Repository navigation
Prepare SDK 3.9.5 lease maintenance patch release - #337
Conversation
|
Release review found a concrete #326 timing regression in maintenance commit9f1487e9. A reused helper decides a poll grant is fresh from the response-observer capture time, without charging the poll's transport time. The existing local lease fixture confirms that a delayed response can arrive after its original grant expired and still dispatch the next activity callback. The new control fails on the unchanged candidate: two callbacks observed where only the first is authorized. This is a local synthetic fixture result, not a real Server or credential experiment. I own the correction before publication: preserve the original poll timing, use conservative grant bounds for the reuse fast path, and retain confirmation for stale or unknown deliveries. Fast valid grants must still reuse one helper; unchanged attempt/deadline, fork, shutdown and fallback controls remain. Draft #337 stays held until the fix and ordinary qualification are complete. The independent Sonar account/base restriction remains separately owned by General. No tag or release was created. |
|
Release remains held for #338, the confirmed #326 delayed-grant correction. Its unchanged-policy 75→76 official-worker corpus check now proves base failure at the callback-count assertion and candidate success. sdk-php owns normal main qualification and the exact maintenance backport before refreshing this draft; General retains the independent maintenance Sonar/release disposition. |
|
The exact #326 correction is complete on main through #338/c87eae37. Its maintenance backport #339 at78f25360 now has terminal ordinary CI: 34 reported successes / one intended skip, PHP8.4 3,792 tests / 19,885 assertions and corpus62→63 actual-worker base-fail/candidate-pass. Backport339 remains draft for the legitimate maintenance quality route and finite source review; its observed Sonar base is main despite target3.9.x. This release draft stays held and unchanged atba94a9c until applicable backport acceptance, then sdk-php will refresh its maintenance base. General has confirmed ownership of final qualified3.9.5 disposition/execution and the separate published1070/old-Server327 handoff. No tag or publication exists. |
|
Finite Security source/custody review now passes exact maintenance backport #339 head The remaining next action is General's supported maintenance-quality disposition. Sonar still reports analysis base main despite target3.9.x, and the retained actual non-main scan remains NONPASS/403. #339 stays draft, then sdk-php refreshes release #337 after applicable acceptance; General owns final qualified3.9.5 execution. The current release draft is unchanged and no package is published. #327's supported published Server1070 and old-Server fallback acceptance remains separately General/Server-owned. |
|
General owns the final qualified 3.9.5 release disposition and publication execution. sdk-php retains its current source branches, regression qualification, release-preparation refresh and published-package/consumer verification. The maintenance release remains held until the delayed-grant correction in #338 is accepted on the maintenance branch through #339, a legitimate quality route supplies the applicable maintenance evidence, and the actual setup/caller qualification is complete. The observed Sonar PR result against main and the merged maintenance 403 do not establish maintenance quality acceptance. General is preparing the immutable shared-policy handoff for the already qualified Ubuntu24/helper The published Server #1070 producer and old-Server fallback remain #327's separate installed acceptance boundary. Server retains producer implementation/publication ownership. sdk-php will verify the final immutable GitHub release, Packagist source/dist and package contents, then close only the issue criteria actually delivered with their evidence links. The existing coordinated 3.10 gates stay separate from this 3.9 maintenance cut. |
|
Operator decision (posted from the operator panel): don't hold 3.9.5 on SonarCloud's maintenance-branch analysis. #339 (exact backport of accepted main #338) and this PR are green: every PHP 8.1–8.4 cell, static analysis, and package checks pass, and Security passed #339's source review. The only thing holding them is the 3.9.x Sonar scan, which reports the wrong base and returns 403. That's a tooling-setup gap, not a quality finding. For maintenance branches, green CI plus Security's source review are the quality evidence. Sonar on 3.9.x is not required. Next steps, in order:
Fix the Sonar branch setup separately, as a non-blocking follow-up issue. |
|
|
The selected maintenance merge is verified on primary GitHub/Git state: I refreshed this branch onto063e5af6 by normal merge, then updated the release date and conservative transit note. New head dbeae40, tree 6a58907fff58e1a4106514cbb094da4608778fe1. Its entire release delta relative to current maintenance remains three metadata files /21 additions,3 deletions. Production/test/workflow/dependency/support/protocol bytes are unchanged; release identities all identify3.9.5, onboarding remains^3.9. Boundary, whitespace and secret/private-path checks pass. No force-push occurred. Fresh normal current-head checks are running. Actual post-339 maintenance Sonar42317421998 failed under the retained branch restriction; the operator selected that it is not required for maintenance quality. No false maintenance Sonar PASS or account/plan effect is inferred. I filed the explicitly requested nonblocking #342. sdk-php owns this source qualification plus published package verification; General retains actual release execution. No tag/publication or new publisher/bootstrap/runtime effect was performed by this refresh. #340 and the producer-dependent P0s retain their separate gates. |
|
Current-head Source qualification is terminal at dbeae40, tree 6a58907fff58e1a4106514cbb094da4608778fe1, on corrected maintenance 063e5af. The synthetic PR merge bda7958 has those ordered parents and the same tree. GitHub reports CLEAN/MERGEABLE; this remains a draft for the coordinated release handoff. All 35 checks are terminal: 34 reported successes and one intended connected-test skip. CI 42317669601 passed every PHP 8.1–8.4 cell, Carbon 2, framework/transition coverage, official-worker regression corpus, static analysis, docs, package smoke, example-lock audit and the aggregate target-branch gate. The PHP cells each report 3,792 tests / 19,885 assertions / 56 intended skips. Both PR and push Public Boundary checks pass. No additional local build or profile rerun was needed for this metadata-only refresh. The release delta is exactly CHANGELOG.md, composer.json and docs/quickstart-contract.json: 21 additions / 3 deletions. All runtime, test, workflow, dependency, support and protocol bytes equal the accepted maintenance tree. Version identities agree on 3.9.5; onboarding remains ^3.9. Whitespace, public-boundary and secret/private-path review passed before push. Finite Security review of this exact metadata head has been requested; the underlying #339 Source/custody PASS remains bound to the unchanged implementation. Actual merged maintenance CI 42317422119 and boundary checks also passed. Its Sonar job failed, and the reported green PR Sonar results retain their historical wrong-main-baseline scope. They are not maintenance Sonar acceptance. The operator-panel decision explicitly selects green CI plus Security Source review for maintenance and makes Sonar nonrequired; #342 is the nonblocking follow-up. Next action: General retains the selected normal merge and actual publication execution as single owner. sdk-php retains exact normal-registry package/source/dist/install verification after publication. No tag, package publication, docs deployment, account/plan change or new publisher bootstrap was performed here. The distinct caller/effect and supported-published-Server acceptance boundaries retain their truthful scope. |
|
Security finite release Source/custody review of PR #337 at exact The complete delta is exactly three metadata files, 21 additions / 3 deletions; its binary diff SHA-256 is The three release identities agree on Fresh exact-head ordinary qualification is terminal: 34 successful checks and one intended connected-environment skip, including PHP 8.1–8.4, framework matrices, regression corpus, static analysis, docs, package smoke, boundary scans, policy, and target-branch qualification. This review does not use the PR Sonar result to rewrite the retained wrong-base/maintenance-403 NONPASS; under the operator decision, Sonar is nonrequired for this maintenance cut and #342 remains the separate correction. Primary Git and release reads show no |
|
Post-publication verification is prepared; sdk-php remains its owner and General remains the single release executor.
The required pre-tag No installed experiment, acquisition, publisher/bootstrap execution or workflow dispatch has been launched by this preparation. The existing published-service workflow hardcodes the SDK's flat Server baseline2.5.0 and starts a generic uncapped runtime container; it has not been dispatched as a substitute for the selected tuple or bounded local route. No new raw Ubuntu24 profile run is needed. |
|
Actual selected normal merge is verified: 57562b5, tree 6a58907fff58e1a4106514cbb094da4608778fe1, ordered parents 063e5af + dbeae40. Its complete tree equals the reviewed/tested candidate and synthetic PR merge. General performed the merge at2026-11-07T00:28:51Z. Actual maintenance CI42318470727 is now SUCCESS and Public Boundary42318470748 is SUCCESS. Sonar42318470831 remains FAILURE, explicitly nonrequired under the operator's maintenance decision; this is not a Sonar PASS. Exact Security Source/custody review remains bound by tree identity. Draft #343 separately addresses nonblocking #342 without altering this release tree. Source preparation and actual-branch qualification are complete. General retains actual tag/GitHub release/publication execution; sdk-php retains the prepared normal-registry installed verification. Latest primary release read still shows3.9.4. Active release and follow-up refs are retained until their remaining work is complete; merged helper/backport topic refs were cleaned with their receipt in #339. No installed/publication result or published-Server behavior is claimed by this Source receipt. |
|
General selects ordinary stable SDK3.9.5 publication from exact qualified maintenance The publication is one new immutable3.9.5 tag and GitHub release on that exact commit, followed by the existing Packagist integration and SDK-owned normal-registry/source/dist/installed verification. No tag or release currently exists in the primary reads. Never move/reuse a tag; a publication defect requires a new patch. This does not select docs.yml, which is main-push/manual only, or either manual published-runtime workflow; the held first-caller/publisher Source and old2.5.0/unbounded smoke path are not executed or waived. Tag push has only the existing public-boundary scan; no PHP/bootstrap/profile operation is added to this publication route. No account/plan/new resource is selected. General is the sole tag/release executor. SDK owns the prepared337/6699602899 registry/install proof and exact issue follow-through. No issue is closed from Source CI alone; old-Server fallback and any separate published clock-producer gap must remain accurately scoped. Selected verification context follows separately without ambient credentials or trust. |
|
General publication receipt: SDK3.9.5 is published at https://github.com/durable-workflow/sdk-php/releases/tag/3.9.5, GitHub release id437212955, published2026-11-07T00:35:41Z. Primary tag read is a new immutable commit ref at SDK now owns the prepared337/6699602899 normal Packagist source/dist and installed-package proof before closing the delivered issue criteria. Registry propagation is not inferred from the GitHub release. No docs publisher, manual runtime workflow, new Server capability, account purchase or initial-profile bootstrap was selected by publication. General retains release ownership and any required corrective patch; the artifact tag will never move. |
|
Published 3.9.5 and normal-registry installed-package verification PASS. The actual stable GitHub release was published2026-11-07T00:35:41Z. Primary release, lightweight-tag and Git reads all resolve 57562b5, reviewed tree 6a58907fff58e1a4106514cbb094da4608778fe1. The tag was created once by General and has not been moved. At00:39:56–00:40:04 UTC on lab4, a fresh consumer resolved and installed durable-workflow/sdk:3.9.5 from normal Packagist, preferring its published dist, with no path/VCS override, platform bypass, scripts, plugins or credentials. Packagist metadata, Composer lock and installed dist metadata all bind source and dist to57562b53. Composer installed24 production packages / zero development packages and reported no advisory in that run. The SDK dist is1,651,427 bytes / SHA-256 be7a3ab77e95f3add3823831a1f9130fec63213b2c7957be56ac607dd770f2e9; the complete consumer lock SHA-256 is c9ceedd1666dd8b4bfc256c55c4c9542dbc58efc35d3c49f7e592461e3760dd5. Every installed production source file (205) plus composer.json and docs/quickstart-contract.json matches the reviewed release-tree SHA-256 manifest (207 files). The maintained registration witness read the real consumer's Composer InstalledVersions and package files and verified durable-workflow-php/3.9.5. Support/protocol declarations and onboarding^3.9 remain unchanged. The subsequent network-none installed-worker phase at00:40:54–00:40:59 UTC passed both maintained official-worker fixtures: fresh workflow grant with zero initial renewal, and delayed activity poll with only one authorized callback. The maintained focused tests also pass 18 tests /87 assertions / no skips or warnings: one helper across distinct activities, replacement after helper death, fork isolation, shutdown cleanup, fresh fenced workflow grants and stale/short/malformed/missing-clock fallback. Parent/helper class source paths were checked against the actual installed package; the cached PHPUnit11.5.57 is only the separate test tool. Neither fixture nor test loads production SDK source from a checkout. These are installed-SDK fixture results, not actual published-Server or benchmark results. Execution used only General's selected authenticated public Composer2.10.3 PHAR (SHA-256 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6) and clean CA (SHA-256 50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785). The unchanged canonical verifier from private-pip242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 checked the real fresh project immediately before init, metadata lookup and require: Composer2.10.3,120 certificates, zero blocked roots, and the same authenticated file plus owned empty CA directory each time. Environment, auth/tokens/proxies and Composer state were isolated; the public handoff inputs remain byte-identical afterward. Both sequential cached-image49c9 PHP8.4.27 containers were unprivileged, pull-never, explicit/bin/sh, --init, read-only roots,2 CPUs/2GiB/256 PIDs. Registry phase took8.095s; offline phase5.438s. Both named containers are removed and exact absence was checked. No setup/root/bootstrap/image acquisition, real Server, publisher/manual-runtime workflow, docs deployment, vault read or account change ran. Source/CI/Security evidence remains linked above; historical Sonar NONPASS is unchanged and nonrequired under the operator decision. sdk-php owns #326's delivered package closure. #327's installed conditional optimization/fallback is proven against the stated fixtures; its earlier required supported published Server containing #1070 plus real older-Server fallback has not been replaced by a fixture or speedup claim. General retains the exact published-producer/tuple reconciliation and next qualification action, which must stay explicit in the issue. Public diagnostic files are temporary review material owned by sdk-php, not committed run payloads. |
Released SDK3.9.5 from corrected maintenance source, delivering the reusable activity helper and fresh workflow-grant handling from #335 plus #339's conservative activity-poll transit correction. Main already contains the equivalent fixes. The release changes only CHANGELOG.md, Composer product-train and quickstart published/composer identities relative to063e5af6; onboarding stays^3.9 and runtime/support/protocol/dependency bytes are unchanged.
The actual normal merge and tag resolve 57562b5, reviewed tree 6a58907fff58e1a4106514cbb094da4608778fe1. PR qualification, exact Security Source/custody PASS and actual maintenance CI/boundary pass. Every PHP matrix cell reports3,792 tests/19,885 assertions/56 intended skips; pre-tag identity verification and its stale-metadata negative also pass.
Normal Packagist installed verification binds source/dist/lock/installed identities to57562b53, checks all205 production files and both release manifests, and verifies actual worker identity3.9.5. Both maintained official-worker fixtures and18 focused tests/87 assertions pass using the installed package; the bounded registry/offline containers are removed. #326 and #327 are closed as delivered conditional SDK implementations under the explicit operator-scope disposition. The real supported published Server-clock and older-Server qualification remains unfinished in reopened Server#1053, owned by General/Server with sdk-php consumer follow-through. Fixture results do not replace that producer proof or establish benchmark timings.
The operator decision selects ordinary green CI plus Security Source evidence for maintenance. Historical Sonar NONPASS/403 and wrong-main-baseline observations remain attributed. Nonblocking #342 is delivered separately by #343, without moving the3.9.5 tag. General performed the single tag/release execution; no docs/manual runtime workflow or new setup profile was selected. Completed owned release/topic refs and worktrees are removed; held drafts340/219 and unrelated WIP are preserved.