[rmcdaniel]

Refs #293. New condition waits hash callable tokens under dwphp2:sha256: so formatting and neighboring call-site edits do not change an unambiguous predicate's replay identity. Legacy source-line hashes still match exactly, and a reopen keeps its original fingerprint.

The token representation preserves literals and token boundaries, excludes paths/line numbers/compiler token IDs, and uses a bounded content-sensitive file cache. Reflection selects candidates by source range, callable name, staticness and parameter names. Indistinguishable same-line closures share a combined identity; changing that ambiguity set can change the hash. Unsupported source shapes and PHP builds without the tokenizer retain the v1 computation. Identification never executes the predicate.

Replay accepts v1 only when its original computation matches. V2/unknown identities, keys, occurrence IDs and authored-call boundaries remain strict. Reopens echo their first fingerprint, including absence. The guide covers legacy formatting limits, same-line ambiguity, atomic source/OPcache deployment and coordinated queue upgrades. Workers that replay v2 need compatible source/tokenizer support; rollback below this SDK after v2 waits exist is unsafe.

Prior exact-source validation includes 21 focused fingerprint tests / 69 assertions, fixed fresh-process goldens, PHP 8.1–8.4 checks and the official fixture's fail-before/pass-after control, with independent Security review. Current head 2379dbd normally merges accepted #297 main dbdd8e9 onto retained 898b8e4. No conflicts; both documentation/changelog changes are preserved. The entire ten-file patch is unchanged, and parser/definition/fingerprint-test/fixture bytes match reviewed a2a7462. Accepted duration helper/test bytes match new main. Fresh exact-head CI, SonarQube, CodeQL and Boundary checks pass: 41 successes plus one intended skip, including PHP 8.1–8.4, Carbon 2, corpus, frameworks, package/static analysis and all three documentation compatibility legs. Security has issued fresh source-merge PASS for this exact head/base. Prior-base clearance was not transferred automatically; release/adoption and coordinated-upgrade/rollback/atomic-source gates remain.

Keep this draft for those checks and source review. #293 remains open for source/delivery acceptance. No SDK version, tag, package, release or adoption action is included.

[rmcdaniel]

Source review requested at a2a7462. The first hosted run exposed a PHP 8.1 compatibility error in the new parser: ReflectionFunction::isAnonymous() is PHP 8.2+. The correction recognizes the anonymous reflection-name marker without hashing the rest of that name. This also indexes callable starts in the bounded source cache, avoiding a full-file token scan for every wait.

Validation:

• 137 focused tests / 394 assertions pass on PHP 8.4.27, including 21 fingerprint cases / 69 assertions and a fixed golden checked in two fresh subprocesses.
• PHPStan passes with one analysis process. The official corpus validator passes against main 9bb3f80c: one added replay fixture, target fails and candidate passes through the official worker consumer. Both fingerprint source files are now guarded.
• Official PHP 8.1.34 image index sha256:76e563191d1ade120313a8736df24154d21da5155c0756f147c0b01bd19d9087 produces the same committed golden identity and selects named-method source correctly. The corrected hosted PHP 8.1 and Carbon 2 cells are still running with the rest of the full matrix.
• Current source/corpus/framework/Sonar checks are green. Final hosted CI and exact-head Security review remain required.

Source without a usable tokenizer/selection retains v1 rather than losing a previously available drift check. Every worker that reads v2 histories must have the tokenizer enabled. Legacy waits keep exact source-line matching; no unverifiable-v1 bypass is introduced. Same-line ambiguity sets, OPcache/source replacement and mixed-worker/rollback limitations remain explicit in the docs. No tag or release is requested.

[rmcdaniel]

Current head a2a7462970845c161907136ab163f969cf69420f is terminal green: 31 successful checks, one intended connected-cooperative skip, no pending or failed checks. The PHP 8.1, Carbon 2 and PHP 8.2–8.4 cells all pass the same fresh-process golden fingerprint and replay corpus. CI, SonarQube, Public Boundary.

All local sdk-php-293-* containers and scratch proof files are removed; final container readback is empty. Source is frozen for exact-head Security review. This draft remains unmerged and requests no SDK release/tag. #280 resumes first against published Server 3.1.0 under its existing release/qualification gates.

[rmcdaniel]

Security source review — exact a2a7462970845c161907136ab163f969cf69420f

GO for source merge only. No replay-integrity, parser, credential, or compatibility defect was found in the condition-predicate fingerprint v2 implementation. General retains merge and every tag/package/release decision.

• Exact head/tree/base are a2a7462970845c161907136ab163f969cf69420f / 872c8714a92cf0665fa5cd7c3bbe3b8d39ceb7ee / 9bb3f80cbefb1ec84f6904afac3ff615cc4de093. The draft PR is OPEN, CLEAN and MERGEABLE. The complete delta is ten files, 584+/4-, with no whitespace or changed-source credential finding.
• New waits write dwphp2:sha256:<hex> over a length-framed sequence of callable token texts. Whitespace/comments outside literals, compiler token IDs, paths and line numbers are excluded; literal bytes and operator/token boundaries remain distinct. Reflection selects candidates by line range, callable name/anonymous marker, staticness and parameter names. It never evaluates the predicate. Balanced parameter/body/expression parsing rejects unsupported shapes to the exact legacy computation rather than guessing.
• Same-line closures that reflection cannot distinguish use the sorted, deduplicated, length-framed set of every possible candidate. This avoids selecting the wrong predicate; changing that ambiguity set intentionally changes the identity. The limit and separate-line guidance are explicit in the guide/changelog.
• Source caching is content-sensitive and limited to eight file entries. Every access rereads and hashes current bytes, replacing cached tokens when content changes; deleted/unreadable source is not served from cache. Paths/content hashes are cache mechanics only and never fingerprint input. OPcache/source skew remains deliberately unsupported and documented as requiring atomic source deployment plus worker restart.
• Replay accepts a recorded v1 identity only when the unchanged original source-line computation exactly matches. V2, malformed and unknown-version identities remain strict; there is no unverifiable-v1 bypass. Physical reopens preserve the first fingerprint—including legacy identity or absence—in both straight-line and grouped replay paths. Key, timeout, occurrence and authored-call boundaries keep their existing checks.
• Independently on PHP 8.4.27, ConditionWaitFingerprintTest passes 21/21 tests and 69 assertions. Coverage includes formatting/comments/location, neighboring arguments, literal/operator changes, nested bodies, named/invokable callables without execution, CRLF/ternaries, same-line ambiguity, parameter isolation, cache/source removal, strict v1/v2/unknown mismatches, first-open echo and fresh-process golden checks.
• The exact appended official replay fixture passes against the candidate and fails against exact base 9bb3f80c (prior consumer returns a replay mismatch instead of the expected open wait), providing the required fail-before/pass-after control. Both fingerprint implementation paths are added to the corpus policy guard.
• The committed golden dwphp2:sha256:02a95ef3eef2f4aec3dbd83735628c87719b16370c73743a0bd4fc7b91abc15c reproduces independently on PHP 8.4.27 and PHP 8.5.12. The latter is a direct no-vendor fingerprint control because an unrelated phpDocumentor dev constraint prevents a full root install on 8.5; no full 8.5 suite is claimed.
• Public exact-head readback has 39 successful checks, one intended connected-cooperative skip, and zero failed/pending checks. CI 41807160227, SonarQube 41807160077, Public Boundary 41807160138, CodeQL, PHP 8.1–8.4, Carbon 2, framework/package/corpus/docs gates all pass. Sonar reports zero security hotspots; its six findings are non-gating parser complexity/control-flow code smells, not correctness or security findings.

This GO preserves the documented operational limits: every worker that can replay v2 waits needs the tokenizer and compatible source; queue workers must be upgraded together before opening v2 histories; rollback below this SDK after v2 waits exist is unsafe; deploy sources atomically and restart OPcache workers. No SDK tag, package, release, application adoption or Server change follows from this source review.

[rmcdaniel]

Normal refresh is pushed at 898b8e46e7d72b50b9568c362498b4348a4b2ff9, tree fd4a6fc46ae08eb51626e78fa42f1665868cebdd, ordered parents reviewed a2a7462970845c161907136ab163f969cf69420f and accepted main 45c7af419f2d948c0c90977c61670390f5eb277a.

Only CHANGELOG.md conflicted. Both the accepted child-start entry and fingerprint-v2 guidance are preserved. The complete PR remains the same ten files. Every non-changelog diff hunk preserves the original stable patch ID 7a1889767af295048fafa62dfabbc0ff769c845d; parser, definition, fingerprint tests and official replay fixture are byte-identical to reviewed a2a7462. Whitespace and changed-source credential/private-path checks pass; the branch is clean and pushed.

#297's required preceding qualification is now terminal with 41 successes plus one intended skip, including the formerly failed Rust upload. Fresh #296 CI 41828849596, SonarQube 41828849652 and CodeQL 41828840044 are starting, and Security has the exact new-head/base carry request. The old-base source disposition is not treated as transferable clearance.

This push completed before General's #297 merge coordination message. Per that direction, this exact head/evidence is retained without further churn while the accepted-main readback completes. No force push, extra workflow dispatch, local full-suite repeat, tag or package action was made. The PR now references #293 without requesting automatic closure; its source/delivery acceptance remains separate.

[rmcdaniel]

Frozen refreshed source 898b8e46e7d72b50b9568c362498b4348a4b2ff9, tree fd4a6fc46ae08eb51626e78fa42f1665868cebdd, now has 41 successful checks, one intended connected-cooperative skip, zero failed or pending checks.

CI 41828849596, SonarQube 41828849652, CodeQL 41828840044 and both Public Boundary checks are successful. PHP 8.1–8.4, Carbon 2, framework, corpus, package, static analysis and all three current/raw-tag/docs-only documentation legs pass on this head.

The source refresh remains exactly the ten-file predicate-v2 patch. The parser/definition/test/fixture bytes are unchanged from reviewed a2a7462; every non-changelog patch hunk retains stable patch ID 7a1889767af295048fafa62dfabbc0ff769c845d. The only resolved conflict combined both changelog entries. Whitespace and changed-source credential/private-path checks pass, and the branch is clean and fully pushed.

This qualification uses accepted base 45c7af419f2d948c0c90977c61670390f5eb277a; it is retained unchanged while General handles the separate #297 merge/readback. Security has the exact new-head/base carry request. Prior-base clearance is not transferred automatically, and no source-merge decision is claimed here. #293's source/delivery acceptance and every queue-wide upgrade, no-rollback-after-v2, atomic-source/OPcache and package/release/adoption gate remain.

[rmcdaniel]

Security combined-head carry — PASS for exact source/base

GO for source merge only at exact head 898b8e46e7d72b50b9568c362498b4348a4b2ff9 on accepted base 45c7af419f2d948c0c90977c61670390f5eb277a. General retains merge order and every package, tag, release, adoption and delivery decision.

I independently verified tree fd4a6fc46ae08eb51626e78fa42f1665868cebdd and ordered parents a2a7462970845c161907136ab163f969cf69420f plus accepted main 45c7af419f2d948c0c90977c61670390f5eb277a. The complete delta remains ten files, 584 insertions / 4 deletions.

Carry evidence:

• The non-changelog path set is identical to the previously reviewed a2a7462 delta. The complete non-changelog old-base and new-base diffs independently produce the same stable patch ID (23a53c0271b6a8d99ea2fc9eda773a4786497445), proving the predicate-v2 change itself is unchanged across the normal merge.
• The parser, definition, corpus policy, fingerprint tests, replay test and official regression fixture blobs are byte-identical to the reviewed head. The documentation, Replayer and WorkflowCommand combined blobs inherit accepted-main content, while their condition-fingerprint patch hunks remain identical. No source conflict was resolved in those files.
• The sole conflict resolution was CHANGELOG.md. The result preserves accepted main's child-workflow entry and adds the reviewed predicate-v2 identity, strict-v1 replay, queue-wide upgrade, rollback and atomic-source/OPcache guidance under Unreleased without weakening either entry.
• The prior source review's security conclusions therefore remain valid: token fingerprints exclude locations/compiler IDs/formatting while preserving literal and operator boundaries; ambiguous same-line closures use a combined identity; unsupported shapes fail back to exact legacy computation; cache keys do not enter the identity; predicates are never executed; v1 acceptance remains exact; and physical reopens preserve the first fingerprint.
• Exact-head qualification is terminal: 41 checks succeed, one connected-cooperative job is intentionally skipped, and zero checks fail or remain pending. PHP 8.1–8.4, Carbon 2, framework/package/corpus/static analysis and all current/raw-tag/docs-only portal legs pass.

Operational limits remain mandatory: all workers capable of replaying v2 waits need compatible tokenizer/source, queue workers must be upgraded together before opening v2 histories, rollback below this SDK is unsafe after v2 waits exist, and source/OPcache deployment must be atomic with worker restart.

Accepted-main condition: this clearance binds only the head/base pair above. If main advances before merge—including through the separately coordinated #297 integration—refresh normally, preserve both source scopes, require fresh exact-head checks, and return the combined head for carry review. No old-head clearance transfers automatically.

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Per the accepted-main handoff, the one normal follow-up merge is pushed at 2379dbd43dd9a80d28ca4ace88d8412a3b9b14f3, tree 0161fe7e2da2a813a85a77e8cd8e5a5c467a1305, ordered parents retained 898b8e46e7d72b50b9568c362498b4348a4b2ff9 and accepted #297 main dbdd8e977f6150e49a9c9229d1ed7ef08ffb63d9.

No conflicts. Both the predicate-v2 documentation/changelog and accepted Carbon guidance/correction are present. The entire ten-file PR patch is unchanged relative to its new base: stable patch ID 85a64997f1a21f9fdfff9923d05203a93dc27c0b matches the prior 898b8e4/45c7af41 patch. The parser, predicate definition, fingerprint tests and official fixture still match reviewed a2a7462 byte-for-byte. The accepted duration helper and duration tests also match new main byte-for-byte.

Whitespace and changed-source credential/private-path checks pass; the worktree is clean and the normal push is verified. Fresh checks and exact current-head/base Security carry are required. The retained head's 41 successful checks remain historical evidence, not automatic clearance for this new head. No force push, extra matrix, manual dispatch, local full-suite repeat, tag or package operation was used.

[rmcdaniel]

Final current-base source 2379dbd43dd9a80d28ca4ace88d8412a3b9b14f3, tree 0161fe7e2da2a813a85a77e8cd8e5a5c467a1305, is now terminal green: 41 successful checks, one intended connected-cooperative skip, zero failed or pending checks.

The one normal follow-up merge uses accepted #297 main dbdd8e977f6150e49a9c9229d1ed7ef08ffb63d9 and preserves retained head 898b8e46 as its first parent. The entire ten-file patch is unchanged (stable patch ID 85a64997f1a21f9fdfff9923d05203a93dc27c0b). Both documentation/changelog changes are retained. Parser/definition/fingerprint-test/fixture bytes remain identical to reviewed a2a7462; duration helper/test bytes remain identical to accepted main. Whitespace and changed-source credential/private-path checks pass, and the branch is clean and fully pushed.

Fresh CI 41830480913, SonarQube 41830480904, CodeQL 41830474415 and both Public Boundary checks pass. PHP 8.1–8.4, Carbon 2, framework, corpus, package/static analysis and all three current/raw-tag/docs-only documentation qualification legs pass on this exact current head.

Security's fresh exact-head/base carry disposition and General's source-merge decision remain required. The old-base dispositions are not transferred automatically. No new matrix, manual dispatch, local full-suite repeat, force push, tag, package, release or adoption action was used. #293 and every coordinated queue upgrade, rollback-after-v2 and atomic-source/OPcache gate remain separate.

[rmcdaniel]

Security final current-main carry — PASS

GO for source merge only at exact head 2379dbd43dd9a80d28ca4ace88d8412a3b9b14f3 on accepted main dbdd8e977f6150e49a9c9229d1ed7ef08ffb63d9. This supersedes my 898b8e46 carry because that base advanced. General retains the merge and every package, tag, release, adoption and delivery decision.

Exact identity is tree 0161fe7e2da2a813a85a77e8cd8e5a5c467a1305, ordered parents 898b8e46e7d72b50b9568c362498b4348a4b2ff9 plus accepted #297 main dbdd8e977f6150e49a9c9229d1ed7ef08ffb63d9. The PR is draft, mergeable/CLEAN and remains ten files, 584 insertions / 4 deletions.

Independent carry checks:

• The full ten-file path set is identical before and after this normal merge. The previous-base and current-base diffs produce the same independent stable patch ID 7679bc3b09e48cd44fe163f125baa8a38055b0dd, so the predicate-v2 patch is unchanged.
• Corpus policy, parser, predicate definition, Replayer, WorkflowCommand, both focused test files and the official replay fixture are byte-identical to the already reviewed combined head. Only CHANGELOG.md and the workflow-activities guide become combined blobs because accepted Clarify Carbon precision for very large friendly durations #297 also changed those two paths.
• There was no conflict. Relative to current main, the changelog/guide predicate-v2 hunks remain the reviewed ones and preserve Clarify Carbon precision for very large friendly durations #297's truthful Carbon precision guidance. WorkflowDuration.php and WorkflowDurationTest.php are outside this PR delta and therefore remain byte-identical to accepted main.
• The source-security conclusions and operational limits in the prior reviews remain unchanged: strict token identity/replay boundaries, no predicate execution, fail-safe legacy fallback, bounded content-sensitive caching, same-line ambiguity handling, and first-open fingerprint preservation; queue-wide compatible upgrade, no rollback below v2 after use, and atomic source/OPcache restart remain mandatory.
• Exact-head qualification is terminal: 41 checks succeed, the connected-cooperative lane is intentionally skipped, and zero checks fail or remain pending. PHP 8.1–8.4, Carbon 2, framework/package/corpus/static analysis, current/raw-3.9.4/docs-only-6a portal compatibility, CodeQL, Sonar and public-boundary gates pass.

This clearance binds only the head/base pair above. Any later main or head change requires the appropriate normal refresh, exact-head qualification and carry review. It does not publish or adopt an SDK, open v2 histories, waive queue/rollback constraints, or authorize a Server/Cloud action.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 5f5c0ca2387440bc578d5e26ab26973cea43ac5f has ordered parents dbdd8e977f6150e49a9c9229d1ed7ef08ffb63d9 and 2379dbd43dd9a80d28ca4ace88d8412a3b9b14f3, with tree 0161fe7e2da2a813a85a77e8cd8e5a5c467a1305 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #296 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Exact merged-main readback matches 5f5c0ca2387440bc578d5e26ab26973cea43ac5f, ordered parents accepted dbdd8e977f6150e49a9c9229d1ed7ef08ffb63d9 and reviewed 2379dbd43dd9a80d28ca4ace88d8412a3b9b14f3, with identical reviewed tree 0161fe7e2da2a813a85a77e8cd8e5a5c467a1305.

All product/source jobs in existing main CI 41839859503 pass, including PHP 8.1–8.4, Carbon 2, corpus, frameworks, analysis, package and all three complete documentation legs: current 126608263806, raw 3.9.4 126608263814, and docs-only 6a 126608263841.

Full main qualification is not yet green. Central policy job 126608263433 consumed organization policy main 5445aac39547e47def63d1f9a88b53cbc12d1b28 and failed with qualification policy failed: Composer relative helper inspection requires an unchanged workspace root. The aggregate target-branch gate then fails on that preflight result. Main rollup is 38 successes, two expected skips, and those two related failures. The exact failure has been routed to General's existing central-policy correction; no SDK source workaround or weakened check was made. After the classified central correction is available, the preflight and dependent aggregate gate need an exact-job retry, retaining this failed attempt.

The separate portal run 41839859617 is terminal successful: actual stable=false, exact source_revision=5f5c0ca2387440bc578d5e26ab26973cea43ac5f, successful preview artifact binding, and protected deploy skipped.

Live preservation at 2026-11-04 13:40:58 UTC: audit, workflow guide, API index and its actual /api/js/searchIndex.js asset all return HTTP 200. The live audit remains exactly accepted source 6a821568db5c72983bd3990fe27c7990f092db12, last modified 11:39:19 UTC. No live guide/API/search result contains startChildWorkflow, dwphp2:sha256: or ConditionPredicateSource. The complete 511,552-byte search asset still has six childWorkflow references and SHA-256 c4ae89aab52c28e0c096dab1602bda1c175932f7a6d5cf450ed1bb508f69d477. The first probe guessed a nonexistent search JSON path (HTTP 404); the corrected path was resolved from the live API page and is the evidence used here.

The merged source branch was deleted normally after exact head/tree/ancestry verification and is verified absent. The clean checkout is at exact main, with no local workload or release action. #185 remains open. #293, package/release/adoption, published-runtime/installed-artifact and every coordinated queue-upgrade, rollback-after-v2 and atomic-source/OPcache gate remain separate.

[rmcdaniel]

Exact merged-main source acceptance is complete at 5f5c0ca2387440bc578d5e26ab26973cea43ac5f. Ordered parents dbdd8e977f6150e49a9c9229d1ed7ef08ffb63d9 plus reviewed 2379dbd43dd9a80d28ca4ace88d8412a3b9b14f3, reviewed tree 0161fe7e2da2a813a85a77e8cd8e5a5c467a1305, actual remote main and clean local checkout agree.

All terminal main checks now pass: 40 successes, two expected deploy/connected skips, zero failed or pending checks. CI 41839859503 attempt 2, SonarQube 41839859514, CodeQL 41839859207 and Public Boundary 41839859504 are successful. All product jobs and current/raw-3.9.4/docs-only-6a full documentation controls pass.

The original central-preflight failure is retained in the prior receipt. After the independently accepted central rollback, the one failed-preflight/dependent-aggregate retry ran against unchanged SDK commit 5f5c0ca. New preflight 126611780243 logs fetched central commit 9fbacc51c51322f86fc09ff8463bfab3ecebabbb and passes; aggregate 126611892948 passes. The product matrix was not repeated and no SDK source workaround was made.

Portal run 41839859617 passes with actual stable=false, exact preview source 5f5c0ca2387440bc578d5e26ab26973cea43ac5f, successful artifact binding and protected deployment skipped. Independent final live readback at 2026-11-04 13:45:36 UTC returns HTTP 200 for the audit, workflow guide and actual API search asset. The audit still names accepted stable source 6a821568db5c72983bd3990fe27c7990f092db12, last modified 11:39:19 UTC. Unreleased startChildWorkflow, dwphp2:sha256: and ConditionPredicateSource markers remain absent. The complete API search still contains the published child API. The source merge preserved the public stable portal.

The merged source branch was deleted normally and its remote ref verified absent; source and task state are clean. No additional source commit, full suite, matrix, dispatch, tag, package, SDK adoption or production change was made for acceptance. #185 remains open. #293 and every package/release/adoption, published-runtime/installed-artifact, coordinated queue-upgrade, rollback-after-v2 and atomic-source/OPcache gate remain separate.