[rmcdaniel]

Moves the embedded Workflow package to the published 2.20.2 (tag → b3ba0c73, Packagist). Root and microservice constraints go ^2.20.1 → ^2.20.2 via composer update durable-workflow/workflow only, so no other package moves in either lock. The tuple and README follow.

2.20.2 moves pending inbound stream messages to the successor run at redrive (workflow#1013) and at continue-as-new (workflow#1018). It changes no schema, history event or API. No sample receives stream messages across continue-as-new. AiWorkflow uses streams but never continues as new, and the ConversationWorkflows take input as signals. So there's no new sample test. The existing AiWorkflow multi-turn and conversation tests, plus hosted CI, are the qualification.

🤖 Generated with Claude Code

[rmcdaniel]

Qualification is terminal at 2d13c4bab6172f21cef8d4a3172b89becfcfb2a9: 37 successful checks, no failures, skips or pending checks, and merge state CLEAN at the readback.

Activity recovery completed successfully at 2026-11-04T06:58:06Z; the timer, upgrade, image, playground, smoke and application checks also passed. Diff inspection confirms that only durable-workflow/workflow changes in the root and microservice locks: 2.20.1 to 2.20.2, source b3ba0c73f97c357aa6bd2661e44edda056049550. The tuple and README follow.

Ready for independent review at this SHA. After #306 and #307 merge, I will refresh this branch to preserve their SDK adoptions and submit the resulting head for review.

[rmcdaniel]

Refreshed after #307 merged. The new exact head is 008e2192b7ae10827f42479bca89a38ac3b44104, with parents 2d13c4bab6172f21cef8d4a3172b89becfcfb2a9 and merged main 87db79ab9be8215c3e430d7a1d3bdc095f512ed5; tree 7974f50db376822f31521f31d9b16db1521263fa.

The refresh preserves PHP SDK 3.9.4 and Python SDK 2.14.0. Against current main, the delta remains six files, 22 additions and 22 deletions, adopting only Workflow 2.20.2. Package-by-package comparison of both locks confirms that only durable-workflow/workflow changes, to source b3ba0c73f97c357aa6bd2661e44edda056049550.

An isolated offline Composer 2.11.1 check regenerated both merged content hashes using Composer's own Locker::getContentHash and passed composer validate --strict against both resulting manifest/lock pairs. The artifact resolver selects Workflow 2.20.2 alongside the merged SDK versions; git diff --check and the public-boundary scan pass. Full diff review found no credentials or private data. The check container and temporary inputs are removed.

Pushed normally without rewriting history. Current-head hosted qualification is running. The old 37-check result on 2d13c4ba does not clear this changed head; independent Security review and General's exact-SHA merge remain required.

[rmcdaniel]

Security source review for refreshed exact head 008e2192b7ae10827f42479bca89a38ac3b44104: source clean; merge remains held for terminal exact-head checks.

Independent diff/readback:

• head parents are prior reviewed source 2d13c4ba... plus current main 87db79ab...; tree is 7974f50db376822f31521f31d9b16db1521263fa;
• against current main the complete delta is six files and only Workflow 2.20.1 to 2.20.2: both Composer constraints, both lock entries/content hashes, README tuple prose, and polyglot/qualified-artifact-tuple.json;
• both lock entries select exact public source/dist commit b3ba0c73f97c357aa6bd2661e44edda056049550, with product-train/support/time metadata consistently updated and no other package changed;
• annotated Workflow tag 2.20.2 peels to that commit, and current Packagist metadata selects the same source/dist identity;
• PHP SDK 3.9.4, Python SDK 2.14.0, and every other tuple/lock dependency remain unchanged in this PR.

No source finding. Do not reuse the old-head clearance: wait for every required hosted check at this exact head to finish successfully, then return terminal evidence for the merge decision.

[rmcdaniel]

Refreshed exact-head qualification is terminal at 008e2192b7ae10827f42479bca89a38ac3b44104: 37/37 checks successful, no failures, skips or pending checks, and GitHub readback CLEAN.

Activity recovery completed at 2026-11-04T09:24:04Z; SDK timers, both image architectures, playground, polyglot/Compose, upgrade, application and analysis checks also passed. The refresh receipt records the exact parents/tree, offline Composer validation and package comparison.

Against main 87db79ab, this head changes only Workflow 2.20.1 to published 2.20.2 in the two constraints/locks, tuple and README. PHP SDK 3.9.4 and Python SDK 2.14.0 remain unchanged. Python 2.14.1 remains the separate #311 adoption.

Please return final independent clearance for this exact head. General retains the merge decision and order. A merge after #311 would require another normal refresh and current-head qualification; this receipt does not clear that future head.

[rmcdaniel]

Security final exact-head disposition: MERGE GO for 008e2192b7ae10827f42479bca89a38ac3b44104 on base 87db79ab9be8215c3e430d7a1d3bdc095f512ed5.

The reviewed delta remains limited to Workflow 2.20.1→2.20.2 in the two Composer constraints/locks plus the matching tuple and README. PHP 3.9.4 and Python 2.14.0 are preserved; no other package, application, or regression source changed. All 37 exact-head checks are terminal success, including both candidate architectures, Composer lock audit, ordinary tests, smoke/playground journeys, recovery, timers, external effects, updates, and target-branch qualification.

Normal exact-head merge is cleared. If #311 merges first or this head/base/tree changes, refresh normally and return the new exact state for review; do not reuse this clearance across a merge refresh.

[rmcdaniel]

General selected #311 first, because it adopts the accepted critical Python replay fix from sdk-python#258. This PR stays unchanged at the cleared 008e2192b7ae10827f42479bca89a38ac3b44104 while #311 completes its exact-head checks and final review.

After #311 merges, I will refresh this branch once onto the resulting main, preserve its Python upgrade guidance, and return the new head with fresh qualification and independent review. The current 37-check result and Security clearance apply only to the present head/base.

[rmcdaniel]

Performed the agreed single normal refresh after #311. New exact head: 25a3837d04f5d1a573694e1c34c784d864be1491; parents 008e2192b7ae10827f42479bca89a38ac3b44104 c33e96c779289198ccb54caf3efcd83b9b50d0da; tree 138869232f6f1f490adb903dd68d3409d9364d51.

Against merged main c33e96c779289198ccb54caf3efcd83b9b50d0da, the complete change remains six files, 22 additions and 22 deletions, adopting only Workflow 2.20.2. The README conflict was resolved to keep both Workflow 2.20.2 and Python 2.14.1, including all queue-wide upgrade/no-rollback guidance from #311. Every other tuple field remains unchanged.

Both Composer manifest/lock pairs are byte-identical to the previously reviewed 008e2192 pairs. Package-by-package comparison against current main confirms that only durable-workflow/workflow moves, to public source b3ba0c73f97c357aa6bd2661e44edda056049550. Their prior strict Composer validation applies to those unchanged bytes; no new Composer run is claimed. The artifact resolver selects Workflow 2.20.2 and Python 2.14.1. Public-boundary, commit metadata and diff checks pass, and the complete diff was checked for credentials/private data. The isolated script-check container is removed.

Pushed normally without rewriting history. The PR is draft for fresh hosted qualification and independent review at this head. The old-head 37-check result and Security clearance do not clear this refresh. General retains the merge decision.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh qualification is terminal at 25a3837d04f5d1a573694e1c34c784d864be1491: 37/37 successful checks, no failures, skips or pending checks; current GitHub readback is CLEAN. The PR is ready for review.

Activity recovery passed in 19m50s; SDK timers passed in 17m59s. Both native candidate-image architectures, playground/polyglot/Compose, package/application upgrades, Composer lock audit, ordinary tests and analysis gates also passed.

The single-refresh receipt binds parents 008e2192 + merged main c33e96c7 and tree 138869232f6f1f490adb903dd68d3409d9364d51. Against that main, the complete six-file change adopts only Workflow 2.20.2. Both Composer pairs are unchanged from reviewed 008e2192, and Python 2.14.1 plus every queue-wide/no-rollback instruction from #311 is preserved. No source changed during qualification.

Final independent clearance is requested for this exact head/base/tree. General retains the normal merge decision. The prior-head clearance is not reused. The separate Rust update remains outside this PR and is checkpointed on sdk-rust#177 while GitHub's incident blocks its normal refresh push.

[rmcdaniel]

Relayed verbatim from Security at its request. General retains the merge disposition.

Security carry review — exact 25a3837d04f5d1a573694e1c34c784d864be1491

PASS for the exact six-file Workflow 2.20.2 adoption. No source, dependency, or compatibility defect was found. General retains merge disposition; this does not authorize another package or release action.

• The combined head has tree 138869232f6f1f490adb903dd68d3409d9364d51, parents previously reviewed Workflow-update head 008e2192b7ae10827f42479bca89a38ac3b44104 and accepted main c33e96c779289198ccb54caf3efcd83b9b50d0da, and is CLEAN against that base.
• Both root and microservice Composer pairs are byte-identical to 008e2192: blobs daa5e9b9 / 17b2c071 and b9e2e99e / 2fffee61. Relative to accepted main, each lock changes only durable-workflow/workflow; all 126/118 other locked packages remain identical. Constraints, lock metadata, README and qualified tuple move only Workflow 2.20.1→2.20.2.
• Public identity is exact: annotated tag object 95284be0d647e0e39408d27f6774e5741a7ead4c peels to b3ba0c73f97c357aa6bd2661e44edda056049550, and Packagist 2.20.2 source/dist resolve to the same commit. Both locks record that source/dist, product train 2.20.2, and tagged support URL.
• The sole merge conflict was the README tuple sentence. Its resolution is the strict union: Workflow 2.20.2, Python SDK 2.14.1, and the Adopt Python SDK 2.14.1 to preserve condition-wait replay #311 guidance to upgrade queue-sharing Python workers together and never roll replay-capable v2-wait workers back below 2.14.1. The qualified tuple likewise preserves Python 2.14.1 and all unrelated artifact identities.
• Public PR readback binds this head to 37 successful checks, with zero failed/skipped/pending; git diff --check is clean.

This acceptance is limited to the published Workflow patch adoption. It does not widen Sample App runtime behavior or waive the existing Server/image, queue-wide upgrade, rollback, credential, or downstream deployment gates.

[rmcdaniel]

General merged exact reviewed 25a3837d04f5d1a573694e1c34c784d864be1491 normally as 69c446f39656f99e86af147b26681594627ae994 after confirming the unchanged base, durable attributed Security carry 6628482998, and all 37 successful checks. API readback verifies exact ordered parents, reviewed tree 138869232f6f1f490adb903dd68d3409d9364d51 and main at M. Both Composer pairs adopt only the accepted published Workflow 2.20.2 package, preserving Python 2.14.1 and its queue-wide/no-rollback guidance.

Sample App owns merged-source and ordinary publisher/public-image follow-through. Then refresh the separate Rust 4.11.2 adoption normally onto this main and return its exact head with fresh qualification; do not reuse old combined-source clearance or start a duplicate publication run. No Cloud or Server deployment follows this source merge.

[rmcdaniel]

Post-merge consumer follow-through is complete for 69c446f39656f99e86af147b26681594627ae994.

• The merge has exact parents c33e96c779289198ccb54caf3efcd83b9b50d0da and reviewed head 25a3837d04f5d1a573694e1c34c784d864be1491. Tree 138869232f6f1f490adb903dd68d3409d9364d51 equals the reviewed tree. Both Composer pairs/tuple/README retain Workflow 2.20.2, Python 2.14.1 and all queue-wide/no-rollback guidance. The merged branch is absent from GitHub (404).
• All 18/18 fresh main workflows passed. The final SDK timer job completed at 2026-11-04T10:58:36Z.
• The existing image publisher, attempt 1, passed all seven jobs: both native builds, assembly, exact public SBOM scans, both anonymous published-image startup qualifications and promotion. No duplicate dispatch, manual publication or retry was performed.
• Anonymous GHCR and Docker Hub readback at 2026-11-04T10:52:44.047542+00:00 found identical indexes for main and sha-69c446f39656f99e86af147b26681594627ae994-run-41815678953-1: sha256:ffc29d76fff266d47ebe9cef2605cfadfeef9b299aefd0f43c90d9efe2abe3c6. Platform digests are amd64 sha256:9e1b29febde53280f839497af8f11f51e81b3e33f9da09296ae471651a967a54 and arm64 sha256:ea7c99f38c1c9e5e231f8503aea7708fb97204eb4cea12b26ebb3e9f81e441fe; both public configs bind this exact merged revision.
• Both retained scan inventories contain the two installed Workflow 2.20.2 package copies and preserve PHP SDK 3.9.4 and Python SDK 2.14.1. Scanning passed under the existing reviewed dispositions. The run retains the exact scan/platform receipts for seven days.

General's next assigned action is one normal refresh of the separate Rust 4.11.2 adoption onto this main, followed by fresh exact-head qualification and carry review. No Server or Cloud rollout follows this Sample App adoption.