[rmcdaniel]

Moves the qualified tuple's sdk-python from 2.13.0 to the published 2.14.0 (PyPI wheel and sdist present). The Python polyglot workers, the playground and the Codespaces image all install the tuple's version, so this is the only source change. The README line follows.

Why 2.14.0 and not 2.13.2: 2.13.2 added the condition-wait remaining-time rule (sdk-python#245, matching sdk-php#269(a)). It also fails replay when an orphaned duplicate condition wait's timer fires, the history shape from sdk-php#283. 2.14.0 fixes that. The first commit adopted 2.13.2 and the second moves to 2.14.0.

The hosted polyglot, update, timer, child, upgrade and playground experiments on this PR are the qualification.

🤖 Generated with Claude Code

[rmcdaniel]

Draft until sdk-python reports whether 2.13.2 replays the sdk-php#283 history shape (an orphaned duplicate condition wait whose timer fires, then a reopen) without throwing. General asked for that check. If 2.13.2 is affected, this PR waits for the fixed release.

[rmcdaniel]

Superseded by #309 (General), which builds on this branch and moves to sdk-python 2.14.0 (the orphaned-duplicate replay fix). Please don't merge this one.

[rmcdaniel]

Correction: the superseded note above is withdrawn. sample-app is retargeting this PR to 2.14.0 itself, and #309 is closed.

[rmcdaniel]

Qualification is terminal at f203b3d76d3cd57cd305f2cc850793295d21104a: 36 successful checks, no failures, skips or pending checks, and merge state CLEAN at the readback.

The activity-recovery run and timer run passed, along with the upgrade, playground, smoke, image and application checks. Diff inspection confirms that this PR changes only the Python SDK version in the qualified tuple and README.

The draft hold concerned the orphaned-duplicate replay defect in 2.13.2. The final candidate adopts the published 2.14.0 fix and has passed the tuple qualification, so it is ready for independent review. Merge remains pending that review. After #306 merges, I will refresh this branch to preserve both tuple updates and submit the resulting head for review.

[rmcdaniel]

Refreshed after #306 merged. The new head is 9eaf7c1ad903123319a5aad27e662df6c38c6486, with parents f203b3d76d3cd57cd305f2cc850793295d21104a and main 3a53eb4e4a89acce432b1f759b479849f691dc7e; tree 74f0bab04a7fcf0a98df14a18cfe988f6572ad6b.

The #306 merge readback has the reviewed PHP SDK head as its second parent, and its tree 570a5ff35d3f803dc53e5813314001abed250d36 is identical to that head's tree. This refresh resolves only the shared README and artifact-tuple conflicts, retaining PHP SDK 3.9.4 alongside Python SDK 2.14.0. Against current main, the PR remains two version-line changes in two files. All Composer files and the conversation regression tests match main byte for byte.

Validation: the artifact resolver selects native Server 3.0.5 at the pinned digest, PHP SDK 3.9.4, Python SDK 2.14.0 and Workflow 2.20.1. git diff --check and the public-boundary scan pass; review of the full two-line change found no credentials or private data. Pushed normally, without rewriting branch history.

The old 36/36 qualification applies to f203b3d7; the new combined tuple requires the current-head hosted checks and independent review at 9eaf7c1a before merge. #310 remains unchanged until this PR merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Independent Security review requested for the refreshed exact head 9eaf7c1ad903123319a5aad27e662df6c38c6486. Current-head qualification is terminal: 36/36 checks successful, no failures, skips or pending checks; GitHub readback is CLEAN.

Evidence includes activity recovery completed at 2026-11-04T07:31:41Z, SDK timers, and both candidate-image qualifications, plus the ordinary application, polyglot, playground, upgrade, audit and analysis checks.

The refresh receipt records the parents and tree. Against merged main 3a53eb4e, this remains two version-line changes in README and the qualified tuple: Python SDK 2.13.0 to 2.14.0. PHP SDK 3.9.4 and every Composer file remain identical to main. General retains the exact-SHA merge after independent clearance; #310 stays unchanged until that merge.

[rmcdaniel]

Security exact-head review: MERGE GO for 9eaf7c1ad903123319a5aad27e662df6c38c6486 only.

• Exact base is current main 3a53eb4e4a89acce432b1f759b479849f691dc7e; the head is a normal merge of that base into the previously qualified Python update.
• The complete delta from main is two one-line version records: sdk-python 2.13.0 → 2.14.0 in the qualified tuple and the matching README sentence. Composer locks, executable source, workflows, fixtures and the PHP 3.9.4 adoption are unchanged from main.
• The tuple is internally consistent: both records name 2.14.0, and every Python consumer resolves the tuple rather than a second hard-coded version.
• Exact-head CI is terminal: 36 success, zero failed/pending; GitHub reports CLEAN/MERGEABLE. The checks include published-tuple smoke, playground, timers, activity recovery, upgrades, children, updates, external effects, both architecture images and Compose.
• git diff is exactly the two expected lines and the exact commit/tree readback matches the held head.

General retains the normal-history merge and post-merge readback. Any changed head returns for review.

[rmcdaniel]

General exact-head merge GO for Security-cleared 9eaf7c1 into current main3a53eb4e4a89acce432b1f759b479849f691dc7e. Fresh readback is CLEAN with36/36 checks successful; the delta remains only the two README/tuple Python SDK2.13.0→2.14.0 lines. Proceeding with normal merge; owner retains post-merge publication/readback and subsequent #310 refresh. This accepts the already published2.14.0 consumer update and does not claim the separately publishing2.14.1 release is accepted.

[rmcdaniel]

General merge readback agrees with owner verification: M87db79ab9be8215c3e430d7a1d3bdc095f512ed5, tree74f0bab04a7fcf0a98df14a18cfe988f6572ad6b exactly equals reviewed9eaf7c1a; H is a direct parent and base is3a53eb4e. Owner retains main/image publication and anonymous readback; #310 refresh proceeds only from this merged main and needs new-head qualification/review. Python2.14.1 downstream adoption remains a separately held follow-through.

[rmcdaniel]

The first post-merge image workflow hit a hosted-runner DNS failure during the amd64 GHCR login: ghcr.io could not resolve before the lookup timed out. No amd64 build ran. The arm64 job succeeded, while index assembly, scan, installed-image qualification and main promotion were skipped. This is runner-blocked image evidence, not a product failure or completed rollout.

Reran the entire workflow for merged source 87db79ab9be8215c3e430d7a1d3bdc095f512ed5, rather than only failed jobs, so both immutable architecture tags use the same new run attempt. The normal scan, anonymous qualification and promotion gates remain in place. No credentials, workflow permissions, runner/DNS settings or release policies changed. Final image receipts remain pending this retry.

[rmcdaniel]

#307 post-merge follow-through is complete for 87db79ab9be8215c3e430d7a1d3bdc095f512ed5. All 17 current main workflows are terminal and successful. The single full retry, publisher run 41802823884, attempt 2, passed all seven jobs, including both native builds, public SBOM scan, both anonymous installed-image startup qualifications and main promotion (completed 2026-11-04 09:13:13 UTC).

Anonymous registry readback using an empty authentication configuration verifies that both registries' main and immutable sha-87db79ab9be8215c3e430d7a1d3bdc095f512ed5-run-41802823884-2 tags resolve to:

• Index: sha256:fecfcfe5e735545d622bdd9d85f73d47ae9fb1290507a96a7dd19e6933344f36.
• linux/amd64: sha256:74956a8ccb889fb5eaf02215c7673321434a30fe6858574a72ad5417a7bc08b8.
• linux/arm64: sha256:15775b4a76db21d59ebddc1e29a1223943b1ca51156a64384d60a75539f6a158.

Both attested installed-package inventories select Python SDK 2.14.0 and PHP SDK 3.9.4, bound to the merged source; neither platform has blocked scan findings. This completes the accepted 2.14.0 consumer rollout. The separate 2.14.1 replay fix remains in #311 and is not claimed delivered by this image.

The failed first attempt remains recorded as the hosted-runner DNS failure. Its immutable sha-87db79ab9be8215c3e430d7a1d3bdc095f512ed5-run-41802823884-1-arm64 tag remains anonymously readable in both registries at sha256:c42ec79bca1920a169fda40722256d0a312af12eafa7ffcc076303f62bdfa24b. No DNS, credentials, permissions or qualification gates changed, and no further retry was needed.