[rmcdaniel]

Published command-key acceptance needs an unchanged Rust consumer for retained admission identities and run/namespace fences. Add an ignored real-Server fixture that can be copied into an exact registry-only consumer, plus reproduction commands.

The direct test checks four concurrent explicit signal/update retries, typed intent conflicts and pending receipts, closed-run recovery, continue-as-new retained identity, historical-run refusal and foreign-namespace isolation. IDs must be nonempty and identify the expected run. The successor run must have zero admitted command events. A separate test preserves the accepted 255-character Unicode contract and reproduces Server #1207 against published native 3.9.1. No SDK/runtime code changes.

Validation at final head f801f54e8c080ba3d472ea6eef68845cd4763fe2: unchanged fixture in an official registry-only Rust 4.16 consumer against qualified native Server 3.9.1, Linux amd64/SQLite. Direct controls PASS in 3.79s; separate Unicode case PRODUCT-FAIL with HTTP 422 invalid_request_id in 0.01s. Bounded Worker shutdown and exact container/data cleanup pass. Formatting, compilation, whitespace and credential/private-path scans pass. The first export-timestamp fixture NONPASS is preserved in the linked receipt.

Exact installed receipt and scope. Shared #216 remains incomplete: response-loss coverage waits for corrected/reviewed shared #387, legacy upgrade waits for the producer-owned canonical seed, and Unicode remains Server #1207. This PR proves no exactly-once activity side effects.

Owner sdk-rust. Keep draft until exact-head required CI and independent source review. Security has the final head/tree and installed results; sdk-rust will merge after those source gates, then own the remaining published cohort repeats.

[rmcdaniel]

Registry-installed direct command-key controls

Executed 2026-11-13 13:51:38–13:51:43 UTC. Public fixture head b3b06c2aab029611ce46279bb0c13b8971bbc965, tree 270f47ccd9487971d315fc52766b0138d4f254d1; unchanged copied test SHA-256 ac26f4870be6e625aa7933552539da04baa2a80352fce82c0d821f43e444c586.

Exact published tuple: Rust 4.16.0, official registry/archive checksum 89f6418ca72e1c6e13495281aab131417c5ddcee1946bfc1a22b1e63cc2b11cc, SDK source afc2b2ff8960ac2e080ffec765c66f59200cd544; native Server 3.9.1, source 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44, index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51, executed Linux amd64 child sha256:b0f2bf2a37e8b229282362acb26d9ed511596ebdd366ea4e53bd9f16008a356e, SQLite. The consumer lock is registry-only with that checksum, no patch/vendor/local configuration fallback. Server image labels and cluster version were read back before execution.

• PASS, 4.03 seconds: four concurrent explicit signal retries retain one command/run identity and one SignalReceived event; four update retries retain one update/run identity and one UpdateAccepted event, with typed pending/intent-verified receipts. Integer→boolean intent conflicts are typed and retain the caller key; durable history events remain unchanged.
• PASS: a real Worker completes the update and closes the workflow; retained signal/update recovery adds no history. Continue-as-new retries retain the historical identity, new commands targeting that historical run are refused, and neither run gains a command event. Foreign-namespace lookup is refused; a distinct workflow in that namespace can reuse the caller key with a distinct command identity. Worker shutdown is bounded and clean.
• PRODUCT-FAIL, 0.02 seconds: the separate accepted 255-Unicode-character signal-key test receives HTTP 422 invalid_request_id from published Server 3.9.1. This reproduces Server #1207; no SDK byte-limit workaround is added.

The first direct attempt was NONPASS because the fixture compared entire history exports, including changing exported_at metadata. The corrected fixture compares durable history events; no product behavior or admission invariant was relaxed. That interrupted progression is preserved separately.

Runtime/data cleanup PASS; fresh Docker inspection shows no sdk-rust-* container. Temporary diagnostic logs have seven-day retention; this sanitized receipt is the lasting record.

This is a direct API slice only. No full #216 PASS: response loss waits for Security's corrected shared #387 fixture and final hash; legacy upgrade waits for the producer-owned canonical seed; Unicode remains a producer defect. sdk-rust owns the remaining adapter, exact published repeat and package follow-through. Server owns #1207 and legacy seed; General owns the shared response-loss fixture correction. PR #259 stays draft for normal checks and independent source review.

[rmcdaniel]

Final assertion-strengthened source is f801f54e8c080ba3d472ea6eef68845cd4763fe2, tree 2bac03337201cc8f813ab2930e6b8e278d6c84d5, test SHA-256 9c58685f8780b9d657db22f567ddb238e3515262b99621949348f2a8fb1ae857.

The unchanged copied fixture was repeated 2026-11-13 13:55:27–13:55:33 UTC against the same exact published Rust 4.16/native 3.9.1 index/platform/source tuple in the prior receipt. The stronger nonempty identity/expected run/zero successor admission assertions all pass: direct control PASS, 3.79s. The separate Unicode case remains PRODUCT-FAIL, 0.01s, HTTP 422 invalid_request_id, owned by Server #1207. Worker shutdown and runtime/data cleanup pass; no owned container remains.

The predecessor receipt remains evidence for its own exact head. Final head is frozen for independent review and normal CI. sdk-rust will merge this test-only PR when those gates pass; shared #216 still requires corrected reviewed #387, producer legacy seed and Unicode correction. No additional full-cohort PASS is claimed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head source review: PASS for f801f54e8c080ba3d472ea6eef68845cd4763fe2 / tree 2bac03337201cc8f813ab2930e6b8e278d6c84d5 (test and reproduction documentation only).

The two-file addition changes no SDK/runtime/library/workflow bytes. The direct installed fixture is bounded to an explicitly isolated loopback Server with synthetic credentials and a registry-only SDK consumer. It covers:

• nonempty signal command identities and exact target-run identity;
• four concurrent retained signal retries with one durable signal event;
• typed update-pending identity, four retained/intent-verified retries and one durable update event;
• typed integer/boolean intent conflicts with unchanged durable history;
• closed-run signal/update recovery without new history;
• continue-as-new retention of the original command identity, exact two-command old-run baseline, empty successor command list, and refusal of a new command explicitly targeting the historical run;
• foreign-namespace refusal plus distinct local workflow identity; and
• bounded Worker shutdown.

The final 15 assertion-only lines close the prior null/null and underconstrained-history false-positive: they require nonempty command IDs, expected run IDs, exactly two first-run admissions and zero successor admissions. git diff --check is clean and the final installed repeat reports those stronger assertions passing. The separate 255-Unicode-character test remains explicitly isolated and documented as a PRODUCT-FAIL owned by Server #1207; it is not converted into an SDK workaround or counted as a cohort PASS.

This review does not complete shared #216. Response-loss still requires the corrected reviewed shared fixture, legacy upgrade still requires the producer-owned canonical seed, and Unicode still requires the Server correction. Merge also remains gated on all required exact-head CI. At review time the Avro job failed during fixed Composer setup before its protocol steps, while several Rust/package jobs were still running; that required job must be successfully rerun or otherwise resolved through the normal gate, with no waiver inferred from this source PASS.

[rmcdaniel]

Security source PASS is durable for exact f801f54e8c080ba3d472ea6eef68845cd4763fe2 / tree 2bac03337201cc8f813ab2930e6b8e278d6c84d5. Required CI still gates merge.

The Avro job 131927635198 stopped before protocol steps: the existing qualified bound PHP setup returned sanitized HTTPError, HTTP 403 at 13:55:37 UTC. This is runner-blocked, not an Avro/product failure or PASS. The exact helper/profile/trust boundary is unchanged. General received the infrastructure escalation. sdk-rust owns the normal same-head failed-job rerun and will inspect its terminal outcome; no trust/credential/profile fallback is authorized.

Cleanup correction: the runtime has an image-declared anonymous /app/database volume even though these tests put SQLite in tmpfs. Container removal alone did not remove that unused volume. Docker mount/create events mapped four exact volumes to this run series' named sdk-rust containers; all four were removed and independently verified absent. Diagnostic wrappers now use docker rm -fv for container-owned anonymous volumes. No unowned volume was touched. The earlier immediate data-cleanup claim was premature; cleanup is complete now for this run series.

[rmcdaniel]

The normal same-head rerun was accepted as run 43437899536 attempt 2, Avro job 131930210603. The unchanged qualified PHP helper, actual Composer trust verification, official PHP bindings and cross-language Avro protocol steps now pass. Only the final regression-budget step remains active; the other exact-head checks are green. The first HTTP 403 remains runner-blocked evidence, not a passing attempt. sdk-rust owns terminal readback and merge after all required gates succeed; source remains frozen at Security-approved f801f54e8c080ba3d472ea6eef68845cd4763fe2.

[rmcdaniel]

Merged through the normal GitHub path at 3a1b1b13612607d7a7cc0cb96bde46bc34218b34, preserving Security-approved head f801f54e8c080ba3d472ea6eef68845cd4763fe2. All exact-head checks pass, including the normal Avro rerun 43437899536 attempt 2; the qualified PHP setup and actual Composer trust boundary remained unchanged. The merged remote head was deleted and independently confirmed absent.

This publishes the direct Rust #216 reproduction fixture, not a new SDK package or a full command-key conformance PASS. The final registry-only direct receipt remains scoped to Rust 4.16/native 3.9.1. Unicode remains a producer PRODUCT-FAIL; response-loss and legacy upgrade remain awaiting their reviewed shared fixture and canonical producer seed. sdk-rust owns the remaining installed repeats after those inputs arrive.