Repository navigation
Conversation
|
rmcdaniel
left a comment
rmcdaniel
left a comment
There was a problem hiding this comment.
Security review at exact 50c256e23ecd6f16392dcc8613da32419375971d:
PASS (source/case boundary). The opt-in selector is main-only, registry-only, fixes SDK 3.18.2/source f9483bb2… and native 3.8.0/image 7988a235…, refuses candidate and conflicting qualifications before setup, and excludes the sibling Laravel job. The two live cases bind every callback to the selected workflow/run, workflow-task and distinct worker/native attempt identities; they require the exact durable retry records and monotonic gaps for [1,2,2,2] versus [0,0,0,0], then exact completion and worker deregistration. The legacy fixture is explicitly synthetic, separately replayed through the installed official Replayer, keeps its [1,0,0] recorded attempts byte-stable, and requires zero executor callbacks. The 50c256e sentinel correction makes that last refusal part of the corpus path rather than allowing the harness to reject the fixture before replay. I independently reran the four local-backoff selector controls, the four amended activity-identity selector controls, and the three Laravel disjointness controls; all passed.
HOLD (caller/integration, not source semantics). The exact workflow still pins setup-php-linux@411a14ac…. Current-head run 43592128094 and installed-worker run 43592128044 stop at that action's retained HTTP 404 before PHP/dependency/test execution, including the regression corpus and proposed installed case. Therefore there is no current-head PHP/corpus or installed local-backoff observation to borrow, and no dispatch should be selected until the normally reviewed central setup repair is integrated, this consumer pin is rebound, and fresh exact-head gates pass. No runtime/package/release claim is made by this review.
|
One evidence clarification to the source/caller review, with its caller/integration HOLD unchanged: exact head Each is terminal SUCCESS with 9,055 tests / 87,974 assertions / 56 declared skips. I re-read all four actual logs. This includes the corrected legacy fixture's official-Replayer path and zero-callback assertion; the original1809 fixture setup failure remains NONPASS. The separately named Regression corpus job, PHP8.3, static/package/docs lanes and published-worker run43592128044 stop before product execution at retired411a HTTP404. The aggregate CI remains NONPASS. The successful source lanes provide no stock PHP8.3 caller, installed local-backoff, package, main integration or release acceptance. Source/case PASS is recorded; central404/400 activation and qualification, bounded consumer pin adoption and fresh exact-head gates still precede any proposed installed invocation. |
The repeat-last fix shipped in PHP3.13.0, but shared219 still needs actual installed PHP delay evidence and explicit historical replay coverage. This adds an opt-in qualification to the maintained published-worker workflow using normal-registry SDK3.18.2/source+distf948 and immutable published native Server3.8.0/index7988. It changes no SDK runtime, package version or installer/profile.
The one proposed installed invocation runs two ordinary unprepared local-activity cases, five callbacks each: explicit
[1,2]must record and physically wait[1,2,2,2]; an omitted list must record zero delays and remain immediate. Actual monotonic callback gaps are bound to the exact workflow/run, worker/native attempt IDs and durable local ActivityStarted/ActivityRetryScheduled events. The managed Workers must complete and deregister. A 90-second process bound and existing teardown/evidence path remain in force.A separate installed-Replayer control consumes an appended synthetic legacy history with recorded delays
[1,0,0]. It must reuse the recorded failure, make zero local executor calls, finish with the expected command and leave fixture bytes unchanged. This is synthetic recorded-history compatibility; it does not claim an actual old-SDK producer or a previously seeded database. The official corpus also executes that immutable fixture. Existing corpus entries are unchanged.Before effects, the main-only published-tuple guard refuses candidate/source selection and conflicting qualification flags. The sibling Laravel installation job excludes local_backoff at job level. Inert causal controls exercise selector and cross-job refusals; PHPUnit controls refuse obsolete zero-after-list behavior, invented identities/foreign runs, forged elapsed timing and an undeclared default delay. Nonempty typed JSON and the retained installed lock are required.
Validation completed locally: four new inert selector controls, four identity/cross-job controls, five original tuple/pipeline controls, three Laravel metadata controls, YAML structure parsing and diff checks. Original head1809 source lint and the five new verifier controls passed across container-profile PHP lanes, but the full9,055-test suite exposed one new corpus harness setup error: the legacy workflow lacked the inert executor sentinel required before the Replayer can consume recorded history. The successor adds only that workflow to the existing sentinel list; existing zero-callback assertion remains mandatory. Corrected exact head50c256e passes all9,055 tests /87,974 assertions with56 declared skips on PHP8.1,8.2,8.4 and PHP8.1/Carbon2, including the complete official replay corpus and five new verifier controls. Original1809 source NONPASS is retained. All467 packaged file bodies/modes equal accepted main614770; this source-only successor changes no shipped runtime bytes. All stock PHP8.3 lanes separately refuse unchanged411a before dependencies/SDK on HTTP404; direct read-only checks confirm its fixed Ubuntu24 archive739209532 is currently Not Found on both anonymous and authenticated metadata. No profile fallback or blind retry is selected. The .github helper owner has the exact blocker; The complete CI43592128094 and published-worker43592128044 results remain terminal NONPASS because static/stock/package lanes cannot enter the required profile. These successful container-source lanes do not waive those gates; no installed backoff attempt has occurred. No local PHP or new installed backoff invocation has run. Independent source/case PASS now binds exact50c256e; caller/integration HOLD remains on retired411a. Actual source-lane clarification binds all four successful current-head PHPUnit/corpus logs without borrowing a stock or installed result. Central404/400 protected activation and original hosted qualification precede the prepared bounded consumer pin adoption, fresh exact-head caller checks, normal main integration, one installed observation and independent artifact review. The parallel pagination PR425 owns its own source and installed gates; any workflow composition will be rebound and checked.
PHP's explicit-list API gains no generated-policy maximum field; Python's generated default cap remains separately owned. No #419/#420 continuation, prepared-local v2 revival, retired PHP Server, new SDK release or #421 substitution is selected.
Tracks durable-workflow/.github#219.