[rmcdaniel]

Qualify the published Python Client's original keyed-update readbacks after the producer's actual published3.8 SQLite seed is upgraded to qualified native3.9.2. Open/completed/continued readbacks retain original durable identities with explicit unknown intent, changed-name conflicts and GET pending/completed-null outcomes. Historical NULL-key signals receive history compatibility checks only.

The conformance controllers previously reopened copied databases, configuration and evidence through mutable workspace paths. This change holds no-follow directory/file identities through use, creates evidence exclusively through retained descriptors, and validates mounted database/directory identities inside the published image before executing its native entrypoint. Captured-ID cleanup uses an independent empty configuration namespace. It also retains the qualified captured-input/fixed-interpreter boundary. The copied database is private; every original business row/schema and every tagged migration journal field is checked, with full logical snapshots across readbacks.

Final source is 377a3eeeece605da675e4b628c308dd2e6be527c. All20 exact-head checks and130 focused controls pass. The exact literal trusted Git bootstrap, two pre-open substitution controls, fresh installed physical/response-loss packets, tuples and cleanup bind the final observations. Qualifying execution must use that literal bootstrap to verify frozen Git bytes before compile/exec; opening the host controller pathname first is insufficient. Independent exact-source/evidence Security counter-review remains required before merge/qualification. Earlier NONPASS/HOLD observations remain separately retained.

Producer accepted contract is Server1210 a09f156399416216d2f097c257a2164f83c7eda7; original seed execution stays 09a4ccda3da11853606af031a8970bbde4b2d6ec. Both physical and loss runs use approved registry SDK2.17.2 and published qualified native3.9.2, fresh fixed official Python/hash-locked wheel environments, at most two1CPU/1GiB/256PID containers, and complete exact-ID/volume/database/token cleanup.

Tracks durable-workflow/.github#216. The shared boundary correction scopes merged320 explicitly. Synthetic legacy322 remains separately held until the corrected boundary is ported and its exact-source cells repeat. No product source, package publication, capability advertisement or blanket216 completion is claimed.

[rmcdaniel]

Producer source gate is now resolved: Server1210 merged normally at a09f156399416216d2f097c257a2164f83c7eda7, with accepted handoff6860138558. The actual original seed execution remains 09a4ccda3da11853606af031a8970bbde4b2d6ec, driver SHA01c0fa12, distinct from the accepted contract source. Backup7d18, packet8c72 and physical manifestceb469 are unchanged. The old transient HTTP504 prerequisite is not carried forward.

Current next action/owner: sdk-python must port the corrected SDK320 captured-input/fixed-interpreter provenance boundary into this draft before any physical execution. Its current host-interpreter/path execution remains unqualified under the same root finding as320. Then run the independently installed physical readback on an owned copy, with exact journal/business-row preservation and complete request-window snapshots, followed by Security review/normal CI. Original NULL-key signals remain compatibility only. The accepted producer handoff does not itself qualify this consumer.

[rmcdaniel]

Current qualification: HOLD. Security identified a shared mutable workspace identity gap after the earlier review. Preserve this as a historical business observation; it does not currently authorize qualification. Correction and fresh source-bound repeats are tracked in SDK321.

Physical SQLite upgrade and independently installed Python readbacks PASS observation at frozen c499145a097e3ebde75a365aa83beb8bcf4a6153. Independent Security counter-review and exact-head checks remain required before qualification/merge.

The accepted producer contract is Server1210 a09f156399416216d2f097c257a2164f83c7eda7. Original seed execution remains 09a4ccda3da11853606af031a8970bbde4b2d6ec, driver SHA-256 01c0fa1251ac3c809723e58d71817881fe2c5c9498579bc4c2e6097324a3618b. Frozen backup 7d1826f7681342bb3a5974509648e2e8d75e7a21d262f65f3ec1f58727ccbc0c and packet 8c728ce827df3a11621dfb0e82cdd404bbab48784182a5e92c8d632d49047fc5 were captured and rechecked unchanged. Only an owned copy was upgraded.

Tuple: registry SDK2.17.2 / wheel 7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc; qualified published native3.9.2 / source 5614274d2629d03f92932a07dfee0fb10349ddd9 / index sha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9 / linux-amd64 child sha256:813c9337c44be7d497efd29e1b463546519e488aa796b5ecf9dfc6f4f10d2128. Official Python3.12.16 index sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df, amd64 child sha256:0f086103b026048cc50cb5da25ec435c023c5241a83fc44daea593377abc61c4. Registry installation verified all46 SDK runtime files against the approved wheel. All nine dependency wheels were hash-locked, with no direct URL or repository fallback.

Run: 2026-11-13T18:27:04.572591Z–18:27:14.302533Z; actual installed API window 18:27:12.929719Z–18:27:13.123227Z. Upgrade CLI reported SQLite schema12→13. Full schema/business rows were preserved, allowing only the exact empty intent catalog, native marker transition and fully checked tagged consolidated journal. Tagged step SHA-256 fc3ad1730682c09704027dcbabc17cd6ded9c642a3ff20d7988d5f4b4a5726fd; cumulative journal SHA-384 53b752529a1f7addaefe62ab61160dd42b3990f805cfdc4ecd1b48927a6c2f7ce42526fc04522ac887a37208f343fc73.

Outcomes:

• Original keyed updates in open/completed/continued states each passed four concurrent changed-input retries, retaining command/run/update/accepted-at identities with retained:true and explicit intent_verified:false. Changed names returned typed request_id_conflict with the original retained command ID. GET-only reads distinguished pending from completed-null, including typed update_outcome() is None for completed cases.
• All six original histories matched the producer packet exactly. The three historical NULL-key signals are compatibility-only checks; no fabricated keyed-signal recovery is claimed. Python uses its existing unscoped update route, so this does not claim an explicit-run update helper.
• Complete typed logical snapshots before consumer start and after its return matched SHA-256 91b39f6292dde7d80aa67370bd3343d9f50fd97849aeaeacf71de28132b66fc4. This includes the registry installation interval and ends before shutdown. No row exemption or post-stop comparison was used.
• All12 captured source/data roles passed post-call identity checks. Fixed interpreter/image identity was rechecked; the full1164-file/28008350-byte private environment inventory matched before/after. Interpreter binary SHA-256 4dbf3143240288fb2170257ffaa7bd030cdda5d2703d1f5f30b627042267e2e3; requirements SHA-256 7102fdc18f3ba8c29e5b05bcfd7a2a29f36c7ab48d2cc03fd9ad5b9a52398e47.
• Captured upgrade/runtime/consumer IDs respectively bdb35e110b9b68f56462bddb4f7ee3eb6eb511c5b9d58763c985a583516df9c7, 1b7a70467debbbdb1936fd0b6d67592a2ae2a3470775aace7b320e9c3b21b64b, 833204382e53eb5d66fd1b2c29f97759a0f02d9adb2a35cd3c16dcce0dd5a861 all have verified absence and removed anonymous volumes, with no OOM. Independent exact-ID absence checks passed after return. The copied DB and fixture credential are removed; original backup/packet are unchanged.

All101 inert capture/ownership/physical controls and Ruff passed. This is one consumer-specific physical-upgrade observation. Synthetic legacy transforms, other backends and blanket shared216 acceptance remain separate. sdk-python owns review/check completion, then the remaining synthetic adapter using Rust's accepted helper.

Retained sanitized evidence identities: run.json SHA-256 ddf903a0267b0213d11c9cf8560cadecd36445fbc14dcacb9e857b45bf1de2de; consumer.json SHA-256 7640ca53bb7f33a53b681e25046d24451e4e1ae5279b55fd1a2eeb6e8d7f366d.

[rmcdaniel]

Security review: HOLD on exact c499145a097e3ebde75a365aa83beb8bcf4a6153 and its installed receipt.

The frozen inputs, product assertions, full-ID cleanup, and retained evidence are coherent. I independently matched the exact Git-source hashes, producer backup/receipt hashes, helper, tagged SQL step, wheel, complete before/after logical fingerprint, installed environment inventory, and all three container IDs. The IDs are absent on the execution host, the original producer inputs still hash exactly, and the 66 focused source controls pass independently.

One trust-boundary gap remains in run_physical_readback.py. The controller correctly holds every source/data input, but the copied database and evidence workspace are then used only through mutable pathnames:

• root, database, docker-config, and fixture.env are created without retaining and rechecking their parent/directory/file identities;
• upgraded.sqlite is written once, then every snapshot and the Docker bind mount reopen copied / database by pathname;
• the final logs and JSON evidence are also reopened by pathname.

Consequently, a parent/directory/file rename or replacement after the input capture can substitute the database that becomes the controller's baseline, the database mounted into the upgrade/runtime containers, or the evidence destination. The original frozen backup and other captured-input rechecks still pass because they do not bind the new copied file or its mount path. The current tests cover source/data substitution, but not copied-database parent/file substitution or evidence-root replacement.

Please retain no-follow descriptors and original identities for the output root, database directory, copied database, Docker config, and credential; recheck the exact path/inode chain immediately around snapshot and container create/start boundaries and again before a complete result. Write retained evidence through the held private directory with no-follow/exclusive regular-file checks. Add predecessor-failing controls for at least copied-file replacement, database-directory replacement, credential/config replacement, and evidence-root/report substitution. Then repeat the exact installed physical cell from the corrected source.

Until that successor and repeat are reviewed, the current run remains a useful product observation but not an accepted installed physical-upgrade receipt. No finding changes the producer backup, Server 3.9.2 tuple, package contents, or the observed SDK behavior.

[rmcdaniel]

Qualification is HOLD following Security's workspace-identity finding. The frozen input/product/ID evidence reconciles, but mutable paths for copied DB, configuration, credential and evidence do not yet have the required held workspace identity. The installed observation is preserved; it is not currently sufficient for qualification.

sdk-python owns the shared workspace fix on321: held no-follow directory/file identities, checks around create/snapshot/mount/report use, predecessor-failing substitution controls, then fresh exact-source physical and response-loss repeats. The same common boundary affects merged320 and the preparatory322 controller, so neither earlier qualification nor synthetic observations will be carried as current authority until scoped correction/review. No SDK product failure or package release is inferred. Existing capability gates remain unchanged.

[rmcdaniel]

Workspace-corrected physical attempt at ae35b2e7928497e461c85a75c0552350a36b4ea8 is RUNNER-BLOCKED/NONPASS before the schema CLI executed. Docker create succeeded, but OCI/runc rejects the held /proc/<controller-pid>/fd/<directory> bind source with MS_BIND|MS_REC: invalid argument. A separate tiny credential-free/no-network marker control reproduced that exact mount error, then removed its captured container. No product failure is inferred and no runtime/consumer ran.

The captured upgrade ID and anonymous volumes are absent; private copied DB/credential were removed; original frozen inputs are unchanged. The common held workspace controls remain necessary. sdk-python will use the checked canonical bind path with an immutable-image preflight that verifies mounted directory/database inode identities before executing the published native entrypoint. The host will retain descriptors and recheck before/after create, startup, snapshots and evidence; no runtime mount protection will be disabled. Fresh exact-source repeats and independent review remain required for both physical321 and response-loss320.

[sonarqubecloud]

Quality Gate passed

Issues
9 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh held-workspace physical and response-loss repeats PASS observation at exact 377a3eeeece605da675e4b628c308dd2e6be527c. Independent source/evidence counter-review and normal exact-head checks remain required; earlier320/321 qualification is not automatically restored.

Both runs use registry SDK2.17.2 / approved wheel 7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc, qualified native3.9.2 source 5614274d2629d03f92932a07dfee0fb10349ddd9 / index sha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9 / amd64 child sha256:813c9337c44be7d497efd29e1b463546519e488aa796b5ecf9dfc6f4f10d2128. Official Python3.12.16 index sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df / amd64 child sha256:0f086103b026048cc50cb5da25ec435c023c5241a83fc44daea593377abc61c4 supplies fresh hash-locked registry environments. All46 installed SDK files and the full environment inventories match before/after.

The physical run preserves Server1210 accepted contract a09f156399416216d2f097c257a2164f83c7eda7 separately from actual seed execution 09a4ccda3da11853606af031a8970bbde4b2d6ec. Frozen backup7d18/packet8c72 and all declared inputs remain unchanged. Exact tagged schema12→13 marker/journal/empty intent catalog changes pass every row/schema check. All six original histories match; three original keyed updates in open/completed/continued states pass four concurrent changed-input retained retries with unknown intent, typed changed-name conflicts and GET pending/completed-null outcomes. Original NULL-key signals remain compatibility-only.

The separate response-loss run passes all six workflows/eight complete committed response drops, stable generated/explicit keys across automatic/manual retry, concurrent duplicate/conflict controls, original identities after closure/continuation and one business execution. It binds accepted proxy117118c8/bd1e8ccb. No synthetic legacy or blanket216 result is borrowed.

Workspace correction: held no-follow directory/file identities, immutable config/credential bytes, retained exclusive evidence creation descriptors, before/after guards around snapshots/lifecycle/report writes, and published-image mounted-inode preflight before native execution. Cleanup is independent of mutable workspace configuration and remains captured-ID/ownership-label based. All130 focused controls pass, including predecessor-following substitutions, independent preflight refusal and the fixed empty kernel configuration namespace. The ae35 OCI bind NONPASS and all earlier held observations remain preserved.

All five exact captured containers and anonymous volume sets are independently absent after both returns; private copied DB and fixture credentials are removed, with no OOM. Sanitized evidence:

{
  "physical": {
    "runner_commit": "377a3eeeece605da675e4b628c308dd2e6be527c",
    "started_at": "2026-11-13T18:58:24.115915+00:00",
    "finished_at": "2026-11-13T18:58:33.461194+00:00",
    "complete_observation": true,
    "workspace_identities_rechecked": true,
    "input_identities_rechecked": true,
    "interpreter_identity_rechecked": true,
    "cleanup": {
      "containers_and_volumes_absent": true,
      "private_database_removed": true,
      "credential_removed": true
    },
    "cleanup_by_id": {
      "upgrade": {
        "id": "906dad27b27edc59dd3c1d0e8ecf32c6f38b5cfdf3ad28e267e2b6eae57bd494",
        "absent": true,
        "volumes_absent": true,
        "oom_killed": false
      },
      "runtime": {
        "id": "9cf2dce0a71aca9577dd81ba0f7c7f38b3c911c4e912213c898de6da3376a8b1",
        "absent": true,
        "volumes_absent": true,
        "oom_killed": false
      },
      "consumer": {
        "id": "9f923df1d3937720d1cb0ee5f470ed4c395576d60a2eb68eb9f3803714a3885b",
        "absent": true,
        "volumes_absent": true,
        "oom_killed": false
      }
    },
    "evidence_sha256": {
      "run.json": "4b479fc48373492ee9ac4a64ea17db1b1eb5f1f8087bb17f1ab10cd0e6fd9912",
      "consumer.json": "8781a9dbe3fcad73b4bd83d067fec861bd3b1e6013b87f02a09da4c1e80c3034"
    },
    "environment": {
      "interpreter_sha256": "4dbf3143240288fb2170257ffaa7bd030cdda5d2703d1f5f30b627042267e2e3",
      "venv_config_sha256": "581a435ef7733b8968506d065db41428059accefe4e5bb99fb72565f5fa2695c",
      "environment_inventory": {
        "sha256": "3d86d5c205424369068f78e2ddb39829e6970b3522c51a0242f09b00a74b9dae",
        "files": 1164,
        "bytes": 28008350
      },
      "post_inventory_equal": true,
      "requirements_sha256": "7102fdc18f3ba8c29e5b05bcfd7a2a29f36c7ab48d2cc03fd9ad5b9a52398e47"
    },
    "snapshot_before": "0620b449c9bf6706a6483d896ad484926c68b2e90c080526a8a675e572b60755",
    "snapshot_after": "0620b449c9bf6706a6483d896ad484926c68b2e90c080526a8a675e572b60755",
    "upgrade": {
      "backend": "sqlite",
      "from_schema_version": 12,
      "schema_version": 13,
      "status": "upgraded"
    },
    "original_inputs_unchanged": true
  },
  "loss": {
    "runner_commit": "377a3eeeece605da675e4b628c308dd2e6be527c",
    "started_at": "2026-11-13T18:58:55.505083+00:00",
    "finished_at": "2026-11-13T18:59:08.042640+00:00",
    "complete_observation": true,
    "workspace_identities_rechecked": true,
    "input_identities_rechecked": true,
    "interpreter_identity_rechecked": true,
    "cleanup": {
      "containers_and_volumes_absent": true,
      "credential_removed": true,
      "oom_killed": false
    },
    "cleanup_by_id": {
      "runtime": {
        "id": "3843016c6c7f2c6ccacb1768d853c72480f5e18b50aa8def8350c62a9a445831",
        "absent": true,
        "volumes_absent": true,
        "oom_killed": false
      },
      "consumer": {
        "id": "126e5635318813a21485ee29d3ad00008b45c4f883f4d153554251a6d6116ba1",
        "absent": true,
        "volumes_absent": true,
        "oom_killed": false
      }
    },
    "evidence_sha256": {
      "run.json": "6ae20e90c6e447d3b26a0a4ac17da2ba0e9cf63ce258d73d07e1a4af300616e9",
      "consumer.json": "045e862559d985f656a7655383d9c146678214c54cd17a324548622543eb3ccb"
    },
    "environment": {
      "interpreter_sha256": "4dbf3143240288fb2170257ffaa7bd030cdda5d2703d1f5f30b627042267e2e3",
      "venv_config_sha256": "1283df07cfa353d86f562f6b6e0db1ea757812b5723cd430e4f8366be48b0e18",
      "environment_inventory": {
        "sha256": "5cc596709590e04c5288e6d5de471faafbfc13a01ce643c563301a410ca22e96",
        "files": 1164,
        "bytes": 28008350
      },
      "post_inventory_equal": true,
      "requirements_sha256": "7102fdc18f3ba8c29e5b05bcfd7a2a29f36c7ab48d2cc03fd9ad5b9a52398e47"
    },
    "workflows": 6,
    "deliberately_lost_successes": 8
  }
}

sdk-python owns the final source/evidence review and exact-head checks, then normal merge/tree verification and the corrected322 synthetic repeats. No product/package release or capability activation is requested.

[rmcdaniel]

Security review update: exact 377a3eeeece605da675e4b628c308dd2e6be527c closes the prior workspace/canonical-bind/cleanup findings once the reviewed controller is running, but the two 18:58 installed observations remain HOLD for one outer invocation distinction.

Those commands opened the host controller pathname before its own Git/input/held-identity guards ran. A same-owner pre-open path replacement can therefore execute different controller bytes and let the replacement become its own authority. This does not invalidate the inner correction or indicate compromise; it means the current run/consumer JSON is observation evidence, not qualification.

The owner is repeating both bounded cells through a literal trusted bootstrap that obtains the exact 377a Git blob, checks an independently fixed SHA-256 before compile/exec, and supplies only the reviewed __file__ context needed by the existing guards. Final review will bind the bootstrap bytes/hash/invocation, a predecessor pre-open-swap refusal, and fresh physical/response-loss run+consumer hashes and full-ID cleanup. The earlier ae35 OCI-bind NONPASS and the current direct-path observations remain preserved rather than inherited.

[rmcdaniel]

Final literal-bootstrap repeats PASS observation, exact controller source 377a3eeeece605da675e4b628c308dd2e6be527c. All20 exact-head checks and130 inert capture/workspace/ownership/physical controls pass. Independent Security counter-review of this exact invocation and both new packets remains required before qualification/merge. The earlier18:58 pathname-invoked observations remain HOLD; no prior qualified claim is carried forward.

The trusted invocation uses /usr/bin/python3 -I -B -c with these exact UTF-8 bootstrap bytes (including final newline), SHA-256 e6ebeebd0b9bc1f77100d0cc788913ad0b1371c1e29c4eba2a493ac2de2abda5. It obtains the frozen Git blob, checks an independently fixed SHA-256, then compiles/executes only captured Git bytes. It never opens the host controller as executable source. Only the reviewed logical __file__ context is supplied to the code.

import hashlib, os, subprocess, sys
from pathlib import Path
commit = "377a3eeeece605da675e4b628c308dd2e6be527c"
targets = {
    "physical": ("scripts/conformance/command_keys/run_physical_readback.py", "dad62d6271fb9affad651b58b62193085aaf95625f906d9bbc99846a78156799"),
    "loss": ("scripts/conformance/command_keys/run_response_loss.py", "006c5c45cfd43f88bf4af3d1cd19fde6e54e10c0a183dff08c3985f41e0bd488"),
}
relative, expected = targets[sys.argv.pop(1)]
data = subprocess.check_output(
    ["/usr/bin/git", "show", commit + ":" + relative],
    env={"PATH": os.defpath}, timeout=10,
)
if hashlib.sha256(data).hexdigest() != expected:
    raise ValueError("reviewed controller Git bytes differ")
context = {"__name__": "__main__", "__file__": str(Path.cwd() / relative)}
exec(compile(data, context["__file__"], "exec"), context)

Invocation: /usr/bin/python3 -I -B -c "$BOOTSTRAP" physical --runner-commit 377a3eeeece605da675e4b628c308dd2e6be527c --wheel "$WHEEL" --baseline "$BASELINE" --seed "$SEED" --snapshot-helper "$HELPER" --step-sql "$STEP" --output "$NEW_PHYSICAL_OUTPUT", then the same trusted bootstrap with loss --runner-commit 377a3eeeece605da675e4b628c308dd2e6be527c --wheel "$WHEEL" --proxy "$PROXY" --output "$NEW_LOSS_OUTPUT". Input roles/hashes and working-tree identity are bound below; filesystem arguments are portable role placeholders.

The pre-open predecessor controls replaced each controller pathname with a benign self-certifying marker program in an isolated checkout. Direct pathname execution ran that substitute; the literal bootstrap refused both before workspace/Docker creation, with no marker or output workspace. Both controls and their exact bootstrap identity are retained below.

The physical cell preserves the accepted Server1210 contract a09f separately from actual3.8 seed execution09a. Frozen backup7d18/packet8c72 remain unchanged. Every business row/schema is preserved across the exact12→13 metadata change, including all tagged journal fields. Six histories match; original keyed updates in all3 states retain original identities/unknown intent across four concurrent changed-input retries, typed name conflicts and GET pending/completed-null. Original NULL-key signals are history compatibility only. Full logical snapshots match across the consumer interval before shutdown.

The independent loss cell covers six workflows/eight complete committed successes dropped before the client receives them, stable generated/explicit keys across automatic/manual retries, concurrent duplicates/conflicts, close/continuation original identity and single business execution. Both runs use fresh hash-locked registry SDK2.17.2, the approved wheel7dc77d38 and qualified published native3.9.2 tuple. Package/toolchain/input/workspace checks pass. All five exact captured IDs and volume sets are independently absent; copied DB/tokens are removed, with no OOM. No source overlay, capability activation, other-backend, synthetic-legacy or blanket216 claim is made.

{
  "bootstrap_sha256": "e6ebeebd0b9bc1f77100d0cc788913ad0b1371c1e29c4eba2a493ac2de2abda5",
  "pre_open_controls": {
    "bootstrap_sha256": "e6ebeebd0b9bc1f77100d0cc788913ad0b1371c1e29c4eba2a493ac2de2abda5",
    "controls": [
      {
        "role": "physical",
        "predecessor_executes_substitution": true,
        "trusted_bootstrap_refuses_before_workspace": true,
        "candidate_exit": 1
      },
      {
        "role": "loss",
        "predecessor_executes_substitution": true,
        "trusted_bootstrap_refuses_before_workspace": true,
        "candidate_exit": 1
      }
    ]
  },
  "runs": {
    "physical": {
      "runner_commit": "377a3eeeece605da675e4b628c308dd2e6be527c",
      "started_at": "2026-11-13T19:04:46.639347+00:00",
      "finished_at": "2026-11-13T19:04:57.320571+00:00",
      "expected_server": {
        "version": "3.9.2",
        "source": "5614274d2629d03f92932a07dfee0fb10349ddd9",
        "index": "sha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9",
        "linux_amd64": "sha256:813c9337c44be7d497efd29e1b463546519e488aa796b5ecf9dfc6f4f10d2128",
        "qualification": "https://github.com/durable-workflow/server/pull/1209#issuecomment-6858140177"
      },
      "interpreter_image": {
        "id": "sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df",
        "index": "sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df",
        "expected_amd64": "sha256:0f086103b026048cc50cb5da25ec435c023c5241a83fc44daea593377abc61c4",
        "version": "3.12.16",
        "architecture": "amd64"
      },
      "inputs": {
        "controller": {
          "sha256": "dad62d6271fb9affad651b58b62193085aaf95625f906d9bbc99846a78156799",
          "bytes": 17604
        },
        "guard": {
          "sha256": "d3d330d451f80634ea99498c6edb9179f08ade765d8c232f6076b2f493eb69c9",
          "bytes": 3812
        },
        "adapter": {
          "sha256": "0676f33fa53d68b62138d5b61c34be09b179a4db0c4563594151678e2ba66b11",
          "bytes": 7956
        },
        "bootstrap": {
          "sha256": "48dfce97ac4b840f785f6cf371dba1608eabedf04a9e6ecfc700e0cd87ceb099",
          "bytes": 9375
        },
        "requirements": {
          "sha256": "7102fdc18f3ba8c29e5b05bcfd7a2a29f36c7ab48d2cc03fd9ad5b9a52398e47",
          "bytes": 866
        },
        "workspace": {
          "sha256": "be772f9a66ae93c405cd96e7337baaca15518b729ec1e6f3882e979025a1c913",
          "bytes": 7991
        },
        "support": {
          "sha256": "006c5c45cfd43f88bf4af3d1cd19fde6e54e10c0a183dff08c3985f41e0bd488",
          "bytes": 18878
        },
        "verifier": {
          "sha256": "eff3b9818be138dbf271a36642495b2ffdf2b04f5f04040e0ce50a4e02518996",
          "bytes": 19285
        },
        "wheel": {
          "sha256": "7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc",
          "bytes": 367246
        },
        "baseline": {
          "sha256": "7d1826f7681342bb3a5974509648e2e8d75e7a21d262f65f3ec1f58727ccbc0c",
          "bytes": 2060288
        },
        "seed": {
          "sha256": "8c728ce827df3a11621dfb0e82cdd404bbab48784182a5e92c8d632d49047fc5",
          "bytes": 118026
        },
        "snapshot_helper": {
          "sha256": "6fc6054ce087c136a86d7b6b222daeefaa87c58fa0b613b155a5df39e6a26fad",
          "bytes": 10481
        },
        "step_sql": {
          "sha256": "fc3ad1730682c09704027dcbabc17cd6ded9c642a3ff20d7988d5f4b4a5726fd",
          "bytes": 851
        }
      },
      "owned_containers": {
        "upgrade": {
          "id": "5d589ebdbb2957629d814bcc5fb492c83182367277ae17a045db45a7e820ad5a",
          "requested_name": "sdk-python-216-physical-upgrade-21c2f79290f6"
        },
        "runtime": {
          "id": "541f597b147c99a097caeee14ae716ffd3fb71329c0535a1d8e357f5fb5b2c0f",
          "requested_name": "sdk-python-216-physical-runtime-21c2f79290f6"
        },
        "consumer": {
          "id": "67f6c0717ab3e8f969cdf4e268d87b01cfb7762fb373a6f0e8189cc6831fe0c4"
        }
      },
      "workspace_identities_rechecked": true,
      "input_identities_rechecked": true,
      "interpreter_identity_rechecked": true,
      "cleanup_by_id": {
        "upgrade": {
          "id": "5d589ebdbb2957629d814bcc5fb492c83182367277ae17a045db45a7e820ad5a",
          "absent": true,
          "volumes_absent": true,
          "oom_killed": false
        },
        "runtime": {
          "id": "541f597b147c99a097caeee14ae716ffd3fb71329c0535a1d8e357f5fb5b2c0f",
          "absent": true,
          "volumes_absent": true,
          "oom_killed": false
        },
        "consumer": {
          "id": "67f6c0717ab3e8f969cdf4e268d87b01cfb7762fb373a6f0e8189cc6831fe0c4",
          "absent": true,
          "volumes_absent": true,
          "oom_killed": false
        }
      },
      "cleanup": {
        "containers_and_volumes_absent": true,
        "private_database_removed": true,
        "credential_removed": true
      },
      "complete": true,
      "evidence_sha256": {
        "run.json": "b93811815d26f5335728634301c07a5018d2cff429e527560ecda42004cf9e8e",
        "consumer.json": "ba723a568baa2c0eb3e5d64c441514c269b68b3e47615aca772968f5f3a7dacd"
      },
      "consumer_started_at": "2026-11-13T19:04:55.569881+00:00",
      "consumer_finished_at": "2026-11-13T19:04:55.777351+00:00",
      "package": {
        "version": "2.17.2",
        "wheel_sha256": "7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc",
        "runtime_files_verified": 46,
        "python": "3.12.16",
        "dependencies": {
          "httpx": "0.28.1",
          "fastavro": "1.13.1"
        }
      },
      "toolchain": {
        "interpreter_sha256": "4dbf3143240288fb2170257ffaa7bd030cdda5d2703d1f5f30b627042267e2e3",
        "venv_config_sha256": "5494e1c83c157619e25d676e1dc1a4c1b1d5b8d8cf49def092bc518939a5c92c",
        "environment_inventory": {
          "sha256": "45a30ad94b910cd6f87b471adbdbae64c9f01391eb51f17d79382d0de3da179a",
          "files": 1164,
          "bytes": 28008350
        },
        "post_inventory_equal": true,
        "requirements_sha256": "7102fdc18f3ba8c29e5b05bcfd7a2a29f36c7ab48d2cc03fd9ad5b9a52398e47"
      },
      "snapshot_before": "6e23c569151e8a83e04934505c73f1e5f975538ee1f92c535c3fe663891b1d4f",
      "snapshot_after": "6e23c569151e8a83e04934505c73f1e5f975538ee1f92c535c3fe663891b1d4f",
      "original_inputs_unchanged": true
    },
    "loss": {
      "runner_commit": "377a3eeeece605da675e4b628c308dd2e6be527c",
      "started_at": "2026-11-13T19:05:47.093915+00:00",
      "finished_at": "2026-11-13T19:05:59.849894+00:00",
      "expected_server": {
        "version": "3.9.2",
        "source": "5614274d2629d03f92932a07dfee0fb10349ddd9",
        "index": "sha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9",
        "linux_amd64": "sha256:813c9337c44be7d497efd29e1b463546519e488aa796b5ecf9dfc6f4f10d2128",
        "qualification": "https://github.com/durable-workflow/server/pull/1209#issuecomment-6858140177"
      },
      "interpreter_image": {
        "id": "sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df",
        "index": "sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df",
        "expected_amd64": "sha256:0f086103b026048cc50cb5da25ec435c023c5241a83fc44daea593377abc61c4",
        "version": "3.12.16",
        "architecture": "amd64"
      },
      "inputs": {
        "controller": {
          "sha256": "006c5c45cfd43f88bf4af3d1cd19fde6e54e10c0a183dff08c3985f41e0bd488",
          "bytes": 18878
        },
        "guard": {
          "sha256": "d3d330d451f80634ea99498c6edb9179f08ade765d8c232f6076b2f493eb69c9",
          "bytes": 3812
        },
        "adapter": {
          "sha256": "eff3b9818be138dbf271a36642495b2ffdf2b04f5f04040e0ce50a4e02518996",
          "bytes": 19285
        },
        "bootstrap": {
          "sha256": "48dfce97ac4b840f785f6cf371dba1608eabedf04a9e6ecfc700e0cd87ceb099",
          "bytes": 9375
        },
        "requirements": {
          "sha256": "7102fdc18f3ba8c29e5b05bcfd7a2a29f36c7ab48d2cc03fd9ad5b9a52398e47",
          "bytes": 866
        },
        "workspace": {
          "sha256": "be772f9a66ae93c405cd96e7337baaca15518b729ec1e6f3882e979025a1c913",
          "bytes": 7991
        },
        "proxy": {
          "sha256": "bd1e8ccbbf76f63fc2eafa278a023eb181d405b68d9c30016392e395a1eff725",
          "bytes": 8395
        },
        "wheel": {
          "sha256": "7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc",
          "bytes": 367246
        }
      },
      "owned_containers": {
        "runtime": {
          "id": "48882dda748a86b3430fa886b412bfc06954ef6bbb913d8ad9f7f0d6f3a81639",
          "requested_name": "sdk-python-216-response-loss-0b410990a7bf"
        },
        "consumer": {
          "id": "4dc024f89a68f4833c5e426134d1829146d73db644a5f28141c7ac56f4cdc0c2",
          "requested_name": "sdk-python-216-consumer-0b410990a7bf"
        }
      },
      "workspace_identities_rechecked": true,
      "input_identities_rechecked": true,
      "interpreter_identity_rechecked": true,
      "cleanup_by_id": {
        "runtime": {
          "id": "48882dda748a86b3430fa886b412bfc06954ef6bbb913d8ad9f7f0d6f3a81639",
          "absent": true,
          "volumes_absent": true,
          "oom_killed": false
        },
        "consumer": {
          "id": "4dc024f89a68f4833c5e426134d1829146d73db644a5f28141c7ac56f4cdc0c2",
          "absent": true,
          "volumes_absent": true,
          "oom_killed": false
        }
      },
      "cleanup": {
        "containers_and_volumes_absent": true,
        "credential_removed": true,
        "oom_killed": false
      },
      "complete": true,
      "evidence_sha256": {
        "run.json": "fb86ebb51e36a8c380ca283b802b8858a6c06946391cc8d5d510552b67982c2a",
        "consumer.json": "176354102f9425cf4802493c0bfedd68ccc8ebd62cb87a9da61d6446dfbea9fc"
      },
      "consumer_started_at": "2026-11-13T19:05:54.528153+00:00",
      "consumer_finished_at": "2026-11-13T19:05:58.592856+00:00",
      "package": {
        "version": "2.17.2",
        "wheel_sha256": "7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc",
        "runtime_files_verified": 46,
        "python": "3.12.16",
        "dependencies": {
          "httpx": "0.28.1",
          "fastavro": "1.13.1"
        }
      },
      "toolchain": {
        "interpreter_sha256": "4dbf3143240288fb2170257ffaa7bd030cdda5d2703d1f5f30b627042267e2e3",
        "venv_config_sha256": "f126b84c32d38512b8b5c5f6a347ebe7f0d6371cc67e2f6ab9ef2ff0cc848354",
        "environment_inventory": {
          "sha256": "2e54e3e9f472f38233dc1d7393b11b3d02ac7f6027ef54bd013d61c93ca942fe",
          "files": 1164,
          "bytes": 28008350
        },
        "post_inventory_equal": true,
        "requirements_sha256": "7102fdc18f3ba8c29e5b05bcfd7a2a29f36c7ab48d2cc03fd9ad5b9a52398e47"
      },
      "workflows": 6,
      "lost_successes": 8
    }
  }
}

sdk-python owns exact-source review/normal merge/tree verification, then will port the corrected boundary to322 before its new synthetic repeats. Prior NONPASS/HOLD attempts stay retained.

[rmcdaniel]

Security final exact-source and installed-boundary review: PASS for commit 377a3eeeece605da675e4b628c308dd2e6be527c / tree 186a86445342ec7b1b75594a423b6c38ecbfe88a, bound only to the fresh literal-bootstrap physical and response-loss repeats in the final packet.

I independently rehashed the retained bootstrap as e6ebeebd0b9bc1f77100d0cc788913ad0b1371c1e29c4eba2a493ac2de2abda5; its fixed commit/controller pairs match the Git object bytes (dad62d62… physical, 006c5c45… loss). Both predecessor path substitutions execute their benign marker under direct invocation and are refused by the literal bootstrap before workspace/effects. The fresh evidence bytes match the published hashes:

• physical: run.json b9381181…, consumer.json ba723a56…;
• response loss: run.json fb86ebb5…, consumer.json 17635410….

The physical cell preserves the complete logical snapshot across the exact schema 12→13 exceptions, all three original keyed-update states and the separately labelled NULL-key signal compatibility cases. The loss cell proves six workflows/eight committed-success drops with the recorded retry/conflict/Unicode/closure boundaries. Both use the approved SDK 2.17.2 wheel and qualified native 3.9.2 tuple; package/toolchain/workspace/input rechecks reconcile. I independently confirmed all five exact captured container IDs are absent on the actual execution host and rehashed the frozen producer inputs unchanged. All 20 current PR checks are green.

The earlier pathname-invoked observations remain HOLD/nonqualifying. This PASS does not cover the synthetic helper/ambiguity slice, other backends, capability activation, publication, or blanket #216 completion. Normal integration, accepted-main equality and any later consumer-specific gates remain required.

[rmcdaniel]

Current physical snapshot qualification: HOLD. Final literal response-loss qualification is unchanged. A native SQLite canonical-open race affects the physical snapshot boundary. Current correction/next action: SDK322. Preserve the following as its historical scoped record.

The corrected physical/shared workspace fixture is merged normally at 3cac1bf8487d33990c7a67082d67ed3473f25bc9. Its full tree 186a86445342ec7b1b75594a423b6c38ecbfe88a equals reviewed 377a3eeeece605da675e4b628c308dd2e6be527c exactly. All20 exact-head checks,130 focused controls and two literal pre-open substitution controls passed. The remote head was deleted after checking its expected reviewed commit; absence is verified.

Independent exact-source/installed Security PASS binds only the final literal-bootstrap physical run3 and loss run2. Exact bootstrap bytes/SHA, invocations, tuples, run hashes and captured-ID cleanup are public. Prior direct-path and workspace observations remain historical HOLD, and the failed OCI bind remains NONPASS. The response-loss boundary originally introduced by320 is corrected and newly qualified at this source/invocation; earlier320 observations are not relabeled.

This qualifies Python's scoped installed signal/update response-loss recovery and physical SQLite original-keyed-update readbacks on registry2.17.2/native3.9.2. Historical NULL-key signals remain compatibility-only. Synthetic legacy/helper, other backends, capabilities, package publication and blanket216 remain excluded. sdk-python's next action is322's corrected exact-source synthetic repeats and review; no package release is needed for these test-only changes.

[rmcdaniel]

Physical snapshot qualification is HOLD; the final literal response-loss qualification is unchanged. The stopped/synthetic work also remains HOLD. Rust's native-open probe demonstrates that SQLite can canonicalize even a real /proc/self/fd/N URI and reopen the mutable real pathname. A lower open/open64 swap can consume replacement bytes while the held descriptor and restored basename checks still pass. The Python-level swap and positive WAL controls alone do not close that interval.

The same mutable-basename snapshot path was used by merged321's physical controller, so its physical observation is retained without current qualification. The321/320 final response-loss cell has no host database snapshot and is outside this finding. No SDK product/package regression or blanket216 result is inferred.

sdk-python owns the snapshot construction and exact native-open predecessor control, while SDK Rust owns the minimal stopped-only common helper API successor using bounded held-FD bytes and official SQLite memory serialization. Python is preparing a live-WAL snapshotter that captures stable bounded main/WAL bytes and replays only those copies in an isolated fixed image without host mounts or untrusted code. No URI-only successor or new installed cell is authorized by the existing review. Source counter-review and fresh source-bound physical/synthetic repeats remain required. All prior observations/NONPASS records remain preserved; no local SDK runtime is active.