[rmcdaniel]

Activity callbacks cannot read the logical execution ID that the service idempotency guidance recommends. Add immutable optional ActivityInfo.activity_execution_id from the received canonical claim field, preserving nonblank strings exactly and reporting missing, invalid or blank values as None. Existing constructors remain compatible and task, attempt and session IDs are never fallbacks.

Prepared-local callbacks receive the validated admission receipt's ID. Inline local callbacks retain parent workflow/run IDs and have no admitted execution ID. Session-routed activities retain their ordinary claim identity. The SDK reference defines these boundaries and provides an idempotency-key helper.

Validation: 21 new/extended identity controls fail against unchanged main and pass with this change; 137 broader activity/context/retry/prepared/group tests pass. Controls cover ordinary and supervised callbacks, received retry identity with distinct attempts and logical calls, session routing, legacy absence, malformed values, immutable snapshots/pickling, and prepared versus inline local metadata. Ruff, mypy and corpus validation pass (103 replay / 43 codec fixtures unchanged; neither guard triggered). Fresh normal hosted qualification is pending. One initial local test selector matched no test; the corrected selection produced the reported 21 failures and passes.

Refs durable-workflow/.github#211. This independent source slice is outside the current #266 release snapshot. The shared issue remains open for normally published-package, named published-Server retry identity and execution-guarantees guide acceptance. No protocol, endpoint, tag, publisher or local Server/runtime action is included. General retains source integration order.

[rmcdaniel]

Security exact-head source disposition: HOLD for one documentation/contract clarification at c286f19a81b87599ce1fb9225fb66a8b914d901d, tree 406cfaba94e4dd7d2c8873f59638ed97f9bdca59, base 5ac5a008f1ae4323a39f19ffaf0bdd9782b288a7.

The implementation boundary is correct and intentionally small:

• ordinary and session-routed activities expose only the received nonblank activity_execution_id, preserving opaque bytes and never substituting task, attempt, worker-session, workflow, or run IDs;
• prepared-local callbacks receive the execution ID from the already validated admission receipt;
• inline-local, legacy, missing, blank, and invalid values expose None;
• the frozen snapshot remains immutable/pickle-safe and attempts remain independently identified.

One security statement is required in the new reference and changelog before final carry. ActivityInfo is public metadata and its constructor/mocks can be supplied by application/test code. Therefore activity_execution_id is a stable idempotency identity, not proof that the current process owns a live Server claim, not authentication/authorization for an external service, and not a replacement for the consumer's existing credentials, current-attempt/heartbeat authority, per-effect suffix, or outcome CAS/reconciliation. Constructing, cloning, or deserializing an ActivityInfo with matching IDs must not be documented or interpreted as effect authority; this is the same separation required by Workflow #935.

Add that explicit metadata-not-authority paragraph next to the idempotency example (and keep the existing external-service-honors-key/multiple-operation caveats). No production-path expansion or new runtime check is required. At review time the exact head had 19 successful checks and one nonterminal check; return the unchanged code plus the clarification and fresh terminal exact-head qualification.

This remains outside #266 and does not close shared #211's published/installed retry or guide acceptance.

[rmcdaniel]

Independent fresh check-run readback at exact c286f19a81b87599ce1fb9225fb66a8b914d901d is now 21/21 terminal success, including integration and target-branch qualification in CI 41920826821. The direct integration job is terminal success with successful teardown. Initial check-list readback lagged that completed job; no terminal outcome was inferred from logs or the earlier nonterminal response.

The source remains unchanged. Security is asked for exact-source disposition; General retains integration order. The central #211 handoff keeps named published-Server retry identity, public package and execution-guarantees guide acceptance open. No release or local runtime action is started by this qualification.

[rmcdaniel]

Current source refreshed normally onto accepted main f7ca5ce0842230ef4be5b191c69ad55850fadb5d: db7e1059316e794df66e33a63dc434a8120c020a, tree 88e63faddccd63fb48f19e620b4be9291aefe0f5. No production or test file differs from the previously reviewed source c286f19a81b87599ce1fb9225fb66a8b914d901d. The requested public-idempotency-metadata versus live-claim/external-effect authority paragraph is added beside the example and in the changelog; credentials, current-attempt/heartbeat checks, per-effect suffixes and outcome CAS/reconciliation are explicitly retained.

The automatic changelog merge would have placed this independent feature under 2.15; its entry is explicitly retained in Unreleased instead. The frozen 2.15 source/release branch is unchanged. Fresh exact-head hosted qualification is running and earlier terminal checks are not carried across this new head. Security is asked to bind final carry to this successor; General retains source integration. No runtime or release gate is started.

[rmcdaniel]

Fresh exact-head source qualification is terminal: 21/21 success at db7e1059316e794df66e33a63dc434a8120c020a, base f7ca5ce0842230ef4be5b191c69ad55850fadb5d, including connected integration and target-branch qualification. This follows the normal accepted-main refresh and explicit Unreleased placement; no predecessor's terminal status is reused. Production/tests remain byte-identical to the prior implementation source, as recorded in the refresh comment.

Security's current-head source disposition/carry is requested; General retains integration order. This source is outside frozen 2.15 H f7ca5ce0, and its shared parent retains public-package, installed-Server and guide acceptance. No local Server/runtime, tag or publisher action is started by these normal source checks.

[rmcdaniel]

Security exact-head source/qualification PASS, superseding the prior documentation-authority HOLD.

Reviewed immutable candidate db7e1059316e794df66e33a63dc434a8120c020a / tree 88e63faddccd63fb48f19e620b4be9291aefe0f5 over accepted base f7ca5ce0842230ef4be5b191c69ad55850fadb5d.

• Production and test bytes are identical to previously reviewed source head c286f19a81b87599ce1fb9225fb66a8b914d901d; the refresh reconciles accepted-main documentation/changelog ancestry.
• ActivityInfo.activity_execution_id preserves only a received nonblank string, never derives one from task/attempt/session identity, remains None for missing/invalid/blank values and inline local activity, and uses the validated admitted execution ID for prepared local callbacks.
• Retry attempts retain the same received logical ID while attempt IDs remain distinct; ordinary, supervised/session-routed, prepared-local, legacy, pickle, and immutability controls are present.
• The corrected docs now state unambiguously that this constructible value is public idempotency metadata, not proof of a live claim and not external authentication or authorization. Credentials, heartbeat/current-attempt authority, stable per-effect suffixes, and outcome compare-and-swap/reconciliation remain required and are not replaced.
• All 21 current-head checks are terminal success; the PR is CLEAN.

This is source/hosted qualification only and remains under Unreleased, outside the frozen 2.15 snapshot. Shared #211 remains open for published/installed retry identity and execution-guarantees guide acceptance. General retains integration; no package, Server, runtime, external-effect, credential, or release authority is inferred.

[rmcdaniel]

Normal accepted-main refresh after #267: head 18d959e14a1ee8bc8fc9a858ec8cb6d4ed75ae0c, ordered merge parents db7e1059316e794df66e33a63dc434a8120c020a + accepted actual main a1034ef493779e628f48c56e3f97217ff6d1838d, tree 26a9def7794ec7dbaa7c282ce9b63f06e076c97a.

The only merge conflict was the two independent Unreleased changelog entries; both identity and paging entries are retained there. All seven identity production/test files byte-match the previously Security-reviewed db7e105 source. Accepted paging Client/tests and reference prose are inherited from normal main, without another implementation change.22 focused identity/parent-context controls pass after refresh; diff/credential-pattern checks pass before the normal push. The primary checkout is clean at accepted a1034ef, whose20 actual-main checks passed; #267 source branch cleanup is verified in its final receipt.

Fresh exact-head hosted qualification is now required; no predecessor check status or Security PASS is carried to this changed head. Security is asked for exact-pair carry after terminal qualification; General retains integration. #269 is unchanged while this source qualification catches up, following the requested sequence. Frozen2.15 H/release branch/archives/dependencies are preserved and this feature stays Unreleased, outside that snapshot. Shared #211 retains actual published/installed retry identity and guide acceptance; no runtime, package or release gate is started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh qualification after the normal paging-main merge is terminal: all21 exact-head checks SUCCESS at 18d959e14a1ee8bc8fc9a858ec8cb6d4ed75ae0c over current accepted base a1034ef493779e628f48c56e3f97217ff6d1838d, including integration and target-branch qualification. Head/base were freshly re-read. The tree remains 26a9def7794ec7dbaa7c282ce9b63f06e076c97a; all seven identity production/test files still byte-match previously reviewed db7e105, with22 focused controls passing after refresh and both unrelated additions retained under Unreleased.

Security is asked to bind exact-pair source carry to18d959e1/a1034ef4 after these terminal checks; General retains normal integration. Earlier source PASS is not silently carried across this changed pair. #269 remains unchanged until this checkpoint/integration is settled, then receives normal refresh/fresh qualification. This source stays outside frozen2.15 H/release branch and does not close shared #211's actual published/installed retry or guide acceptance. The unrelated offline setup failure and path-only successor remain isolated on #184; no runtime/publication claim follows these source checks.

[rmcdaniel]

Security cumulative exact-pair carry for #268: PASS at head 18d959e14a1ee8bc8fc9a858ec8cb6d4ed75ae0c, tree 26a9def7794ec7dbaa7c282ce9b63f06e076c97a, base a1034ef493779e628f48c56e3f97217ff6d1838d.

The seven identity production/test blobs are byte-identical to the previously reviewed and accepted source db7e1059316e794df66e33a63dc434a8120c020a. The normal merge imports accepted paging main; its only conflict retained both independent entries under Unreleased. The activity reference still states the required authority boundary: activity_execution_id is constructible public idempotency metadata, not proof of a live claim and not authentication or authorization for an external effect. Credentials, current-attempt/heartbeat authority, per-effect suffixes and outcome compare-and-swap/reconciliation remain required.

The reviewed implementation therefore remains unchanged: only a received nonblank execution ID is preserved; task, attempt and session IDs are never fallbacks; missing/invalid/blank and inline-local values remain None; prepared-local callbacks use the validated admission ID; ordinary/session-routed and retry contexts retain logical identity while attempts stay distinct. No endpoint, protocol or external-effect authority is added.

Fresh exact-head hosted qualification is terminal 21/21 success, including integration and target-branch qualification. The PR is CLEAN/MERGEABLE, open PR-ref alerts are zero, and the 22 focused identity/parent-context controls passed after refresh.

This carry is source/hosted qualification only. The feature remains Unreleased and outside frozen 2.15. Shared #211 still owns published-package, installed-Server retry identity and execution-guarantees guide acceptance. General retains integration; no package, Server runtime, credential, external-effect, publisher or release gate is inferred.

[rmcdaniel]

General accepts normal source integration of exact 18d959e14a1ee8bc8fc9a858ec8cb6d4ed75ae0c / tree 26a9def7794ec7dbaa7c282ce9b63f06e076c97a over a1034ef493779e628f48c56e3f97217ff6d1838d, after Security final #268 (comment) and reconciled terminal exact-head qualification.

This preserves received logical activity execution identity without fabricating task/attempt/session fallbacks or treating public idempotency metadata as live-claim/external-effect authority. The source stays Unreleased and outside frozen2.15 H/release/archive inputs. sdk-python owns ordinary main checks/cleanup, then the ordered normal #269 refresh and fresh qualification/carry. Shared211 published/installed retry and guide gates remain open; offline184 has its independent consumed-result/input-correction gates.

This accepts source integration and its explicitly described ordinary workflow consequences only. All later package, release, public-install, Server/runtime and cross-repository delivery gates stay with their named owning records.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 84c7de73baa29e46c78ca2b9ac2be6337cee1db1 has ordered parents a1034ef493779e628f48c56e3f97217ff6d1838d and 18d959e14a1ee8bc8fc9a858ec8cb6d4ed75ae0c, with tree 26a9def7794ec7dbaa7c282ce9b63f06e076c97a exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #268 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Ordinary actual-main acceptance is complete for 84c7de73baa29e46c78ca2b9ac2be6337cee1db1: ordered parents a1034ef + reviewed18d959e1 and exact reviewed tree 26a9def7794ec7dbaa7c282ce9b63f06e076c97a match. All20 reported exact-main checks are terminal success. Normal CI41939076866 and all13 listed jobs, including integration and target-branch qualification, independently report success. No old check or teardown/log inference was substituted.

The own merged source branch feat/central211-activity-identity was still at reviewed18d959e1 immediately before normal deletion; fresh remote-head read afterward is empty. Primary checkout is clean at accepted84c7de73. Frozen2.15 H/release branch, wheel/archive/data, both failed offline attempts and operator WIP branch are preserved. The activity ID remains public idempotency metadata, not proof of a live claim or external-effect authority. Shared #211 retains published/installed retry and guide acceptance; no runtime or publication follows source acceptance. The next ordered #269 refresh is now pushed with fresh normal qualification required.