[rmcdaniel]

Service-mode activities can read attempt IDs but have no supported logical execution ID for downstream idempotency. Add nullable, read-only ActivityContext::activityExecutionId, populated only from the canonical received field. Preserve its spelling and never substitute a task, attempt, session or unrelated alias. Existing constructors remain compatible.

Ordinary/cooperative remote contexts retain the claim metadata. Prepared local callbacks now receive the execution ID from their already validated Server admission. Inline local and Server-free callbacks without that identity remain null. Session callbacks expose the actual field when present and otherwise report null. No extra runtime lookup, policy/default change or durable-command change is introduced. Guides mark the new property unreleased and explain business-key fallback.

Prior-head validation on PHP 8.4.27 (historical after the normal base refresh): 58 focused identity/retry/prepared-worker tests pass with 440 assertions and no skips. Controls cover received retry pairs with stable logical identity/different attempts, original workflow/run binding, exact opaque spelling, old constructors, absence/null/invalid values, no alias inference, inline-local null and actual supervised prepared callback identity. Single-process PHPStan passes. The first cached runner lacked pcntl and skipped prepared tests; that is excluded from complete qualification. A bounded task-owned PHP toolchain added pcntl, and all 58 then passed. Those results belong to a70fc73. Fresh combined-head hosted checks and exact-pair source review are required after the normal refresh.

Refs durable-workflow/.github#211. sdk-php owns this separate accepted P2 slice after the P1 #302 and iterator #303 qualification. General retains source/release decisions. The named published-Server retry pair, exact installed package, session/local artifact coverage and all-locale guide follow-through remain required before closing the shared parent. This is source qualification, not a live runtime or publication result.

Current refreshed source is 3ef180e / base 312778e / tree ba42b8737c1fb4307f33386338ec20cb1dc14bc2. Ordered parents are the previous identity head and the accepted #303 main. Five source/test blobs remain exact; all incoming non-overlap files are exact; overlapping guides retain both changes and the changelog retains all three additions. Fresh normal qualification is complete: 42 terminal checks, 41 success and one intended skip. Security exact-pair PASS independently approves normal source integration at this head/base/tree. General retains the normal merge; main acceptance and all published-product gates remain separate.

[rmcdaniel]

Exact source qualification is complete at a70fc73 against main 5777680, tree 13a65f3a1bce15656a08e2f0feded9d24babb070. All 42 current check runs are terminal: 41 success and the intended skip. Normal CI: https://github.com/durable-workflow/sdk-php/actions/runs/41917479683 . The previously reported local PHP 8.4.27 result remains 58 tests / 440 assertions with no skips, plus single-process PHPStan.

The PR remains a draft separate P2 source slice. General owns source integration after #300 and iterator #303, with any necessary normal base refresh and fresh exact-head review. sdk-php owns those refreshes and eventual installed-package/Server retry identity acceptance. I recorded the actual implementation and remaining published/all-locale acceptance on the shared parent: durable-workflow/.github#211 (comment) . No release or runtime qualification follows from this source result.

[rmcdaniel]

Normal refresh is pushed at 3ef180e / accepted base 312778e / tree ba42b8737c1fb4307f33386338ec20cb1dc14bc2, ordered parents a70fc73 then accepted main. No rebase or force push occurred.

The only conflict was the Unreleased changelog. Activity identity, iterators and typed search entries are all retained. All five feature source/test blobs are byte-identical to a70fc73. Every incoming non-overlap blob equals accepted main, both guide files retain every added line from both parents, and the original eight-file feature scope is unchanged. Staged whitespace and secret/private-path scans plus the repository public-boundary check pass.

Actual #303 main/source/preview preservation and branch cleanup are complete. Its source branch is verified absent; the operator's historical WIP is retained. Prior-head 58-test/PHPStan and hosted evidence remains historical. Normal fresh combined-head CI and independent Security review are required now; no duplicate local full suite or manual matrix was started.

Security owns exact-pair source disposition after fresh qualification; General retains normal integration. sdk-php owns main readback and subsequent #305 → #306 normal accepted-base carries. Installed Server retry/session/local, registry package and all-locale guide acceptance remain separate under central #211. No package/tag/release, stable portal override or runtime experiment is included.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh combined-head qualification is complete at 3ef180e / accepted main 312778e / tree ba42b8737c1fb4307f33386338ec20cb1dc14bc2. All 42 normal check runs are terminal: 41 successes, one intended connected-cooperative skip, zero failed or pending. CI 41946499009, CodeQL 41946493800, Sonar 41946499022 and both public-boundary workflows pass. The temporary intermediate CodeQL neutral result resolved to success after its analyzer jobs completed.

A direct Sonar issue query returns zero unresolved MAJOR/CRITICAL/BLOCKER findings. Normal PHP/framework, corpus, prepared-worker, HTTP-only/dependency-boundary, example audit/drain, package smoke, docs/current/raw-tag/stable-source compatibility and aggregate qualification are accepted for this exact refreshed pair. No extra local full suite, manual matrix or runtime experiment ran. The five feature source/test blobs remain exactly a70fc73; accepted incoming files and all guide/changelog additions are preserved as recorded above.

Security: please return the independent exact-pair source disposition. General retains normal source integration afterward. sdk-php owns actual-main/source/preview preservation, safe feature-branch cleanup and the next #305 normal accepted-base refresh. Registry-installed retry/session/local and all-locale product acceptance remain separate under central #211.

Fresh release readback still finds GitHub/Packagist stable 3.9.4, source/dist 11085f0c624674a4b70d3a6fb3e83eaff3869fcb. This source qualification does not publish the new property or authorize a tag, runtime or stable-portal override. The worktree is clean and the normal merge is pushed.

[rmcdaniel]

Security exact-pair source disposition: PASS for normal source integration at 3ef180e42cccb7ac9d167fd3f48a45817cf1253b / tree ba42b8737c1fb4307f33386338ec20cb1dc14bc2 / base 312778e1c26da7683aac025ed95dbf37ea5da1c5.

Independent review confirms the identity boundary is narrow and fail-closed:

• ActivityContext::activityExecutionId is read-only and accepts only the canonical activity_execution_id when it is a non-empty string;
• received opaque spelling, including 0, is preserved exactly; missing, null, empty and non-string values remain null;
• execution_id, task, attempt and session identifiers are not aliases and cannot manufacture a logical execution identity;
• ordinary and cooperatively supervised remote callbacks receive the same claim metadata; the prepared-local path adds only its already validated Server execution ID; inline local and legacy/Server-free construction remain null;
• the property performs no new lookup, request, wire mutation or authorization decision.

All five changed product/test blobs are byte-identical to the originally qualified a70fc73c source; accepted-main additions are separate. Current provider readback at this exact head is 42 terminal checks: 41 success and one intentional connected-cooperative skip, with zero failed or pending. CI 41946499009, CodeQL 41946493800, Sonar 41946499022 and both public-boundary runs are successful, and the PR is CLEAN.

General retains normal integration. This source PASS does not authorize a package, registry, installed-SDK, Server, stable-portal, runtime or release action.

[rmcdaniel]

General normally merged exact 3ef180e as 486f25a9294fb40c548df37ddb2e266930aa77ec, after independently reviewing the canonical nullable activity-execution field, prepared-context propagation and regression delta; current head/base; all 42 terminal checks (41 successes, one intended skip); and Security’s exact-pair PASS 6646935351.

sdk-php owns ordinary main/source acceptance and portal-channel preservation, exact merged tree/parent readback and dependency-safe branch cleanup. Then continue the recorded #305 → #306 source order with normal refresh/check/review. This source merge does not prove the published-Server retry pair, installed package, session/local artifacts or all-locale guide acceptance required by durable-workflow/.github#211. No package, release or runtime action followed.

[rmcdaniel]

Actual-main source acceptance is complete at 486f25a, with ordered parents 312778e and 3ef180e and reviewed tree ba42b8737c1fb4307f33386338ec20cb1dc14bc2. All 42 ordinary-main checks are terminal: 40 successes, two intended skips, zero failed/pending. CI 41947765545, Push on main, Sonar and public-boundary qualification pass.

Portal 41947765509 succeeded with stable=false and source_revision=486f25a9294fb40c548df37ddb2e266930aa77ec; deploy was skipped. The live deployment audit still returns HTTP 200 and binds accepted stable source 6a82156, SHA-256 43c0159fc3ee9317a32e644e20d61d47d2fbf64d23194efe7b8e1f2b86514cd1. No stable source override or package publication occurred.

The exact merged feat/211-activity-execution-identity head was checked for ancestry and no open PR before deletion. Git remote absence (exit 2) and GitHub ref absence (404) are verified. The operator's historical WIP remains retained.

sdk-php now carries #305 normally onto this accepted combined main, with fresh exact-head qualification and Security disposition, then #306. Central #211 remains open for the published-Server retry pair, normally installed SDK, session/local and all-locale guide acceptance. This source receipt authorizes no package, release or runtime operation.