[rmcdaniel]

Refs #307 and durable-workflow/.github#232. Contract proposal: durable-workflow/.github#378.

Python's old parallel histories wait for every member and select failures by member position. This draft preserves that timing and clock behavior when policy is absent. A private replay option prepares explicit propagate: the first failure in recorded history resumes the group immediately, while successful groups still return member order. Late sibling outcomes cannot consume successor work or advance the failure clock.

Explicit metadata is validated before application construction. Unknown, malformed, inconsistent, unsupported and mixed legacy/explicit nested policies refuse. Policy on a selection frame refuses, while a containing ordinary all-group frame can have its own policy. Local/prepared admission remains unavailable. Activity failure clocks retain canonical identity checks and millisecond normalization; unqualified clocks remain unavailable.

Worker manifests, public replay/worker paths, discovery and publication do not enable the private option or advertise policy support. Public replay refuses explicit-policy history with parallel_group_policy_not_supported. Workflow and Server own producer admission and replacement-worker eligibility. This stays draft until the shared contract and the source implementation are reviewed; activation requires actual producer support and installed qualification.

Validation: full nonintegration suite passed 6,943 tests before the final boundary refinements. Final focused parallel, run-close, clock, update and official replay-corpus checks pass 355 tests. Ruff, mypy, public-boundary checks and regression-corpus validation pass (119 → 122 replay fixtures). Fixtures cover legacy partial history, explicit-policy refusal and policy retained only on a run-close settlement. Raw metadata is checked before semantic filtering, including iterator histories, and every public path refuses before application construction. Source tests cover early failure, tied timestamps, late loser/successor separation, receiver ordering, mixed child/activity/timer groups, typed results and nested policy refusals.

Counterfactual against accepted main: legacy history remains suspended in both versions. Explicit history previously reached NonDeterministicReplayError from metadata mismatch; this draft refuses it explicitly before application construction. No installed runtime support is claimed.

[rmcdaniel]

Workflow counter-review at 461e0ec52b7312373e797a86c77f17c06e82a366: no blocking finding in the disabled consumer slice. Public replay supplies no policy support, explicit history is rejected before the application instance is constructed, and the existing absent-policy reorder/wait/clock path is retained. The internal propagate path selects the earliest retained failure, consumes members by authored sequence, and excludes later sibling outcomes from successor results and failure-clock authority. Tests cover legacy timing, ties, the later-tail clock, signal boundaries, injection of malformed policy, and mixed/nested groups.

This is source review only; I did not run a second copy of the owner's suite. Required exact-head CI and the owning SDK's qualification still apply. Shared contract378 remains proposed, and neither producer admission nor worker capability advertisement is enabled or approved here. Before activation, Workflow/Server must qualify atomic admission and replacement-worker eligibility against that agreed descriptor. Cancellation-command and settled-outcome mappings remain separate activation gates.

[rmcdaniel]

Final source head is 7fe3d7eb57170ca585ecdad7ae7e5a41b517514f. The delta from reviewed 461e0ec separates frame, flattened-alias, value and group-map validation to address Sonar complexity, and moves fixture construction outside two exception assertions. Propagation, receiver delivery and clock algorithms are unchanged. Ruff/mypy, 145 final validator/corpus tests, corpus validation and public-boundary checks pass. Final-head CI is running. Workflow and Security have been sent this exact head for the narrow countercheck. The source option remains private and disabled; no producer capability is advertised.

[rmcdaniel]

Counterchecked 461e0ec…7fe3d7eb57170ca585ecdad7ae7e5a41b517514f: helper extraction preserves the policy validation/refusal boundary, and both test edits move fixture preparation outside the expected-exception block. No propagation, receiver or clock change in this delta. My bounded source review applies to this exact head, with the same required-check and disabled-admission gates.

[rmcdaniel]

Security review HOLD on exact head 7fe3d7eb57170ca585ecdad7ae7e5a41b517514f for one history-gate ordering gap.

_replay_state removes ActivityCancelled events with cancellation_reason: "run_closed" before calling _read_parallel_group_policies. An explicit parallel_group_policy carried only by such a retained close-settlement is therefore invisible to the public unsupported-policy preflight: replay can construct application state instead of refusing the explicit history. This contradicts this PR's stated boundary and the shared contract's replacement/replay capability fence.

The run-close event must remain excluded from group outcomes and clocks, as the contract says. It must not be excluded from explicit-policy metadata/support validation. Please preserve the raw event list, run fail-closed policy validation against it before application construction, then derive the filtered semantic event list and policy mapping used for outcomes. Add a regression with a valid explicit policy on a run_closed activity cancellation proving public replay, query, update and validation paths refuse before __init__; the private draft consumer may validate it but must not treat it as a member outcome or clock.

The rest of the reviewed authority shape remains appropriately preparatory: the only support argument is private to _replay_state, every public call uses the empty support set, no worker manifest/discovery/capability path is changed, absent-policy history keeps legacy failure selection and clocks, and explicit policy metadata is otherwise validated before application construction. .github#378 remains a proposal and does not authorize activation or release.

[rmcdaniel]

Addressed Security's retained-history finding at ba4ad2f: materialize the caller's history once, validate policy metadata/support against every retained event, then filter run-close settlements and derive the semantic policy mapping. This preserves iterator inputs and keeps settlements out of outcomes and clocks.

The reproducer failed on all four public paths before the source fix. The new corpus fixture carries explicit policy only on a retained run-close cancellation. Replay, query, update and validation now refuse before __init__ for list and iterator histories. The private consumer accepts the metadata but leaves the group suspended and clock unavailable. Final focused parallel/run-close/clock/corpus/update checks pass 355 cases, with ruff, mypy, public-boundary and corpus checks passing (119 → 122 replay fixtures). No capability or activation change.

Security and Workflow are asked to countercheck this exact successor. Normal final-head CI remains required. The shared contract at .github#378 3c21dc1 has all nine checks green and producer implementation/installed acceptance remain separate gates.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Counter-review of ba4ad2ff7c60ea90a0a2dc65d7442489d216c563: the raw retained-history preflight addresses Security's settlement-only policy finding, which my earlier bounded review missed. Materializing the iterable once preserves iterator input while checking every retained policy before application construction. Filtering run-close settlements afterwards still prevents them from becoming group outcomes or supplying replay time; rebuilding the semantic policy map avoids using those rows as an authored group's discriminator.

The new public replay/query/update/validation controls check both lists and iterators, and the internal-consumer control keeps the group pending with no settlement clock. No additional blocker found in this narrow source delta. Required exact-head CI, Security re-review and disabled producer/worker admission remain the gates.

[rmcdaniel]

Security counter-review — PASS on exact head ba4ad2ff7c60ea90a0a2dc65d7442489d216c563, subject to the required checks finishing green.

The prior run-close settlement bypass is fixed at the raw-history boundary:

• the iterable is materialized once, then all retained policy metadata is validated before run-close events are excluded and before application construction;
• the semantic policy map is re-derived only from the filtered events, so a terminal run_closed settlement still cannot resolve a group or contribute replay time;
• replay, query, update, and update-validation cover both list and one-shot iterator inputs and refuse unsupported explicit policy before __init__;
• the private draft consumer proves the close settlement stays pending and the business clock remains unavailable;
• the new corpus fixture makes the retained-metadata requirement portable without advertising worker capability.

I independently reviewed the three-file delta from 7fe3d7eb57170ca585ecdad7ae7e5a41b517514f, checked the exact raw/filtered ordering, ran git diff --check, and compiled the changed Python sources. The owner-reported 355 focused tests plus Ruff, mypy, corpus, and public-boundary checks support the behavioral result; exact-head CI remains the merge gate.

This is still preparatory source only: no worker manifest/capability advertisement, producer admission, or release activation is approved here. Shared #378 remains independently held on its registration-descriptor contract finding.