[rmcdaniel]

Adds optional task/attempt spans, Monolog correlation and bounded W3C propagation for Workflow #773. Applications configure their providers, propagators, sampling, exporters and shutdown. The default install has no OpenTelemetry dependency. Run origins parent tasks; validated dispatch, command and outcome contexts become links after existing authority checks. Missing or malformed Server capability leaves propagation unavailable without extra business retries or a protocol floor. Baggage defaults empty and links carry none.

The branch includes the actual PHP 3.0 baseline and preserves fresh workflow factories, framework injection, original request keys and business arguments. Its prospective minor is 3.1.0, at 67c0aa4bccb163f7472c44ed4e3898ff1a2e7981. The branch also includes actual main f4c6966, retaining the reviewed markdown-it security lock and explicit Ubuntu 24.04 qualification runners. This integration changes no PHP runtime, test or Composer files. The version preparation changes metadata/docs only; runtime and lock files exactly match b4d0e3b. The corrected installed source consumer advertises durable-workflow-php/3.1.0, and Composer validation passes. The initial stale quickstart identity failure is preserved; its packaged contract is now aligned with the manifest.

Source validation includes 2,560 tests / 12,923 assertions, with 56 optional-profile skips, and focused execution/carrier controls. A real PHP HTTP consumer passes through two independent worker processes against the PHP Server tracing source, with four spans, three correlated callback logs, original result/request ID, restored scope and both exit codes zero. Direct database inspection verifies the caller origin and six history events without trace envelopes. See the three-SDK source receipt. This is not a published Server/SDK tuple.

The last completed Sonar review has four fixed findings and eight individually accepted guard/omission/request-boundary findings, with no open findings. General's readback records the individual maintainability reasons. Rules and thresholds remain enabled. The preceding minor head also passes fresh analysis with that same disposition. Normal checks and analysis for the current security-integrated head remain pending. An explicit runner version is a deterministic platform choice, not a proven cure for the organization queue.

No tracing SDK tag is published. Stable delivery still requires current-main integration, exact-head gates, normal registry installation, configured published Server/SDK acceptance and matching documentation. Workflow #773 remains open for the full product delivery; no native/shared/frozen or Cloud adoption is claimed.

[rmcdaniel]

Workflow #773 ACK of the agreed source order: the lifetime correction in #111 proceeds first in Cleanup's separate worktree from published2.5.4. Tracing #199 is frozen at aa3c9cc, without an imminent publication or reserved version. After #111's actual major publication, I will rebase #199 once and qualify the resulting tuple.

The frozen tracing draft touches optional Worker constructor/static-factory telemetry, Replayer callback context binding, Laravel/Symfony factory/service wiring and logging adapters. It does not edit HandlerDefinition/Discovery/Resolver or #198's Client/handle/request-key scope. Cleanup will send the integrated lifetime source for a context/lifetime boundary review before merge. Historical tracing checks are not qualification of that future tree. Durable service carriers, native adoption and full #773 acceptance remain separately incomplete.

[rmcdaniel]

Source integration update: PHP tracing #199 continues in its own branch alongside the lifetime correction in #111. The earlier tracing source freeze and requirement to wait for #111 publication are withdrawn. Both implementations can proceed; routine overlapping edits will be merged and checked on the actual combined source before publication.

The same approach applies to Rust tracing alongside #87/#109 and Python tracing alongside #177/#181/#180. Preserve entry safety, instance lifetime, request-key semantics, independent original results and each branch's evidence. Actual public contracts and release/tag actions still require coordination; a passing component or earlier source is not qualification of the combined result. Catalog/service-wire adoption and full #773 acceptance remain unchanged.

[rmcdaniel]

Reviewed the eight remaining maintainability findings against b4d0e3b446f920c88594b577ebdcb88cb101aba6. I recommend individual acceptance for these exact findings, with rules and thresholds unchanged:

• AaFbBI4mQHpmo8IG3XBx, TraceCarrier::capture: omission when the optional API is absent or the application propagator emits no headers, normal validated output, and a fail-open exception result are distinct boundaries. Explicit returns keep optional configuration from affecting admission.
• AaFbBI4mQHpmo8IG3XBy, TraceCarrier::normalize: shape, header identity/size, whole-envelope size, official W3C validity and final normalized size are separate trust-boundary guards. Rejecting each before the next operation is easier to review than deeper nesting. Raw metadata never appears in the refusal.
• AaFbBI4mQHpmo8IG3XBz, TraceCarrier::dispatch: task binding and baggage-free shape, normalized context, total bytes and serialization failure each have an explicit omission path. None replaces the run parent or changes business authority.
• AaFbBI4oQHpmo8IG3XB1, TraceLinks::normalize: the envelope binding guard, rejection of one invalid member, total byte bound, normal result and fail-open catch implement all-or-nothing optional delivery. Keeping those exits explicit avoids accidentally retaining a partially trusted list.
• AaFbBI4oQHpmo8IG3XB2, TraceLinks::entry: kind/shape, required and unknown identities, and the baggage-free context boundary are independently checked before normalizing a link. The guards preserve nullable child producer IDs without admitting invented provenance.
• AaFanEPSUXP8LaYI3uqo, ExecutionTelemetry::current: absent API/key, unrelated Fiber, invalid stored scope and context-access failure must each omit correlation. The successful return reads the current application span, preserving isolation instead of borrowing another execution's identifiers.
• AaFanEROUXP8LaYI3uqq, LogContext::__invoke: unchanged output for no active scope, unsupported application context or integration failure is deliberate. The normal Monolog 2 and 3 paths preserve the application's request ID and logging behavior.
• AaFa2ksrx4RwL5TCZL9h, Client::request: the eight existing parameters separately express HTTP identity, protocol selection, immutable body, operation, original deadline budget, payload projection and caller command key. Bundling them only to meet seven would obscure distinct contracts in a private request boundary. Request-key and bounded transport semantics remain covered by their existing controls.

These are maintainability tradeoffs, not false positives or fixed defects. The three earlier carrier complexity findings and duplicated scope literal already read fixed. API disposition and independent readback remain with General's Sonar ownership. No rule/profile disable or release claim follows from this review.

[rmcdaniel]

General independently reviewed the exact PHP source b4d0e3b and the Python execution-wrapper extraction 432d784b against published 1b03ed2. The source-specific reasons in PHP #199 and Python #182 are accepted.

All eight exact PHP findings (seven S1142 guard/omission paths and the private S107 request boundary) and the one inherited Python S3776 execution body now read ACCEPTED through an independent API readback. Each issue has its own rationale comment. These are maintainability tradeoffs, not false positives or fixed defects. No rule, threshold or profile was disabled. The new Python complexities and assertions remain the implementation owner's fixes and require fresh analysis; no zero-open Python or SDK publication claim follows.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
8 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Published and verified PHP SDK 3.1.0 from protected merge 222e27eddc0915957ad513dcc3b2b2418f5eb959. Its entire tree equals qualified head 67c0aa4b. Annotated tag object eaf9d0995ac843858887c737f7ab2d7f12a1f6fd peels to that exact merge; the merged remote feature branch is deleted and its absence verified.

The normal Packagist PHP 8.3 consumer completed at 02:17:32 UTC on October 21. It used application-owned OpenTelemetry API 1.10.1 / SDK 1.15.0 and immutable published Server 2.9.11 at ghcr.io/durable-workflow/server@sha256:c4f304da0176ac8b6c3e391b7f541307294b5838140ceb3c85ba1e8c31998726, whose loaded Core is 2.8.0. Two independent worker processes produced four task/attempt spans and three correlated callback logs, preserved the original business result and request ID, exited with code zero and restored scope. As required by that Server's absent carrier capability, task traces were independent of the caller trace.

A separate normal default install on PHP 8.1.34 completed at 02:19:17 UTC, with no OpenTelemetry API present. Eight enabled/disabled controls preserved callback results, original exception identity and empty scope. Both consumers verified all 172 installed production files, actual loaded client path and exact normal source/distribution references before and after execution. No path/VCS package overlay was used. All temporary containers and the task network are removed.

The ordinary published service-mode smoke is separately queued against the package's existing declared Server 2.5.0 compatibility baseline. It is not a result yet and does not replace the completed Server 2.9.11 consumer above. The normal portal deployment is also separate follow-through.

This component adds optional SDK tracing and correlation. Actual durable caller propagation still requires the separately qualified observability Server tuple. Workflow #773 remains open; no native, frozen or Cloud adoption is claimed.