[rmcdaniel]

Stable portal deployments currently copy sdk-reference.md from the immutable SDK tag, so accepted corrections to already-shipped behavior remain invisible. The latest 2.17.2 deployment still labels activity execution identity “unreleased” and omits the documented repeat-last local retry rule.

Allow the current committed reference prose only when its complete tracked SDK source is identical to the selected published tag and every fenced example is unchanged. Otherwise retain the tag's reference guide. Generated API pages and other guides remain bound to the published source. The deployment audit records the actual reference revision and SHA-256.

Validation: 43 portal-source/release-selector tests and Ruff pass. The new positive regression fails against the previous renderer. Controls cover changed/added SDK source, changed examples, uncommitted reference edits, package/source mismatch and preview/stable separation. No SDK code, version, package, workflow permissions or runtime tuple changes.

Follow-through for shared identity #211 and the already-shipped local retry portion of shared #219. After normal checks/review/merge, deploy the existing 2.17.2 stable portal and verify the actual guide and provenance. No package release is needed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact source PASS for ec1f531715a1d4b3eccd9178d91f511eeb01e190 / tree c6e8b30c72e75cd3a00d528c75c26a9e5a052ebd, scoped to the stable reference-guide overlay.

Independent checks:

• the complete PR delta is exactly scripts/prepare_portal.py plus its portal-source tests; no SDK/package/workflow/runtime bytes change;
• selected tag 2.17.2 resolves to 9e77bc8eca77f8bff7bc6dad6ed4bb002c480cb9 and git diff --name-only from that commit to this head is empty for src/durable_workflow;
• tag and current docs/sdk-reference.md contain the same 38 fenced blocks in the same order and with byte-equal languages/bodies; tag guide SHA-256 is c81e2d91dbb84d9cfa118e680fd7f0a784549ee6320acbbc2dcd26b080c1af47, current committed guide is 07e0b761d8598409f4e841cdf1271d0559707f614591fbafbe9bd0b187668c94;
• current guide bytes are read from the committed Git object, not the mutable checkout; changed/added package source falls back to the tag guide, and changed fenced examples refuse;
• generated API inventory, Python handler source, nav and all other guides remain selected from the immutable tag; the separate reference revision and digest enter the deployment provenance.

The portal build, policy, lint, package, CodeQL, Sonar and most matrix checks are already green; the still-running normal Python/integration checks remain required. After normal merge, the stable deployment must independently prove tag/wheel/API inventory unchanged, provenance reference_guide.source_revision=ec1f531... with SHA 07e0b761..., and rendered removal of the stale unreleased label plus the intended local-retry prose. No package, SDK runtime, shared acceptance or deployment PASS is inferred from this source verdict.

[rmcdaniel]

Security current-head gate readback for exact ec1f531715a1d4b3eccd9178d91f511eeb01e190 / tree c6e8b30c72e75cd3a00d528c75c26a9e5a052ebd: all 22 reported checks are terminal, with 21 SUCCESS and the one expected non-dispatched published-activity cell SKIPPED; there are no failures, cancellations or pending checks. This closes the source+current-CI gate from the exact source verdict. Normal merge/tree equality and the separately scoped stable portal deployment/provenance/rendered readback remain required; no deployment or package authority is inferred.

[rmcdaniel]

Security accepted-main rebind for SDK #326:

• normal merge af204f77c8bdfc0e2c64b260cc0d98d50257f321 has tree c6e8b30c72e75cd3a00d528c75c26a9e5a052ebd, exactly equal to reviewed head ec1f531715a1d4b3eccd9178d91f511eeb01e190;
• parents are accepted main d7eb1fe3300cbf514a169d8e76d5854ccc183232 and the reviewed head;
• actual-main CI 43543100249, Sonar 43543100022 and CodeQL 43543099348 are all terminal SUCCESS, with no failed or pending job.

This closes source, PR-CI, normal-merge/tree-equality and accepted-main gates for the reference-guide overlay. The unchanged reviewed guide bytes remain SHA-256 07e0b761...; selected SDK tag/source/wheel remain 2.17.2 / 9e77... / 7dc77....

Stable portal deployment is still separate. Its audit must bind reference_guide.source_revision to accepted main af204f77..., retain the exact guide hash, and prove the tag, wheel, API pages and all other guides unchanged. Final rendered readback must show the stale unreleased heading and local-retry prose removed without changing fenced examples. No package, SDK runtime, tuple or installed-cell authority is inferred.

[rmcdaniel]

The stable Python portal now publishes the reviewed corrections for already-shipped behavior: activity execution identity is no longer labelled unreleased, and local activities explains repeat-last backoff and replay of older recorded zero-delay tails.

Normal merge af204f77c8bdfc0e2c64b260cc0d98d50257f321 has reviewed tree c6e8b30c72e75cd3a00d528c75c26a9e5a052ebd, with parents accepted d7eb1fe… and reviewed ec1f531…. The merged remote branch was deleted under an expected-head lease and independently verified absent. Exact source review, 21-success/one-intended-skip PR gates, and accepted-main rebind pass.

Protected stable deployment 43543872426 completed SUCCESS after all accepted-main gates passed. Independent public HTTP readback at 2026-11-14 02:03:23 UTC verified:

• Deployment audit: stable 2.17.2; documentation/reference source af204f77…; reference Markdown SHA-256 07e0b761d8598409f4e841cdf1271d0559707f614591fbafbe9bd0b187668c94.
• SDK source remains published tag 9e77bc8eca77f8bff7bc6dad6ed4bb002c480cb9; wheel SHA-256 remains 7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc.
• API source inventory hashes to f343f2f4fd2e3b6e802d3cf1b1826169e556a8b53605ebef7d7ddcd96be40131. All 46 package source files match the approved wheel exactly, including complete package-file membership.
• Rendered guide contains the new activity-execution-identity anchor, omits the old -unreleased anchor, states availability from SDK 2.15.0, and includes repeat-last plus old-record replay scope. Rendered HTML SHA-256 is 8e670b6605201c193318f54ab05d7e81fd91559ba2e202e46c1259425936f7ad; deployment-audit SHA-256 is 52b4bb2bafce969ae598657ccd13b14a0277238e8f47157e56555ab4003beda0.

An earlier read while Pages was still publishing returned the previous deployment audit; it is retained separately and is not the qualified readback. No package, API, SDK runtime or version changed here. The installed ordinary retry-identity receipt remains separately scoped. This clears the SDK guide link dependency for Docs543, whose root-site/locales/Pages and shared-issue closure remain with their owners.

[rmcdaniel]

Security final stable-portal deployment/readback for SDK #326: PASS.

Independent evidence:

• manual stable deployment run 43543872426 is terminal SUCCESS at accepted main af204f77c8bdfc0e2c64b260cc0d98d50257f321;
• Pages artifact 14093152147 contains artifact.tar SHA-256 1998bb949aa604a38ce4876ca180e56df0bcda4e556fc49381099bbcc4ccf181;
• artifact and live deployment-audit.json are byte-identical, SHA-256 52b4bb2bafce969ae598657ccd13b14a0277238e8f47157e56555ab4003beda0;
• the audit binds stable channel, docs/reference source af204f77..., exact reviewed guide SHA-256 07e0b761d8598409f4e841cdf1271d0559707f614591fbafbe9bd0b187668c94, SDK source 9e77bc8eca77f8bff7bc6dad6ed4bb002c480cb9, SDK 2.17.2 and wheel 7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc;
• artifact and live API inventories are byte-identical SHA-256 f343f2f4fd2e3b6e802d3cf1b1826169e556a8b53605ebef7d7ddcd96be40131, covering 46 unique published SDK source paths / 1,694,845 bytes;
• artifact and live /sdk-reference/ HTML are byte-identical SHA-256 8e670b6605201c193318f54ab05d7e81fd91559ba2e202e46c1259425936f7ad;
• live HTTP is 200 with the new deployment timestamp. The activity heading renders as Activity execution identity without the stale unreleased qualifier, and the reviewed local-activity retry-tail paragraph is present. The build retained the exact fenced examples already compared in source review.

This closes the source, merge, accepted-main, stable deployment, provenance and rendered-readback gates for the narrow reference-guide correction. It does not change or qualify any SDK/package/runtime/Server tuple beyond the already published 2.17.2 identities above, and it does not infer a new installed acceptance cell.