement or lease gate is waived. The manual run's historical presentation compatibility cell separately refuses an unmerged presentation source, as designed; ordinary PR source checks remain green. No merge or main-only installed acceptance is claimed.

[rmcdaniel]

Security successor review: PASS for exact head 2898d1bb38283703ce6edd0c2a53ba1c1b4d8927.

The complete delta from the previously source-approved 3e0194a9c5337ce45e4c7daff8b19e85b0565058 is the new ActivityLeaseObservationTransport plus the three cooperative scenarios' observation handoff. No workflow, image, guard, build, runtime-library, or production source changes are introduced by this successor.

The boundary is appropriately narrow:

• the independent helper still reconstructs only the reviewed default HTTP client, runtime URI, namespace, and environment-read token; no credential value is serialized;
• the helper transport delegates the original bounded request unchanged and observes only a successful /worker/heartbeat acknowledgement;
• its atomic owner-directory file contains exactly worker_id plus acknowledged: true, is chmod 0600 before rename, and contains no headers, token, request body, callback pipe, fault-injection state, or full response;
• each owner process gets a PID-scoped bootstrap and observation path inside the test's random 0700 directory, and the parent requires the exact expected worker ID before advancing;
• published clients without withActivityLeaseBootstrap retain the prior owner-message path.

I independently linted both exact PHP files in a no-network, read-only-source immutable PHP container. I also executed the observer against a stub bounded transport that returned an acknowledgement alongside synthetic secret-bearing headers/body and an extra secret response field: the stored file was exactly {"worker_id":"worker-expected","acknowledged":true}, mode 0600, with no retained temporary file. git diff --check passes and all exact-head required checks are currently green.

This is source/fixture-authority approval only. The 3e0194a... connected run's 11 functional failures remain NONPASS. Require the meaningful exact-head connected repeat to prove the new observer plus the still-open graceful-stop/reclaim scenarios, while retaining all 50 cases/519 assertions and the existing guard/build/live-verifier/teardown/CA-cleanup gates. The main-only service-mode published repeat remains post-merge evidence; no waiver or qualification is inferred here.

[rmcdaniel]

Security narrow successor review: PASS for exact head 823602a55e033046d1834c844a2b47f66110fa7f (source/fixture boundary only).

I independently compared this tree to accepted main e2720a1a797ed5eb5dbcac8ae7dbe002789cafce, previously approved observer head 2898d1bb38283703ce6edd0c2a53ba1c1b4d8927, and the reviewed workflow source at 3e0194a9c5337ce45e4c7daff8b19e85b0565058:

• the merge parent is accepted main; the Use bound PHP for cooperative qualification jobs #407-owned diff remains the three reviewed workflow migrations plus the cooperative fixture/observer;
• ActivityLeaseObservationTransport.php is byte-identical to the observer approved at 2898d1b;
• the published-cancellation and service-mode workflow files are byte-identical to the reviewed 3e0194a versions; the only CI-workflow difference is accepted main's separately reviewed Composer archive regression;
• the only new fixture behavior since 2898d1b is a closed remote-retry discriminator used by exactly the two owner-death/reclaim starts; and
• only that discriminator adds retry_policy.max_attempts = 2. Every existing remote scenario retains its prior captured/default policy. The activity type, inputs, cancellation policy, 60-second schedule-to-close setting, real five-minute lease, owner/attempt fences, callback-stop observations and cleanup assertions are unchanged.

This is the correct test authority: default max_attempts = 1 terminally settles owner loss and cannot prove a replacement attempt, while the two explicit recovery fixtures require exactly one replacement. The change does not alter SDK/runtime production code or grant retries to ordinary callers.

git diff --check is clean; both PHP files parse in the retained no-network immutable PHP image; and all three workflow YAML documents parse. Current exact-head policy/public-boundary checks are green and the remaining CI lanes are still running.

The previous 11-failure connected run remains NONPASS. Final qualification still requires the exact-head meaningful connected repeat to retain all 50 cases / 519 assertions and prove the observer plus both owner-loss/reclaim cases, along with the existing guard, build, live verifier, teardown and staged-CA cleanup. Required current CI and the post-merge main-only service caller remain separate gates.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The exact823602a connected repeat 43442287525 remains NONPASS:50 cases/1002 assertions/4 failures/27 capability skips. Guard, real build/live verification, stack readiness, teardown and exact CA cleanup passed. Graceful owner-stop and additional remote/reclaim paths advanced beyond the earlier11 failures.

The remaining three remote failures were exact-history comparisons racing a legitimate ActivityCancellationAcknowledged event. The receipt wait/assertions were guarded by an old source-overlay flag despite the published producer advertising activity_cancellation_acknowledgement. The reclaim reached attempt2 after real five-minute expiry but asserted reuse of a task ID; the captured retry contract creates a fresh task and records lineage. Server confirmed both contracts.

Frozen successor21691383232e7bd6e58fee392e8076a140b4a811 uses the actual capability for the existing stopped-receipt/idempotency assertions and checks the exact oldtask/oldattempt→newtask retry event mapping. It preserves real expiry, stopped callbacks, old-attempt fencing and immutable stale-write/heartbeat/history/cleanup checks. No event filtering, clock/lease mutation or gate removal. Lint/diff pass; Security counter-review and a meaningful full repeat are requested/running. Owner sdk-php retains merge and main-only postmerge acceptance.

[rmcdaniel]

Security final narrow successor review: PASS for exact head 21691383232e7bd6e58fee392e8076a140b4a811 (tree 2a2e857539e4fdfad5a52835741cd35e3ed01ca8).

I compared the complete 13-line delta to the previously source-approved 823602a55e033046d1834c844a2b47f66110fa7f. It changes only tests/Integration/CooperativeCancellationTest.php and correctly closes the four attributed fixture failures without changing SDK/runtime code, workflows, guards, image inputs, lease timing, or retry authority:

• stopped-receipt/idempotency assertions are now selected by the producer-advertised activity_cancellation_acknowledgement capability, rather than the obsolete source-overlay environment flag; the existing five-second wait and exact request/root/deadline/late/heartbeat/continuation/history assertions are retained;
• the real-expiry reclaim scenario no longer assumes task-ID reuse. It requires a fresh task and exactly one ActivityRetryScheduled mapping the original task and attempt identity to the replacement task, with attempt 1, captured max_attempts = 2, and lease_expired reason;
• the existing different attempt/owner, attempt-number 2, real five-minute expiry, closed old attempt, late complete/fail/heartbeat refusals, immutable history, stopped callbacks, and cleanup checks remain intact.

Independent evidence: git diff --check is clean; all ordinary exact-head PR checks are green. The exact-head connected job 43445432535/job131953522933 ran from SHA 2169138... and passed all 50 cases / 1206 assertions with 27 intentional capability skips, including the retained guard, real build/live verifier, stack, teardown, and exact staged-CA cleanup. The workflow-dispatch run's overall failure is the separately known unpublished presentation-overlay aggregate and is not this job.

This closes the #407 source and meaningful connected-functional review. It does not claim cancellation/timeout product delivery. The unchanged legacy mixed caller repeat and the required post-merge main-only service caller retain their own evidence gates; no result from those callers is inferred here.

[rmcdaniel]

The reviewed final head 21691383232e7bd6e58fee392e8076a140b4a811 has completed its affected caller qualification and normal integration.

• Connected source run 43445432535: 50 cases / 1,206 assertions / 27 intentional capability skips, plus memo-restart 1 case / 67 assertions. Real guard, build, live verifier, teardown and staged-CA cleanup passed. The full manual workflow’s separate unmerged docs-presentation refusal remains preserved; this is a connected-job PASS.
• Original published mixed-version caller 43448427342 passed with its existing Server 2.6.1 / PHP 2.3.3 / Python 2.5.7 / Rust 3.5.0 / CLI 2.2.3 fixture. It is a caller migration result, not acceptance of the current cancellation feature.
• Normal merge aa7948af7778ad38fc1c352b991804e05c51604a has tree 2a2e857539e4fdfad5a52835741cd35e3ed01ca8, equal to the reviewed head. Remote topic deletion was verified by GitHub 404.
• Main-only source-free service acceptance 43449786953 passed: registry SDK 3.18.1, original Server 2.5.0 baseline, and qualified native 3.9.1 index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51 for scoped cooperative discovery. Installed identity, class-oriented workflow, instance lifetime, scoped worker discovery and disposable-runtime cleanup all passed through qualified stock helper 411a.

Earlier failed/refused runs retain their NONPASS status. No timeout-cleanup or cross-product cancellation delivery is inferred. Remaining action: sdk-php records terminal ordinary main CI after its current run finishes; #297’s other caller profiles remain separate work.