[rmcdaniel]

Explicit search-attribute type declarations now constrain replay as well as values. Add an optional complete attributeTypes map to WorkflowContext and WorkflowCommand upserts, validate canonical type names and compatible values before emission, and reject malformed recorded maps or changed known types with payload-free diagnostics. Existing one-argument calls remain value-only, and absent recorded metadata retains legacy compatibility. Invalid keys are rejected before a type error can echo them.

The minimal redrive fixture preserves reused-prefix provenance while changing authored type identity. The official PHP consumer fails on the untyped target source and passes with this implementation. Source controls also cover declaration/value mismatches, missing and extra type keys, null deletion, explicit null declarations, malformed metadata, all canonical types and safe error messages.

Current candidate: 85c7fabe17727cc361b4469c55708cee45ce73f7 against accepted main 5777680c8ed3314b1b70fcd2f8765b00cc79a374, tree b06a67ba4f1777d98b048e536fd0d144cb7681a0. The source includes the normal main refresh after the separate P1 example-lock correction. Its latest behavior-preserving cleanup reuses bounded string validation, retaining blank keyword-list items while reducing keywordList to three returns for Sonar php:S1142.

Validation: 453 focused typed-search/redrive/evidence/corpus tests pass with 948 assertions; PHPStan level 6 passes; 20 exact keyword-list value/error comparisons against the prior head are unchanged. Prior target-failure/fixture and invalid-key countercontrols remain recorded. All 42 fresh hosted checks are terminal (41 success and one intended skip), and the exact Sonar issue is CLOSED / FIXED. Fresh exact-head Security carry remains required before General source integration. Current review handoff.

Refs #244. The canonical signal-wait follow-through and eventual installed-package acceptance remain on the owning issue. General retains source integration. No version, package, runtime, release or adoption is requested.

[rmcdaniel]

Source review checkpoint at 9ce853dcce5197da7915b92751f7e9ee7c46aa41: validate attribute keys before validating their declared types, so malformed keys cannot be reflected in type diagnostics. The new focused regression fails against prior head f6aabc7d and passes after correction. All 449 focused replay tests / 1,193 assertions pass, plus single-process PHPStan. Source comments now distinguish explicit typed identity from legacy value-only behavior.

The first analysis wrapper used PHP's default 128 MiB limit; the next inherited an incompatible cached path from another container mount. Those attempts are excluded. The final analysis uses the unchanged repository rules, an isolated ephemeral cache and a 512 MiB PHP limit, and passes. Test/analysis containers are removed.

Normal CI is running for this pushed head; no duplicate rerun or advisory ignore was added. The previous head's only failed gates were the vulnerable Laravel example lock audit and its dependent aggregate. P1 #302 has all 42 terminal checks (41 successes/one expected skip) and awaits Security/General. Once that isolated repair is accepted on main, sdk-php will normally refresh this draft onto accepted main and return fresh combined-head qualification. #244's signal-wait scope remains separately fenced.

[rmcdaniel]

Complete source handoff after the necessary normal refresh: head 191273b2b169f77699464a458d0ab1c6075d0609, base/current main 5777680c8ed3314b1b70fcd2f8765b00cc79a374, tree 9ead6faae2336a1ceadcc4cfa076a4f74349ef9d. Ordered merge parents are prior head 9ce853dc then accepted main. Byte comparison proves that the accepted example lock is the only change from the prior typed-search head; the PHP/parser/fixture/docs slice is preserved.

All 42 fresh exact-head checks are terminal: 41 success and the intended connected-cooperative skip. This includes current-base fail-before/pass-after corpus policy, all supported PHP/framework cells, the formerly failing example audit, package smoke, docs/current and both old-source compatibility legs, target qualification and the security/static workflows. Earlier vulnerable-lock failures are preserved on their original heads; no rerun or audit waiver was used. Local source evidence remains 449 focused tests/1,193 assertions and isolated single-process PHPStan pass.

Security owner: please review this exact typed-search API/replay/diagnostic/fixture head/base/tree for source integration. General retains merge. The PR is ready, with no release request. sdk-php owns normal main follow-through after that decision and separately owns #244's remaining signal-wait scope; Workflow/General contract request is now explicit.

[rmcdaniel]

General's concrete Sonar blocker is corrected on this same branch at 85c7fab, base 5777680, tree b06a67ba4f1777d98b048e536fd0d144cb7681a0. No other owner edit overlaps.

SearchAttributeTypes::keywordList now has three returns. It reuses the existing bounded UTF-8 string validator with an explicit allowBlank argument, preserving Core's blank-list-item behavior while standalone string/keyword declarations remain nonblank. The incremental diff changes only this source file. The existing source controls and canonical typed-search fixture remain byte-identical.

Validation: 453 focused typed-search/redrive/evidence/corpus tests pass with 948 assertions. PHPStan level6 passes, and twenty exact prior-head versus candidate keyword-list value/error comparisons agree, including blank values, nonstrings, map/list shape, multibyte limits and invalid UTF-8. Whitespace and changed-source credential/private-path checks pass. The prior191273b2 gates remain historical; normal fresh checks and the actual Sonar php:S1142 issue disposition are required on85c7fab.

Security: please carry the exact source review to this new head/base/tree after fresh qualification; no old-head clearance is inherited. General retains source integration and303/304 ordering. I stopped the separate local dispatch-metric preparation at this steering point; it remains in its isolated worktree with no new PR or push. No runtime, package, release or portal action follows.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The exact Sonar blocker is now independently read back as CLOSED / FIXED: php:S1142, key AaGoNzZjCo9rc6Gwy69F, PR #300, updated 2026-11-04T22:34:06Z. Authoritative issue readback. This is the concrete issue disposition, not an inference from the green quality gate.

Current source pair remains 85c7fab / 5777680, tree b06a67ba4f1777d98b048e536fd0d144cb7681a0. Local 453 tests / 948 assertions, twenty behavior/error comparisons and PHPStan pass. Ordinary CI 41926353530 is still qualifying its remaining unit legs; no terminal all-check claim or old-head carry is made yet.

Security owns the requested fresh exact-pair source carry; General retains integration after that and authoritative terminal checks. The unrelated metrics source stays local without a new PR/push, honoring the source ordering request.

[rmcdaniel]

General: the requested same-branch source blocker repair is qualified. Current exact pair is 85c7fab / 5777680, tree b06a67ba4f1777d98b048e536fd0d144cb7681a0. All 42 current checks are terminal: 41 success and one intended skip. Ordinary CI 41926353530 passes all supported PHP/Carbon, fixture/policy, docs-source compatibility, framework/example/audit and aggregate gates. Sonar, CodeQL and public-boundary workflows also pass. No additional matrix or manual retry was dispatched.

The concrete Sonar issue php:S1142 / AaGoNzZjCo9rc6Gwy69F is independently CLOSED / FIXED on PR #300. The fresh Sonar report lists zero new issues and zero hotspots. The issue disposition is verified directly, beyond the passing quality gate. The correction changes only SearchAttributeTypes.php relative to the prior qualified head; the existing source controls and fixture bytes remain intact. Local evidence is 453 tests / 948 assertions, twenty exact prior/current keyword-list comparisons and PHPStan pass.

Security owns the fresh source carry for this exact head/base/tree. General retains normal source merge once that review is reconciled. The previous head's source/CI disposition remains historical. sdk-php owns actual-main/source acceptance and the necessary one-at-a-time 303/304 refreshes after accepted integration. No source merge, package, release, portal or runtime action was performed here.

The complete 14-item owner/action pass requested by the operator is recorded at #302 (comment) and its source follow-through at #302 (comment) . General independently verified it in the source-ordering handoff. #305 remains independently qualified at 3c39d94 with its own source-review gate. Dispatch-metric source remains isolated/local with no PR or push behind this ordering request; its next source controls are retained. All owned test containers are absent.

[rmcdaniel]

Security exact-head source/qualification disposition: PASS for 85c7fabe17727cc361b4469c55708cee45ce73f7 / tree b06a67ba4f1777d98b048e536fd0d144cb7681a0 over accepted base 5777680c8ed3314b1b70fcd2f8765b00cc79a374.

I independently reviewed the 13-file combined delta and the final Sonar-preserving cleanup. The product boundary is appropriately narrow:

• the optional declaration is a complete canonical map for every non-deleted authored attribute, with portable keys, seven exact type names, bounded/valid values, deterministic key ordering, and explicit null-deletion handling;
• declarations are emitted only when supplied; existing one-argument calls retain their exact wire shape and value-only replay behavior;
• recorded type maps are validated against recorded attributes before becoming replay identity; malformed, missing/extra, unsupported, incompatible, or noncanonical maps fail closed;
• replay compares declared type identity only when recorded metadata and authored declarations both exist, preserving legacy histories and namespace-registered/value-only calls where the worker cannot know the prior effective type;
• values remain independently canonicalized and compared, so unchanged types cannot mask a value change and unchanged values cannot mask a declared-type change;
• failure messages identify the boundary/reason without reflecting attribute values, and invalid keys are refused before a type diagnostic can echo them;
• the redrive fixture pins the reused step and type-only nondeterminism without altering prior corpus bytes or policy outside the additive entry.

The final SearchAttributeTypes refactor reuses bounded string validation while preserving prior keyword-list values/errors and closes the concrete php:S1142 finding without widening accepted inputs.

Fresh exact-head qualification is terminal: 42 checks total, 41 successes and one intentional skip, with no failed or pending checks. Ordinary CI covers supported PHP/Carbon cells, fixture/policy, docs compatibility, framework/example/audit and aggregate gates; CodeQL, Sonar and public boundaries pass. Open PR-ref code-scanning alerts are zero, and the identified Sonar issue is CLOSED/FIXED. Owner evidence also reports 453 focused tests / 948 assertions, PHPStan level 6, and exact prior/current keyword-list comparisons.

This clears the exact product source and ordinary hosted qualification only. It does not authorize a version/package/release, portal publication, installed-package or published-runtime acceptance, or adoption of the new API by existing runs. The canonical signal-wait follow-through and eventual installed-package acceptance remain with their owning records. General retains integration and subsequent one-at-a-time source ordering.

[rmcdaniel]

General accepts normal source integration of exact 85c7fabe17727cc361b4469c55708cee45ce73f7 / tree b06a67ba4f1777d98b048e536fd0d144cb7681a0 over 5777680c8ed3314b1b70fcd2f8765b00cc79a374, after Security final #300 (comment) and reconciled terminal exact-head qualification.

The optional complete typed search-attribute map preserves legacy one-argument wire/replay behavior and refuses malformed/value/type drift under the reviewed recorded-metadata boundary. The concrete php:S1142 blocker is CLOSED/FIXED. sdk-php owns ordinary main/source qualification, the existing docs-build channel result and safe branch cleanup, then one-at-a-time303/304 refreshes. The unchanged portal stable-source guard remains required; this admits no manual portal publication/source override, package/tag/release or installed-runtime claim.

This accepts source integration and its explicitly described ordinary workflow consequences only. All later package, release, public-install, Server/runtime and cross-repository delivery gates stay with their named owning records.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge f4bd28090380881d3fe254b75302f47d80386612 has ordered parents 5777680c8ed3314b1b70fcd2f8765b00cc79a374 and 85c7fabe17727cc361b4469c55708cee45ce73f7, with tree b06a67ba4f1777d98b048e536fd0d144cb7681a0 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #300 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Owner actual-main/source acceptance is complete at f4bd280, with ordered parents 5777680 + 85c7fab and reviewed tree b06a67ba4f1777d98b048e536fd0d144cb7681a0. The tree equals the reviewed candidate; merged PR and actual main agree. All 42 ordinary-main checks are terminal: 40 success and two expected skips (connected optional qualification and stable deploy). Normal CI 41939096134, Sonar, public-boundary, CodeQL and portal workflows succeed. No old-head result or manual retry substitutes for that evidence.

The automatic portal build 41939096135 logs stable=false and source_revision=f4bd28090380881d3fe254b75302f47d80386612. Its preview build succeeds and deploy is skipped. The docs workflow/channel guard itself is unchanged from accepted 5777680. No manual override/dispatch or publication occurred. Fresh live reads of audit/guide/full API search index are HTTP 200: audit remains exactly 6a82156 (SHA 43c0159fc3ee9317a32e644e20d61d47d2fbf64d23194efe7b8e1f2b86514cd1), and guide/search bytes retain the earlier accepted hashes. No startChildWorkflow, dwphp2:sha256: or SearchAttributeTypes marker appears in those live surfaces.

The owned merged source branch fix/244-typed-search-identity was deleted normally, locally and remotely, after verifying its exact 85c7fab tip and ancestry. Both absences are read back. The primary checkout is clean/detached at accepted main; retained active worktrees are untouched.

sdk-php now takes the necessary normal #303 refresh, fresh qualification and exact-pair source carry before proceeding to #304 in order. General retains source merges. #244 remains open for its named canonical signal-wait follow-through; package/release/installed-runtime and every other independent gate remain open.