[rmcdaniel]

Prepare Python 2.18.0 for the accepted finite generated-backoff API from #328 and shared #219. The package source already has independent API/Security approval. This PR updates release metadata and adds the bounded installed scalar-local retry case needed before publication and after registry readback.

The new manual case uses the existing closed internal two-container profile and exact published native 3.9.2 / Python 3.12.16 platform. It executes three policies through real Workers: the factory's omitted 60-second maximum with an initial interval of 61 seconds, a short explicit list producing 1, 2, 2, 2, and an empty list. Monotonic callback times independently check nonzero waits; exact attempt reports and actual retained public retry/activity snapshots must agree. Committed histories replay with callbacks forbidden. The default-cap case makes one real 60-second wait; the full case is bounded at 180 seconds within the existing controller/session limits.

Candidate mode reuses the protected publication resolver and archive extractor to bind the same-repository successful build, source/tree, immutable artifact and approved distribution hashes. The controller independently captures the approval record from Git and rechecks the consumed wheel bytes. The fixed 14-package dependency lock plus approved SDK hash forms the complete private 15-package install. Registry mode downloads the same full lock and requires the identical wheel hash. Both retain the wheel set, SDK/environment inventories, runtime/container/network authority, commands/history/timing evidence and independent cleanup.

The new job is disabled by default and runs only on an explicit workflow dispatch. It has read-only contents/actions permissions; the Actions token is scoped to candidate metadata/download steps and is not admitted to the SDK consumer. Existing identity/timer tuples and their default selection remain unchanged. No new host mount, port, capability, Server role, prepared-local carrier or SQL collector is introduced.

Validation: 233 focused source/consumer/authority/install/retry controls and 124 release/metadata/portal controls pass, with Ruff, package-wide mypy and corpus-policy validation. Download tests use inert marker bytes and no package installation. The real case only collected locally. No 2.18 build-only producer, candidate install, actual retry runtime, publication or registry qualification has been selected. A reviewed release approval record is deliberately absent until the exact build exists and artifact review completes. Source/runner review and terminal normal checks precede build/installed selection; candidate evidence, protected promotion, registry repeat and stable/root docs remain separate delivery gates.

[rmcdaniel]

Security source/runner review PASS for exact head 9749d59aa146afcecff69ee040ca0d1b6f2c9a67 / tree 5d62aa87e9e6d2cd9bf909dab7271b5f16fab59f, scoped to release preparation and the disabled installed retry-cap cell.

Independent scope review confirms the direct parent is accepted #328 main 5f3ecc91509b005d9ee34c890c8ca670cce529d2; the complete delta is 13 files, 665 insertions and 12 deletions. SDK runtime implementation bytes are unchanged. Product metadata advances only version/product-train/registry-version to 2.18.0 and records the already-reviewed finite retry API.

Runner boundary:

• The job is manual dispatch only, disabled in push/PR CI, gated by action policy and lint, with read-only contents/actions permissions and pinned actions.
• Candidate mode is accepted only for the fixed retry-cap scenario. It uses the protected same-repository resolver/extractor, captures the later Git-tracked 2.18.0 approval record, requires its exact wheel/sdist membership, and rehashes the consumed candidate wheel through a held no-follow bounded read.
• Registry mode downloads the complete lock and must produce the identical approved wheel hash. Candidate mode downloads only the fixed 14 dependency packages, then adds the approved wheel bytes. Both hand the consumer the same complete 15-package hash lock.
• The approval record is deliberately absent now, so neither candidate nor registry execution can pass source capture before the separately reviewed build/approval record lands.
• The existing closed two-container/internal-network profile, exact image/platform authority, installed inventory, Git-captured no-site entry, before/after byte commitment, full-ID/label cleanup, and stream/time bounds are retained. No host mount, port, extra capability, SQL collector, or alternate carrier is added; the Actions token is confined to host-side candidate metadata/download steps.

Scenario contract:

• The generated default policy performs two attempts with a real 60-second capped wait from an initial 61 seconds.
• Explicit [1,2] with five attempts must report/observe [1,2,2,2]; the empty list with three attempts must report/observe [0,0].
• Monotonic callback gaps independently enforce each nonzero lower bound with only the stated 10 ms clock tolerance.
• Commands and retained public history bind exact policy, ordered attempts, reported backoffs, one scheduled execution, retries and completion. The export is exact workflow/run, retained, complete and unredacted.
• Replay uses the committed history with callbacks forbidden, must produce only the final completion, and the public history is re-read unchanged.

The inert downloader/workflow controls independently pass 7/7 locally. Two earlier local collection attempts stopped before tests because the review host lacked the repository import path and then httpx; no package download, installation, Docker, Server or SDK case ran, and neither attempt is product evidence. Exact-head hosted Python 3.10–3.15, lint, package, corpus, CodeQL, Sonar, docs and public-boundary checks are green; the integration job remained pending at this readback and is required.

No installed selection follows from this PASS. Before a candidate dispatch, return the exact build-only producer, source/tree, wheel/sdist hashes, immutable handoff, Git approval record, final lock and caller identities for separate review after exact-head integration/main gates. Candidate evidence, protected publication, ordinary registry propagation/hash equality, registry repeat, stable/root docs and final release acceptance remain separate gates.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Frozen successor ad74c1323446ede3ce7d24d97ab0504ea2813c47 / tree 3fc99dad0766bd45713e27c2c4b268d823ab393b strengthens only the case's counter/timing validation after the initial source/runner review.

The callback and reported attempt numbers must be actual integers, and successive monotonic readings must not go backwards even in the empty-list case. This prevents Python boolean/integer equality and the 10-millisecond nonzero-wait tolerance from admitting malformed observations. Three focused controls were added. The artifact selector, full lock, workflow/token boundaries, published platform, consumer/profile and cleanup are unchanged.

233 focused source/consumer/authority/install/retry controls pass with Ruff. The additional 124 release/metadata/portal controls pass, as do package-wide mypy and corpus-policy validation. The actual case only collected locally. Fresh exact-head CI and the narrow source rebind remain required. No build-only producer, approval descriptor, candidate installation, retry runtime or publication has been selected.

[rmcdaniel]

General scenario/acceptance source review PASS at current head ad74c1323446ede3ce7d24d97ab0504ea2813c47.

The three selected ordinary scalar-local cases cover the remaining Python #219 behavior: the accepted factory with an omitted maximum and initial interval 61 must encode and actually wait 60 seconds; the explicit short list produces 1,2,2,2; the empty list produces zero waits. The test independently measures monotonic callback gaps, checks total ordered attempts and outcomes, compares the exact recorded policy and backoffs, and checks retained public local-activity retry snapshots. Committed history is replayed with callback execution forbidden and re-read unchanged. The 10-millisecond measurement tolerance and 180-second case bound are explicit.

The metadata selects API minor 2.18.0 for the already accepted additive factory; it does not change the legacy constructor or recorded policy. Candidate and registry modes require the same approved wheel hash and complete dependency lock. The default-disabled dispatch, existing internal runtime 3.9.2 profile and separate artifact approval remain appropriate boundaries. This case introduces no physical-row, clock-redrive or prepared-local dependency.

This accepts the scenario and delivery scope. Security's complete runner/artifact-source disposition, normal source checks, an exact build/artifact approval, candidate observation, protected publication, identical registry repeat and stable/root documentation remain independent gates. No installed invocation or publication is selected by this source review, and I ran no additional runtime.

[rmcdaniel]

Security narrow source/runner rebind PASS for exact successor ad74c1323446ede3ce7d24d97ab0504ea2813c47 / tree 3fc99dad0766bd45713e27c2c4b268d823ab393b.

Independent comparison confirms this is the direct child of the reviewed 9749d59aa146afcecff69ee040ca0d1b6f2c9a67 head and changes only:

• tests/integration/test_activity_retry_cap.py
• tests/test_activity_retry_cap_cell.py

The delta is semantically narrow and correct. type(value) is int now prevents Python boolean/integer equality from admitting True as callback or recorded attempt 1. The separate nonnegative-gap assertion applies before the declared-wait tolerance, so the zero-delay case can no longer admit a backwards monotonic reading. The callback-boolean, report-boolean and empty-list backwards-clock controls exercise those three exact predecessors. No artifact resolver, lock, workflow, token, container profile, timeout, cleanup, SDK runtime or release metadata byte changes in this successor.

The reported tree identity and two-file scope reproduce locally, git diff --check is clean, and the exact-head hosted check set is now terminal with all required jobs successful and only the two installed cells intentionally skipped.

This PASS inherits only the prior source/runner scope. It does not select a build producer, create an approval record, install a candidate or registry package, run the retry cell, publish 2.18.0, or qualify downstream documentation. Return the exact producer/artifact/approval/lock/caller identities for the already-required separate review before any installed selection.

[rmcdaniel]

Normal merge 0f281d748a49e79ea5b31471178eb3c14cc40045 has tree 3fc99dad0766bd45713e27c2c4b268d823ab393b, exactly equal to reviewed ad74c1323446ede3ce7d24d97ab0504ea2813c47. Its parents are accepted main 5f3ecc9… and that exact head. All 24 head contexts are terminal: 21 SUCCESS and the three intended manual-cell SKIPs. Exact PR Sonar has zero OPEN/CONFIRMED issues. Security exact rebind and General acceptance review bind this source. Expected-head branch deletion and remote absence were verified.

Actual-main checks are now running and remain a prerequisite before selecting the build-only producer. PyPI still reports 2.17.2 with no 2.18.0 release, and the 2.18.0 Git tag is absent. No reviewed 2.18 approval record, build-only selection, candidate retry observation, publication or registry retry observation exists yet. The artifact/installed/docs stages remain explicit; the independent timer physical-row hold is unchanged.

[rmcdaniel]

Actual-main CI 43559976143 is terminal SUCCESS at 0f281d748a49e79ea5b31471178eb3c14cc40045, exact reviewed tree 3fc99dad0766bd45713e27c2c4b268d823ab393b. Main Sonar, CodeQL, Public Boundary, dependency graph and developer-portal build are also terminal SUCCESS. The portal's deploy job was skipped; stable package/docs authority is not advanced by a source build. No pending/failing main check remains.

Owner selection: one build-only publish.yml invocation, publish=false, from a temporary sdk-python/2.18-build-0f281d7 ref fixed to that exact accepted-main commit. No tag, PyPI promotion or installed retry invocation is selected. After the producer finishes, I will return its exact run/attempt, source/tree, handoff/wheel/sdist identities and approval descriptor for independent artifact review before candidate installation. The normal reviewed publication and identical-registry retry/docs stages remain separate.

[rmcdaniel]

The current 2.18.0 qualification step is policy-blocked and has been set aside; no candidate retry invocation or publication is selected.