[rmcdaniel]

Purpose

Prepare PHP SDK 2.5.4's entry-binding safety patch for durable-workflow/.github#221 after #192's candidate and independent fresh-main qualification.

Scope and source evidence

The two metadata files are composer.json's product train and docs/quickstart-contract.json's published version/exact Composer requirement, from 2.5.3 to 2.5.4. Dependencies, Server minimum, protocol version and runtime bytes remain exact merged b4fd69b2e744d8ae6c399c2b5749aa83e0b7058e / tree 3ee1474e.

The first metadata candidate omitted the quickstart version and failed the existing release-boundary assertion. That original failure is retained. Current 08c33a6ec1ae2be1414ddb91f177f9e39b8c5667 corrects the omitted metadata and runs its own normal checks without changing tests. The docs and package checks have passed; remaining checks are still running.

Normally installed old-producer failures, final source refusal/recovery controls, preserved business failures, 41 official replay fixtures and stopped read-only audit are recorded in .github#221 comments 6291064461 and 6291667537. Sixteen business originals remain scoped to their tested runtime source.

This metadata tree must pass its own normal checks and independent main checks before immutable publication. Registry identity, normally installed replay/HTTP acceptance and downstream consumers remain pending. No Server/native/shared or frozen dependency adoption is included.

[rmcdaniel]

The first metadata candidate 8180dd9 failed normal PHP8.1–8.4, package and portal checks because I advanced the product train without its machine-owned quickstart contract. Independent completed PHP8.3 job output confirms the sole test failure: DependencyBoundaryTest::testReleaseMetadataDeclaresExactArtifacts, expected 2.5.4 versus quickstart 2.5.3 (2,516 tests / 12,468 assertions / one failure / 56 skips). This is my release fan-out omission, not a runtime regression or an installable release.

The correction advances only docs/quickstart-contract.json's exact published version and Composer requirement to 2.5.4. The onboarding range stays ^2.5; dependencies, Server minimum, protocol, runtime and tests remain unchanged. Normal checks will qualify the corrected two-file metadata tree. No assertion or quality threshold is relaxed, and the failed original is retained.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud