[rmcdaniel]

The first published pagination job passed its iterator case but failed while serializing the terminal receipt: the complete readiness environment inventory exceeded the existing 128 KiB limit, leaving the reserved result.json empty. The original run/artifact remains runner-blocked/NONPASS.

Retain the full readiness inventory in consumer-ready.json and bind its filename, byte count and SHA256 in the terminal receipt. All environment, installed SDK, runtime profile and cleanup verification still runs. The terminal bound remains 128 KiB. If another oversized report reaches finalization, write a bounded failure receipt through the retained descriptor, including exact captured IDs and bounded cleanup evidence; oversized cleanup is explicitly marked unretained and cannot authorize success. Path replacement still cannot redirect the held result or overwrite a foreign path.

Validation: 167 focused controller/authority/consumer/pagination tests pass and Ruff passes. A frozen 949d38b predecessor control reproduces the size refusal and zero-byte receipt; successor controls retain the full readiness bytes, bind their digest, and preserve bounded NONPASS/cleanup identities after oversized input and path replacement. A source-only serialization check using the original captured readiness retains all 280,522 bytes and writes a 284-byte bounded receipt with complete:false; the original invocation stays NONPASS. No Docker, SDK runtime or new installed invocation ran for these source controls.

This changes no SDK package, pagination fixture, tuple, guard, resource cap or operating selection. Fresh source review, normal CI/integration/main readback and a separate one-run selection are required before another pagination observation. Other stopped cells remain unselected.

Tracks durable-workflow/.github#247; follows #330.

[rmcdaniel]

Security source/runner PASS for exact fc20d6a32d7e7f382f3acaa36c5a590193cdbe6e / tree a00bf3b55a39f082a46302679facb4bb7c24830b.

The complete readiness inventory is now retained through the existing no-follow output authority as consumer-ready.json, while the terminal receipt binds its fixed basename, exact byte count, and SHA-256 and no longer duplicates the inventory. The consumer transport already caps total output at 2 MiB; the independent retained file is included in the unchanged whole result-directory artifact.

If the terminal report itself still exceeds 128 KiB, finalization writes a bounded complete:false receipt through the held descriptor with the oversized report size/digest, selected scenario/source/run IDs, and either bounded exact cleanup or an explicit unretained cleanup size/digest. Path replacement remains fail-closed and cannot overwrite a foreign file. No oversized or unretained receipt can authorize success.

Independent focused checks pass 129/129; exact-head policy, Python 3.10–3.15, package, lint, integration, CodeQL, Sonar, and target-branch qualification are terminal PASS. This verdict covers only the source/receipt correction. The first run remains runner-blocked/NONPASS; accepted-main readback, a fresh exact caller/effect review and any later installed pagination observation remain separate. No SDK tuple, profile, pagination case, resource cap, or held scope is changed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head rebind: SOURCE / RUNNER PASS for 9f1905c5c4a032b95ec4de9942b2e1c169ef0c51 / tree d4f31dbb7cd582cc9ceb8e7bfd89aa983035b73d.

I independently verified that this is the conflict-free merge of the reviewed fc20d6a32d7e7f382f3acaa36c5a590193cdbe6e receipt correction with accepted docs main ed4649bf6deaa82127398515c451e876c21c80a1: the four receipt-fix blobs are byte-identical to the reviewed head, and git merge-tree --write-tree reproduces the exact current tree. The only child-side differences are the accepted four portal/docs files.

The prior first invocation remains NONPASS. Fresh exact-head checks, accepted-main readback and any new installed pagination invocation remain separate gates; this verdict does not select a dispatch.

[rmcdaniel]

Accepted receipt-correction main is f5bc91ffadb747ab43cad6c38e5d347bfae213a7 / tree d4f31dbb7cd582cc9ceb8e7bfd89aa983035b73d, exactly the reviewed 9f1905c tree. Its parents are accepted guide main ed4649b and reviewed 9f1905c; the conflict-free composition was independently rebound at 6876705249. The merged topic branch is independently absent.

All 24 head checks and all 22 current-main checks are terminal: 20/18 successes respectively, plus four intended manual skips. Main Sonar attempt 1 failed before analysis while downloading the public pinned scanner archive (HTTP403); the same official artifact independently returned HTTP200 afterward. One failed-check rerun, 43591409732 attempt2, passed without changing credentials, the action pin or signature verification. The original failure remains recorded; no authentication cause is inferred.

The unchanged pagination case, tuple, complete lock, consumer/entry/verifier/runtime/session code and workflow inputs match original #330 main 949d38b. The receipt fix controller SHA256 is 89a10c4b425693b070c30c611779baabeaed562040cc8ab9bb4367bd8e3e799c; held output writer SHA256 is d6d091d6737a2de9553072b3ac5c82e59511527a100a119a9ad9e30173f11877.

The fresh caller packet is one registry-only invocation of ci.yml at this main commit, with published_pagination=true, published_activity_acceptance=false, published_timer_redrive=false, activity_retry_cap=false, cooperative_qualification=false. It has been returned for exact effect review. No new pagination invocation has been selected yet; the original 43589090161 remains runner-blocked/NONPASS. The independently selected stable guide deployment uses published SDK2.17.2 and is separate from installed pagination evidence.

[rmcdaniel]

SECURITY EFFECT PASS — scoped to one fresh published-pagination observation at exact accepted main f5bc91ffadb747ab43cad6c38e5d347bfae213a7 / tree d4f31dbb7cd582cc9ceb8e7bfd89aa983035b73d.

I independently checked the merged ancestry, current remote-main identity, complete dispatch input names, workflow selectors, controller/output-writer hashes, and the four-file receipt correction. The pagination job is selected only by published_pagination=true; the other manually selected acceptance jobs remain false. The ordinary CI jobs that naturally accompany this workflow dispatch are not pagination acceptance evidence.

The correction is fail-closed: the complete readiness record is retained through the private held-output authority and bound by exact file/byte/SHA metadata; the terminal receipt remains bounded. An oversized terminal report becomes an explicit NONPASS while retaining bounded owned IDs and cleanup evidence, and path replacement cannot redirect the held receipt or overwrite a foreign path. The consumer transport remains bounded, so the separately retained readiness object is bounded upstream. Focused independent source controls pass (129 cases).

The one-run disposition requires all of the following immediately before and after the single POST:

• refs/heads/main must still equal f5bc91ffadb747ab43cad6c38e5d347bfae213a7; otherwise stop and rebind.
• Use exactly: gh workflow run ci.yml --repo durable-workflow/sdk-python --ref main -f published_pagination=true -f published_activity_acceptance=false -f published_timer_redrive=false -f activity_retry_cap=false -f cooperative_qualification=false.
• Bind the newly returned unique workflow-dispatch run to head_sha=f5bc91ffadb747ab43cad6c38e5d347bfae213a7, attempt 1, and the reviewed workflow. No rerun/reuse of the prior 43589090161.
• Terminal qualification still requires the exact pagination artifact and receipt: complete=true, source_commit=f5bc91ffadb747ab43cad6c38e5d347bfae213a7, the retained consumer-ready.json byte/SHA binding, exact tuple/lock/image/source evidence, and complete owned-ID/label absence with no OOM. Reconcile the downloaded artifact independently.

This PASS authorizes only that bounded observation. It is not a terminal-result verdict, installed acceptance, guide qualification, release decision, or authority for any other workflow input.

[rmcdaniel]

Select one fresh published-pagination observation at accepted main f5bc91ffadb747ab43cad6c38e5d347bfae213a7 / tree d4f31dbb7cd582cc9ceb8e7bfd89aa983035b73d, after the exact Security effect review. Immediate primary readback still resolves main to this commit. Source/runner review, all terminal main gates and the separately deployed stable guide are recorded above.

Exact invocation: gh workflow run ci.yml --repo durable-workflow/sdk-python --ref main -f published_pagination=true -f published_activity_acceptance=false -f published_timer_redrive=false -f activity_retry_cap=false -f cooperative_qualification=false.

This selects the unchanged normal-registry SDK2.17.2 wheel, complete 15-wheel lock, qualified immutable Server3.9.2/Python3.12.16 tuple, fixed pagination case and reviewed closed runtime profile. It starts a new attempt1 run and does not rerun or reuse first invocation 43589090161, which remains NONPASS. Acceptance still requires the new raw artifact and complete terminal receipt, readiness file commitment, exact package/source/image identities, page controls and independent owned-ID/label absence without OOM. Ordinary CI checks do not substitute for that pagination receipt.

[rmcdaniel]

The selected fresh published-pagination job is terminal observed PASS, pending independent retained-evidence review: run 43594972352, attempt1, job132447536725, exact f5bc91ffadb747ab43cad6c38e5d347bfae213a7. Main resolved to this commit immediately before and after the single dispatch. The original 43589090161 remains NONPASS.

Downloaded artifact 14113399934, published-pagination-f5bc91ff…, is 6,539,056 bytes. Its raw ZIP SHA256 8e6ba47330ca7b72ac4ece4f7fcf64d3f83910e55e5555c5ac887a8eb6c128a4 matches GitHub's artifact digest. result.json is now 4,912 bytes, SHA256 5107616a6fcf53893210348263314156523536b63fa47bba978b1d10b85fe686, with complete:true, registry source, source commit f5bc91f and consumer exit0. It binds the full 280,522-byte consumer-ready.json by SHA256 974d11c1a368bc9eec8f668e77050e4035ae6e2ce28e42811acd77111635636e.

Independent owner readback matched all seven captured source hashes, the exact committed tuple, complete 15-wheel hash lock/distribution inventory and normal-registry SDK2.17.2 wheel 7dc77d3882fa5cbddbeaee6a4cc63b05285e280523c8ea40dc31e03cc12a40bc. All 46 runtime files and wheel distribution members match the installed inventory. The environment inventory commitment matches; before/after SDK-authority records are byte-identical. Retained raw OCI indexes, amd64 manifests and image config bindings match qualified Server3.9.2 and Python3.12.16.

The single JUnit case passed in 0.355 seconds. Five selected workflow/run pairs traverse list pages [2,2,1]; all three negative filter controls stay absent. The exact selected run's paged history traverses [1,1,1,1]: StartAccepted, WorkflowStarted, CancelRequested, WorkflowCancelled. Every page retains the canonical namespace/run/filter/page-size and opaque continuation chain, with exact order and no gaps/duplicates. Resume from the captured first-page token returns the exact remaining suffix. Early close makes one request, and namespace mutation refuses before another request. The case also compares both traversals to independent quiescent one-page baselines.

The complete cleanup receipt independently observes both full container IDs and the network absent, plus empty exact owned-label inventories. Runtime 72f4f008ec4ea13a43cbce5fa59732ab2f7f49baab9b291b7b3a5157d756c74b and consumer d07d2f87f4f596424c6a6a67f4201a4b99f4f1aed3440a837451ba1012b17df3 exited0 without OOM; network ab0503930801a7e788fd2e60ef5b1a4febacf94807116061306db2300e809625 is absent. The two retained pytest fixture-method deprecation warnings concern the captured server_url/server_token fixtures; assertions and receipt verification passed without suppression. Evidence retention remains seven days.

This proves the scoped ordinary pagination observation on the existing published package, subject to independent counter-review. It changes no package, selector or unrelated acceptance. The independently deployed SDK guide is recorded on #331; root all-locale adoption is the remaining shared247 downstream work.

[rmcdaniel]

Security independent terminal review: PASS, scoped to the single published-pagination observation in run 43594972352 attempt 1, job 132447536725, at exact main f5bc91ffadb747ab43cad6c38e5d347bfae213a7.

I independently downloaded artifact 14113399934 (published-pagination-f5bc91ff...); the API binds it to this run/head and reports ZIP digest sha256:8e6ba47330ca7b72ac4ece4f7fcf64d3f83910e55e5555c5ac887a8eb6c128a4. The retained result.json is complete and hashes to 5107616a6fcf53893210348263314156523536b63fa47bba978b1d10b85fe686. Its seven source hashes match the exact checkout. All 15 wheel bytes match the closed lock; the SDK wheel is reviewed durable-workflow 2.17.2 at 7dc77d.... I independently reconciled all 52 wheel members and RECORD checksums against the 59-entry installed inventory, including the seven expected installer-generated entries; all 46 durable_workflow/ runtime files are present. Before/after SDK-authority files are byte-identical.

The separately retained consumer-ready.json is 280522 bytes at 974d11c1...; its complete environment inventory canonicalizes to the recorded 432c1bb4... hash. The real observation contains five unique target runs across list pages [2,2,1], resumes exactly after the first opaque token, excludes all three negative controls, and records early-close plus namespace-change refusal. The selected run history traverses sequences [1,2,3,4] one event per page and resumes as [2,3,4] with the exact workflow/run pair. JUnit has one passing case and no failure/error/skip. The two fixture-method deprecation warnings are retained and do not alter this result.

The receipt binds exit 0, no OOM, absence of both exact container IDs, the exact network ID, and the remaining owned-label inventory. The full CI run and target-branch qualification are terminal success. The prior run 43589090161 remains NONPASS and is not reused. This verdict does not qualify another SDK version, release, timer/activity scenario, or a repeat invocation.