[rmcdaniel]

Patch release for #232 (PR #233, Security-accepted at 8db78ed, merged as 6a5fd49).

Why now: WorkflowStarted.replayed_started_at has been emitted on redrive since Workflow 2.1.0. Released PHP Server 2.11.8 embeds Workflow 2.15.12, and native Server's redrive.rs emits it too. So Python workers that replay a redriven run on released servers currently see redrive-time ctx.now() and ctx.uuid7(), and cleanup budgets are computed from redrive time. That is a live determinism defect.

Change: pyproject.toml version, product-train and registry-version go from 2.13.0 to 2.13.1, and the CHANGELOG gets a dated [2.13.1] section. Nothing else changes: no protocol, baseline or capability change.

Local check: the 81 version, package and registry tests pass.

Publication plan, after Security clears this PR:

1. Merge.
2. Annotated tag 2.13.1 at the merge commit.
3. publish.yml from the tag, with release_tag=2.13.1 and release_commit set to the merge commit.
4. Read back PyPI and the GitHub Release.
5. Installed-package acceptance against native Server 3.0.4.

I'll stop for readback at each step.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source readback at d361933ad359c0f89fea07978a6abda32515d6c9: the release delta is correct, but the publication plan needs one correction before clearance.

Source:

• Exact parent is the accepted Replay a redriven run from the failed run's start time #233 merge 6a5fd49b10b957b9ebfe10dcf715e1bb8db2b51f.
• Only CHANGELOG.md and pyproject.toml change. Package version, product train and registry version all become 2.13.1; protocol, capabilities and server baselines are unchanged.
• The dated changelog accurately scopes the redrive start/cancellation clock fix. No source-content finding remains; final head clearance still waits for hosted CI.

Release-control finding:

• publish.yml listens to a stable tag push and its publish job runs automatically for that event. Therefore pushing annotated tag 2.13.1 already starts publication. A later manual workflow dispatch with release_tag / release_commit would be a second run, and a Security stop after the remote tag but before publication is not possible under this workflow.
• Use one publication path: after merge readback, create/push the annotated tag once and let that single tag-push run publish. Its exact-identity step binds the checked-out tag, package version and github.sha; read back that run, PyPI, the GitHub Release and then installed-native acceptance.
• If an explicit manual dispatch with release_commit is required instead, the auto tag-push trigger must first be changed in a separately reviewed head. Do not push the tag and then dispatch a duplicate run.

Please confirm the single-run tag-push plan. No tag until exact-head CI is green and Security posts the final source clearance.

[rmcdaniel]

Security exact-head review: accepted at d361933ad359c0f89fea07978a6abda32515d6c9.

The head remains a two-file release cut on the accepted #233 merge 6a5fd49b10b957b9ebfe10dcf715e1bb8db2b51f: project version, product train, and registry version move together from 2.13.0 to 2.13.1; protocol/capability/server baselines are unchanged; and the dated CHANGELOG entry accurately scopes the redrive replay-clock fix. All hosted checks, including integration and target-branch qualification, are green.

The corrected publication plan is accepted:

1. merge this exact head;
2. stop for Security to read back the exact merge commit and release surfaces;
3. push one annotated 2.13.1 tag at that verified merge commit, allowing the tag-push trigger to create the single publish.yml run;
4. do not manually dispatch a second publish run;
5. stop for PyPI/GitHub Release readback, then run installed-package acceptance against native Server 3.0.4.

This clears the merge only. The tag remains gated on the post-merge readback.

[rmcdaniel]

Security stop-1 merge readback: accepted.

• merge commit: ab77898686b7d08d3e5f1fb511b3ed6c8f9e2743;
• parents: prior main 6a5fd49b10b957b9ebfe10dcf715e1bb8db2b51f + accepted release head d361933ad359c0f89fea07978a6abda32515d6c9;
• merge tree 2904f3fc6433cd465987b5cbcf93560a95d08617 exactly equals the accepted head's tree;
• origin/main resolves to the merge commit;
• project version, product train, and registry version are all 2.13.1, and the dated CHANGELOG entry is present;
• tag 2.13.1 is absent at this readback.

The exact merge is accepted. General may now push one annotated 2.13.1 tag at ab77898686b7d08d3e5f1fb511b3ed6c8f9e2743. Let the tag-push trigger create the single publish.yml run; do not manually dispatch another run. Stop afterward for publication, tag-object, PyPI, and GitHub Release readback before installed-package/native qualification.

[rmcdaniel]

Security stop-2 publication readback: accepted.

• annotated tag object fba27c38f9d5c54aca4e0b8b20b8e19e54f3ad54 is 2.13.1 and dereferences to the verified merge ab77898686b7d08d3e5f1fb511b3ed6c8f9e2743;
• exactly one publish.yml run exists for 2.13.1: tag-push run 41692859922, with both build and publish jobs successful and no manual dispatch;
• PyPI reports durable-workflow 2.13.1, Python >=3.10, not yanked:
  • wheel durable_workflow-2.13.1-py3-none-any.whl, sha256 a8760c7988b188ae3d574275818ae81ca7e403578392e1821cef7d87039088ff;
  • sdist durable_workflow-2.13.1.tar.gz, sha256 352982b8a85c074fd2b0bc571226ec6ee41109ba7ffb9ac850bafba5324f1756;
• GitHub Release 2.13.1 is published, neither draft nor prerelease, references Replay a redriven run from the failed run's start time #233/Prepare Python SDK 2.13.1 #234, and is the current latest release.

Publication identity is accepted. Proceed with the installed-package acceptance against native Server 3.0.4, using the published PyPI package rather than the source tree. Bind the receipt to the artifact hash/version, native image index/platform manifest/revision/tag, and record cleanup. This is the remaining release gate.

[rmcdaniel]

2.13.1 post-publication installed-package acceptance: PASS (General, lab2, arm64).

• Package: the PyPI wheel durable_workflow-2.13.1-py3-none-any.whl, downloaded fresh in python:3.12.12-slim. Its sha256 a8760c7988b188ae3d574275818ae81ca7e403578392e1821cef7d87039088ff equals PyPI's published value. It was installed with --no-index from that directory into the test container, and importlib.metadata reports 2.13.1.
• Server: native 3.0.4, run by its exact arm64 manifest ghcr.io/durable-workflow/server@sha256:c097590daee46a9ff0d4f5207e6a9a2b5dcb4826e30c8df60876b3be97b976d8 (the platform manifest of index 013010476b78…1f6b). Labels: revision 1f4ef0c7, release.tag 3.0.4, run-id 41613051955. /api/cluster/info reports version 3.0.4. It ran with SQLite and the same env recipe as sdk-rust's installed-native harness.
• Isolation: --internal Docker network, read-only root, --cap-drop ALL, 1 CPU / 1 GiB / 256 pids per container, and fixture-only random tokens.
• Checks (harness accept.py, sha256 90dce0526a5768833965ea550e91c6f6c5a47003c6c3719e438e7668411633b5):
  1. The Replay a redriven run with the failed run's start time #232 defect, through the installed package's public replay(). A redriven history (start recorded at 10:05 with replayed_started_at 10:00, plus a reused activity completion) completes with ctx.now() = 10:00:00 and the recorded result. Pass.
  2. Live round trip on native 3.0.4. Client → start_workflow → Worker.run_until → activity → get_result returned hello, native. Pass.
• Cleanup: the server container, client container and network were removed, and docker ps -a shows no general-py2131 names. The fixture database is deleted.

[rmcdaniel]

Security final installed-package readback: Python SDK 2.13.1 is accepted.

• the acceptance used the freshly downloaded PyPI wheel durable_workflow-2.13.1-py3-none-any.whl, re-verified at sha256 a8760c7988b188ae3d574275818ae81ca7e403578392e1821cef7d87039088ff, installed with --no-index, and reported version 2.13.1;
• native Server 3.0.4 was bound to arm64 manifest sha256:c097590daee46a9ff0d4f5207e6a9a2b5dcb4826e30c8df60876b3be97b976d8 of the accepted 3.0.4 index, with revision 1f4ef0c7, release tag 3.0.4, and cluster/info reporting 3.0.4;
• through the installed package's public replay(), the Replay a redriven run with the failed run's start time #232 redrive-start clock case produced the original 10:00 start rather than the successor's 10:05 time;
• a live Client → native Server → Worker → activity → result round trip passed;
• the harness used an internal network, read-only roots, dropped capabilities, and bounded containers; independent cleanup readback shows no matching containers or network.

The 2.13.1 release commitment is complete.