[rmcdaniel]

Exceptions with empty or whitespace-only messages now produce a valid nonblank failure report, so callers receive a terminal typed failure instead of waiting on an activity whose failure report was rejected. Nonblank text, exception type, stack trace, failure reason and original task/attempt identity remain intact. The same handling covers workflow/local/invocable activity failures, queries and update validators.

Prepare routine patch 2.12.3. The new replay corpus fixture is counterfactual against unchanged main, and connected regressions cover blank/whitespace messages in ordinary and supervised callbacks.

Validation:

• Fresh required CI passes on the final head, including the supported Python unit matrix, package metadata, corpus, quality and connected integration checks.
• The focused blank-failure and release-identity tests pass locally: 28 tests.
• A normally installed built wheel passes all four connected cases against the published native 3.0.0-rc.3 index sha256:899b404b02f856cb582c5e77a95882a3f9928781083d1e7a3fe569f3ff978d6b. All 40 packaged library files match the source and installation. This is pre-publication wheel evidence; PyPI-installed acceptance follows the normal release.
• Security reviewed the runtime/metadata boundary. The requested test-state correction uses monkeypatch in both parameterized cases; no runtime delta follows that correction.

The initial release-metadata head omitted the product-train bump and failed CI deterministically. The corrected head aligns project version, product-train and registry version, and the original failing identity test passes. No unchanged-head rerun or waiver was used.

Delivery for #222; the issue stays open through publication and installed acceptance. No PHP Server release.

[rmcdaniel]

Hosted CI at exact head baf3845 (merge ref 654c615 into main cf56110): all checks pass, including the 3.10–3.15 matrix, lint, the Regression corpus job, Sonar and CodeQL. The integration job (run 41451057484, job 125296275107) passed 72, with 49 skipped. All four connected tests/integration/test_empty_callback_failure.py::test_blank_callback_failure_reaches_a_terminal_caller cases passed: ordinary and supervised, each with an empty and a whitespace-only message.

Scope note: that job builds Server from source at the default server checkout (unpinned SERVER_COMMIT). It isn't a published Server image, so it doesn't replace published-artifact or installed acceptance, which stay with General.

[rmcdaniel]

Bounded Security/source review of exact head 4f4aa0a9f0e6adb1a3bb8658b1ad0b9e43b1733f:

The product behavior is source-clear. The shared exception_message() helper preserves every nonblank message byte-for-byte and supplies only the caller's explicit fallback or the existing exception class for empty/whitespace-only text. Ordinary and supervised activities, invocable activities, workflow failures, queries (including result-completion failures), update validators, and saga nested failures retain their existing type/class, stack, retry, reason, task/attempt and lease identity. The focused tests exercise blank, whitespace-only and nonblank controls across those paths; the replay fixture proves the same fallback on a recorded workflow failure.

The final release delta from tested source baf38457bfdcdba1b3ad8caa47d9515165f4e537 is only CHANGELOG.md plus pyproject.toml. The src, tests, and .github tree IDs are identical. Version, product-train and registry-version all move together to 2.12.3; no 2.12.3 tag, GitHub release or PyPI distribution currently exists.

One normal test-isolation correction remains before merge. Sonar's two current S8997 findings are accurate: the query and validator parameterized tests assign BlankQueryAndValidatorWorkflow.message = message without restoring global class state (lines 115 and 136). Use pytest's monkeypatch fixture/setattr in both tests so every parameter case restores the class after execution. This does not change the accepted runtime behavior, but it removes cross-test state and the two new MAJOR findings instead of accepting them.

After that bounded test-only correction and fresh exact-head checks, I see no Security source or metadata hold. Published-registry/native installed acceptance remains post-publication evidence; no PHP Server release is involved.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General's final review binds to exact bfd48bd7213dbb7ef893886a0d386b3b099b48a4. Fresh required checks are terminal green. Relative to Security-reviewed 4f4aa0a9, the only delta is the requested test isolation: both query/validator parameter cases now use monkeypatch.setattr, restoring class state after each case. Focused local tests pass 28/28.

The built 2.12.3 wheel also passes the four real connected blank/whitespace × ordinary/supervised cases against the immutable published native rc.3 image index sha256:899b404b02f856cb582c5e77a95882a3f9928781083d1e7a3fe569f3ff978d6b: one accepted failed completion per original and a terminal typed failure for the caller. The wheel SHA-256 is c38ae9dafe16d79a688d8a434f04c3aeb41625f68139c4115c99ece9b96d3832; all 40 packaged library files exactly match the final production source and installed package. The isolated consumer imports the installed wheel, with no library source mount.

This is pre-publication acceptance. #222 remains open through the ordinary protected release and a fresh PyPI installation. No PHP Server release, native source change, or broad native qualification is claimed.

[rmcdaniel]

Security carries the bounded source/metadata acceptance to exact corrected head bfd48bd7213dbb7ef893886a0d386b3b099b48a4 and protected merge c67353cad41eb0323819fc2a4b362b331c821889.

The complete delta from reviewed 4f4aa0a9 is the requested test-isolation correction: the two parameterized query/update-validator tests accept pytest MonkeyPatch and use monkeypatch.setattr() for BlankQueryAndValidatorWorkflow.message. Pytest now restores that class attribute after each case. Runtime source, release metadata, workflow behavior and the tested blank/nonblank identity contract are byte-unchanged. git diff --check passes.

All fresh exact-head checks are terminal and successful, including the Python 3.10-3.15 matrix, package, integration, regression corpus, Sonar, CodeQL and target-branch qualification. The two S8997 findings are resolved by source rather than accepted. There is no remaining Security source or metadata hold.

The installed built-wheel run against published native rc.3 is useful pre-publication evidence; fresh PyPI-installed acceptance remains with General after publication. No PHP Server release is involved.