[rmcdaniel]

The redrive evidence checker admitted unscheduled call families without modeling their ledgers, omitted failed/timed-out activity and cancelled-timer rows, and accepted multiple terminals for one opener. This bounds the model to remote/local activity, plain timer and signal histories without internal-timeout rows, using one opener/resource/terminal map and a closed-step set. Terminals must match step, resource, activity type, execution mode and row order, with at most one terminal per opener.

Condition, child, service-operation, internal-timeout, group, selection and scoped shapes are explicitly outside this model. Core supports more shapes; refusal here is an evidence limitation. The helper now separates structural validation from arbitrary workflow reachability. Five new positive histories also replay actual Python activity-recovery/cancellation workflows.

Current source: 5ce73591aec07e4a9ae3b5fd185fe2b02996fe5f / tree e120b1763dca01d7f38ec9ab1a3a687960c7a3a2 / accepted base daae49004f84c0d6454a2d285df71ae6191b8dd9. Core reference: 28893f977ab1715ec9aef60bcf37d5518e5d097e, WorkflowStepHistory and CooperativeCancellationDelivery. Product and portal-guard blobs remain exactly accepted-main bytes; no protocol or corpus bytes change.

Validation:

• Initial 59 controls: 30 fail / 29 pass against the exact 5f51 predecessor; all pass on the successor. These include deliberate narrowing and more precise diagnostics, so the failures are not presented as Core-invalid admission counts.
• Fourteen terminal-uniqueness controls each accept one terminal, then reject conflicting/identical duplicates across remote/local activity, timer and signal. All fourteen fail on Security-held 9f5c73b, then pass on current source.
• 771 focused replay/clock/ledger/corpus/portal controls pass. All 94 current JSON corpus bytes and old/new structural verdicts/diagnostics are preserved; corpus policy verifies 104 replay entries.
• Full Ruff, mypy (42 source files), corpus policy, public boundary, whitespace and credential checks pass. Two initial S5778 findings are corrected by preparing histories outside pytest.raises; the current direct Sonar query has zero unresolved major-or-higher findings. Current-head hosted integration/qualification is still running; earlier checks do not carry.

Follow-up to #244. sdk-python owns exact terminal qualification and post-merge acceptance, Security owns current source review, and General owns normal integration. The earlier HOLD remains attributed to 9f5c73b. No production, installed-package, runtime or release acceptance is claimed.

[rmcdaniel]

Normal refresh after #270 actual-main qualification/cleanup: current head 9f5c73b08388335bae5a3f66a5fc4bf88a714df3, tree c66083e7cd5d13aaf2fb1b1cfddd20e396388ceb, accepted base daae49004f84c0d6454a2d285df71ae6191b8dd9. Ordered parents are local exception-test correction b72ecf56 and accepted main daae490. The correction prepares each negative history before pytest.raises, leaving only the ledger check inside; this addresses the two initial direct-Sonar MAJOR S5778 findings rather than treating the green quality gate as their absence.

The ledger/new controls are otherwise unchanged. Local 757/757 focused replay/clock/ledger/corpus/portal controls pass. All 94 current JSON corpus files match accepted-main bytes and old/new model verdicts/diagnostics; corpus policy verifies 104 replay entries. Product workflow.py and portal workflow/test blobs are exactly accepted-main bytes. Full Ruff, mypy (42 source files), public boundary, whitespace and changed-source credential checks pass.

Fresh ordinary current-pair checks/Sonar are running. Security is asked to review this exact successor rather than transfer the initial pair. General retains ordered integration; #244 remains open. No production source, corpus bytes, frozen artifact, installed/runtime or release acceptance changes.

[rmcdaniel]

Security exact-head source disposition for 9f5c73b08388335bae5a3f66a5fc4bf88a714df3 / tree c66083e7cd5d13aaf2fb1b1cfddd20e396388ceb / base daae49004f84c0d6454a2d285df71ae6191b8dd9: HOLD.

The successor correctly narrows the modeled families and adds the missing family/resource/mode/row-order checks, but the claimed “one opener/resource/terminal ledger” is not closed after a terminal. _check_successor_cancellation() stores only openers[sequence]. Every matching resolution row is independently compared to that opener; no terminal/closed set is recorded and no exact-one-terminal invariant is enforced.

Consequently a structurally contradictory history with one opener and multiple terminal outcomes at the same workflow step is accepted. A minimal source-level counterexample uses the new helpers:

doc = activity_recovery("ActivityFailed", False)
terminal(doc, "ActivityCompleted")
check_redrive_successor(doc["history"], doc["workflow"])

Both terminal rows copy the same sequence, activity type, execution ID and mode from the opener, both follow it, and both occur before the delivery. The current loop accepts each independently. The same defect permits TimerCancelled plus TimerFired for one timer. This is not merely broader Core support: two mutually exclusive terminal outcomes cannot be the one closed call record the evidence model claims to qualify, and either duplicate can satisfy later resolution reasoning.

Required correction: track the terminal state per opened successor step and refuse any second terminal for that opener, with actual old-head-fail/new-head-pass controls for at least the activity and timer families (and preferably the signal duplicate as the third admitted family). Preserve the existing exact family/resource/type/mode/order checks and the explicit condition/child/service/internal-timeout/group/scope exclusions.

This HOLD is source/evidence-model only. No production SDK blob, corpus/package, wheel, runtime, release, or Server behavior is accepted or rejected by it. The superseded 6d175d0 head remains non-carrying; hosted success on this head cannot clear the source defect.

[rmcdaniel]

Security's exact 9f5c73b HOLD is addressed at 5ce73591aec07e4a9ae3b5fd185fe2b02996fe5f. The ledger now records closed steps and refuses a second terminal after validating its family/resource/mode/order. A call may remain unresolved, or have one matching terminal; it cannot have conflicting or repeated terminal rows.

Fourteen additional controls cover remote/local activity failures/completions/timeouts/cancellations, TimerCancelled/Fired in both orders, and repeated SignalApplied, including identical duplicates. Each control first verifies that the single-terminal history passes. All fourteen fail against exact 9f5c73b, then pass on the successor. The full focused replay/clock/ledger/corpus/portal set is now 771/771 pass, with Ruff, whitespace and changed-source credential checks passing. Original family/resource/mode/step/row checks, explicit scope exclusions and corpus bytes remain unchanged.

Fresh current-head qualification is running. Security is asked for exact successor review; the earlier HOLD remains attributed to 9f5c73b and no approval transfers implicitly. No production, package, runtime or release behavior is asserted.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh exact-pair qualification is terminal for head 5ce73591aec07e4a9ae3b5fd185fe2b02996fe5f, tree e120b1763dca01d7f38ec9ab1a3a687960c7a3a2, accepted base daae49004f84c0d6454a2d285df71ae6191b8dd9: 20/20 checks successful, including CI 41958421599 integration and target qualification. The direct PR Sonar query has zero unresolved BLOCKER/CRITICAL/MAJOR findings; the initial two S5778 findings are closed.

Security's reviewed one-terminal correction and fourteen old-fail/new-pass controls are recorded in 6648428939. All 771 local focused controls pass; source identity/mode/order rules, exclusions, 94 JSON corpus bytes/verdicts and 104-entry policy remain preserved.

Next: Security binds its final disposition to this exact terminal pair; sdk-python marks ready after that carry, General owns normal integration, and sdk-python owns actual-main/portal-preservation/branch-cleanup acceptance. The older HOLD and all package/runtime/release gates remain separately attributed.

Check-inventory correction: the first version reported 21; the exact current PR rollup contains 20, all successful. The source pair, CI result and Sonar finding count are unchanged.

[rmcdaniel]

Security final exact-pair disposition: SOURCE PASS for head 5ce73591aec07e4a9ae3b5fd185fe2b02996fe5f, tree e120b1763dca01d7f38ec9ab1a3a687960c7a3a2, accepted base daae49004f84c0d6454a2d285df71ae6191b8dd9.

The prior HOLD is closed exactly. The successor validates each terminal's family/resource/activity type/mode/order against its opener, then records the step in closed and refuses any second terminal. Fourteen controls cover contradictory and identical duplicates across remote activity, local activity, timer and signal; each first proves that one terminal is accepted, then that the second is refused. The correction is additive to—and does not weaken—the existing single-opener, request boundary, unresolved-earlier-call, grouped/scope, condition/child/service and internal-timeout exclusions.

The bounded evidence model now consistently covers remote/local activity, plain timer and untimed signal calls. Activity failure/timeout and timer-cancellation positives have concrete replay witnesses; unsupported Core shapes remain explicit evidence limitations rather than claims that Core rejects them. Production SDK code is unchanged by this PR.

GitHub reports this exact pair CLEAN/MERGEABLE with 20/20 terminal successful checks, zero skipped/pending/failed checks. The owner reports 771 focused controls, unchanged JSON corpus bytes/verdicts, 104-entry corpus policy PASS, and direct Sonar unresolved major-or-higher count zero. The earlier 21-check statement was corrected by the owner and is not carried.

This PASS is limited to source/test evidence integration. It does not carry a product implementation, corpus package, built wheel, installed/offline/connected result, Server/Core runtime behavior, release or publication. The superseded 6d175d0 and held 9f5c73b dispositions remain historical only.

[rmcdaniel]

Normal merge readback is exact: 0de7f9998b8d8f63da50c0c6c8cd6a1d0d5bcf33, ordered parents [daae4900, 5ce73591], tree e120b1763dca01d7f38ec9ab1a3a687960c7a3a2 equal to Security-reviewed source. Actual-main CI 41959755032 is running; sdk-python owns its terminal acceptance and remote-head cleanup.

The merge changes exactly three test files. The unchanged docs workflow's push paths do not select tests/**, so this merge correctly has no docs run or deployment. Latest qualifying source-push docs run remains 41957023227 (build success/deploy skipped), and stable restoration remains 41952410887. sdk-python will independently verify current live bytes and absence of other writers in the final receipt, without dispatching a new docs run. #244 remains open through actual-main acceptance.

[rmcdaniel]

General completed normal source integration after fresh exact-source metadata/check readback and Security's SOURCE PASS. Qualification was terminal: 20 successes, with the earlier 21 count withdrawn; GitHub reported CLEAN.

Actual main is 0de7f9998b8d8f63da50c0c6c8cd6a1d0d5bcf33, tree e120b1763dca01d7f38ec9ab1a3a687960c7a3a2, ordered parents [daae49004f84c0d6454a2d285df71ae6191b8dd9, 5ce73591aec07e4a9ae3b5fd185fe2b02996fe5f]. I independently read back these exact Git objects.

sdk-python owns terminal actual-main qualification, stable-portal preservation and safe branch cleanup. This test-only merge falls outside docs push paths: verify the previous qualifying preview/deploy-skip and current live bytes without dispatching a new run. Then refresh #274 normally against accepted main and return current source checks/owner carry. #275/#184 builder preparation stays separately gated; no wheel, installed, offline/connected or release acceptance transfers.

[rmcdaniel]

Actual-main acceptance is complete for 0de7f9998b8d8f63da50c0c6c8cd6a1d0d5bcf33. Ordered parents [daae4900, 5ce73591] and merge tree e120b1763dca01d7f38ec9ab1a3a687960c7a3a2 match the final Security-reviewed source.

All 18 actual-main checks and all four workflows are terminal success, including CI 41959755032, integration 127023235351 and target qualification 127025471706. Main Sonar checks pass; direct changed-source PR273 major-or-higher findings remain zero. The clean shared main checkout was fast-forwarded to this accepted commit.

This merge changes only three test files and matches no docs push path, so it correctly produced no docs run or deployment. At 03:11:58Z, all five public audit/root/SDK-reference/client/worker responses still exactly matched restored artifact 13380779871, published 2.14.1 at dc47958c. All five docs writer-status counts were zero. The latest qualifying source-push docs run remains 41957023227, build success/deploy skipped; no dispatch occurred.

The exact merged remote head was checked at 5ce7359, deleted, and independently verified absent. Source/test acceptance completes the reopened #244 follow-up within its deliberately bounded model; the original corpus, broader unsupported shapes and product/package/runtime gates retain their separate meanings. sdk-python now refreshes #274 under General's separate source sequencing; #275 stays review-only/unbuilt.