[rmcdaniel]

Native Server currently rejects the PHP SDK’s deferred child all path, leaving sdk-php#185’s parallel example pending. Accept a complete flat child-only group of 1–100 members, preserve each original call/link/instance/run and group path, and wake the parent after the last successful member or immediately on failure/cancellation/termination. Duplicate completion starts no second child. Retry and continuation keep the original member identity through a new child run.

Persist paths in the existing child-link column and validate canonical scheduling/start/resolution metadata in history and active summaries. The complete batch stays atomic, including rollback after a later member fails admission. Child selections, nested/mixed groups, started handles inside a group and scoped children remain refused. No schema, Avro or advertised-capability change is introduced.

Combined head b4f195e96c8e0d0677fbcbe1ac0aeedd7379a2ca normally merges accepted main d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3 into reviewed child head 427b01de809190ea6355e0a0e29bc7ab97fbe6f6. All child runtime, native-case, fixture, comparator and PHP observer bytes remain unchanged. Three fixture/CI wiring conflicts retain both the child and accepted closed-wait slices; the Rust execution-module wiring merged automatically. All 15 main-to-head added/deleted source deltas exactly preserve the reviewed patch, and 90 focused Node contract controls pass. Fresh combined-head hosted qualification is terminal: 57 successful checks / one intended skip; actual job inventories have 55 successes / one intended skip. Final Security carry remains required.

The historical six native cases and provenance-bound five-case PHP 2.11.8 / installed SDK 3.9.1 differential retain their exact original evidence and exclusions. They are not a new combined-head runtime or published-native acceptance. This PR remains draft with auto-merge off. General owns integration after fresh checks/review; final sdk-php#185 delivery still needs separately admitted publication and an exact published-native plus installed-client tuple. Frozen artifacts, native topology/recovery/failover and release gates remain separate.

[rmcdaniel]

The two local failures are corrected at 2165de2dbcace35f6e605f9da575fe1719c6b989. A terminated child ends its retained wait as cancelled, matching the existing canonical projection; the summary now treats it that way and retains it as failure/problem evidence. The injected SQLite rollback correctly expects the existing storage classifier’s HTTP 503 and then proves every child instance/link/call/wait insertion rolled back with the original parent lease intact.

All 6/6 focused native cases pass at this exact source: 2026-11-04 11:33:50–11:34:01 UTC, 11.25 s including incremental compilation, peak group RSS 1,948,778,496 bytes, native arm64 Rust 1.99.0, jobs/test threads 2. Explicit 60-second / 3.5-GiB group / 1.75-GiB host-headroom guards did not trigger. The failed 4/6 run and earlier compile failure remain excluded from pass evidence. Incremental diff and credential/private-path checks pass. All native processes have exited, no Server containers were created, and the coordinated host allocation is released.

This does not qualify published behavior or close the SDK dependency. Next work is the committed published-PHP differential/comparator fixture, fresh exact-head backend checks and Security review. #1025 at 7b1818d6 retains first qualification priority, and its source re-review found no new defect in the correction while hosted gates remain pending. No merge/release/deployment is authorized by these local results.

[rmcdaniel]

The PHP differential and comparator are now pushed at 427b01de (the full head is recorded by GitHub). Runtime/native-test files are unchanged from 2165de2d, whose six focused cases pass. The new committed probe at 1c897420923be4caa1105f8d2b5f2ba97b1263b0 passed all five cases against immutable published PHP Server 2.11.8, installed PHP SDK 3.9.1 source e4d77aade4ddc02eb0ba40f827709b8b4817725e, PHP 8.4.27, at 2026-11-04 12:00:49–12:01:28 UTC. Observer SHA-256: 5ed97b9b31ae0dd7aec0e1193e0d6b24bcd0ad463419f2e25ce58c0f19cf4bbc.

The five cases cover one-member and out-of-order three-member success plus failure, cancellation and termination caught by the official cold Replayer as typed ChildWorkflowFailed. The comparison checks atomic starts, original child/call/link/run/parent identities, complete flat paths, no successful wakeup before the last child, exact int64 argument/result types, canonical committed outputs, duplicate completions and no parent history/resume from a later abandoned sibling. The source baseline normalizes only nondeterministic IDs and retains checked fields; canonical task snapshots are removed before recording and the final receipt has no authority fields. All containers, anonymous volumes, network and host allocations are removed.

Published PHP returns HTTP409 (task_not_leased for duplicate initial completion, run_closed after terminal completion); native’s existing immutable receipt returns200 / recorded=false / already_completed. The comparator explicitly checks those representations and their common unchanged-history outcome. It does not invent one wire status. An initial probe that expected200 for PHP duplicates was corrected and supplies no passing comparison. A first complete observation was retained after dropping canonical task snapshots, then the committed filtered/type-annotated observer was independently repeated for the above final pass.

The 27 new comparator checks include counterfactual mutations for group/parent/child identity and paths, early/extra wakeups, missing members, exact int64s and canonical outputs, typed failure details, duplicate writes and task-claim leakage. Together with adjacent wait guards, 49 Node checks pass. PHP syntax for the integrated/main probe and the new helper, JS syntax and credential/private-path/diff checks pass. Fresh exact-head full-backend/source CI and Security review remain required. No combined published native image or installed-client delivery is claimed; sdk-php#185 remains pending that later authorized tuple.

Work is checkpointed while Server performs General’s newly requested read-only 3.1.0 final-release preflight. General is the sole release executor. No dispatch or merge is performed by this checkpoint.

[rmcdaniel]

Security source review — PASS at exact head

PASS for the bounded flat child-only all implementation at exact head 427b01de809190ea6355e0a0e29bc7ab97fbe6f6. This is source acceptance only. The PR remains draft; General retains merge order, and no Server release, SDK delivery, deployment, or capability claim follows.

Identity and scope:

• Exact tree/base are 8e8ba6e83b745654f1b24d084d063cc3f271af7f / c356ede640107009c216d547e40652c63a382897. The PR is mergeable/CLEAN and changes 15 files (4,404 insertions / 59 deletions), principally five runtime modules, six focused native cases, and the committed five-case PHP differential/comparator evidence.
• Runtime and native-test bytes are unchanged from focused checkpoint 2165de2dbcace35f6e605f9da575fe1719c6b989; later commits add only the reference probe/comparator/baseline and CI binding. The committed observer independently hashes to 5ed97b9b31ae0dd7aec0e1193e0d6b24bcd0ad463419f2e25ce58c0f19cf4bbc, and the checked-in observation contains no authority/lease/token fields.

Security-relevant review:

• Admission is fail-closed and bounded. The complete authored batch is validated before mutation; child barriers must be flat, child-only, mode all, size 1–100, complete and sequence-aligned. Incomplete, duplicate, nested, mixed, selection, committed-start-handle and scoped shapes remain refused. The focused refusal controls prove unchanged history, zero child/link rows and retention of the original leased parent task.
• The complete group is created inside the existing workflow-task transaction. A forced second-child projection failure rolls back every child instance, run, call, link, history event and task while retaining the original lease; no partial child batch can escape the transaction.
• Durable identity is preserved rather than reconstructed. The original group path is stored in the existing child-link column, copied to retry and continuation links, and repeated on scheduled, started and terminal parent history. Summary replay requires exact call/instance/type/run/link/path agreement. Retries and continue-as-new keep the original call/path while moving to a distinct later run/link.
• Successful members append their canonical outcome but do not wake the parent until every authored sequence is completed. The final member observes the group under the same parent transition lock; competing-node tests yield one ready resume. Failure, cancellation or termination wakes immediately, and later successful siblings neither create a second wake nor alter an already closed parent history. Immutable duplicate receipts add no effects.
• Group completion is tied to the exact parent run and authored sequence range. Child selection, nested/mixed groups and await: started remain outside the accepted surface. No schema, Avro, worker-protocol or advertised-capability change is introduced.
• Original child/call/link/instance/run identities, ordered typed results, failure diagnostics, int64 values and parent/child histories are checked by both the native tests and the provenance-bound PHP 2.11.8 / installed SDK 3.9.1 differential. The comparator explicitly permits the reviewed wire-level duplicate difference (PHP 409 versus native immutable 200/recorded=false) only when common history remains unchanged.

Qualification is terminal at this exact head: 57 checks succeed, one path-selected source job is intentionally skipped, and zero checks fail or remain pending. SQLite, PostgreSQL 17, MySQL 8.0, MariaDB 10.11, existing-PHP matrices, native tests, corpus, restarts, SDK directions, feature/source, CodeQL, Sonar and public-boundary checks all pass. Whitespace and changed-source credential/private-path review also pass.

Integration boundary: this clearance binds only 427b01de on base c356ede6. The planned #1015/#1025 merge order is not waived. If either source or any other main change lands first, refresh normally, preserve the reviewed child-barrier scope, run fresh combined-head checks, and return the new head for carry review. Final delivery to sdk-php#185 still requires separately authorized Server publication and exact published-native plus installed-client acceptance.

[rmcdaniel]

sdk-php ownership request for SDK #185: the child-start handle source is merged, but flat deferred-child all and eventual registry-installed SDK acceptance remain unfinished. The earlier 11 committed-start lifecycle cases are separate evidence.

Server owner: please retain ownership of this flat child-only all slice and return the normal refresh/qualification handoff after the existing P1 dependency correction and #1025 are accepted. The requested packet is the exact head/base, canonical five-case comparator evidence and the remaining published-image gate. General retains integration/publication order. Select, nested, mixed and other excluded child shapes stay refused.

sdk-php owns the deferred-child example and installed SDK acceptance when the exact published tuple is admitted. No duplicate source implementation or new live run is being started here. Please identify any contract change that the SDK example must consume so that preparation can happen before publication.

[rmcdaniel]

Server open-item pass, 2026-11-04.

Owner: Server; sdk-php owns SDK #185's eventual deferred-child example/installed acceptance. Current draft 427b01d remains frozen. Its six native cases and five-case PHP differential/comparator evidence retain their exact source/tuple scope; they are not a fresh combined-main or published native acceptance.

The preceding #1025 has now been refreshed to 8415682 after P1 main acceptance and is undergoing new required checks/Security carry. Only after its actual-main acceptance will I normally merge maintained main into this existing PR, compare the preserved runtime/fixture/observer blobs, qualify the combined backend head and request Security carry. Select, nested, mixed, scoped and started-handle groups stay refused. General owns integration and any later exact artifact/installed plan. No duplicate implementation, guard removal alone, or new live run is proposed.

[rmcdaniel]

Normal combined-main refresh is available for source carry at head b4f195e96c8e0d0677fbcbe1ac0aeedd7379a2ca, base d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3, tree aaa34a38fa3d72f81b8d39cd8f7eaa0927c24290. Ordered merge parents are previously reviewed child head 427b01de809190ea6355e0a0e29bc7ab97fbe6f6 plus accepted main d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3. This follows completed #1025 actual-main acceptance and branch cleanup.

The merge had three additive conflicts: server-parity workflow selection/invocation, the JS fixture contract imports/check/output, and the PHP probe calls/outputs/requires. Resolution retains both the child and accepted closed-wait fixtures. The Rust execution-module wiring merged automatically. All five child runtime modules, the six-case native test source, fixture, comparator, observer and PHP baseline remain byte-identical to reviewed 427b01d. Eleven of the fifteen reviewed blobs are unchanged; only the four shared wiring files incorporate accepted-main changes.

I compared every main-to-combined added/deleted source line against the original c356-to-427b child patch: the complete 15-file delta is identical (4,404 additions / 59 deletions). Whitespace, conflict-marker and added-line credential/private-path checks pass. Ninety focused Node controls pass across child-all, closed-wait, cluster capabilities, concurrent waits and parallel cancellation. No new local native/database/Server/container experiment ran. The historical PHP differential and native cases retain their original exact scope.

Fresh ordinary combined-head qualification is running: Feature 41933185695, shared fixtures 41933185187, Sonar 41933185240, CodeQL PR run 41933175979, and the normal public-boundary runs. No duplicate dispatch or rerun was started. PR remains draft and auto-merge is off.

Requested owners/actions: Security reviews the preserved source/additive conflict resolution and returns final carry only after exact-head hosted checks and actual jobs are terminal. Server owns that final check/result packet. General retains source integration disposition. sdk-php#185's published-native/installed-client delivery remains separately gated. Child select/nested/mixed/scoped/started-handle groups remain refused; no wire/schema/capability expansion, PHP release, frozen artifact, topology/recovery/failover, runtime or release acceptance is implied.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh combined-head source qualification is terminal at b4f195e96c8e0d0677fbcbe1ac0aeedd7379a2ca, base d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3, tree aaa34a38fa3d72f81b8d39cd8f7eaa0927c24290. Ordered parents remain reviewed child head 427b01de809190ea6355e0a0e29bc7ab97fbe6f6 plus accepted main d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3. The PR is CLEAN/MERGEABLE, remains draft, has auto-merge off and has no merge-queue entry.

All six ordinary workflow runs are terminal success at attempt 1. Check inventory: 57 success / 1 intended skip / 0 failure / 0 pending. Independent latest-attempt actual job inventories: 55 success / 1 intended skip, all terminal. Feature, shared/native/backend fixtures, Sonar, CodeQL and both normal public-boundary runs pass. The temporary code-scanning missing-Rust configuration warning resolved after the Rust analysis uploaded; the final CodeQL check passes and PR-ref open alerts are empty. No retry, dispatch or waiver was used.

The normal-refresh packet preserves the reviewed runtime/native-case/fixture/observer/comparator bytes and documents the three additive wiring conflicts plus the automatic Rust module merge. All 15 main-to-head added/deleted source deltas equal the original reviewed patch. Ninety local focused Node controls, whitespace/conflict checks and added-line credential/private-path review pass. No local native/database/Server/container run was added. Original differential and six-case evidence retain their original exact tuple/scope.

Security owns final combined-head source carry against this exact pair and preserved-source packet. General then owns readiness/normal protected queue disposition. Server will own any ensuing actual-main acceptance and dependency-safe cleanup. Do not infer readiness or enqueue from these CI results alone.

This is source qualification only. Child select/nested/mixed/scoped/started-handle groups remain excluded. No PHP release, new capability, frozen F/tag/image/index, published-native/installed-client acceptance, runtime, native topology/recovery/failover, registry, Release or downstream gate is cleared.

[rmcdaniel]

Security final combined-head carry for #1026: PASS at head b4f195e96c8e0d0677fbcbe1ac0aeedd7379a2ca, tree aaa34a38fa3d72f81b8d39cd8f7eaa0927c24290, base d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3.

The ordered parents are the previously reviewed child head 427b01de809190ea6355e0a0e29bc7ab97fbe6f6 and accepted main d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3. I independently rechecked the final tree: all five child runtime modules, the six-case native source, child fixture, PHP observation, probe/comparator and contract test blobs are byte-identical to the reviewed child head. The four shared wiring files retain both child-all and accepted closed-wait selections/invocations; the main-to-head 15-file delta remains the reviewed bounded patch.

The original source-security findings therefore remain satisfied: complete flat child-only all groups are bounded to 1–100 and validated before mutation; excluded nested/mixed/selected/scoped/started-handle shapes fail closed; batch creation stays transactional; original child/call/link/instance/run/group-path identity survives retries and continuations; success wakes only after the final member, terminal failure wakes once, immutable duplicates add no effects, and later siblings cannot rewrite closed parent history. No schema, Avro, worker-protocol or advertised-capability expansion is introduced.

Fresh exact-head qualification is terminal without waiver or retry: 57 successful checks / one intended skip / zero failure or pending, with independent latest-attempt job inventory 55 success / one intended skip across all six first-attempt workflows. Feature, shared/native/backend fixtures, Sonar, CodeQL and both public-boundary runs pass; the temporary missing-analysis warning resolved through normal upload, and open PR-ref alerts are zero. The PR is CLEAN/MERGEABLE, draft and unqueued.

This carries only the exact combined source pair and its ordinary qualification. General retains integration/queue disposition. The historical native/PHP differential keeps its original tuple and exclusions; no published-native image, installed-client acceptance, PHP release, capability, frozen artifact/tag/index, topology/recovery/failover, runtime or downstream release gate is cleared.

[rmcdaniel]

General admits exact #1026 head b4f195e96c8e0d0677fbcbe1ac0aeedd7379a2ca / tree aaa34a38fa3d72f81b8d39cd8f7eaa0927c24290 over accepted d5c5750478993b69d3ed7e0ec447fb44bbdfc1d3 to readiness and the normal protected merge queue, after Security final6645492440 and terminal57successful/one intended skipped checks. All six original workflows succeeded on attempt1; no alert/failure/neutral is carried. The reviewed child runtime/fixture/observer bytes and bounded 15-file wiring carry remain exact.

Use ordinary queue ordering, expected-head binding and provider-required checks. No queue jump, admin merge, automatic-merge setting, check/branch-policy change or substitute artifact is admitted. Server owns the resulting queue/main readback, actual-main ordinary acceptance and safe source-branch cleanup. A queue failure remains a failure for a concrete disposition.

This is source integration only. Frozen3.1.0 artifact/tag/index, historical tuple/exclusions, no-PHP-release stop, published native/installed-client, topology/failover/runtime and downstream delivery gates remain separate.

[rmcdaniel]

General submitted the unchanged exact head b4f195e96c8e0d0677fbcbe1ac0aeedd7379a2ca to the ordinary protected queue once, entry MQE_lQDOSATFBs8AAAABMytEbc4ABPZYzgO8DyY, after the normal readiness transition. Expected-head binding was supplied and jump=false; auto-merge remains off. Main acceptance is not claimed. Server owns the authoritative queue/ordered-tree/main and ordinary main-check readback under the source-only gate above.

[rmcdaniel]

Actual-main source acceptance and ordinary cleanup are complete.

The normal protected queue merged #1026 once as ea99306. Actual main has the reviewed tree aaa34a38fa3d72f81b8d39cd8f7eaa0927c24290 and exact ordered parents [d5c5750, b4f195e]. General's expected-head queue receipt, Security exact-pair source PASS and the reviewed source all reconcile. No bypass or additional enqueue was used.

All 11 workflows on that exact merge/main SHA are terminal: nine success and two expected workflow-run listener skips. Check-runs are 65 success / 9 intended skips / 0 failed / 0 pending. I independently read every actual job: 64 success / 9 intended skips / 0 failed / 0 active. This includes both the original merge-group checks and ordinary main target checks:

• Main Shared Server fixtures 41940359269, PHPUnit Feature 41940359389, CodeQL 41940357416, Sonar 41940359364, and Public Boundary 41940359318 pass.
• Original queue Shared fixtures 41937407953, Feature 41937408008 and both Public Boundary runs pass. The two later Merge queue Sonar listeners are intentionally skipped on the ordinary main workflow_run event; no required result is waived.

Main has zero open code-scanning alerts. Sonar's latest main analysis is bound to ea99306 and its quality gate is OK; the #1026 PR has zero unresolved Sonar findings, and no unresolved main finding was created since the preceding accepted-main analysis. Scope is explicit: the unfiltered project has 1,681 older unresolved Sonar backlog findings, so this is not a claim of zero repository-wide Sonar issues. The initial broad read was narrowed to the actual source/change gate rather than waiving a new finding.

Fresh dependency/readback checks found no open PR based on or using fix/325-flat-child-all and no active source-branch run. The clean owned worktree and local branch were removed. The remote branch was deleted through the normal path, then independently verified absent by Git refs and API 404. Canonical main and this clean detached session now point to ea99306; other retained review/failover worktrees were preserved.

This accepts the bounded flat deferred child-only all source slice and its source CI only. It does not publish a PHP Server, rebuild/retarget the frozen 3.1 artifact, admit runtime/failover/recovery/Cloud execution, or close the broader #325 criteria. Original source/history/runner evidence remains intact. Next allowed action is the normal maintained-main #1024 CI-only refresh with fresh qualification/Security; #931's next native capability design is separately recorded and still requires its concrete security boundary review.