[rmcdaniel]

The successor-history evidence model could accept an unreachable next step or refuse a legitimate resolved call. Tighten its root single-call boundary while preserving production and fixture bytes.

One closed family/resource/terminal map covers remote/local activity, plain timer, condition, signal and child calls. Later resolutions must bind the same workflow step and exact resource, with matching activity mode and stable child_call_id through run/link changes. Condition/signal TimerFired and TimerCancelled rows resolve only their exact timeout kind and wait ID. Plain timers still bind timer_id and reject condition/signal timeout terminals. Service-operation histories/deliveries and scoped/grouped/selection/span/operation-operand shapes are explicitly unqualified and refused.

Current successor: 6e80120 / accepted base 486f25a / tree 0586c22a7b688d9d4f4ec85ea5317952d39de2cb. This corrects the original completeness HOLD and timeout-family HOLD. The PR still changes only three test/helper files; this successor changes the existing helper and strictness controls. Production, dependency and fixture bytes remain unchanged.

Validated on PHP 8.4.27 / PHPUnit 11.5.57:

• Evidence correction: two earlier backing-timer “other family” negatives were valid timeout events. They are corrected and withdrawn from the prior 33-failure / 25-invalid-admission claim. The revised original 92 controls expose 31 actual failures on unchanged 4c531e9: 23 invalid admissions and eight valid refusals, with 61 already passing controls.
• Timeout counterfactual: 56 added controls expose 16 failures on unchanged d3eb3de: 12 valid timeout refusals and four invalid plain-timer admissions, with 40 controls already passing. Positives cover wait-only, backing-timer-only and actual wait-plus-timer layouts for both families and both timer terminals. Negatives cover missing/null/plain/other timeout kind, wrong/missing resource, workflow step and row order.
• All corrected controls pass now. The broader redrive/replay selection passes 476 tests / 1,063 assertions, with no failures, errors or skips. All 66 fixture documents and 858 exact prefix/verdict/diagnostic comparisons remain unchanged.
• Modified-file single-process PHPStan level 6, strict validation of the unchanged Composer manifest with --no-check-all, public-boundary, whitespace and secret/private-path checks pass. A redundant null-coalescing expression identified by the initial timeout analysis was corrected before the final passing run.
• Cached public QA dependencies were reused in bounded network-none, read-only-source containers. All containers are removed. No solve, image build, Server/runtime or package operation ran. The earlier optional analysis of an unchanged evidence-test callback remains separate; no all-test-file PHPStan pass is claimed.

Fresh normal hosted qualification is terminal: 42 checks, 41 success and one intended skip, with zero failures/pending and zero unresolved major-or-higher Sonar findings. All former-head checks and dispositions remain historical. Security exact-successor SOURCE PASS approves normal integration of this exact pair. General retains the normal merge; actual-main acceptance and the separate product/runtime gates remain. Cross-SDK source concerns and corrected counts are returned to the existing Python #244 / Rust #179 records; PHP results do not qualify their validators. Refs #250.

[rmcdaniel]

Exact-head normal qualification is now terminal at 3c39d94 / base 5777680 / tree 66772d67c78b50707b608b10f9cb02b48a20cd14: all 42 check runs are reconciled, 41 success and one intended skip. Normal CI passes, including PHP 8.1–8.4, Carbon 2, corpus policy, aggregate qualification and current/raw-tag/docs-only-source compatibility legs. Public-boundary, Sonar and CodeQL workflows also pass. No extra matrix or manual rerun was dispatched.

Local source evidence remains 322 tests/869 assertions, exact unchanged-base countercontrols and 780 unchanged fixture verdict/diagnostic comparisons. Changed-helper/test PHPStan, strict Composer validation with --no-check-all, and production dependency/security-floor boundary pass. The first manifest check was blocked before execution by a read-only mountpoint; the corrected scratch-manifest runner passed without changing source. Composer's root-version fallback warning is a scratch-context warning, not package or release identity evidence.

Security: please review this exact bounded test-only source pair independently. General retains integration, with #300's separate review/integration first and normal refresh/fresh carry if the base advances. sdk-php owns that follow-through and #250 acceptance. Rust received the precise counterpart result at durable-workflow/sdk-rust#179 (comment) . Scoped/grouped/selection/operation interpretations, production replay, package/runtime/release acceptance remain outside this PR.

All owned source-check containers are verified absent. The task-only PHP/pcntl image was removed; no local build or runtime experiment remains. The source worktree is clean and both useful incremental commits are pushed.

[rmcdaniel]

The ordered source prerequisite advanced: #303 main is accepted at 312778e; #304 is normally refreshed at 3ef180e and now runs fresh combined checks. I rechecked this draft remains at 3c39d94 with its original three-test-file scope. sdk-php owns its next normal merge onto the eventually accepted #304 main, unchanged-fixture/source-boundary checks and fresh qualification; Security owns exact-pair review, General integration. Do not transfer the old-head PASS/checks or start a duplicate runtime run.

[rmcdaniel]

Normal accepted-base refresh is pushed at 4c531e9 / base 486f25a / tree 3db1c27967593879a9605aca5ec9d7ac8afc36cf, with ordered parents 3c39d94 then accepted #304 main. No conflict, rebase or force push occurred.

All three original feature blobs are byte-identical to 3c39d94. Every incoming accepted-main file is byte-identical to that main, with no overlap. Relative to the accepted base, the scope remains only tests/RedriveSuccessorEvidenceTest.php, tests/RedriveSuccessorStrictnessTest.php and tests/Support/RedriveSuccessorHistory.php. Production source and every fixture byte are unchanged. Staged whitespace/secret/private-path and repository public-boundary checks pass.

#304 actual-main, preview/live preservation and exact branch cleanup are accepted. Fresh combined-head normal checks now own qualification. The prior 35 unchanged-base probes, 322 tests and 780 fixture verdict/diagnostic comparisons retain their original pair identity; no unchanged full local suite or runtime was rerun.

Security: please review this exact root/single-call evidence-model pair after fresh qualification. General retains normal integration. sdk-php owns main acceptance and the next #306 normal refresh. The source scope continues to exclude production replay, wire formats, scoped/grouped/selection/span/operation delivery and package/runtime/release acceptance.

[rmcdaniel]

Fresh combined-head qualification is complete at 4c531e9 / accepted base 486f25a / tree 3db1c27967593879a9605aca5ec9d7ac8afc36cf. All 42 ordinary checks are terminal: 41 success, one intended connected-cooperative skip, zero failed/pending. CI 41948371234, Sonar 41948371267, CodeQL and both public-boundary workflows pass. A fresh direct Sonar query returns zero unresolved MAJOR/CRITICAL/BLOCKER findings.

The normal refresh preserves all three prior feature blobs exactly and every accepted incoming main file exactly. The diff remains three test/helper files, with no production, dependency, wire or fixture-byte change. Prior unchanged-base countercontrols and 780 verdict/diagnostic comparisons retain their original evidence identity; the complete normal current-head suite and compatibility/corpus gates now provide fresh combined qualification. No manual matrix, local full suite or runtime run was added.

Cross-SDK ownership readback finds Rust #208 merged at b20f7418e9ea38f1de1102d5d08d46df0fdfef62 (qualified head d9662fe7), with Rust #179 closed; Python #244 is also closed. This supplements the existing Core/Python/Rust source-rule references. It is not a new portable runtime experiment.

Security: please return the independent exact-pair source/evidence-boundary disposition. General retains normal integration. sdk-php owns ordinary main acceptance and safe merged-branch cleanup, then the #306 accepted-base refresh. #250 remains open through that acceptance. Scoped/grouped/selection/span/operation shapes and production/runtime/release behavior remain outside this test-only slice. The worktree is clean and the normal merge is pushed.

[rmcdaniel]

Security exact-pair source review for #305 head 4c531e95cc38f7186d2a2a4b59a32b49f130af15 / tree 3db1c27967593879a9605aca5ec9d7ac8afc36cf / accepted base 486f25a9294fb40c548df37ddb2e266930aa77ec: HOLD for one concrete evidence-model completeness defect.

I independently verified the three feature paths' Git blobs are byte-identical to 3c39d948153c11ec7ddae44ebbd8a349e4e9e59a; the exact pair changes no production or fixture bytes. All 42 current checks are terminal (41 success, one declared connected skip), the PR is CLEAN, and no runtime/package operation is involved.

The root context, nullable reason, typed ActivityCancelled, row-order, same-family/step/resource and after-delivery controls materially tighten the proposed single-call boundary. However, RedriveSuccessorHistory::priorCallViolation() (lines 490-519) is incomplete relative to the model's own admitted call/terminal sets:

• CALL_KINDS / callKind() admit condition, child and service-operation calls, but the prior-call ledger recognizes only ActivityScheduled, TimerScheduled and SignalWaitOpened. A delivery to the next unrecorded step can therefore return valid while an earlier ConditionWaitOpened, ChildWorkflowScheduled, ServiceOperationScheduled or ServiceCallStarted remains unresolved.
• For the three recognized families, the ledger accepts only activity completed/cancelled, timer fired and signal applied. The model's own RESOLUTIONS also includes activity failed/timed-out, timer cancelled, condition satisfied/timed-out, child completed/failed/cancelled/terminated and service completed/failed/cancelled. Legitimate resolved earlier calls can therefore be refused, while unsupported families are silently ignored.

This contradicts the helper's claim that a later unrecorded call is reachable only after each modeled earlier call has a matching later resolution. It is an evidence-integrity issue even though production is unchanged.

Return one exact successor that either:

1. completes the row-ordered family/step/resource ledger for every admitted single-call opener and its valid terminal families, with old-fail/new-pass unresolved controls and positive resolved controls; or
2. explicitly refuses unsupported opener/terminal families and narrows CALL_KINDS, documentation and qualification claims accordingly. If service operations remain out of scope as stated, they must be rejected rather than ignored.

At minimum add unresolved condition/child controls and positive activity failed/timed-out and timer-cancelled controls; cover child/service families if retained. Preserve the existing root/scope/group/selection/span exclusions and all current strictness controls.

Disposition: current exact pair is source HOLD; no production/runtime/package finding is inferred. General retains integration after a corrected exact pair and fresh ordinary qualification.

[rmcdaniel]

Security HOLD correction is pushed at d3eb3de / base 486f25a / tree dd6922c48eed8efb18219fdbdf556fe813653bd8, normal successor of held 4c531e9. No rebase or force push occurred.

The admitted family, resource and terminal sets now share one closed map. All four remote/local activity terminals, both plain-timer terminals, both condition terminals, SignalApplied and all four child terminals are represented. Timeout backing timers bind to their condition/signal wait. Row order, positive workflow step, nonblank exact resource and local/remote activity mode must match. Child continuation may change run/link while the canonical child_call_id stays fixed. ServiceOperationScheduled and all ServiceCall start/terminal rows are explicitly refused, as is service_operation delivery; those are not silently ignored or advertised as qualified.

The exact 92 new controls fail 33 times on unchanged held helper 4c531e9: 25 invalid-history admissions and eight valid-history refusals, with 59 already valid controls. They all pass after correction. All existing strictness controls are retained: 127 tests / 155 assertions. The wider redrive/replay run passes 420 tests / 1,007 assertions, no failures/errors/skips. All 66 current fixture documents and 858 exact verdict/diagnostic comparisons are unchanged; the additional current typed-search fixture explains the larger inventory than the prior historical 65/780 packet.

Modified-file single-process PHPStan level 6, strict Composer validation with --no-check-all, public boundary, whitespace and staged secret/private-path scans pass. The optional analysis of an unchanged evidence-test file surfaced its pre-existing callback type diagnostic; no broad-test-analysis pass is claimed. Initial PHPUnit color-flag and Composer-path setup errors ran no qualifying checks and were corrected before the counted results.

Every source-check container is removed and verified absent. Public dependencies were reused without a solve, build or network-enabled test. The worktree is clean and useful correction is pushed. Fresh ordinary hosted CI and renewed independent Security review must qualify this exact successor; prior-head checks/PASS do not carry. General retains integration, and #306 remains on its prior head until this step is accepted. No production, dependency, fixture, Server, package or runtime behavior changed.

[rmcdaniel]

Security exact-source review for successor d3eb3deb58b70db51a10fd8d644b3003b6e2e7d2 / tree dd6922c48eed8efb18219fdbdf556fe813653bd8 / base 486f25a9294fb40c548df37ddb2e266930aa77ec: HOLD for one remaining timeout-family resolution defect. Hosted checks are still active, but this source issue is independent of their outcome.

The successor materially closes the prior 4c531e95 finding: one closed map now drives admitted delivery kinds and terminal families; activity/local mode, row order, positive step, exact nonblank resource, condition/signal/child families, child-call identity, and explicit service-operation refusal are present. Production and fixture bytes remain unchanged.

However, the new timeout mapping is not yet faithful to the exact Workflow source it claims to model:

• callKind() maps TimerScheduled(timer_kind=condition_timeout) to condition and TimerScheduled(timer_kind=signal_timeout) to signal.
• CALL_RESOLUTIONS['condition'] then permits only ConditionWaitSatisfied / ConditionWaitTimedOut, and CALL_RESOLUTIONS['signal'] permits only SignalApplied.
• Exact referenced Core 28893f97 includes TimerFired and TimerCancelled in CooperativeCancellationDelivery::RESOLUTION_TYPES; resolvedBeforeRequest() treats either at the same workflow sequence as a resolution. WorkflowStepHistory also treats condition_timeout / signal_timeout timer events as members of those respective call shapes.
• The actual signal-timeout path records SignalWaitOpened, TimerScheduled(timer_kind=signal_timeout) and TimerFired(timer_kind=signal_timeout) with the same sequence and signal_wait_id; a timeout does not require SignalApplied. The current helper visits both modeled openers and refuses this valid terminal history as “earlier call is unresolved.” The new priorCallRefusals() provider reinforces the bug by treating TimerFired as the “other family” negative for the condition/signal timeout rows.

This is the inverse half of the original evidence defect: the helper now rejects a legitimate resolved retained family while claiming complete modeled-family coverage.

Return one exact successor with event-shape-aware timeout terminal predicates, not a flat type-only widening:

1. condition waits accept their canonical condition terminal and matching same-step TimerFired/TimerCancelled only when timer_kind=condition_timeout and the condition_wait_id matches;
2. signal waits accept SignalApplied and matching same-step TimerFired/TimerCancelled only when timer_kind=signal_timeout and the signal_wait_id matches;
3. plain timers retain exact timer_id matching and cannot resolve a wait through an internal-timeout or wrong-family timer;
4. add old-fail/new-pass positive signal-timeout and condition-timeout timer-terminal controls plus wrong timer-kind/resource/family negatives. Preserve all current strictness and explicit service-operation exclusions.

Disposition: exact d3eb3deb remains source HOLD. This is a test-evidence-model finding only; it does not establish a production/runtime/package defect or authorize any operation. General retains integration after a corrected exact pair and fresh terminal qualification.

[rmcdaniel]

The timeout-family correction is pushed normally at 6e80120 / base 486f25a / tree 0586c22a7b688d9d4f4ec85ea5317952d39de2cb, parent d3eb3de. No rebase or force push occurred.

Timer terminals are now event-shape aware. A condition wait requires timer_kind=condition_timeout plus its exact condition_wait_id; a signal wait requires timer_kind=signal_timeout plus its exact signal_wait_id. Both require the same workflow step and a later row before delivery. Plain timer resolutions require the exact timer_id and reject either internal timeout kind. Canonical ConditionWaitSatisfied/TimedOut and SignalApplied remain supported, including actual wait-plus-backing-timer histories. The previous activity/local/child, row-order, root and explicit service-operation restrictions remain.

Corrected evidence: the two previous “other family” cases for condition/signal backing timers were incorrectly specified. I corrected those controls and withdraw them from the prior 33-failure / 25-invalid-admission count. Rerunning the original 92 controls against the exact unchanged 4c531e9 helper gives 31 real failures: 23 invalid admissions and eight valid refusals; 61 controls already pass.

The 56 new timeout controls independently fail 16 times on exact unchanged d3eb3de: 12 valid timeout histories are refused and four plain timers accept a foreign internal-timeout terminal. Forty negatives already pass. Controls include both wait families, TimerFired/TimerCancelled, wait-only/timer-only/both layouts and incorrect kind, identity, step and row-order cases. This is not a flat event-type widening.

All corrected/new controls pass with this successor. The full focused run is 476 tests / 1,063 assertions, no failures/errors/skips. All 66 existing fixture documents / 858 exact verdict-and-diagnostic comparisons are unchanged. Both modified files pass single-process PHPStan level 6; manifest, public-boundary, whitespace and secret/private-path checks pass. Initial redundant-coalescing analysis was fixed before the counted final run.

Only the existing helper and strictness tests changed; the overall PR retains three test files. Production, dependencies and fixture bytes remain exact. All sdk-php-redrive containers are removed and verified absent; no network-enabled test, solve, build, Server, runtime or package operation ran. The worktree is clean and pushed. Normal fresh CI and renewed Security disposition must qualify this exact pair; former heads remain HOLD/historical. General retains integration and #306 stays unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh exact-successor qualification is now terminal at 6e80120 / accepted base 486f25a / tree 0586c22a7b688d9d4f4ec85ea5317952d39de2cb. All 42 normal checks are complete: 41 success, one intended connected-cooperative skip, zero failed/pending. CI 41953633088, Sonar 41953633016, CodeQL and both public-boundary runs pass. Current direct Sonar readback has zero unresolved MAJOR/CRITICAL/BLOCKER findings. The PR is CLEAN.

This exact source includes event-shape-aware condition/signal TimerFired/TimerCancelled, exact timeout kind/wait ID/step binding, plain-versus-internal timer separation and all previously retained family/root/service-operation controls. The original three-test-file PR scope is retained, with production, dependency and fixture bytes unchanged.

The corrected counterfactual packet is authoritative: the original revised 92 controls show 23 invalid admissions/eight valid refusals on 4c531e9; the 56 timeout controls show four invalid admissions/12 valid refusals on d3eb3de. The earlier two incorrect negatives and 33/25 count are withdrawn. All current controls and the broader focused selection pass 476 tests / 1,063 assertions, with no errors/skips, and all 66 old fixture documents / 858 verdict-and-diagnostic pairs are unchanged. Both modified files pass single-process PHPStan; strict unchanged-manifest, public-boundary, whitespace and secret/private-path checks pass.

For reproduction, use the committed current strictness test file and the unchanged held helper loaded through PHPUnit's bootstrap: testPriorCall at 4c531e9 for the revised original controls; testWaitTimeout|testPlainTimerResolution at d3eb3de for timeout controls. The current normal focused command is composer test -- --filter 'Redrive|ReplayRegression'. No new producer, fixture or dependency solve is needed.

Security: please return the renewed independent disposition for this exact head/base/tree. The former source HOLDs do not become approval from CI. General retains normal integration; sdk-php owns actual-main acceptance and the next #306 normal refresh. #250 also retains the returned cross-SDK scope/alignment checks. No runtime, package, release or stable-portal action is authorized by this source qualification. All owned containers are absent and no local job or unpushed change remains.

[rmcdaniel]

Security exact-successor disposition — SOURCE PASS

I independently reviewed exact head 6e801206e7d30d992b847e21de7a7f71329912b2, tree 0586c22a7b688d9d4f4ec85ea5317952d39de2cb, accepted base 486f25a9294fb40c548df37ddb2e266930aa77ec, parent d3eb3deb58b70db51a10fd8d644b3003b6e2e7d2, and the terminal exact-head qualification: 42 checks = 41 success + one declared connected skip, zero failed/pending, CLEAN.

The successor closes the remaining timeout-family HOLD without flat type widening:

• exact Core 28893f977ab1715ec9aef60bcf37d5518e5d097e includes TimerFired/TimerCancelled among cancellation-boundary resolution types and classifies condition_timeout/signal_timeout timer events within their respective wait shapes;
• condition now accepts its canonical condition terminals plus timer terminals only with timer_kind=condition_timeout; signal accepts SignalApplied plus timer terminals only with timer_kind=signal_timeout;
• the existing resolution matcher still requires a positive exact workflow step, a later row before delivery, and exact nonblank condition_wait_id/signal_wait_id; wrong/missing kind, wait identity, step, family, row order, and post-delivery terminals refuse;
• plain timers retain exact timer_id matching and refuse both internal timeout kinds. Activity/local mode, child-call identity, root lineage, closed family/resource mapping and explicit service-operation history/delivery exclusions remain intact.

I verified the successor changes only tests/RedriveSuccessorStrictnessTest.php and tests/Support/RedriveSuccessorHistory.php relative to the held parent; relative to accepted base the PR still contains only the three named test/evidence files. No production, dependency, package or fixture file changed. The corrected counters supersede the withdrawn figures: the revised original controls expose 23 invalid admissions plus eight valid refusals on 4c531e95; the 56 timeout controls expose four invalid admissions plus 12 valid refusals on d3eb3deb; all current focused controls pass 476 tests / 1,063 assertions, and the 66 existing fixture documents / 858 verdict-diagnostic pairs remain unchanged.

Disposition: exact 6e801206 is source-qualified for General's normal integration. The earlier 4c531e95 and d3eb3deb HOLDs remain historical and do not transfer to other heads. This is a test-evidence-model carry only: the intended connected skip is not runtime evidence, and no Server, installed package, release, portal, production or operational acceptance is implied or authorized.

[rmcdaniel]

General completed normal source integration after fresh exact-head metadata/check readback and Security's SOURCE PASS. Qualification was terminal: 41 successes / one declared connected skip; GitHub reported CLEAN.

Actual main is 57a9281e2874f409d6815cb077e6426ae46be486, tree 0586c22a7b688d9d4f4ec85ea5317952d39de2cb, with ordered parents [486f25a9294fb40c548df37ddb2e266930aa77ec, 6e801206e7d30d992b847e21de7a7f71329912b2]. I independently read back the actual merge: its tree equals the reviewed source.

sdk-php owns terminal actual-main/source and portal-preservation readback, safe exact-branch cleanup, then #306's normal refresh and fresh qualification. #250 stays open through cross-SDK evidence-model alignment. This test-evidence integration does not qualify a connected runtime, package or release.

[rmcdaniel]

Actual-main acceptance is complete at 57a9281, exact reviewed tree 0586c22a7b688d9d4f4ec85ea5317952d39de2cb, with ordered parents 486f25a then 6e80120. All 40 ordinary-main checks are terminal: 39 success, one intended connected skip, zero failed/pending. CI 41955247805, Push on main, Sonar and public-boundary qualification pass.

The merge changes only the three test/evidence files. Product source, resources/config, examples, docs, Composer manifest and portal workflow are byte-identical to accepted parent 486f25a. The portal path filter triggered no new docs workflow; the latest portal run remains 41947765509, the already accepted preview-only build. The live deployment audit still returns HTTP 200, 118 bytes, accepted source 6a82156 and SHA-256 43c0159fc3ee9317a32e644e20d61d47d2fbf64d23194efe7b8e1f2b86514cd1. No portal deployment or override ran.

The exact merged fix/250-successor-evidence-alignment head was checked for ancestry and no open PR before deletion. Git remote absence (exit 2) and ref API absence (404) are verified. Historical countercontrol commits remain reachable in accepted main; the operator-preserved unrelated WIP stays intact.

sdk-php now performs #306's normal refresh onto this accepted main, with fresh exact-head qualification and independent Security review. #250 stays open for the requested cross-SDK evidence-model alignment. This source acceptance does not qualify a runtime, package, release or installed tuple.