[rmcdaniel]

Queries returning nested AvroBinaryValue bytes throw while encoding the optional plain JSON result, despite a valid authoritative Avro envelope. This 3.18.2 patch preserves the envelope and omits the plain projection only when it cannot be JSON encoded. Ordinary JSON display values, lease identity, Avro validation and payload planning remain unchanged.

The new codec corpus case exercises the production PSR-18 JSON/planning boundary. Its runner adds only fixed HTTP interface/PSR-7 dependency roots while retaining candidate-source isolation. Controls cover null, whole floats, signed zero, nested JSON and invalid unwrapped UTF-8. A narrow option in the existing qualified installed-worker workflow adds actual binary/JSON/null query round-trips and graceful cleanup, using its exact candidate-dist or registry consumer modes.

Validation so far: 225 focused cases / 965 assertions; all four codec fixtures pass. The new binary fixture fails against unchanged aa7948af with the expected projection assertion. Fresh registry 3.18.1/source+dist ffa67454 reproduces the defect: ordinary JSON sends one completion; valid nested binary sends zero. The original broken probe remains inconclusive. No actual Worker delivery or new release is claimed yet.

Refs #414. Owner: sdk-php. Release gates: independent exact source/harness and package review, normal required checks, exact packaged-candidate/native 3.9.1 query Worker qualification through protected stock 411a, normal merge/main checks, immutable publication, registry-only repeat and stable portal/consumer follow-through. #267's no-4.0 stop and unrelated #216/#297/timeout gates remain separate.

[rmcdaniel]

Security review of exact 0e9ed1a98f633be86ab5f73418022749cc50c9e9: client/source PASS; qualification harness HOLD.

The Client::completeQueryTask change is appropriately narrow. It constructs the authoritative Avro envelope first, attempts the existing JsonDocument policy only for the optional legacy display projection, preserves result byte-for-byte for JSON-representable values (including signed zero), and omits only that projection on JsonException. Invalid Avro still refuses before any HTTP request. The production PSR-18 tests and frozen nested-binary corpus exercise the actual request document and exact envelope; the added smoke covers installed JSON/binary/null query round trips, workflow closure, graceful Worker exit and deregistration. I found no source authority widening in this part.

The protected workflow currently cannot support its claimed immutable 3.9.1 query result, however. SERVER_VERSION and SERVER_IMAGE select 3.9.1 only when inputs.completion_limits is true. An independent dispatch with query_results: true and the default completion_limits: false executes the new query smoke against 3.8.0 / index 7988a235…, while its description and review packet claim the qualified 3.9.1 tuple. The current PR installed-worker-metrics success does not cover this: on a pull request the new input is false and the query step is skipped.

Before qualification, make both tuple selectors depend on inputs.completion_limits || inputs.query_results (or fail closed unless query_results also has the required completion input), and add a committed structural control proving the query-only dispatch selects exact 3.9.1/index 946c65eb… and cannot fall back to 3.8.0. Then run the protected candidate query cell on that exact successor. Keep candidate package/registry repetition and final release gates separate.

No product failure is inferred; this is an evidence-selection defect caught before the query dispatch. Current normal CI and package checks remain required, but cannot substitute for the corrected opt-in Worker cell.

[rmcdaniel]

Qualification HOLD remains despite green job conclusions on 43452458079 (0e9ed1a) and 43453043231 (7d4ce6a). Artifact inspection found empty query-results.json; the probe’s workflow used an unsupported context method, so the workflow failed before the binary query. An inherited bash -e pipeline returned tee’s success and hid PHP’s nonzero exit. These are NONPASS runner/harness results, not installed query acceptance.

The current successor changes the fixture to the established waitCondition/signals path, selects native 3.9.1 for either feature flag, uses explicit bash --noprofile --norc -e -o pipefail {0}, and requires nonempty, valid, positive query evidence with matching SDK/Server versions. Five structural controls pass, including an actual shell predecessor returning zero versus the corrected shell returning producer exit 7. The Client fix is unchanged from Security’s source PASS. A new query-only protected exact-source candidate run is underway; independent counter-review and all release gates remain.

Run 43452986627 had an incorrectly transcribed candidate SHA and was cancelled as invalid/nonqualifying before it could provide evidence. Subsequent dispatches derive the full SHA directly from Git.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact source b0ce44195e10c55100dd93594c5497b03047be09 now has a successful protected packaged-candidate run: 43454221657. I downloaded and inspected its actual artifact, rather than relying on its job conclusion.

query-results.json is valid and positive: SDK3.18.2/reference b0ce441, native Server3.9.1, exact 3-byte nested binary round-trip, ordinary JSON and signed-zero controls, null result, workflow completion and graceful Worker deregistration. The query-only flag selected immutable index 946c65eb… as required. Existing metrics and retained-update controls also passed. The candidate manifest binds the exact archive SHA, retains all300 required runtime/example/resource/config/contract inputs, excludes internal tooling and matches the downloaded bytes. The independently downloaded public GitHub ZIP has the same file bytes and modes.

Earlier runs 43452458079/43453043231 are NONPASS despite green jobs (empty evidence and hidden PHP failures); c99/43453556121 correctly failed on the undeclared signal, and 20a/43453833032 failed on my incorrect registration method. The final fixture uses the published declareSignal API; its Worker/Context/Handle calls were independently checked against the installed 3.18.1 API before this dispatch. Run43452986627 remains invalid/cancelled for a mistyped SHA. No earlier result substitutes for the final source.

Release HOLD remains for independent exact source/harness/package approval, terminal current-head checks, normal merge and main readback, immutable publication, registry-only repeat and stable portal verification. Client runtime behavior is unchanged from the reviewed source fix throughout the harness corrections.

[rmcdaniel]

Final normal checks at exact b0ce44195e10c55100dd93594c5497b03047be09 are terminal: 33 SUCCESS, one intended skip, zero failures/pending. CI43454232209 passed, including the actual PHP support/Carbon suites, corpus, package smoke and required aggregate.

Protected exact candidate43454221657 and its downloaded positive query artifact remain the applicable prepublication evidence. Public GitHub ZIP SHA256 53846411d5284d29e6fe59449ad94e17361a7ecbe8522fdc2131e2b5c881c427 equals the tested candidate ZIP (SHA256 b58e35cde65b87c8459067e03f10201c6fa734985e7d1a91758e09cb5725197c) in file bytes and modes.

Only independent final source/harness/package approval remains before normal merge and main verification. No tag or publication has occurred.

[rmcdaniel]

Security final source/harness/package review: PASS for exact head b0ce44195e10c55100dd93594c5497b03047be09 / tree f34f34f7784b970a83996415a49d088cef412551 and the exact prepublication packet below.

Source contract:

• completeQueryTask() still constructs the authoritative Avro envelope first. Invalid Avro therefore refuses before any HTTP request. It retains the optional raw result projection only when the same closed JSON policy can encode it; otherwise it omits only that optional projection. Ordinary JSON, signed zero and the existing polyglot projection remain covered.
• No lease, request-budget, path, payload-size or transport authority changed. The Server 3.9.1 producer explicitly accepts the envelope-only form.

Harness corrections:

• Either completion_limits or query_results selects exact native 3.9.1 and immutable index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51; independent selector and digest mutations refuse.
• Every run step uses bash --noprofile --norc -e -o pipefail, so the PHP producer's nonzero status cannot be hidden by tee.
• Query evidence must be valid nonempty JSON, must assert all binary/JSON/signed-zero/null/completion/deregistration booleans, and must match the requested SDK and Server versions.
• The fixture uses the published declareSignal() API and the established durable waitCondition/signals path. It completes and then proves Worker deregistration.

Independent protected-run/package readback:

• Run 43454221657 attempt 1 is a successful same-repository workflow dispatch at exact head b0ce441; its sole job is successful. Artifact 14053975676 is unexpired and its downloaded outer ZIP hashes to the API digest sha256:e274e9a7289a0a3b40227d983e7bc91db5409793b953bc93f28b5f6a2dfa1fe2.
• Logs and retained evidence bind SDK 3.18.2 / source b0ce441, Server 3.9.1, and the immutable 946c… image. query-results.json is nonempty and positively records the three-byte nested binary round trip, JSON control, signed zero, null result, workflow completion and Worker deregistration. Composer lock binds the installed SDK dist to the same exact source.
• The candidate ZIP hashes to b58e35cde65b87c8459067e03f10201c6fa734985e7d1a91758e09cb5725197c and byte-reproduces with git archive from exact b0ce441. It retains all 300 declared runtime/example/resource/config/contract inputs and contains none of .github/, docker/, scripts/ci/, tests/ or .dockerignore.
• Fresh public GitHub source ZIP hash is 53846411d5284d29e6fe59449ad94e17361a7ecbe8522fdc2131e2b5c881c427; after normalizing the root directory, all 530 members, bytes and ZIP mode metadata equal the tested candidate ZIP.

The earlier empty-evidence false greens and the c99/20a fixture failures remain NONPASS and are not used by this verdict. All current exact-head checks are terminal green.

This approval binds only the source, run, artifact and hashes above. Normal merge/main equality and protected release gates remain; tag/publication is not performed by this review, and final registry archive/source plus installed query repeat remain post-publication requirements.

[rmcdaniel]

3.18.2 is delivered: https://github.com/durable-workflow/sdk-php/releases/tag/3.18.2 .

Identity and integration:

• Independently reviewed source b0ce44195e10c55100dd93594c5497b03047be09, Security final source/harness/package PASS6857765153, all33 source checks green/one intended skip.
• Normal merge/tagged source f9483bb2b5b45f591a82d9e5419c5b60a6e967c6, tree f34f34f7784b970a83996415a49d088cef412551 equal the reviewed head; remote topic404. All six actual-main workflows passed, including CI43455684906 and portal43455684822.
• Annotated tag object c63c6c712e752106fb41a14af8bb81a635cd1afa; Packagist3.18.2 source and dist both point to f9483bb. Published ZIP SHA256 32dc5d1a05a96e9e772e964bea95ae8142882b901d612c97a4aadee699f4ec6b equals the approved candidate in file bytes/modes; all300 required runtime/example/resource/config/contract inputs remain, internal Git/CI/container tooling absent.

Registry-only installed acceptance 43456999904 PASS, PHP8.3.36 / published native3.9.1 index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51, producer source7d7ad9d6. Actual Composer log confirms extracting the registry archive; retained lock source/dist=f9483bb, no candidate artifacts or repository fallback.

• Real Worker nested binary3-byte query, ordinary JSON, signed zero and null round-trip; workflow completion and graceful Worker deregistration all true in nonempty query-results.json.
• Actual300×10KB completion4,158,899B/HTTP200; over-cap60×450KB completion36,032,179B/HTTP413 once with exact33,554,432B structural diagnostic, one WorkflowFailed and zero partial activities; fresh same-Worker follow-up completes, uploads0.
• Retained pending→completed-null uses one POST/four GETs and one accepted/completed event; default completed wait and unknown original GET key remain explicit. Readiness metric labels and task-kind observations pass.

Exact-tag portal 43457005358 build/deploy PASS. Live https://php.durable-workflow.com/deployment-audit.json binds SDK/presentation/published/workflow revisions to f9483bb and version3.18.2; Client query API and retained-read manual were fetched and verified. No source override was supplied.

All earlier false-green/empty-evidence, invalid-SHA and fixture-failure attempts retain NONPASS; only the corrected source/candidate and final registry results authorize this receipt. #414 can close. Wider #216, timeout-cleanup, #267/no4.0 and remaining #297 caller profiles remain separate. Root Docs/Sample adoption belongs to their owners; this receipt is the PHP handoff.

The normal maintainer annotated-tag push reported the existing tag-creation-rule bypass, as for3.18.1. No force/admin option or policy change was used; source, independent package review and all main gates preceded the push. General was notified immediately.

[rmcdaniel]

Root docs adoption is delivered via docs #537, merge 1d03e75bdcf6c6e8e978e43942eb5f884f180eb6, protected Pages43459730369 SUCCESS. All 16 changed public PHP/Python pages across eight locales, exact manifest and unchanged installers passed live readback.

Stable selection now uses PHP 3.18.2 / Python 2.17.2; exact manifest SHA256 61a7dd2e45b1226763e3d7612c9328b435b8c4bdb945047afb53ae8bac20c810. PHP's binary-query note and Python query-receipt guidance link the actual final installed receipts and live SDK guide anchors. Authoritative-envelope/optional-projection behavior and the named native3.9.1 linux/amd64 SQLite scope are explicit; PHP also names PHP8.3.36. Historical aggregate-size evidence keeps its original version scope, and no broader #216/timeout/parallel-policy activation is inferred. Docs has no remaining action for this scoped patch adoption.

[rmcdaniel]

Independent PHP-owner downstream readback completed after root#537 deployment: default public https://durable-workflow.com/stable-releases.json SHA256 is 61a7dd2e45b1226763e3d7612c9328b435b8c4bdb945047afb53ae8bac20c810 and selects PHP3.18.2. The public English PHP page contains the binary-query anchor, Avro adapter note and exact native3.9.1 named controls. This matches the published SDK415 receipt and exact-tag PHP portal audit; no fresh capability/#216/timeout claim is inferred. Root deployment receipt: durable-workflow/durable-workflow.github.io#537 (comment) .