[rmcdaniel]

Prepare SDK 3.18.3 with corrected Laravel security floors. The optional bridge admits releases affected by three November Laravel advisories. Require Laravel 12.72.0 or 13.41.0 and refuse affected versions before provider bindings. Keep the bare SDK PHP floor and optional-framework dependency model unchanged.

Update the machine-owned adoption contract, Composer metadata, five current Laravel qualification cells, guides and unqualified static-consumer intent. The HTTP example lock changes only Laravel from 12.69.3 to official 12.72.0/source b089d302, plus its content hash. Product and quickstart identities select planned SDK 3.18.3; onboarding retains ^3.18.

Workflow 2.28.1 is now published at c090506cafa011335fcd5db07b7da79945fe83db. Its normal Packagist source/dist and immutable annotated tag agree. The public archive hashes to 11f4a4b41995a2d94d886c5191885c7a779d95d5169bb48a1d63259a00cb7f2f; the exported transition contract is byte-identical to its Git blob, SHA-256 153a261371272e0fa8e0a6e79dbe425b9adc311cbe596ce0237575a78b0828a7. A new versioned fixture supplies the matching patched authority. Historical Workflow 2.17.1/2.21.0 fixtures and the strict equality checker remain byte-identical. Historical matching/refusal controls retain their original authority, while the new positive and drift controls use 2.28.1.

Exact reviewed head f3364f5eaddd46d6ea48c92d6e49125597fccd0d adds only that published fixture and its test adaptation to reviewed parent a2444161. Runtime, caller/workflow, Composer and tool/profile bytes do not change in this successor. Historical fixture bytes and the strict checker remain unchanged.

Validation:

• Current checks are terminal: 35 success, one declared connected-cooperative skip. The first analysis setup HTTP403 remains runner-blocked / NONPASS; the one targeted retry and dependent qualification passed without source, profile, trust or credential changes.
• The actual embedded-v2 transition passed on PHP8.3.36 with published Workflow2.28.1 and the exact SDK checkout, using the unchanged strict installed-authority checker.
• Fresh packaged-candidate run43555406729 passed on accepted workflow main c3387fe, candidate f3364f5. Archive SHA256 a7605df72b88d5f79d459bbe3f2c4fa51923baef8cc1727e6a964aa5cd1f0d08 is byte-equal exact Git archive; all467 public-normalized file bodies/modes and300 required runtime inputs match, internal CI/Git/container tooling excluded. Actual native3.8 baseline Worker/metrics and retained pending-to-completed-null reads passed.
• Independent exact fixture/source PASS and package/member/hash PASS are recorded. Earlier floor/lock and Docs reviews remain applicable. All84 source hash/mode bindings across six SDK runtime records remain unchanged.

The matching Workflow publication prerequisite is cleared. Normal integration/main readback, immutable3.18.3 publication, registry archive/lock verification and named registry-installed Laravel follow-through remain before closing #421. Earlier candidate and authority-refusal attempts remain scoped historical evidence. No parser/range waiver, historical fixture rewrite, #419/#420 retry or broader native acceptance is selected.

Refs #421. Primary advisory links and the scoped reachability matrix are on that issue. Owner: sdk-php.

[rmcdaniel]

Prepared SDK422 at exactf8d9f013242604b6a9b415efa1fe3caa979cef6a for the highest12.72.0/13.41.0 floors across all three advisories. Final metadata-only example lock changes only laravel/framework to12.72.0/sourceb089d302; selected-cleanCA+real242c guard, normal project validation and locked audit pass. No dependency install, scripts/plugins, SDK autoload or app execution occurred in that metadata cell. All captured container IDs are absent. Initial strict validation warnings on existing exact pins and initial source-QA OCI mountpoint refusal remain NONPASS.

Focused current-source reflection/syntax +72tests/216assertions pass, no OOM. Hosted CI43494507709 at precedingd240615 passed all five exact floor cells, example audit, embedded-v1 transition and central policy. The docs browser found a real inline-link overlap, corrected by placing each advisory on its own row inf8d9f01 without relaxing hit testing; current-head CI is running.

No central profile change is needed: all84 source hash/mode pairs across all six SDK records and absent-file controls match accepted54c6a2b; the complete actual candidate workflow passes that policy. The remaining current external dependency is observed at actual job132124068870: the unchanged strict embedded-v2 transition authority check rejects the current ^2.21-selected Workflow package's older Laravel constraints. Workflow1133 owns a corrected published authority. No checker/parser waiver, modified historical package fixture, rerun of the disabled419 step, SDK publication or shared216 acceptance is claimed. Source/release review and final installed/package follow-through remain open.

[rmcdaniel]

Bounded current-source docs review: one historical-attribution finding below before semantic PASS. The combined 12.72.0/13.41.0 floors match the three linked advisories; PHP and optional-bridge scope remain distinct. Historical 2.17.1/2.21.0 authority fixtures and the strict checker are byte-identical to base. This review runs no SDK/package/browser experiment and does not waive Security, current CI, corrected installed producer authority or publication/live gates.

[rmcdaniel]

Bounded current-source docs semantic PASS at exact 6d33d1acbfd00cdd98c1b742d307037da1e5092b. The full successor delta from reviewed f8d9f013 is the two-line upgrading-guide correction: SDK 3.11 now names only its occurrence-deadline introduction. It no longer attributes the current framework floors to that historical release, resolving my P2.

The combined current floors 12.72.0/13.41.0 cover the linked concurrency, signed-URL query-limit and signed-URL parameter fixes. No route reachability or exploitation is claimed. Bare PHP/optional bridge requirements remain separate. Current docs require matching installed embedded authority instead of attributing these new floors to Workflow 2.21.

Both historical Workflow 2.17.1/2.21.0 fixture bytes, reports and the strict transition checker remain untouched; the original equality gate is preserved. The changelog remains Unreleased. This passes only the requested prose/contract-identity slice: no build/runtime experiment was run or Security, current browser/CI, corrected installed producer, package publication or live portal gate waived.

[rmcdaniel]

Security source/floor/lock review: PASS, scoped to current exact head 6d33d1acbfd00cdd98c1b742d307037da1e5092b (requested f8d9f013242604b6a9b415efa1fe3caa979cef6a plus its one docs-only successor).

I independently checked the complete 16-file delta from c3387fe670049a0bc30490e65af893827c13c5dd:

• ^12.72.0|^13.41.0 is identical across bridge admission, Composer metadata, the adoption contract, all five exact-minimum CI cells, tests and documentation. The negative controls reject the former 12.69/13.30 floors and the incomplete concurrency-only 12.71/13.40 fixes.
• The official v12.72.0 tag resolves to b089d3020e508f49b3625726ab4a2c897f1b78d5, exactly matching the example lock and static-consumer intent. The official v13.41.0 tag resolves to 95934d2868c90c1aa8e711791ea33d1e990e1719.
• Normalized full package comparison of examples/laravel-http/composer.lock shows only the content hash and laravel/framework changing: v12.69.3/58ea544a... to v12.72.0/b089d302.... No other package metadata changes.
• JSON inputs parse, the diff is clean, and I found no advisory ignore, audit bypass, scan suppression, action-policy relaxation, runtime-record edit or central catalog mutation. The three primary advisory links remain explicit in the Laravel guide.
• The successor only separates the historical occurrence-deadline release wording from the current Laravel floor; it does not change code, dependency or authority bytes.

This is deliberately source-only. The current embedded-v2 job correctly remains NONPASS against the old installed Workflow authority: its setup/trust steps pass and the established-transition step refuses. It does not authorize a parser/equality waiver. Merge/activation still requires the corrected Workflow #1133 publication/authority, a fresh exact installed embedded-v2 transition pass, and terminal required CI. SDK #420 remains execution-HOLD and #419's disabled step is unchanged.

[rmcdaniel]

Prepared the remaining patch identities at exacta2444161981b1c3d028aed8b082c3b8f8ec1f391: Composer product-train and quickstart package requirement/published-version are3.18.3; onboarding stays^3.18. This successor changes only those two JSON files from the source/floor/lock and Docs-reviewed6d33d1a. No runtime, contract-checker, installer, image or catalog input changes.

Source-dist data inspection: exact git archive SHA256a4066d1cd85455da2a9487edff06c8c152358149f9059b7c108eb1df9421c523, all300 required runtime inputs retained, no internal CI/Git/container tooling, and package/quickstart/floor metadata agree. This is source-dist inspection only: no PHP/package execution, installed-candidate verdict, independent package approval or publication. No tag exists/was created for this work.

Parent6d33d1a CI finished33success/1 intendedskip with only the expected embedded-v2 authority failure and its aggregate failing. That failure remains attributed to the old installed Workflow support contract. Current-head normal checks are running; no failed-only retry occurs before the corrected Workflow1133 authority is published. Existing421 release/installed gates and420 execution HOLD remain unchanged.

[rmcdaniel]

Bounded planned-version metadata countercheck PASS at exact a2444161981b1c3d028aed8b082c3b8f8ec1f391. The full delta from docs-reviewed 6d33d1ac changes only Composer product-train and quickstart published_version/composer_requirement from 3.18.2 to planned 3.18.3. The onboarding requirement remains ^3.18; reviewed prose, strict authority checker, runtime and historical fixtures are unchanged. These source identities agree with one another. This is candidate metadata consistency only: no tag, registry package, installed tuple, portal publication or root stable-selection acceptance is inferred; the stated CI/Security/corrected-producer/package gates remain.

[rmcdaniel]

Security bounded successor review of exact a2444161981b1c3d028aed8b082c3b8f8ec1f391 / tree 62e53450: PASS for the two-file package-identity delta.

• The commit has exact parent 6d33d1acbfd00cdd98c1b742d307037da1e5092b, whose Laravel floor/lock/source disposition remains unchanged.
• The complete successor diff changes only composer.json product train 3.18.2 → 3.18.3 and the quickstart contract's exact published/Composer identity 3.18.2 → 3.18.3.
• The quickstart onboarding range remains ^3.18; runtime targets, inputs, registration, examples, qualification authority and source mappings are byte-identical. The changelog correctly keeps the security correction under Unreleased and preserves the historical 3.18.2 query fix.
• git diff --check and exact JSON identity assertions pass. No catalog, dependency, workflow, runtime, source-dist member or permission change enters through this successor.

This is source metadata approval for the planned identity only. It is not a package/archive/tag/publication or installed-runtime approval. Workflow #1133 corrected authority, the exact protected package build/member/hash inspection, fresh installed qualification, terminal current CI, and the existing #420 execution HOLD remain separate gates. The expected embedded-v2 refusal is not waived.

[rmcdaniel]

Protected prepublication package smoke passed: https://github.com/durable-workflow/sdk-php/actions/runs/43499084194 (job132139821029, artifact14073491506). Executed workflow/main sourcec3387fe670049a0bc30490e65af893827c13c5dd is separate from installed candidate sourcea2444161981b1c3d028aed8b082c3b8f8ec1f391. It used the existing qualified stock411a PHP8.3.36 path and real242c guards, not the held420 controller/profile.

Exact candidate Git archive and downloaded protected candidate.zip both have SHA256a4066d1cd85455da2a9487edff06c8c152358149f9059b7c108eb1df9421c523. Package evidence retains all300 required runtime inputs and excludes internal CI/Git/container tooling. Independently downloaded public source ZIP for the same commit has SHA256bb1481e321403f977f1b9fe883965bc3e27555d49e919fbdb31e026408cf254e; all467 regular file bodies and normalized modes equal the candidate.

Actual installed-candidate observations bind SDK3.18.3/referencea244 to the existing qualified native3.8.0 baseline index7988a23525d9e50e997a9f6f02e801300ed4f626de3cf6977033657ae7e9f58e. Worker metrics/workflow completion/deregistration pass. Retained-update evidence reports typed initial/read pending→completed PHPnull, one accepted/one completed event, one POST/four GETs, preserved default waits and no source fallback. The job's runtime teardown passes. This is prepublication baseline/package evidence; no Laravel transition, corrected3.9.2 command-key cohort, registry-only repeat or broader feature acceptance is inferred.

Current candidate source CI is terminal33SUCCESS/1 intendedSKIP with only the unchanged embedded-v2 Workflow authority refusal and aggregate failing. Independent final package/member/hash review is requested; merge/tag/publication remains held for Workflow1133's matching published contract, fresh exact installed transition, current required gates and normal integration. No tag or release was created, and the disabled419 step/420 execution HOLD remain intact.

[rmcdaniel]

Security package/artifact review for exact draft head a2444161981b1c3d028aed8b082c3b8f8ec1f391: PASS, narrowly for the prepublication package and the published Server 3.8 baseline observations. This is not a publication or transition approval.

Independent checks:

• Artifact 14073491506 belongs to successful protected run 43499084194 / job 132139821029. The workflow source is the distinct accepted-main commit c3387fe670049a0bc30490e65af893827c13c5dd; the installed candidate identity is a2444161981b1c3d028aed8b082c3b8f8ec1f391.
• Downloaded candidate.zip SHA-256 is a4066d1cd85455da2a9487edff06c8c152358149f9059b7c108eb1df9421c523, byte-for-byte equal to a fresh local git archive of that exact candidate commit. It contains 467 files. All 300 source-selected runtime inputs are present, and the prohibited .github/, docker/, scripts/ci/, tests/, and .dockerignore members are absent.
• A fresh anonymous GitHub source archive currently has a different raw container SHA from the earlier recorded download, but after stripping the generated root directory its 467 file bodies and normalized executable modes exactly equal the candidate. Raw GitHub-generated ZIP bytes therefore should not be treated as the durable binding; the exact candidate Git commit plus the deterministic candidate archive hash above are the binding.
• The retained Composer lock selects durable-workflow/sdk version 3.18.3, dist type zip, reference a2444161981b1c3d028aed8b082c3b8f8ec1f391, and no source entry. The runtime receipt independently reports source_fallback: false.
• Retained installed evidence coherently binds PHP 8.3.36, Server 3.8.0, and immutable Server index 7988a23525d9e50e997a9f6f02e801300ed4f626de3cf6977033657ae7e9f58e. Worker completion, metrics, deregistration, typed pending-to-completed-null behavior, one submission/four outcome reads, and the teardown step all passed.

Scope retained: this does not qualify Laravel transitions, corrected Server 3.9.2 command-key behavior, a registry-only installation, SDK #420, or broader product features. Merge/tag/publication remains held for the matching Workflow publication/authority, a fresh exact installed transition, and the normal remaining gates. In particular, Workflow issue #1133's current PR #1136 has a separate Security HOLD on its PHP 8.3 example-lock mismatch; this package PASS does not clear that dependency.

[rmcdaniel]

The corrected upstream publication is now tracked in Workflow #1141, draft head 8b6942f21f97b0fc5ae725ddd7051cf6a48a22d9, proposed 2.28.1. The main-line correction remains #1136. I independently rechecked that the latest public release is still 2.28.0; neither proposed source establishes an installed corrected contract yet.

SDK head a2444161 still has exactly the embedded-v2 authority refusal and its aggregate failure. That refusal is retained. After the reviewed upstream package is actually published, the next action is a fresh strict installed embedded-v2 qualification and current-head aggregate, followed by the remaining 3.18.3 integration/package/publication and registry acceptance gates. The earlier minimum-PHP source warning is not the current blocker, and no checker widening or #1130/#419 retry is selected.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The upstream publication dependency is cleared. I independently read the normal Packagist P2 row, public archive and immutable tag for Workflow 2.28.1: source and dist both resolve c090506cafa011335fcd5db07b7da79945fe83db; tag object 98021fdb3c277e41413b3ec87da578b90fac8325 points there. The downloaded archive is 2,931,709 bytes / SHA-256 11f4a4b41995a2d94d886c5191885c7a779d95d5169bb48a1d63259a00cb7f2f. Its exported Laravel contract equals the same Git blob b999b33073d6c758740256427ac1888e31a5103a byte for byte, SHA-256 153a261371272e0fa8e0a6e79dbe425b9adc311cbe596ce0237575a78b0828a7. Producer's final package/installed receipt.

Successor SDK head f3364f5eaddd46d6ea48c92d6e49125597fccd0d / tree ca3cf5385b89826fa02c2fd5268807fd1c1abcab, direct parent reviewed a2444161, adds only:

• the exact published contract as a new versioned workflow-2.28.1 fixture;
• its positive transition-authority control, with counterfactuals now evaluated against that matching current authority. Historical matching/refusal cases explicitly keep their original 2.21.0 fixture.

The checker and both historical 2.17.1/2.21.0 fixture files are byte-identical to the reviewed parent. No SDK runtime, workflow/caller, tool/profile, Composer or central catalog input changed. The new published schema/version, PHP/Laravel constraints, ordered five cells and stable-v1 authority match the SDK's corrected boundary. Metadata/hash/matrix and diff inspections pass. The prior embedded-v2 refusal remains historical NONPASS; it is not waived or relabeled.

Normal current-head source/installed transition checks are running. Fresh exact-head packaged-candidate qualification will use the unchanged maintained published-worker workflow before integration/publication. The prior a244 native-3.8 package receipt remains separately scoped and is not treated as the new commit's final archive binding. Independent exact fixture/source review, actual current transition and aggregate, new package/member/hash proof, normal merge/main, protected publication and registry-installed Laravel follow-through remain required. No #419/#420 step is retried and no wider command-key or runtime acceptance is implied.

[rmcdaniel]

Security bounded fixture/source PASS at exact f3364f5 / tree ca3cf5385b89826fa02c2fd5268807fd1c1abcab.

I reviewed the complete two-file delta from a244416. The added workflow-2.28.1 fixture is byte-for-byte the immutable published tag resource: SHA-256 153a261371272e0fa8e0a6e79dbe425b9adc311cbe596ce0237575a78b0828a7, matching local tag 2.28.1 at accepted c090506c. Its schema/version, PHP ^8.2, Laravel ^12.72.0|^13.41.0, ordered five-cell matrix and stable-v1 authority match the already-qualified producer contract.

The test adaptation is correctly scoped. Historical matching/refusal cases explicitly continue to use their 2.17.1 and 2.21.0 fixtures. Current positive and drift counterfactuals use the new 2.28.1 authority. The strict transition checker, both historical fixtures, SDK adoption contract, Composer files, runtime/caller/tool/profile and central catalog are unchanged.

This clears the exact fixture/source successor only. Current CI still contains the retained analyse setup HTTP 403 NONPASS and active lanes; that failure occurred before dependency or code execution and is not relabeled here. Fresh exact-head package/member/hash proof, normal merge/main, protected publication and registry-installed Laravel follow-through remain required. No #419/#420 retry or policy-hold waiver is inferred.

[rmcdaniel]

Fresh exact-head qualification for f3364f5eaddd46d6ea48c92d6e49125597fccd0d:

• The ordinary embedded-v2 transition job passed on PHP 8.3.36, installing published Workflow 2.28.1 and this exact SDK checkout. Its retained final line is source_mode=embedded_v2 ... workflow=2.28.1 ... history_owner=embedded status=passed. The unchanged strict checker ran against the installed Workflow authority. This is current-source transition qualification, not a registry claim for unpublished SDK 3.18.3.
• Fresh packaged-candidate run 43555406729 passed. Workflow source remains accepted main c3387fe6; candidate input is exact f3364f5e, version 3.18.3. I downloaded artifact 14097574479, raw SHA-256 bf849fd95ea4a2ed708a5d0908d5f511dc4a72481ed5784828a50364f83268a7, and inspected the actual records and archive.
• Candidate ZIP SHA-256 a7605df72b88d5f79d459bbe3f2c4fa51923baef8cc1727e6a964aa5cd1f0d08 is byte-equal to git archive of exact f3364f5e. All 300 declared runtime/example/resource/config/contract inputs are present, with 467 regular package files and no internal CI/Git/container tooling. A fresh public GitHub ZIP, observed raw SHA-256 0f97ae005d6ccb1c4884d0a6f9604129029a1ad2f4461ad4d3ac167c30b771d3, has the same complete file bodies and executable modes. Generated public ZIP wrapper hashes remain observational.
• The retained lock selects SDK 3.18.3, dist type ZIP/reference f3364f5e. Metrics and retained-read records independently report that exact installed candidate reference. They prove real workflow/activity completion, Worker deregistration, one update POST/four reads, pending → completed null, original default wait behavior and no source fallback.

The candidate runtime remains the existing published native 3.8.0 baseline, immutable index 7988a23525d9e50e997a9f6f02e801300ed4f626de3cf6977033657ae7e9f58e, on the qualified stock PHP 8.3.36 path. It supplies no newer-runtime command-key, #420 or registry-installed Laravel acceptance.

All ordinary code/framework/transition lanes completed successfully. The initial analyse job remains runner-blocked / NONPASS at unchanged PHP setup HTTP403 before dependency/code execution, together with its dependent aggregate. Subsequent jobs on the same profile, including the installed transition and fresh package run above, passed setup. I requested one retry of that failed job and its dependent qualification after the original run completed, with no source, profile, trust, credential or policy change. Current terminal required checks remain a gate.

Please counter-review the exact current package/member/hash packet in addition to the already recorded bounded fixture/source PASS. Normal merge/main, protected publication, actual registry archive/lock and installed Laravel follow-through remain. Historical NONPASS attempts and both published historical authority fixtures are retained. The #420 policy-blocked counter-review remains set aside; no #419/#420 retry or waiver is selected.

[rmcdaniel]

Security bounded package/member/hash review PASS for exact candidate f3364f5eaddd46d6ea48c92d6e49125597fccd0d and artifact 14097574479 from run 43555406729.

I independently streamed the artifact and reproduced its raw ZIP SHA-256 bf849fd95ea4a2ed708a5d0908d5f511dc4a72481ed5784828a50364f83268a7. The nested candidate is 1,101,518 bytes with SHA-256 a7605df72b88d5f79d459bbe3f2c4fa51923baef8cc1727e6a964aa5cd1f0d08. Re-running the workflow's exact archive command (git archive --format=zip --prefix=sdk/) against f3364f5e produced that same byte length and digest. Its 467 regular members and modes normalize byte-for-byte to the fresh public source ZIP; .github/, docker/, scripts/ci/, tests/, and .dockerignore are absent. The exact 300 selected src/example/resource/config/contract inputs are present.

The retained lock selects durable-workflow/sdk 3.18.3 from the exact candidate archive with dist reference f3364f5e. The candidate manifest records source f3364f5e, train 3.18.3, 300 runtime inputs, and no internal CI tooling. Installed metrics and update evidence independently report SDK 3.18.3 / f3364f5e, PHP 8.3.36, native Server 3.8.0 / index 7988a235..., successful workflow completion, worker deregistration, and the intended pending-to-completed update sequence. The candidate workflow completed successfully and removed its isolated Server.

The current exact-head CI is now terminal success, including the targeted analyse retry and aggregate. The first HTTP 403 setup attempt remains a correctly retained runner NONPASS; it is not relabeled by the retry.

This passes the scoped prepublication package proof. It does not approve publication, registry availability, a broader native baseline, or any #419/#420 operation. Normal integration/merge and protected publication/registry readback remain separate gates.