Replay service cooperative cancellation at the canonical boundary

.github/workflows/ci.yml

@@ -6,6 +6,19 @@ on:
   pull_request:
     branches: [main]
   workflow_dispatch:
+    inputs:
+      server_commit:
+        description: Exact public Server candidate SHA, or empty for its default branch
+        type: string
+        default: ""
+      cooperative_qualification:
+        description: Qualify the candidate cooperative protocol 1.20
+        type: boolean
+        default: false
+      native_commit:
+        description: Optional exact public Native source overlay SHA for candidate qualification
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -145,6 +158,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     needs: [lint, test]
+    env:
+      DURABLE_WORKFLOW_WORKER_PROTOCOL_VERSION: ${{ inputs.cooperative_qualification && '1.20' || '1.19' }}
+      DURABLE_WORKFLOW_COOPERATIVE_QUALIFICATION: ${{ inputs.cooperative_qualification && '1' || '0' }}
+      DURABLE_WORKFLOW_NATIVE_SOURCE: ${{ github.workspace }}/native
+      COMPOSE_FILE: docker-compose.test.yml
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
         with:
@@ -153,7 +171,32 @@ jobs:
         with:
           python-version: "3.12"
       - name: Check out public Server integration source
-        run: python sdk-python/scripts/ci/checkout-public-repository.py server server
+        env:
+          SERVER_COMMIT: ${{ inputs.server_commit }}
+        run: python sdk-python/scripts/ci/checkout-public-repository.py server server --commit "$SERVER_COMMIT"
+      - name: Require exact cooperative candidate identities
+        env:
+          COOPERATIVE_REQUESTED: ${{ inputs.cooperative_qualification }}
+          SERVER_COMMIT: ${{ inputs.server_commit }}
+          NATIVE_COMMIT: ${{ inputs.native_commit }}
+        run: |
+          if [ "$COOPERATIVE_REQUESTED" = true ]; then
+            [[ "$SERVER_COMMIT" =~ ^[0-9a-f]{40}$ ]]
+          fi
+          if [ -n "$NATIVE_COMMIT" ]; then
+            test "$COOPERATIVE_REQUESTED" = true
+            [[ "$NATIVE_COMMIT" =~ ^[0-9a-f]{40}$ ]]
+          fi
+      - name: Check out optional exact public Native source
+        if: ${{ inputs.native_commit != '' }}
+        env:
+          NATIVE_COMMIT: ${{ inputs.native_commit }}
+        run: python sdk-python/scripts/ci/checkout-public-repository.py workflow native --commit "$NATIVE_COMMIT"
+      - name: Select readonly Native source qualification
+        if: ${{ inputs.native_commit != '' }}
+        run: |
+          printf 'COMPOSE_FILE=docker-compose.test.yml:docker-compose.native-cancellation.yml\n' >> "$GITHUB_ENV"
+          printf 'DURABLE_WORKFLOW_NATIVE_SOURCE_QUALIFICATION=1\n' >> "$GITHUB_ENV"
       - run: pip install -e '.[dev]'
         working-directory: sdk-python
       - name: Configure isolated Docker project
@@ -162,31 +205,55 @@ jobs:
       - name: Start Server stack
         working-directory: sdk-python
         run: |
-          docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
+          docker compose --project-name "$COMPOSE_PROJECT_NAME" \
             up -d --build --wait --timeout 300
+      - name: Retain exact source and published image authority
+        working-directory: sdk-python
+        env:
+          NATIVE_COMMIT: ${{ inputs.native_commit }}
+        run: |
+          docker compose exec -T server cat /app/.package-provenance > integration-package-provenance.txt
+          docker compose images --format json > integration-images.json
+          jq --null-input --arg sdk "$GITHUB_SHA" --arg server "$(git -C ../server rev-parse HEAD)" --arg native "$NATIVE_COMMIT" \
+            '{qualification:"source",sdk_commit:$sdk,server_commit:$server,native_source_overlay:($native | if length > 0 then . else null end)}' \
+            > integration-source-provenance.json
       - name: Select and probe integration endpoint
         working-directory: sdk-python
         run: python scripts/ci/configure-integration-endpoint.py
       - name: Run integration tests
+        shell: bash
         working-directory: sdk-python
         env:
           DURABLE_WORKFLOW_AUTH_TOKEN: test-token
-        run: pytest tests/integration/ -v
+        run: pytest tests/integration/ -v --capture=tee-sys --junitxml=integration-results.xml 2>&1 | tee integration-scenarios.log
+      - name: Retain connected scenario results
+        if: ${{ always() && github.server_url == 'https://github.com' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        with:
+          name: connected-integration-${{ github.sha }}
+          path: |
+            sdk-python/integration-results.xml
+            sdk-python/integration-scenarios.log
+            sdk-python/integration-source-provenance.json
+            sdk-python/integration-package-provenance.txt
+            sdk-python/integration-images.json
+          if-no-files-found: warn
+          retention-days: ${{ inputs.cooperative_qualification && 90 || 7 }}
       - name: Emit integration diagnostics
         if: failure()
         working-directory: sdk-python
         run: |
-          for service in bootstrap server worker; do
+          for service in bootstrap server worker repair; do
             echo "::group::$service logs"
-            docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
+            docker compose --project-name "$COMPOSE_PROJECT_NAME" \
               logs --no-color --tail 200 "$service" || true
             echo "::endgroup::"
           done
       - name: Teardown
         if: always()
         working-directory: sdk-python
         run: |
-          docker compose --project-name "$COMPOSE_PROJECT_NAME" -f docker-compose.test.yml \
+          docker compose --project-name "$COMPOSE_PROJECT_NAME" \
             down -v --rmi local
 
   target-branch-qualification:

README.md

@@ -115,6 +115,21 @@ capabilities with Server at startup. Use stable `2.x` SDK and Server channels
 for new applications. The [compatibility guide](https://durable-workflow.com/docs/2.0/compatibility/)
 documents protocol and upgrade guarantees.
 
+## Cooperative cancellation release candidate
+
+Use `request_cancellation()` for bounded, replayable workflow cleanup. Opt in
+against a Server that advertises protocol 1.20 and the required capabilities:
+set `DURABLE_WORKFLOW_WORKER_PROTOCOL_VERSION=1.20` and include
+`cooperative_cancellation` in the Worker's `capabilities`. Durable local callback
+admission also needs `prepared_local_activities`, with
+`prepared_local_activity_cancellation_policies` for explicit local policies.
+Independently cancellable scopes remain disabled.
+
+The cooperative worker supervises async and synchronous activity callbacks
+independently of application heartbeats. Existing terminal cancellation remains
+available. See the [cancellation guide](docs/cooperative-cancellation-design.md)
+for immutable context, operation policies, shielded cleanup and recovery.
+
 ## Development
 
 ```bash
@@ -127,11 +142,26 @@ pytest tests/ -m "not integration"
 Integration tests use Docker:
 
 ```bash
+export COMPOSE_PROJECT_NAME=sdk-python-local
 docker compose -f docker-compose.test.yml up -d --build --wait
-pytest tests/integration/ -v
+SERVER_PORT=$(docker compose -f docker-compose.test.yml port server 8080 | sed 's/.*://')
+DURABLE_WORKFLOW_SERVER_URL="http://127.0.0.1:$SERVER_PORT" DURABLE_WORKFLOW_AUTH_TOKEN=test-token pytest tests/integration/ -v
 docker compose -f docker-compose.test.yml down -v
 ```
 
+Candidate cooperative cancellation qualification is explicit. In a manual CI
+run, supply an exact public `server_commit` and set `cooperative_qualification`
+to true. CI verifies that checkout, builds the candidate Server, enables protocol
+1.20, runs the connected cases and retains JUnit, raw observations, image
+authority and exact source provenance. An optional exact `native_commit` mounts
+that public Native checkout read-only into the test stack. The image's published
+Composer authority stays intact and the evidence identifies the source overlay.
+These are source qualification runs. For a local
+candidate, set `DURABLE_WORKFLOW_WORKER_PROTOCOL_VERSION=1.20` before starting
+Compose and `DURABLE_WORKFLOW_COOPERATIVE_QUALIFICATION=1` for pytest. These cases
+fail if the runtime does not discover the required capability. Ordinary CI
+keeps protocol 1.19 and skips this unpublished feature's connected cases.
+
 ## License
 
 [MIT](LICENSE)

docker-compose.native-cancellation.yml

@@ -0,0 +1,15 @@
+# Source qualification only. Published Composer authority stays in the image.
+services:
+  bootstrap:
+    volumes:
+      - ${DURABLE_WORKFLOW_NATIVE_SOURCE:?exact Native checkout}:/app/vendor/durable-workflow/workflow:ro
+  server:
+    volumes:
+      - ${DURABLE_WORKFLOW_NATIVE_SOURCE:?exact Native checkout}:/app/vendor/durable-workflow/workflow:ro
+      - ./tests/integration/native-scope-request.php:/app/sdk-source-fixtures/native-scope-request.php:ro
+  worker:
+    volumes:
+      - ${DURABLE_WORKFLOW_NATIVE_SOURCE:?exact Native checkout}:/app/vendor/durable-workflow/workflow:ro
+  repair:
+    volumes:
+      - ${DURABLE_WORKFLOW_NATIVE_SOURCE:?exact Native checkout}:/app/vendor/durable-workflow/workflow:ro

docker-compose.test.yml

@@ -30,6 +30,8 @@ services:
       WORKFLOW_SERVER_AUTH_DRIVER: token
       WORKFLOW_SERVER_AUTH_TOKEN: "test-token"
       DW_WORKFLOW_TASK_TIMEOUT: 10
+      # Candidate cooperative qualification is explicit. Published defaults remain 1.19.
+      DW_WORKER_PROTOCOL_VERSION: "${DURABLE_WORKFLOW_WORKER_PROTOCOL_VERSION:-1.19}"
     depends_on:
       mysql:
         condition: service_healthy
@@ -70,6 +72,16 @@ services:
       redis:
         condition: service_healthy
 
+  repair:
+    build:
+      context: ../server
+    # Match the production scheduler's unscoped, unthrottled repair cadence.
+    command: sh -c 'while true; do php artisan workflow:v2:repair-pass --json; sleep 10; done'
+    environment: *server-env
+    depends_on:
+      server:
+        condition: service_healthy
+
   mysql:
     image: mysql:8.0
     environment: