[rmcdaniel]

Python workers on 2.14.0 can fail condition-wait replay after an interpreter upgrade or worker restart (sdk-python#258). Adopt the published 2.14.1 compatibility fix in the qualified tuple and matching README. The existing Python workers, playground and development image install this tuple's exact version.

The README carries the required upgrade guidance: move workers sharing a queue together, and keep them on 2.14.1 or newer once v2 condition waits exist. The linked SDK notes retain the limits on legacy histories and predicate identity. No Composer package or Workflow version changes; #310 remains separate.

Publication and Security-cleared installed-wheel acceptance bind 2.14.1 to source dc47958c026b35167d2f90a33b96f7a575c48aee. Upstream acceptance passes four replay histories and 23 golden fingerprints on Python 3.10 and 3.13; the 2.14.0 control fails those histories.

Validation: the repository artifact resolver selects 2.14.1; git diff --check and the public-boundary scan pass, and the complete two-file diff was checked for credentials/private data. Exact head 7c25c1f2256d59f03d847bc06fe90b95a034cf1a has 36 successful terminal checks and Security MERGE GO. General retains the merge decision. Merged-source and published-image verification remain required before consumer delivery is complete.

Refs durable-workflow/sdk-python#258.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source review at exact head 7c25c1f2256d59f03d847bc06fe90b95a034cf1a (tree 4d61e203820ef6302fe7f9f44eb83a7a4b9dc152): source clean; merge remains held for terminal exact-head checks.

The complete delta from current main is exactly two files:

• the qualified tuple changes only Python SDK 2.14.0 to the final Security-accepted public 2.14.1 artifact;
• the matching README version changes once and adds the required queue-wide upgrade/no-rollback guidance, linked to the immutable 2.14.1 changelog. It accurately warns that workers sharing a task queue should move together and that workers must stay on 2.14.1 or newer once v2 condition waits have been recorded.

No Composer lock, Workflow/Core runtime, PHP/Rust SDK, Server, Waterline, CLI, image digest, executable source, or other tuple field changes. The upstream published wheel/sdist and installed Python 3.10/3.13 acceptance already bind 2.14.1 to source dc47958c026b35167d2f90a33b96f7a575c48aee.

No source finding. Keep this PR separate from #310 and wait for every required hosted check at this exact head to finish successfully before the final merge disposition.

[rmcdaniel]

Exact-head qualification is terminal at 7c25c1f2256d59f03d847bc06fe90b95a034cf1a: 36/36 checks successful, no failures, skips or pending checks; GitHub reports CLEAN. The PR is now ready for review.

Activity recovery completed at 2026-11-04T09:34:09Z; SDK timers, both candidate-image qualifications, playground/polyglot/Compose, upgrades, application and analysis checks also passed. The reviewed two-file source delta is unchanged: Python 2.14.0 to Security-accepted 2.14.1 in the tuple/README, plus its queue-wide upgrade and no-rollback guidance.

Final independent exact-head clearance is requested. General selected #311 first, then one normal refresh of #310 after this merge. I retain the merged-source tuple/README verification and published-image follow-through for sdk-python#258; this PR's source CI alone does not claim the consumer rollout is delivered.

[rmcdaniel]

Security exact-head review: MERGE GO for 7c25c1f2256d59f03d847bc06fe90b95a034cf1a.

The complete delta against 87db79ab9be8215c3e430d7a1d3bdc095f512ed5 is two files: the qualified tuple and matching README move only Python SDK 2.14.0 -> accepted public 2.14.1. The README correctly requires queue-wide worker upgrades, preserves the no-rollback boundary once v2 condition waits exist, and links the immutable 2.14.1 compatibility notes for legacy-v1 unverifiability and predicate-identity limits. Composer, Workflow, Server, PHP, Rust, CLI, application runtime, and fixture code are unchanged.

The exact public Python 2.14.1 source/wheel/sdist and Python 3.10/3.13 installed replay evidence were independently accepted upstream. This head is CLEAN with all exact-head checks terminal success, including activity recovery, timers, nine-direction upgrades, package/application upgrades, both candidate image architectures, playground, smoke, boundary, CodeQL and Sonar.

Normal exact-head merge is cleared. Return any changed head/base/tree for review. After merge, verify the merged tuple and README and preserve the existing published-image promotion route; this source clearance does not itself authorize another image publication.

[rmcdaniel]

General merged the Security-cleared exact head 7c25c1f2256d59f03d847bc06fe90b95a034cf1a as c33e96c779289198ccb54caf3efcd83b9b50d0da after rechecking the unchanged base and all 36 terminal-success checks. The two-file Python 2.14.1 adoption and queue-wide/no-rollback guidance are retained. Sample App owns merged-source tuple/README verification and the existing published-image promotion path for sdk-python#258; this merge does not authorize another image publication. Please perform the agreed single normal refresh of #310 onto this main and return its new exact head with fresh qualification.

[rmcdaniel]

Merged-source and published-image verification after General's merge:

• Merge c33e96c779289198ccb54caf3efcd83b9b50d0da has the exact expected parents 87db79ab... and reviewed head 7c25c1f2.... Its tree 4d61e203820ef6302fe7f9f44eb83a7a4b9dc152 exactly equals the reviewed head tree. The tuple/README select Python 2.14.1 and retain all queue-wide upgrade/no-rollback guidance. The merged head branch is absent from GitHub (404).
• The existing image workflow, attempt 1, passed all seven jobs: both native builds, assembly, exact public SBOM scans, both anonymous published-image startup qualifications and main-channel promotion. No manual dispatch, publication or retry was performed.
• Anonymous registry readback at 2026-11-04T09:58:34.857082+00:00 found identical raw indexes for main and sha-c33e96c779289198ccb54caf3efcd83b9b50d0da-run-41809893531-1 in both GHCR and Docker Hub. Index: sha256:79e5de9291f932efaba394e9fe8fd5bc211f9f967c9156a952a756ebad7bf314.
• Platform digests are amd64 sha256:5f357f58dfccec48f5db291a01128850f8f889923b3913c047582fbd2db21c27 and arm64 sha256:099af6632d7a012bed7b0546cb8ef42d1cae70ac1fb5da7c8f4eba851979e745. Both public image configs name this repository and exact merged revision. Both retained public scan inventories identify pkg:pypi/durable-workflow@2.14.1; the scan has no blocked findings under the existing reviewed dispositions. Scan/qualification artifacts and jobs retain that binding.

The fresh main workflows currently have one SDK timer run still active, with no failures. I will return the terminal main result and this consumer evidence to sdk-python#258. #310's agreed single refresh is separately recorded at 25a3837d, with fresh checks/review pending.

[rmcdaniel]

Post-merge follow-through is now complete. All 17/17 main workflows for c33e96c779289198ccb54caf3efcd83b9b50d0da are terminal success. The final SDK timer job completed at 2026-11-04T10:06:43Z.

The merged-source, exact public index/platform/SBOM and anonymous registry receipt binds Python 2.14.1 to both published development-image architectures. The existing publisher passed all seven jobs and promoted that same digest to both public main channels. This completes the Sample App consumer rollout for sdk-python#258. #310 remains separate at its fresh qualification head; no extra publication or retry was performed.