Skip to content

Release PHP 3 with fresh attributed workflow instances - #111

Merged
rmcdaniel merged 10 commits into
mainfrom
fix/16-fresh-workflow-instances-20261010
Oct 20, 2026
Merged

rmcdaniel merged 10 commits into
mainfrom
fix/16-fresh-workflow-instances-20261010

Conversation

@rmcdaniel

@rmcdaniel rmcdaniel commented Oct 10, 2026 •

Copy link
Copy Markdown
Member

Addresses #16. Delivery requires qualified PHP SDK 3.0.0 publication and installed-package acceptance.

Attributed workflow instances currently receive shallow clones. Constructor-created nested mutable objects can therefore leak state across executions, replay tasks, queries and updates. This change constructs fresh workflow instances while preserving application-owned dependency identity.

Class registration and WorkflowFactory now define workflow construction. Prebuilt attributed workflow objects must migrate to a class or factory; PSR-11 bindings must produce fresh workflow instances, and constructors must tolerate repeated invocation without external side effects. Laravel and Symfony factories follow that contract. Activity and low-level callable lifetimes retain their existing contracts. README, SDK reference, protocol and framework guides describe the migration.

PHP SDK 3.0.0 is approved in the release decision. Final head is 7f9fd769f633e3c956282df264ddbb03a4f9dffa, including current main 8718e59 and the original c5a4f8c candidate in ancestry. The final merge adds only four prose lines from documentation PR #195; runtime source and Composer metadata remain byte-identical to qualified ac69c37. Integration retains current replay fixtures and updates the Symfony history-cache fixture to explicit factory construction. Product metadata and quickstart requirements identify 3.0.0. The old shared-template Sonar finding is corrected in source.

Current qualification:

  • Full source suite: 2,522 tests, 12,513 assertions pass; 56 optional-framework skips. PHPStan passes. The initial SDK-2-only metadata assertion failure is retained and corrected by a version-independent SemVer assertion.
  • Official replay corpus: 41 base cases and 42 candidate cases; the nested-state fixture fails against normal registry-installed 2.5.4 and passes with this change. All 83 corpus policy controls pass.
  • Laravel 13.38.0 and Symfony 7.4.21 native-container consumers pass using path-installed SDK 3.0.0. The missed Symfony prebuilt-object fixture was migrated and rerun successfully.
  • Actual HTTP execution, replay, query and update checks pass against both the declared immutable Server 2.5.0 baseline and Server 2.9.9 using a path-installed SDK, including scoped credentials, shared dependency identity and graceful worker deregistration. The same check is now part of the existing published-service smoke workflow for SDK 3 and later.

The preceding source/path results retain their stated scope. Final-head hosted CI, its actual required aggregate, boundary and Sonar passed before merge at 22:17:50 UTC as 4c045e645142e0d0fa13cbd71e18dfdcb426b221. Its tree equals qualified 7f9fd769f633e3c956282df264ddbb03a4f9dffa; immutable tag 3.0.0 and Packagist source/dist point to that head. Normal installed acceptance passes.

Historical original candidate qualification, integration results and framework migration results retain their exact source and scope. The former Server #358 shutdown prerequisite is complete. Current tracing and request-key work proceed independently; overlapping source will receive combined checks when integrated.

Post-publication Laravel/Symfony, cached configuration, registration identity and actual HTTP lifetime checks pass with normal registry SDK 3.0.0 against immutable Server 2.5.0 and scoped-credential Server 2.9.9. Both test backends are retired. The original setup-blocked 2.9.9 attempt remains explicit in the installed receipt. Existing SDK-2 consumers remain on their current constraints until their owners deliberately adopt the major.

@rmcdaniel

Copy link
Copy Markdown
Member Author

Sonar findings reviewed against the protected source

The source remains exactly c5a4f8ce8d7f7360858e8b5522458a5a967adb0a; no file, version or release change was made.

Nine test/compatibility findings now have individual accepted dispositions, verified through Sonar's API:

  • Five generic exceptions are deliberate failed assertions or an arbitrary dependency-construction failure used as negative input. A new public exception type would not improve these fixture contracts.
  • Four unused QueryContext bindings deliberately retain the context-bearing query/update signatures exercised by the instance-lifetime and compatibility controls. Removing them changes the invocation shape being tested.

The production nested-ternary finding in HandlerDiscovery.php:36 remains open for later qualified source cleanup. The rule stays enabled; this review neither changes lifetime behavior nor clears the existing major-release decision.

@rmcdaniel

Copy link
Copy Markdown
Member Author

Integration order agreed with the active tracing owner: publish the qualified PHP 3.0 lifetime change first. The tracing candidate at aa3c9cc freezes its overlapping Worker/Replayer/framework source, then rebases once onto the actual published major and qualifies that tuple. This change will integrate separately from current main cd8834a. Handler lifetime correctness and injected collaborator identity will be reviewed before merge. The independent signal/update draft remains separate.

@rmcdaniel rmcdaniel removed the status:blocked Waiting on a named dependency or decision label Oct 20, 2026
@rmcdaniel

Copy link
Copy Markdown
Member Author

Workflow #773 ACK of the agreed source order: the lifetime correction in #111 proceeds first in Cleanup's separate worktree from published2.5.4. Tracing #199 is frozen at aa3c9cc, without an imminent publication or reserved version. After #111's actual major publication, I will rebase #199 once and qualify the resulting tuple.

The frozen tracing draft touches optional Worker constructor/static-factory telemetry, Replayer callback context binding, Laravel/Symfony factory/service wiring and logging adapters. It does not edit HandlerDefinition/Discovery/Resolver or #198's Client/handle/request-key scope. Cleanup will send the integrated lifetime source for a context/lifetime boundary review before merge. Historical tracing checks are not qualification of that future tree. Durable service carriers, native adoption and full #773 acceptance remain separately incomplete.

@rmcdaniel

Copy link
Copy Markdown
Member Author

Source integration update: PHP tracing #199 continues in its own branch alongside the lifetime correction in #111. The earlier tracing source freeze and requirement to wait for #111 publication are withdrawn. Both implementations can proceed; routine overlapping edits will be merged and checked on the actual combined source before publication.

The same approach applies to Rust tracing alongside #87/#109 and Python tracing alongside #177/#181/#180. Preserve entry safety, instance lifetime, request-key semantics, independent original results and each branch's evidence. Actual public contracts and release/tag actions still require coordination; a passing component or earlier source is not qualification of the combined result. Catalog/service-wire adoption and full #773 acceptance remain unchanged.

@rmcdaniel

Copy link
Copy Markdown
Member Author

The approved PHP 3.0 source is integrated with current main. Original c5a4f8c source/evidence remain in ancestry. Integration 8425fe3 preserves both the current numeric-workflow replay fixture and the nested-state regression. The full local PHP 8.3 run executed 2,522 tests: the only failure was an obsolete release-metadata assertion requiring SDK major 2. That assertion now validates the SDK and Server exact versions independently; its focused two tests / 61 assertions pass. PHPStan passes without errors. Fresh normal CI is running on the corrected head. No package or installed-artifact completion is claimed yet. Routine source freezes are withdrawn: active tracing and signal/update work continue independently, with actual conflicts resolved and combined source requalified before publication.

@rmcdaniel

Copy link
Copy Markdown
Member Author

Exact candidate 81780d0 now passes the official replay-corpus comparison against cd8834a: baseline 41 fixtures, candidate 42, and the new nested-state case fails on the baseline and passes on the candidate through the actual Worker consumer. All 83 corpus-policy controls pass. A fresh path-installed 3.0.0 consumer also advertises durable-workflow-php/3.0.0 consistently with the Composer and quickstart metadata; this is source-package identity evidence, not registry publication. Hosted checks remain queued; implementation and installed-consumer preparation continue.

@rmcdaniel

Copy link
Copy Markdown
Member Author

The corrected exact candidate 81780d0 now passes the complete PHP 8.3 source suite: 2,522 tests, 12,513 assertions, 56 framework-dependent skips. The ordinary installed published 2.5.4 package independently fails the same official nested-state fixture at the second workflow task, confirming the current registry defect without a source overlay. Its candidate counterpart and all 83 policy controls pass as recorded above. Completed local core vendor/cache state has been retired after qualification; hosted framework/normal gates and published-major acceptance remain required.

@rmcdaniel

Copy link
Copy Markdown
Member Author

Actual native-container qualification exposed one fixture migration missed by the core suite: the current Symfony history-cache check still supplied a prebuilt workflow object, which PHP3 correctly refuses. It now uses an explicit WorkflowFactory with a shared injected dependency. Both actual framework checks pass against a path-installed candidate: Laravel13.38.0 and Symfony7.4.21, including nested instance state, shared collaborator identity and history-cache behavior. The first Laravel attempt omitted the compatibility script synthetic credential environment; supplying that declared fixture input resolves it without a runtime change. The initial failures remain recorded. No registry-major or deployment claim is made.

@rmcdaniel

Copy link
Copy Markdown
Member Author

The framework fixture correction is pushed as 7cc8509. Its production runtime files are identical to 81780d0, whose full source/corpus/static checks are recorded above. Laravel13.38.0 and Symfony7.4.21 native-container controls both pass with this fixture revision. Required hosted checks are still queued; no queued result is being treated as passed and neither new major is published. The queue delay has been alerted through the operating notification paths while local conformance continues.

@rmcdaniel rmcdaniel changed the title Give attributed workflows fresh execution state Release PHP 3 with fresh attributed workflow instances Oct 20, 2026
@rmcdaniel

Copy link
Copy Markdown
Member Author

The installed-package lifetime check is now committed at ac69c37 and wired into the existing published service-mode smoke for SDK 3 and later.

Two actual HTTP runs against immutable Server 2.9.9 sha256:d45d197e9556292ec096531030717e43d69ea4ea9ab197170971492f14cc0869 passed using a path-installed SDK 3.0.0, including separate scoped-client/worker configuration. Each used two distinct workflow IDs and checked fresh nested state through workflow execution, subsequent history replay, query and update, preserved injected dependency identity, and orderly worker deregistration. Runtime classes were verified to load from the installed package directory, without a source autoload fallback. The Composer path reference identifies this local package copy; this is source-package evidence, not Packagist publication or immutable tag acceptance.

Current main remains cd8834a. Final-head hosted CI/Sonar and normal registry installation are still pending. Existing main consumers were reviewed: Sample App retains ^2.0; the Laravel HTTP example retains 2.4.2; Waterline's SDK dependency is development-only (2.4.0), and Server/Workflow have no runtime SDK dependency. Major adoption will be deliberate in the owning consumers, rather than silently updating constraints. Existing SDK-2 applications continue to use their published contract until migrated. Private deployment decisions remain in their private owning record.

@rmcdaniel
rmcdaniel marked this pull request as ready for review October 20, 2026 19:49
@rmcdaniel

Copy link
Copy Markdown
Member Author

The new actual HTTP lifecycle smoke also passes against the declared minimum baseline: published Server 2.5.0 at immutable digest sha256:66bd0e510c033af611cc1e2191e1ed592acf26e80f89766b0a3e1a0e463ccd19.

Using path-installed SDK 3.0.0 and distinct scoped operator/worker credentials, two executions passed nested-state freshness, subsequent replay, query/update isolation, application dependency identity, and graceful worker deregistration. The same smoke had already passed against Server 2.9.9. The Server compatibility floor remains 2.5.0; no runtime dependency adoption is needed for this lifecycle correction. The disposable baseline runtime was retired after verification.

This is source-package qualification at ac69c37, not Packagist acceptance. Final-head hosted CI/Sonar and normal installed registry acceptance remain pending.

@sonarqubecloud

Copy link
Copy Markdown

@rmcdaniel
rmcdaniel enabled auto-merge October 20, 2026 21:29
@rmcdaniel
rmcdaniel merged commit 4c045e6 into main Oct 20, 2026
37 checks passed
@rmcdaniel
rmcdaniel deleted the fix/16-fresh-workflow-instances-20261010 branch October 20, 2026 22:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants