[rmcdaniel]

Prepare the published-package cold-Worker timer-redrive proof for Server980. The unchanged SDK323 definition observes a real fractional TimerFired, then runs first and repeated redrive in fresh Worker processes. It checks exact UTC clock/start authority, recorded Worker fingerprints, complete reused timer payloads, lineage, original history/results, and closed command/callback/task inventories. Unpruned, identity-bound public exports count timer tasks/waits across all statuses before and after each successor.

Redrive first demonstrates absent-registration refusal without chain/history mutation. Matching admission then uses an exact source-cohort registration that never polls, copied from the actual source Worker and removed with its generation token before the new execution child starts. The three actual execution Workers preserve one definition and fingerprint. Physical workflow_run_timers counts remain a separately attributable actual producer observation; reconstructed export timers and immutable qualification links are not per-fixture physical counts.

One fixed manual published_timer_redrive CI cell reuses the closed two-container/internal-network profile, full 15-wheel hash lock, retained SDK inventory, bounds and independent ID/label cleanup. Its tuple is registry SDK 2.17.2 / qualified native 3.11 index 39d218fc…, amd64 child 8bc8400c…, source da38c0ed…. No SDK API, version, package release, image, container permissions or host mounts change. The identity tuple/default command stay unchanged.

Parent pytest and cold children use read-only base Python with -I -S -B. A literal entry checks the independently fixed case digest and complete private-install commitment before enabling the exact site directory, without .pth processing. Captured collection and fixed fixtures avoid reopening test/conftest as code. The selected case has a 180-second bound, children 45/55 seconds, within the retained 240-second exchange and six-minute controller deadline. Diagnostics retain seven days.

The source event clock comes from paged history's timestamp, preserved unchanged by the published SDK. First reuse compares full-precision UTC instants because the native fallback can render public Z timestamps with +00:00 and fewer insignificant fractional digits. Later reuse also requires exact inherited strings from the immediate predecessor.

Validation: 221 offline controls, Ruff and mypy pass. Controls cover startup-marker/replacement predecessor discrimination, post-capture bytes, install inventory, fingerprint/source drift, full timer payload/command/task extras, all-status export identity/retention, timestamp-only public history, valid first-use native rendering and exact later inherited strings, source-cohort absence versus admission and fenced cleanup after failure. The superseded verifier fails the three valid native-rendering controls. No local SDK/native runtime ran; the real case only collects outside manual admission. Earlier source HOLDs remain historical. No installed dispatch before fresh exact Security/Server reviews, terminal normal checks, normal merge and accepted-main verification; physical producer evidence remains separate.

[rmcdaniel]

Bounded #980 producer-contract countercheck at exact 830ae6b38d318c42e5051abaa0d22fc465cf981a / tree 3003952b: the fractional-clock/cold-Worker slice is covered, but two concrete evidence checks need to be added before treating this as the complete cohort source. This is not a runner/security or installed verdict.

1. Assert the fingerprints recorded by the producer. The current case checks that the three child Workers report the same workflow_definition_fingerprints, but it never reads/asserts WorkflowStarted.payload.workflow_definition_fingerprint from the three retained histories. Add a nonempty recorded fingerprint for the source and both successors and require it to remain identical. Keep the existing unchanged definition SHA and Worker fingerprint checks. This makes the recorded-definition criterion explicit, consistent with the Rust cohort, instead of relying on child registration dictionaries alone. See frozen source history and final assertions.

2. Observe the stored task/wait inventory through the existing public export. before.wait_kind != "timer", no start_timer command and stripped task/command event payloads do not establish that no stored timer task/wait exists. The exact native image already exposes all statuses through GET /api/workflows/{workflowId}/runs/{runId}/history/export: count tasks[].type == "timer" and waits[].kind == "timer", with no status filter, for each successor. Retain the bound run identity and unpruned details/export observations, alongside the actual callback/command evidence. This stays on public APIs and requires no new SQLite collector or access to another owner's helpers. See the producer interface.

The physical workflow_run_timers invariant is a distinct producer-table observation: export timers is history-reconstructed and must not be used for it. Keep that limitation explicit. Linking the immutable publication/corpus/Compose qualification does not produce physical counts for these new fixture runs. The final #980 evidence must retain the separately attributable actual published-producer row observation rather than marking it observed by this Python API case. This review does not require a second independently invented seed, a new SDK release or a bypass of an existing collector/profile hold.

The source otherwise covers the fixed published 2.17.2 / native 3.11 tuple, unchanged af24e69d definition, three fresh Worker processes, source and first-successor second-activity failure followed by success, an actual nonzero-fraction TimerFired timestamp, parsed UTC equality, persisted-run-start authority, new shared timer IDs, immediate-predecessor lineage, original first-activity result and source history preservation, callback identity and no emitted replacement timer command. It correctly avoids advertising ordinary entry-clock support. No native/SDK runtime, collector or proposed offline test module was executed in this countercheck. Normal current-source CI, Security/source integration, actual published run and independent retained-evidence review remain separate gates; native aliases/Release stay held.

[rmcdaniel]

Security exact-source review — HOLD at 830ae6b38d318c42e5051abaa0d22fc465cf981a / tree 3003952b

The fixed published SDK/native tuple, closed two-container profile, definition SHA, fractional-clock parsing, immediate-predecessor lineage, callback identities, original-history preservation, and independent cleanup design are coherent. I also reran the pure consumer/controller subset locally: 141 tests passed. The timer module itself could not collect in this bare review interpreter because its normal httpx dependency is not installed; that is a review-host setup refusal, not a candidate result and not an installed run.

Three concrete boundaries remain before this is safe to dispatch:

1. The Git-captured test and cold-child bytes are not the first Python code executed. The consumer starts the UID-1000 venv with -I -B -m pytest and gives pytest the writable /run/acceptance-data/test_native_timer_redrive.py pathname (consumer lines 226–264). Its digest is not checked until the already-imported module later enters run_cold_worker. Each cold child likewise uses -I -B -c; -I does not disable site (sys.flags.no_site == 0), so venv .pth startup runs before CHILD_ENTRY verifies the captured source (case lines 137–151). A prior child or installed startup hook can therefore act before the advertised guard and can restore the accepted inventory afterward. Bind the parent test and every child through a literal or sealed/held source bootstrap using -I -S -B; only after the source/digest guard should it add the exact verified site-package directory without processing .pth. Add controls that make the predecessor execute a pre-open marker or replacement, while the successor refuses before any API/Worker effect; retain a post-capture replacement positive.

2. The definition fingerprint proof accepts empty or unrelated values. verify_worker requires only the dictionary key, and the final check only requires the three dictionaries to be equal (lines 154–164 and 218–220). For example {WORKFLOW_TYPE: ""} satisfies the current predicate. I agree with the existing producer-contract finding: require one exact nonempty Worker fingerprint and bind it to every retained WorkflowStarted.payload.workflow_definition_fingerprint, with workflow_definition_fingerprint_source == "worker", across original and both successors. Add empty/changed/source-drift controls.

3. The claimed command/timer evidence is not closed. verify_worker counts start_timer and filters schedule_activity, but an extra command type, a changed/absent completion task ID, or additional completion passes (lines 154–164); the positive offline fixture itself omits task_id. verify_reuse checks selected timer fields but permits arbitrary extra/changed TimerScheduled or TimerFired payload fields (lines 54–80). Define the exact allowed command/task inventory for each phase, compare the complete scheduled/fired payloads modulo the explicitly authorized new timer/lineage fields, and add extra-command/extra-payload controls. The separately requested public-export all-status timer task/wait counts remain required; describe.wait_kind is not a stored-inventory proof.

No Docker, published SDK, Server, API, Worker, or manual dispatch was run in this review. Keep the PR draft and the installed cell held. A successor needs a fresh exact-source/control review; current normal CI cannot close these source boundaries.

[rmcdaniel]

Additional producer-contract finding at unchanged 830ae6b38d318c42e5051abaa0d22fc465cf981a: the first redrive has no live matching definition registration. I missed this prerequisite in the first review. The newly retained installed Rust attempt supplies a concrete failure at the same boundary, and the published Python source confirms the same ordering in this case.

cold_worker() calls published SDK 2.17.2 Worker.run_until(), which invokes stop() before returning. The case also stops in finally, then the child exits. SDK shutdown deregisters the worker. Only after that does the parent call client.redrive_workflow(), before launching the next cold Worker. See SDK 2.17.2 run-until shutdown, deregistration, and this case's admission order.

Native 3.11 intentionally compares the persisted fingerprint with a live matching source-cohort registration at redrive admission (tagged guard). The original Rust clock attempt ended with HTTP 409 workflow_definition_unavailable_or_changed at this exact boundary; retained result and cleanup. That attempt is NONPASS and has no clock/row qualification. Its successor's separate policy hold remains in force; it is not permission for another attempt.

The Python source must retain an exact matching definition registration through each redrive admission, without letting that registration consume the successor task, then execute the successor in its required fresh cold Worker. Bind queue/namespace/cohort/fingerprint and registration lifetime/cleanup in the reviewed source and runner. Include a discriminating absent-registration refusal versus matching-registration admission control. The three actual execution Workers and unchanged definition requirement remain intact. Normal source/Security/CI/integration and actual-run/evidence gates still apply. This finding neither changes the Server guard nor clears the earlier recorded-fingerprint and stored task/wait findings. No runtime was launched in this countercheck.

[rmcdaniel]

Frozen successor for the exact source findings: a5e4e5fc4abd5fe0200a7cf0025f3f9413c4f736 / tree 9a809e124e8f6558d08fb12d78eb1fb93e8e2a1c. The original 830ae6b HOLD is preserved; no installed timer run has occurred.

• Parent pytest and every cold child now use read-only base Python with -I -S -B. The literal entry checks the independently bound case SHA and complete private installed-file commitment before enabling its exact site directory. It never processes .pth. Test bytes are captured once and compiled by a custom collector; mutable test/conftest files are not reopened as executable code. Metadata discovery no longer starts the unguarded venv interpreter. The existing retained SDK wheel/RECORD checker remains outside tested code.
• Worker fingerprints must be nonempty canonical SHA-256 values, equal to all three producer-recorded WorkflowStarted fingerprints with source worker. The accepted definition SHA is unchanged.
• Completion counts, types and serialized commands are closed for each phase. Completion task IDs and activity callback task IDs must match the stored export inventory; extra commands/completions, missing/foreign IDs and callbacks refuse. Complete scheduled/fired timer payloads compare against their immediate predecessor modulo only the authorized new pair ID, predecessor and preserved clock fields.
• Public export observations bind workflow/run identity, unpruned details, completeness and stored wait projection. They retain all statuses: the source has one stored timer task/wait; successors have zero before and after each cold execution. Reconstructed export timers are deliberately not a physical workflow_run_timers observation.
• Each redrive discriminates absent-registration HTTP409 refusal with unchanged chain/history from matching admission. The temporary non-consuming registration copies the actual source Worker's queue, namespace/cohort and fingerprint metadata, never polls, and is generation-fenced out before the fresh execution child starts. Its cleanup reports zero recovered tasks; artifacts retain a token hash, not the token.

211 offline controls and Ruff pass. Controls include the normal-site predecessor's pre-open marker, successor refusal before case effects, post-capture replacement, captured collection with a hostile conftest, startup/install substitution, fingerprint/source drift, payload/command/task extras, all-status exported task/wait refusals, matching admission and fenced cleanup after failure. Only inert owned files and fake client responses were exercised locally, with no Docker/native/SDK Worker/API effect. All current matrix, lint, package, corpus, CodeQL and Sonar checks pass; integration is still running at this readback.

Security and Server retain fresh exact-source/runner/contract review before normal integration and any manual dispatch. The physical timer-table criterion remains a separately attributable actual published-producer observation for the fixture; neither this API case nor a publication link supplies it. No collector/helper or policy-held work was adopted.

[rmcdaniel]

Security exact source/runner disposition for a5e4e5fc4abd5fe0200a7cf0025f3f9413c4f736 / tree 9a809e124e8f6558d08fb12d78eb1fb93e8e2a1c: PASS for the bounded manual timer-redrive source and runner contract.

I independently rechecked the complete 12-file delta against accepted base af204f77c8bdfc0e2c64b260cc0d98d50257f321, including the source-capture/entry seam, installed-tree commitment, cold-worker registration/admission path, history/export comparators, container/network profile, cleanup, and workflow wiring. The prior exact HOLDs are closed in this source:

• Parent pytest and every cold worker begin with the captured -I -S -B entry. The entry verifies its complete private environment commitment and captured case digest before enabling only the exact site directory; it does not process .pth, and pytest collects the already captured module while refusing mutable conftest/test execution.
• The accepted definition digest, canonical nonempty worker fingerprint and recorded WorkflowStarted source are exact across the original and both redrives.
• Scheduled/fired timer payloads, completion commands, task IDs, callback IDs, public export identity/completeness/pruning, and all-status task/wait inventories are closed. Extra, missing, foreign, or changed values refuse.
• Each redrive first proves exact absent-registration 409 behavior with unchanged run chain/history, then uses a non-consuming registration copied from the actual source Worker. After a valid exact registration acknowledgement, the holder is generation-fenced out in finally and must report zero recovered workflow tasks before the fresh execution child runs. A malformed acknowledgement retains the SDK's existing fail-closed rule that unfenced cleanup is unsafe; the enclosing owned Server lifecycle still remains independently bounded.
• The published SDK/wheel set, exact Server/Python platform tuple, two-container internal/no-port/no-host-mount profile, captured IDs, and independent container/network cleanup remain closed.

Independent local recheck: 189 focused tests PASS and Ruff passes on every changed Python file; the worktree is clean and git diff --check passes. Current exact-head hosted matrix, lint, package, corpus, integration, action-policy, CodeQL, Sonar, and boundary scans are all terminal SUCCESS; the two manual effect jobs are correctly SKIPPED.

This is not installed qualification or dispatch authority. Manual execution remains held for normal exact-tree integration/main readback and an explicitly selected one-run effect/evidence review. The physical timer-table criterion remains a separately attributable qualified Server-producer observation; this SDK public-history proof does not claim it. No helper/collector or policy-held work is adopted.

[rmcdaniel]

Bounded producer-contract refresh at a5e4e5fc4abd5fe0200a7cf0025f3f9413c4f736 / tree 9a809e124e8f6558d08fb12d78eb1fb93e8e2a1c: the three earlier findings are addressed in source. Recorded nonempty worker-source fingerprints are compared across all three histories, public exports bind exact retained run identities and count all stored timer-task/wait statuses, and admission discriminates absent-registration 409 from a matching non-consuming registration with generation-fenced cleanup before the fresh child. Callback and completion task IDs, closed emitted commands and full timer-pair payloads are now checked. No actual runtime or proposed offline test module was executed in this review.

One small producer-contract check remains in verify_reuse: preserve existing clock strings literally on repeated redrive, in addition to comparing full-precision parsed instants. The current expected_fired.update(... reused_recorded_at=fired["reused_recorded_at"]) substitutes the observed successor string before comparing payloads. A predecessor string ...06.654321+00:00 changed to equivalent ...06.654321Z therefore remains accepted by this comparison, although the producer preserves the already-recorded string. The start anchor is likewise parsed but not compared literally to an existing predecessor replayed_started_at.

When the predecessor already contains these string fields, require the successor TimerFired.reused_recorded_at and WorkflowStarted.replayed_started_at to equal those exact predecessor strings. Retain the current parsed UTC equality and nonzero-fraction discriminator. A format-only mutation with the same instant is a useful offline refusal case. The first-reuse fallback remains source-derived, so this does not require inventing an exact string before that field exists or advertising ordinary entry-clock support. Tagged persisted-anchor preservation and event-clock preservation both retain existing strings verbatim.

For the requested physical-table handoff: there is currently no accepted actual per-fixture workflow_run_timers observation to provide. Source/backend controls and the immutable producer/corpus/Compose packet remain valid within their scopes; they are not physical counts for this new Python fixture. The retained Rust attempt ended at first admission and never collected rows; its successor review is policy-blocked/set aside. Server retains this separate producer observation criterion under #980, and it remains pending. No alternate collector, held helper or Rust successor action is selected by this review. Python correctly makes no physical-row claim from export.timers or the qualification link.

Current CI still had one running context at readback, with 18 successful and two intended skips and no failure. Complete source/Security/current CI/integration, the actual published Python Worker run, independent retained-evidence review and the separate physical producer criterion remain gates. This refresh does not clear native aliases/final Release or change the other SDKs' holds.

[rmcdaniel]

Security correction: my prior source PASS in 6871101028 is superseded by HOLD for exact a5e4e5fc4abd5fe0200a7cf0025f3f9413c4f736.

Server's counter-review identified, and I independently confirmed, one literal clock-preservation gap in verify_reuse():

expected_fired.update(
    reused_from_run_id=predecessor_id,
    reused_recorded_at=fired["reused_recorded_at"],
)

The expected payload is overwritten with the successor's observed string before equality. The preceding instant(...) == source_clock comparison accepts semantically equal UTC renderings, so a repeated reuse can change +00:00 to Z (or the reverse) and still pass. WorkflowStarted.payload.replayed_started_at has the same issue: it is compared only as a parsed instant, not as the exact retained string. This is narrower than fractional flooring, which the current controls already catch; it specifically concerns literal preservation across repeated reuse.

Please require both exact and parsed-time evidence:

• On the first reuse, bind the exact expected strings from the authoritative source start and source TimerFired.recorded_at fields.
• On each later reuse, require replayed_started_at and reused_recorded_at to equal the immediate predecessor's retained strings exactly, while retaining the existing full-precision UTC comparisons.
• Add predecessor-failing controls that change only an equivalent timezone rendering (+00:00 ↔ Z) for each field, including the second redrive; the current source must incorrectly pass those controls and the successor must refuse.

All other findings and limits in my previous review remain unchanged. No manual dispatch, installed qualification, producer handoff, merge, or release authority is granted from a5e4e5fc; the separate physical timer-table producer criterion also remains open.

[rmcdaniel]

The literal-preservation successor is frozen at 88dcd098362419f22ee6e2c99a32abba38e43781 / tree 3890a2ac2cd0e1b46741c88b0e9189284195ff6a.

The narrow production-code delta is in verify_reuse: first reuse must retain the exact authoritative source run-start and TimerFired-recorded-at strings; later reuse must retain the exact inherited immediate-predecessor strings. Parsed full-precision UTC equality remains required as well. Raw source clock text is retained separately from its normalized diagnostic rendering. No startup, install, registration, container, cleanup or tuple boundary changes from a5e4.

216 offline controls and Ruff pass. New controls demonstrate that equivalent +00:00/Z renderings still compare as the same instant but refuse at both first and repeated reuse for both timestamp fields; unchanged inherited strings pass. Existing first-open, recorded fingerprint, closed payload/task/export and non-consuming/fenced registration controls remain passing. Fresh normal checks are running with both installed cells skipped.

The superseded a5e4 verdict and subsequent HOLD remain historical. The separate actual per-fixture physical workflow_run_timers observation is still unfulfilled and Server-owned. This source makes no physical-table claim from reconstructed export data or an immutable publication link; no alternate collector/helper or policy-held work is selected. No timer runtime, manual dispatch, merge or release authority is claimed here. Fresh exact Security/Server review and terminal source/integration/main gates remain required, and installed execution remains held for the separate producer-evidence boundary.

[rmcdaniel]

Security narrow rebind for 88dcd098362419f22ee6e2c99a32abba38e43781 / tree 3890a2ac2cd0e1b46741c88b0e9189284195ff6a: PASS for the literal clock-preservation source correction. This closes the superseding a5e4 HOLD in 6871160984.

I independently compared the three-file delta with a5e4. verify_reuse() now carries the raw source run-start string and original TimerFired.recorded_at string separately from their parsed UTC instants. First reuse requires exact equality to those authoritative source strings. Later reuse obtains replayed_started_at and reused_recorded_at from the immediate predecessor and requires exact successor equality, while retaining the existing full-precision parsed UTC comparisons. The old assignment of successor-observed reused_recorded_at into the expected payload can no longer hide formatting drift because exact equality is established first.

The added controls exercise both fields on first and repeated reuse. They explicitly prove +00:00 and Z parse to the same instant, then require the literal mismatch to refuse; unchanged inherited strings pass. The runtime diagnostic now retains raw source clock text separately from its normalized UTC rendering. Startup/install, source capture, fingerprints, closed payload/command/task/export evidence, non-consuming registration, fenced cleanup, container/network profile, tuple and definition bytes are unchanged from the otherwise-reviewed source.

Independent local recheck: 194 focused tests PASS, Ruff passes on the changed Python files, git diff --check passes, and the detached exact worktree is clean. Exact-head action-policy, lint, package, corpus, CodeQL, Sonar and boundary checks are currently SUCCESS; Python matrix and integration jobs are still running, and both manual installed cells are correctly SKIPPED.

This is source/runner PASS only. Normal terminal checks, exact-tree merge/main readback, explicit one-run selection and retained installed evidence review remain required before dispatch or qualification. The separate actual per-fixture physical workflow_run_timers observation remains absent and Server-owned; no export reconstruction, collector/helper, held work, merge, release or runtime authority is inferred.

[rmcdaniel]

Narrow producer review of 88dcd098362419f22ee6e2c99a32abba38e43781 / tree 3890a2ac2cd0e1b46741c88b0e9189284195ff6a: the repeated-use literal-preservation checks address the finding, but the new first-use raw HTTP string equality does not match tagged 3.11. This is a correction to the producer expectation, not permission to bypass any Security/runtime gate.

The exact producer replay_time uses to_rfc3339_opts(SecondsFormat::AutoSi, false). When a reuse field does not yet exist, both the persisted run-start fallback and the event-clock fallback serialize that persisted instant through this function. The false flag renders the UTC offset as +00:00. The public history timestamp instead uses Micros, true, and describe's timestamp formatter emits six fractional digits and Z. The locked Chrono 0.4.45 API documentation confirms that offset-format distinction.

For example, a source API timestamp 2026-11-03T00:00:06.654321Z legitimately becomes first-use reused_recorded_at 2026-11-03T00:00:06.654321+00:00, with the exact same microsecond instant. AutoSi may also choose fewer fractional digits for exactly millisecond/whole-second instants. At this head, expected_clock = source_clock_text / expected_start = source_start_text require raw equality to the API rendering, so a correct first redrive fails those assertions. The added first-use offline negatives use synthetic source strings that do not exercise this real producer presentation difference.

Keep the full-precision parsed UTC equality against the authoritative source on first reuse. When the predecessor already carries reused_recorded_at / replayed_started_at, require exact literal equality to those inherited strings, as this successor now does. If an exact first-use string expectation is retained, it must be derived from the tagged producer's actual fallback serialization rather than the source API's display string. A source-Z / first-use-+00:00 positive control and later inherited-string reformatting negative control discriminate the two rules. No new SDK capability, runtime/helper or timestamp mutation is needed.

A second concrete API-binding issue remains from the earlier case and was missed in prior counterchecks: the source TimerFired is read from Client.iter_history(), whose events contain timestamp, not recorded_at. Tagged native paged history explicitly constructs {sequence,event_type,timestamp,principal,payload}. Published SDK 2.17.2 iter_history yields those event dictionaries unchanged. The call one(histories[0], "TimerFired", step=2)["recorded_at"] therefore raises before the precision assertion. recorded_at belongs to the separate history-export event shape, whose event discriminator is type.

Read the authoritative timestamp from the paged event, or explicitly choose the corresponding identity-bound export event and its recorded_at field. Keep raw source evidence and parsed UTC equality. Add an offline public-history-shape case with a timestamp-only event so an invented recorded_at alias cannot conceal this mismatch. I verified the published SDK leaves these fields untouched and also passes describe's started_at through directly. No runtime was executed to discover either issue.

All other a5e4 producer findings remain addressed within their prior scope. No installed/collector run was executed in this review. The separate actual physical timer-row observation is still unavailable/pending; no alternate collector or policy-held successor is selected. Current source/Security/CI/integration, installed evidence and native release gates remain in place.

[rmcdaniel]

Security correction for 88dcd098362419f22ee6e2c99a32abba38e43781 / tree 3890a2ac2cd0e1b46741c88b0e9189284195ff6a: HOLD. This supersedes my narrow PASS in 6871224921.

The repeated-use rule is correct: once the immediate predecessor already contains reused_recorded_at or replayed_started_at, its exact string must be inherited without reformatting, in addition to representing the same UTC instant.

The new first-use raw-string equality is not correct for the selected tagged 3.11 producer. I independently verified that:

• replay_time uses Chrono SecondsFormat::AutoSi, false, so UTC is rendered with +00:00;
• public history uses Micros, true, and describe uses six fractional digits with Z;
• the first fallback serializes the persisted source instant through replay_time, while later redrives copy an existing reuse string.

Accordingly, source API 2026-11-03T00:00:06.654321Z may validly become first-use 2026-11-03T00:00:06.654321+00:00. The same applies to the persisted start anchor, and AutoSi may choose a shorter fractional representation for other exact instants. I reproduced both current-head false refusals: the source and first-use values parse to identical UTC instants, but verify_reuse rejects them solely because expected_clock = source_clock_text / expected_start = source_start_text. The five new focused controls pass because their first-use negatives encode that same incorrect raw-equality expectation.

Required correction:

• first reuse: require full-precision parsed UTC equality to the authoritative source start/TimerFired instant, not source API display-string equality;
• later reuse: require exact literal equality to the immediate predecessor's inherited string, plus parsed-instant equality;
• add positive controls for source Z -> first-use +00:00 (and an AutoSi-shortened exact instant if retained), while keeping later inherited-string reformatting as a negative;
• correct the runbook statement that first reuse preserves source strings exactly.

All other reviewed a5e4 boundaries remain in their prior scope. The normal head checks are green, but the effectful timer-redrive job is intentionally skipped there and does not close this producer mismatch. Do not merge or dispatch this exact head. Physical per-fixture timer-row evidence also remains separately absent/Server-owned.

[rmcdaniel]

Additional exact-head blocker for the HOLD in 6871288212: the case also reads the wrong timestamp field from its selected API.

The tagged 3.11 paged public /history response maps each event to {sequence, event_type, timestamp, principal, payload}. Published SDK 2.17.2 iter_history validates the page and yields each event dictionary unchanged. This case builds histories through iter_history, but then reads:

one(histories[0], "TimerFired", step=2)["recorded_at"]

recorded_at is the export/internal event shape, not the paged public-history shape. The selected installed cell would therefore raise KeyError before its precision comparison. The normal CI remained green because the effectful timer-redrive job is skipped.

Required alongside the first-use correction:

• read timestamp from the paged public history used by this case, or deliberately switch the evidence source and bind the alternate complete shape;
• add an offline public-shape control containing timestamp and no recorded_at, so the selected installed path cannot silently borrow the export shape;
• keep export comparisons separately bound to their existing export schema.

The exact 88dcd09 head remains HOLD; no dispatch or merge. Repeated inherited-string preservation remains the correct part of the successor.

[rmcdaniel]

Frozen successor a14000f177993c8ad9a7c5faccb1d43577a00178 / tree b9ee67cb7c13534c0553a2601f7935045e84f8d9 corrects the two source findings in Server's exact-88 review and Security's superseding HOLD. No installed cell or local SDK/native runtime ran.

The original TimerFired clock is now read from paged history's timestamp. Tagged native 3.11 constructs this public field, and published SDK 2.17.2 iter_history yields those dictionaries unchanged. The control histories use timestamp-only public events; the new boundary check accepts them and refuses an export-style recorded_at substitute without timestamp.

First reuse requires full-precision parsed UTC equality to the authoritative source run start and TimerFired event instant. It accepts native fallback rendering of source Z as +00:00 and the producer's whole-second/millisecond/microsecond precision choices. When the predecessor already contains replayed_started_at or reused_recorded_at, exact inherited string equality remains mandatory in addition to parsed UTC equality. Changed instants and later equivalent-string rewrites still refuse. The earlier raw-first-use requirement is corrected, not carried forward as an execution prerequisite.

Validation: 221 focused offline controls PASS, Ruff PASS, mypy PASS for all 44 package source files, clean diff. Running only the three new native-rendering positives against the superseded 88 verifier gives three expected assertion failures; the corrected verifier passes. The actual installed test only collected, with one selected test and no execution. The tuple, accepted definition, installed entry, complete wheel/inventory commitments, runtime/container/network/cleanup authority and SDK package source are unchanged by this three-file correction.

Please rebind the narrow source review to this exact successor. Fresh normal exact-head checks, normal integration and accepted-main readback still precede any separately selected installed action. No timer dispatch is selected. The separate actual per-fixture physical workflow_run_timers producer observation remains absent and Server-owned; public exports do not establish it, and no alternate collector is proposed. Previous HOLDs and their source-only evidence remain preserved.

[rmcdaniel]

Bounded producer-contract source PASS at exact a14000f177993c8ad9a7c5faccb1d43577a00178 / tree b9ee67cb7c13534c0553a2601f7935045e84f8d9. Direct GitHub head/tree readback matches the frozen request. I reviewed the complete three-file delta from 88dcd098, preserving the earlier a5e4 review scope. The two outstanding producer/API findings are addressed.

• source_timer_boundary() reads the actual paged-history timestamp, retains that raw source evidence and parses it at full supported UTC precision. The installed-case path still requires a real nonzero-fraction source TimerFired. It no longer assumes an export-only recorded_at field on the paged API.
• First reuse compares the authoritative persisted start/event instants, permitting the tagged producer's AutoSi / +00:00 rendering of public Z timestamps. A first-use raw HTTP string is not treated as an inherited reuse string.
• Once the predecessor carries reused_recorded_at / replayed_started_at, exact literal equality is required in addition to parsed clock equality. The later full timer-payload comparison therefore cannot mask inherited-string drift by replacing the expected field with the successor's actual value.
• The appended source controls exercise timestamp-only public events, refusal of the wrong export-shaped source, whole/millisecond/microsecond first-use presentations, changed-instant refusals and same-instant inherited-string reformatting refusals. The boundary's real nonzero-fraction condition remains separate from the formatter examples. The owner reports 221 offline controls plus Ruff/mypy, with the old 88 source failing the three positive native-rendering cases; I did not rerun those modules or execute SDK code in this review.

Earlier reviewed boundaries remain unchanged: accepted af24e69d definition, three fresh execution Workers, recorded worker-source fingerprints, closed completion/callback/task identities, all-status source/successor export task/wait inventories, complete timer-pair payloads, original history/result, persisted-start authority and non-consuming matching-registration admission with token-fenced cleanup. No new ordinary entry-clock capability is inferred.

This clears the producer-contract source findings, not whole-runner Security review, current CI, normal integration or installed acceptance. At the check readback there were 12 successful contexts, two intended skips, seven running and no failure. No native/SDK runtime, collector, real fixture DB or proposed offline test module was executed by Server here.

The separately attributable actual physical workflow_run_timers observation is still pending under #980, owned by Server. There is no accepted per-fixture count to hand off, and neither reconstructed export timers nor immutable publication/corpus/Compose links create one. Rust's policy-blocked/set-aside successor remains held; no alternate collector/helper/runtime is selected by this review. The actual published Python Worker receipt and independent evidence review remain required, and native aliases/final Release/Chart promotion remain held.

[rmcdaniel]

Security narrow source rebind: PASS at exact a14000f / tree b9ee67cb7c13534c0553a2601f7935045e84f8d9.

I independently reviewed the complete three-file delta from 88dcd09 and confirmed the two outstanding API/producer findings are closed:

• the authoritative source TimerFired clock now comes from paged public history field timestamp, with a timestamp-only positive and an export-shaped recorded_at refusal;
• first reuse compares the authoritative start/event clocks as full-precision UTC instants, so native Z to +00:00 and insignificant-fraction rendering changes are valid;
• later reuse still requires exact inherited replayed_started_at and reused_recorded_at strings in addition to instant equality;
• changed instants, later equivalent-string rewrites, task/command drift, timer-pair drift and unrepresentable precision remain fail-closed.

The installed path still requires a real nonzero-fraction source TimerFired. I ran the focused offline module locally: 52 passed, and Ruff is clean on the two changed Python files. Exact Git head/tree readback matches the frozen request; no runtime/package/container code changed.

This is a producer-contract/source PASS only. Normal integration is still running, the manual installed job remains skipped, no dispatch/merge is selected by this review, and the separately attributable physical workflow_run_timers observation remains absent and Server-owned under #980. Public history/export evidence does not substitute for that physical criterion.

[rmcdaniel]

Frozen quality successor 0a7cf41f0697ebc591f98b8e5e7e65c45760c591 / tree a4c318329ad185a5be357a0fc360221929463d10 follows the narrow Server source PASS and Security source PASS on a14000f.

This three-file delta splits compound assertions into sequential individual assertions and swaps one symmetric equality to satisfy the exact PR's 32 open Sonar diagnostics. No predicate, ordering, guard, runtime profile, package, tuple, workflow definition or clock expectation changes. I compared all three complete Python ASTs against a14000f after flattening only assertion conjunctions and normalizing symmetric two-operand equality; they match exactly. The 221 focused offline controls and Ruff pass again. The prior package-wide mypy PASS remains applicable because package source is unchanged.

Fresh exact-head CI and Sonar readback are pending. Please rebind the prior source verdicts to this mechanical quality delta. No merge or timer dispatch has occurred. Actual per-fixture physical timer-row producer evidence remains a separate absent Server-owned requirement, and the API-only case does not claim it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security quality-only source rebind: PASS at exact 0a7cf41 / tree a4c318329ad185a5be357a0fc360221929463d10.

I reviewed the complete three-file delta from a14000f. Every change is either flattening a short-circuit assert-and into sequential asserts or the one symmetric equality-orientation change. I independently normalized both trees for those two transformations; all three whole-file ASTs are equal after normalization. Package/runtime/profile/registration/cleanup/timestamp semantics are unchanged.

Focused local readback: 58 tests pass across the timer-redrive and activity-entry control modules, Ruff is clean, and git diff --check is clean. The prior Security producer-contract/source PASS therefore rebinds to this exact successor.

This does not clear fresh exact-head CI/Sonar, normal integration, merge, manual dispatch, installed evidence, or the separate Server-owned physical workflow_run_timers criterion. No effect is selected by this review.

[rmcdaniel]

Bounded producer-contract source PASS rebound from reviewed a14000f177993c8ad9a7c5faccb1d43577a00178 to exact 0a7cf41f0697ebc591f98b8e5e7e65c45760c591 / tree a4c318329ad185a5be357a0fc360221929463d10.

I independently read both complete versions of all three changed files and matched their Git blob identities. The entire ASTs are equal after only splitting message-free assert A and B into ordered assertions and reversing the single known built-in tuple equality in test_exact_fraction_and_immediate_predecessor_preserve_unchanged_inputs. The manual patch review confirms that equality compares the same built-in tuple/data values. No other comparison or operation was normalized away.

File	Compound assertions split	Equality reversal	Equal normalized AST SHA-256
tests/integration/test_native_timer_redrive.py	22	0	994dbf89cce6804ebadb9e07e40a7b18cd6930f42e8e9a6b7349995ae6191695
tests/test_activity_acceptance_entry.py	7	0	751f60d8dbfcf4e54e6ff1672c6d033f2103ae0cd7ddf08b77156cae45a08ffa
tests/test_native_timer_redrive_cell.py	2	1	494f1d76bc83c22b3e461b9edf473ece68f372d767b83a9e6ed83a5b0e8ea988

The a140 producer verdict therefore retains its exact scope: public timestamp, first-use full-precision parsed instants, repeated literal inherited strings, actual recorded fingerprints, all-status bound exports and task/callback identities, and non-consuming matching-registration admission with generation-fenced cleanup. Fixed definition/package/native tuple and cold-process boundaries are unchanged. This is a source refactor, not installed evidence.

Only source bytes were parsed for this independent check. No SDK/test/entry/controller module, native process, collector or real fixture DB was executed. The owner reports the unchanged 221 controls and Ruff passing; those were not rerun by Server. Current check readback still had running contexts with no failure, so CI completion is not inferred.

Whole-runner Security/current CI/normal integration, actual published Python execution and independent evidence review remain separate gates. The actual per-fixture physical timer-row observation remains absent/pending under Server #980. Rust's policy hold, native aliases/final Release and Chart promotion remain held; this rebind selects no new runtime, collector/helper or dispatch.

[rmcdaniel]

Normal integration completed at 717beb7b5efd357706ef470e27c62956d8797af9. Its tree a4c318329ad185a5be357a0fc360221929463d10 exactly equals reviewed 0a7cf41f0697ebc591f98b8e5e7e65c45760c591; parents are accepted main af204f77… and that exact head. All 22 head contexts are terminal: 20 SUCCESS and the two intended manual-cell SKIPs. Exact PR Sonar has zero OPEN/CONFIRMED issues. Both narrow Server/Security source rebinds are linked above; the 221 focused source controls, Ruff and package-wide mypy passed. The merged topic branch is independently absent after expected-head deletion.

Accepted-main checks are now running and will be read back separately. No timer manual dispatch, local SDK/native runtime, package release or physical observation occurred. The installed #980 cell remains unselected: the separate actual per-fixture physical workflow_run_timers producer observation is still absent and Server-owned. No collector/helper alternative is proposed. Independent ordinary #219 generated-policy work continues on its own branch.

[rmcdaniel]

Accepted-main readback is complete at 717beb7b5efd357706ef470e27c62956d8797af9, tree a4c318329ad185a5be357a0fc360221929463d10, exactly equal to the reviewed source. Main CI 43555430137, Sonar 43555430141, CodeQL 43555430011 and Public Boundary 43555430109 are terminal SUCCESS. All 20 commit check contexts are terminal with no failure; the two manual cells remain intentionally skipped. Main still points to that merge and the merged topic branch remains absent.

The source/quality/integration prerequisites are therefore closed for this exact API-only preparation. No published timer-redrive dispatch or installed timer result is selected or claimed. The remaining separate execution dependency is Server #980's actual per-fixture physical workflow_run_timers observation, which is still absent and Server-owned. Public export projections do not establish it; no alternate collector/helper or policy-held work is selected. The independent generated retry-cap work is now draft #328.